when opening photos inside a gallery block set as lightbox, the images are displayed cropped. this seems to be a known bug according to some forum posts i saw while looking around.
how can such a simple built-in feature have such an obvious bug?
With AI evolving so quickly, I think we’ll see more and more websites being built directly with code rather than using platforms like WordPress.
Maybe WordPress will eventually become less common, and honestly, it makes me a little sad to think about. I’ve spent a lot of time working with WordPress, so it would be a little bittersweet to see it slowly disappear. 😢
This is real world example how we caught this exploit on our clients website!
It's called wp2shell (CVE-2026-63030 and CVE-2026-60137). It affects WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. The fix was released on July 17 (7.0.2, 6.9.5 and 6.8.6). A public proof of concept exists, so bots scan the internet for unpatched sites automatically. Nobody targets you personally. Client website missed the update for about a month and got hacked on August 22. While checking our own servers we could see that other websites got the same attack in September, but they were already updated and it failed.
- Created hidden admin accounts. They don't show up under Users in wp-admin.
- Installed a backdoor that puts itself back if you delete it. It lives in several places at once: `wp-content/db.php`, a file in `mu-plugins`, code at the end of `wp-config.php` and in theme files, hidden files in `wp-content/upgrade` and `wp-content/uploads`, and copies in the database. Clients host's malware scanner kept deleting files for weeks and they kept coming back.
- Got full remote control of the site.
- Turned off page caching for the whole site. That made the site slow: Search Console flagged slow mobile loading.(could be a sign)
Only when Googlebot opened the homepage, the site showed 89 links to UK websites (.co.uk and .org.uk) promoting "non GamStop" casinos. GamStop is the UK program people use to block themselves from gambling, so these casinos target people who are trying to stop. Regular visitors saw a normal page. The linked UK sites look like old small business and charity sites that were taken over too. The point is to borrow Google trust from real websites and pass it to casino pages. We found no redirects and no stolen passwords or form data.
- Google sees your site linking to casino spam. That can bring a manual action or a security warning in Search Console.
- The site is slow because caching is off.
- The attacker could read everything on the hosting account, so treat database passwords and other secrets on that account as leaked.
Make a backup first. Then remove every part in one go: files, database entries and hidden users. If you miss one, it brings the rest back. Reinstall WordPress core, your theme and plugins from clean copies, and change the salts and database passwords. Then request indexing of your homepage in Search Console. You are welcome stay stafe!
I’m developing Block Class Manager (BCM), a free plugin for Gutenberg, and I’d like to test something very specific: is the workflow understandable on its own?
BCM is built around a simple class-based workflow for Gutenberg. Instead of adding a large collection of blocks, it provides a lightweight foundation block with a few essential variations (Text, Media, Heading and Button) all using the same styling interface.
You can work with responsive styles, reusable Global CSS Classes, and HTML attributes within the same workflow, making it easier to build and maintain consistent layouts across screen sizes.
The other main part is Global CSS Classes: instead of recreating the same styling for every block, you can define a class once and reuse it across your layouts. You can also combine Global Classes with local block styles when you need something specific to a single element.
The goal is to have a more reusable and consistent way of styling Gutenberg layouts, while keeping the workflow lightweight and close to the native block editor.
BCM workflow inside the Gutenberg editor.
I know there are already plugins that provide some of these features. I’m not trying to reinvent everything. I’m exploring a particular workflow where you can create and apply reusable Global Classes directly while working with a block, rather than having to manage styles separately. I’d like to see how intuitive this feels to Gutenberg users.
If you use Gutenberg, I’d really appreciate it if you could install it and try it without reading the documentation or watching a tutorial first.
Try to:
Then tell me:
I’m not looking for compliments. I’m trying to find the parts of the workflow that aren’t obvious enough.
Even if you find the workflow confusing or something doesn’t make sense, that’s useful feedback for me.
