I submitted my first plugin to the wordpress.org directory at the end of August and it was approved on 8 September, after five rounds. Almost none of the delay was code quality. Writing it down because most of what held me up is the kind of thing you only find out when it happens to you.

1. The name was rejected twice, and that cost the most

The first submission was auto-rejected within a second: a display name or permalink cannot begin with "wp". Fine, I renamed.

The second attempt cleared the automated scan and then a human turned it down. "Toolkit" is a generic description, and "Ultimate" is a promotional modifier rather than a distinctive identifier. Two lines in that reply were worth the whole round:

• "The absence of an exact match in the directory does not make the name distinctive." Checking that your name is free is not the test.
• "Other published plugins do not set a precedent for this submission; some were accepted under earlier standards." I had a list of near-identical names approved as recently as last year. It does not count.

What passes is a coined word or a personal/brand identifier, and it has to be at the front, not the back. I ended up inventing one. Remember that the slug is permanent while the display name is not, so keep the slug short and brandable and put the descriptive part in the name.

2. Your prefix has to be more than four characters

Mine was three. That meant renaming namespaces, constants, option names, post type slugs, hooks, script handles and every public template function. Do it before you submit. If your plugin is already out there, this is a breaking change for everyone who uses it.

A trap I hit doing that rename, and this one applies whether or not you ever submit anything: WordPress builds a submenu page's screen ID from the menu title, not the slug — sanitize_title( $menu_title ) . '_page_' . $submenu_slug. I had that prefix hardcoded in 31 comparisons. After the rename not one of them matched, so every admin screen of the plugin lost its CSS and JS. No error, no warning, php -l clean. It just looked like the styling had evaporated.

3. You can no longer ship an editor for arbitrary CSS, JavaScript or PHP

I had a code snippets feature. The reply was blunt: plugins that let users save arbitrary custom CSS, JS or PHP are not accepted, please remove it.

I asked whether a CSS-only version would be acceptable, since that is narrower than what the Customizer already offers. No, and they named the Customizer as exactly the reason CSS is covered too.

If you have that feature, plan for it not existing in your free version at all.

4. Escaping happens at the point of output, and nothing goes inline

52 notices, two patterns behind them.

Escape where you echo, not where you build. A helper that escapes attributes earlier in the chain does not count, even when it is provably safe. I annotated 105 of those in one directory and proved the rendered HTML was byte-identical before and after, which is a good way to convince yourself you did not break anything while touching a hundred files.

Every <style> and <script> goes through the enqueue chain. I argued for one exception, an engine that printed CSS on wp_head at priority 99 so user CSS would land after the theme, and I was wrong: enqueuing at priority 999 keeps exactly the same order.

Two exceptions I explained in my reply and that survived: a block render callback returning HTML the theme developer wrote themselves, and a standalone page that builds a whole document and exits, the way core's wp_die() does.

Two things I broke myself while fixing the above

• **sanitize_text_field() strips percent-encoded characters.** /caf%C3%A9/ comes back as /caf/. Harmless on REMOTE_ADDR, fatal on a URL path: a redirect or a route with a non-ASCII slug silently stops matching, and nothing errors. Use esc_url_raw() for anything that is a URL. I introduced this by following the review instruction literally instead of choosing the function that fits the value.
• Core owns the id {metabox-id}-title. It gives every metabox heading that id. My box was ultivo-seo and my own title input was ultivo-seo-title, so two elements shared an id and getElementById returned the <h2>. The character counter sat at 0/60 with text in the field, and the live preview never followed that input. It went unnoticed for months because the field right below it had no collision.

One more, if your URIs point at your own domain

If the Author URI or Plugin URI is a domain that is not obviously connected to the email you registered with, they will ask you to prove you own it. A TXT record on the root is enough. Add it next to your SPF record: a root domain can hold several TXT records, and replacing the SPF one instead of adding to it breaks your mail.

None of this is a complaint. The reviewers were right on every point except the one where I pushed back and lost, and the plugin is better for it. But if I had known the name rule and the prefix rule before submitting, I would have saved about two weeks.

The plugin was Ultivo Toolkit, if anyone wants to see what came out the other end. Not linking it, that is not what this post is for.

I wanted to share my application for WordPress on macOS. I worked on a 1.x version for a long time but decided the app should have full Gutenberg compatibility and a native macOS feel. I also decided to make the GitHub repo public if anyone had questions about the architecture/privacy. I just wanted a free, no-frills Mac app that I wanted to use for WordPress. Keep in mind the app only supports self-hosted WordPress.

https://quill.siolon.com

Wordpress is impossible to wor wit .I have contacted their"customer service AI" over and over again for the last month. My payment is up to date, but I cannot edit or change anything on my website! Is there a human being out there who can help me? It is really hurting my business.

Hello. I need some help. I use wpml the latest version (5.0.2) and i try to change some settings as it shows on the screenshot. For some reason it can't be updated after clicking on save button even though the rest of settings work normally.

I find it harder than quoting a project with a detailed brief.

Sometimes a client knows they need a new website, but once you start asking about what he actually needs, there are still a lot of unanswered questions.

providing a fixed quote too early can backfire, but asking technical questions before giving any indication of cost can also lose the client.

How do you approach pricing when the scope is unclear?

Weird thing happening with a very basic anchor link on jim-flannery.com/music

Clicking "Watch" doesn't bring you down to the appropriate position on a mobile device. Yet, if you then scroll back up and click it a second time, it is correct.

No idea why this is inconsistent, seems like the only anchor link on the site doing this and there's quite a few.

After opening an account with AppMySite, I experienced what I consider an extremely misleading and frustrating process, including constant stalling, lack of support, wasted time, and an arrogant attitude. After paying for the service, the level of support and service I received was completely unacceptable. This was an extremely disappointing and trust-destroying experience, and I absolutely do not recommend this company.

I write on my own blog and kept running into the same gap: a post would show 4,000 pageviews and I still had no idea whether anyone got past the intro. GA4 can track scroll, but by the time the number reaches me it has been through consent gating and sampling, and I wanted the raw rows somewhere I control.

So I wrote a small plugin for it. It's free on wp.org, GPL, no pro version, no account, no signup screen: https://wordpress.org/plugins/ango-scroll-analytics/

What it does: one script on single posts and pages. It records how far the page was scrolled per visit, and gives you visits, average, median and percentiles 5/10/25/50/75/90/100 on a wp-admin screen — phrased as "25% of visitors scrolled at least to X% of the page".

Three deliberate decisions, one of which will annoy somebody:

1. It measures depth through the scrollable height of the page, not the share of the article text. A short post that fits on one screen records 100%. That's why the numbers won't match your analytics tool.
2. A visit with zero scrolling still counts, as 0%. The percentiles describe everyone who arrived, not only the people who read to the end. There is a filter that drops "load-and-die" visits — page loads that never sent anything after the