I’d love to hear what you think in the comments, especially if something feels confusing or unintuitive.
👉 Block Class Manager on WordPress.org
Thanks to anyone who takes the time to give it a try!
Every events plugin I tried puts the same three things behind a paywall: recurring events, shortcodes, and a grid view. The big one is $99/yr for recurring alone, and it went up 33% in February.
For a church, a library, a running club — the calendar is the recurring events. "Every second Tuesday" is the whole use case. Paying $99/yr for that felt backwards, so I put out a free one where it isn't paid:
Everything above is free and stays free — I'm not going to paywall the calendar.
It's new, so it's unproven. If you try it and something's broken, tell me here or in the support forum and I'll fix it that day. GPL, on the repo: https://wordpress.org/plugins/beacon-events/
I've been freelancing as a WordPress developer for a few years now, and over the past 6 months, one issue has come up in almost every client conversation: AI disclosure.
Clients are using AI tools for drafting, images, product descriptions — but almost none of them have any system for tracking what was AI-generated, how much AI was involved, or how to prove it if asked.
I tried a few approaches:
· Spreadsheets and manual notes (fell apart immediately at scale)
· Client-side disclaimers buried in footers (not compliant, easy to miss)
· Custom post meta fields (no audit trail, no visitor-facing transparency)
None of it worked. So I ended up building a lightweight toolkit for myself called MegaGovern.
Here's the workflow I landed on:
Declare — Every post gets classified as one of four states: Human, AI-Assisted, AI-Generated, or Synthetic Media. You can do this per-post or bulk-update legacy archives.
Disclose — A visitor-facing badge shows the disclosure status directly on the front end. No hiding it in a footer.
Verify — For images, it scans EXIF metadata and C2PA standards so you know what's actually in the file.
Preserve Evidence — It generates cryptographic PDF logs and ai.txt protocols that you can hand to a client or regulator. Tamper-evident audit records.
The whole thing runs local-first — all data stays in your WordPress database. No external API calls, no cloud service scanning your content.
Why I'm sharing this:
The EU AI Act transparency requirements (Article 50) are already in effect, and a lot of WordPress agencies and freelancers I talk to are completely unprepared. I built this for my own client work, but I've since released it as a plugin.
Full disclosure: I'm the developer behind MegaGovern. There's a free tier that covers manual classification, branded badges, ai.txt generation, and 30-day audit logs — genuinely free, no feature locks. Paid tiers add AI scanning, C2PA checks, and signed PDF reports.
If you're dealing with AI disclosure for clients, I'm happy to answer questions about the compliance side, the WordPress implementation, or anything else. What approach are you all taking right now?
Local has really been a great tool for my work flow, but I have one question.
I keep my staging sites on external drives and I work from a couple of different laptops. On the external drive I have a folder 'local sites' and within that folder I have different staging sites. I am using updraft to backup and restore between online production and offline staging sites. The question is; how can I move that external drive between various laptops and desktops without having to create unique copies of the sites?
Hypothetical: a service business changes the email address for its WordPress contact form. The form still says 'sent', but new inquiries stop reaching the team.
Send one test from a phone with a unique phrase in the message. Look for that phrase in the form plugin's saved entries, then the inbox and spam folder, then the CRM. The first missing handoff tells you where to investigate. A success screen alone doesn't prove anyone received the lead.
Which step has failed for you: the form, email delivery, or CRM sync?
Hello all! I'm the owner of a small business WordPress site that was set up by a local third party who also manages my web hosting. (I do not have access to the hosting panel or FTP files). This person has become unresponsive and I have an SSL certificate that has been expired for two months. Is there a quick fix via WordPress to renew the expired SSL certificate while I figure out how to reclaim my website from the unresponsive developer? The WP Encryption plugin seems very highly reviewed but I'm not sure if it will work in my case. I'm open to any ideas. Thanks in advance!
UPDATE: It's a miracle...I finally got a hold of the developer/reseller and got the SSL cert issue resolved. He is phasing out his freelance work and says he'll help me get migrated over to new hosting at the end of the year. Thank you to everyone who responded!
Not sure what happened here. These embeds have been here for at least a year and suddenly not working on mobile: jim-flannery.com/music
Seems to be some info missing here ;)
???
Any idea what's supposed to be here? Swiping it just turns up an empty rectangle.
thanks
Hi, I'll get right into it. I typically make static and simple wordpress websites (between £400 and 800 ish). I've been doing this for a while now, and am very happy with it, but I recently closed a really promising deal. It's a 3k multivendor site. I'll be building it with dokan + elementor pro
I need help communicating the limitation of liability. I'll explain that I am building a wordpress website, following all the best security practices (wordfence premium, reputable host, regular backups, 2fa for admin, regular updates and testing, reputable plugins only, etc), but that ultimately there are still things out of my control. A million things could go wrong and they could end up costing money, but I can't help if an unexpected plugin break causes the website to go down or causes a hacker to intercept payment details, etc etc etc. Should I recommend them to get some kind of insurance to cover this? How exactly is this handled in formal contracts?
For example I could very well see that someone could somehow hack into somebody account who has a large sum sitting in their wallet, they could then issue a payout to different bank details and steal some money, or a million other ways this could go wrong. Am I overthinking this, or is it a genuine thing I need to bear in mind and protect myself from
Would really apprciate some advice as I've never done a project of this scale, or with the potential to go as wrong, as this one could. What if
I noticed Ive been getting a high load of Traffic from China, its my top traffic source and im located in the USA. I read that I should block China traffic, but how do I do that on Wordpress? Also is it safe for SEO to block traffic from China?
I’ve been working on a WordPress plugin called PostGate, and the mods allow promotional posts when properly tagged, so I wanted to share what I’ve built and hopefully get some feedback from other WordPress users.
The idea behind PostGate is pretty simple: what if you want to charge for access to WordPress content, but don’t need an entire membership or e-commerce system to do it?
For example, maybe you want most of your blog to remain free, but charge $5 for an in-depth article. Or offer a monthly subscription to a premium category. Or keep the introduction of a tutorial public and put the rest behind a paywall.
That’s the use case I built PostGate around.
Everything is managed from WordPress, while Stripe handles the actual checkout.
What it currently does:
A typical setup could be:
Free introduction → Paywall → $5 one-time unlock OR $10/month subscription → Stripe Checkout → reader gets access
I’m deliberately keeping PostGate focused on content monetization rather than trying to turn it into another huge membership platform.
If you need member directories, community features, complex membership profiles, courses, etc., a full membership plugin will probably be a better fit.
But if the requirement is closer to “I want to charge for this article/category/section of my WordPress site”, that’s what PostGate is designed for.
It’s free to download and there’s no recurring plugin license. The current business model is a 5% platform fee on successful transactions, in addition to Stripe’s processing fees.
You can find it on WordPress.org here: https://wordpress.org/plugins/postgate/
It’s still a relatively new plugin, so I’m especially interested in feedback from people who monetize content with WordPress. If there’s something preventing you from using it for your particular setup, I’d genuinely like to hear about it.
And if anyone wants to test a specific paywall setup and gets stuck, I’m the developer, so I’m happy to help with the configuration.
Skip to end for tldr
Hi, I'll get right into it. I typically make static and simple wordpress websites (between £400 and 800 ish). I've been doing this for a while now, and am very happy with it, but I recently closed a really promising deal.
I've spoken to someone who's ready to pay the first deposit, and has given me a budget of around 4 thousand pounds. I think a fair price for something like this is somewhere in the 2-3k range. I did some digging, and think the best way to approach this is designing it as I do other websites (template based), and using the dokan plugin with the pro license to give the site the functionality it needs.
I'm putting together a proper scope of work agreement but honestly am not sure if I'm missing out on anything important. What if something creeps up and I get bitten for it, would very much appreciate some advice from those who are more experienced that myself.
Here are all the points I will cover.
- Milestone based payments - Distinct payments with distinct objectives, and clarify that paying for one milestones means approval of that work
- Explicitly mention that all changes or requirements be put in writing to avoid miscommunication
- What exactly I need from them to proceed and by when
- Scope of work, what exactly my role is and what I cannot do, but more on this below (also please let me know if I am missing anything else)
I need help communicating the following: Understanding wordpress limitations. I've communicated that a custom built website would cost him a lot more money, but that the best option for a new business is to save money and use something like dokan, and upgrade once it makes sense. I use elementor to build websites, so generally it is very customisable, but there will be certain bits that cannot be customised without additional charges. For example dokan's vendor dashboard seems like something that you cannot customse as freely as something like an elementor home page. The issue is that to actually show him what can and cannot be customised, I'd have to actually build the website first, which is exactly what he is paying me to do
I also need help communicating the limitation of liability. I'll explain that I am building a wordpress website, following all the best security practices (wordfence premium, reputable host, regular backups, 2fa for admin, regular updates and testing, reputable plugins only, etc), but that ultimately there are still things out of my control. A million things could go wrong and they could end up costing her money, but I can't help if an unexpected plugin break causes the website to go down or causes a hacker to intercept payment details, etc etc etc. Should I recommend them to get some kind of insurance to cover this? How exactly is this handled in formal contracts?
Lastly, I'll need to somehow explain that the monthly retainer I charge for this website could vary, and that I cannot quote what it will cost right now. As I build the site and figure out dokan for myself, and see the workflow, custom code, etc etc, I'll need to see how much headache mainteance will be and price accordingly. How is this handled?
I think WordPress is still hard to beat. AI can write code, but WordPress has a long built ecosystem already in place. You get plugins, themes, add ons, docs, step by step guides, and fixes for many typical site needs.
AI does not have to make WordPress “done.” If anything, it can speed up how people build with it. The platform and its ecosystem still handle a lot of the work behind the scenes.
WordPress agency owners: what does your development workflow look like these days?
I've been running a small agency for about two years now, and I feel like we've backed ourselves into a bit of a corner with our WordPress development workflow.
When we started, Gutenberg + FSE seemed like the obvious direction. Our setup was basically a blank FSE theme with Greenshift (and later Greenlight) blocks. The idea was that either a designer or developer could build the site directly in the editor without having to touch much code.
For smaller projects, it actually works quite well - especially when there isn't a budget for a full design phase and the design is effectively created while building the website.
But we quickly ran into two problems.
First, e-commerce.
FSE was fine for simple brochure websites, but the WooCommerce development experience was pretty painful. Greenshift had some WooCommerce functionality, but anything beyond the basics became difficult to customise.
We eventually moved to Blocksy as our base theme. It's a more traditional theme setup, but it gives us a lot of useful functionality out of the box - mega menus or quick cart are good examples - while still working nicely with the block editor.
The bigger issue, though, is the workflow between designers and developers.
Greenshift is extremely customisable, but designers can fairly quickly reach the limits of what they're comfortable doing. At that point, the task needs to be handed over to a developer.
And most of the more traditional WordPress developers we've worked with don't particularly enjoy building things in the block editor.
So you end up with this awkward handoff between designer and developer, which slows things down and creates plenty of room for miscommunication.
There's also the hiring problem. Greenshift is still relatively niche, so finding good, reliable people who already know it is difficult.
And now, with AI-assisted development becoming a bigger part of our workflow, the whole visual-builder approach feels even more awkward. AI is great at generating and modifying code, but much less useful when the source of truth is a collection of settings inside a visual editor.
So I'm curious how other small WordPress agencies handle this, especially in environments where speed matters and budgets limit the ability to create a Figma design or wireframes up front.
Login
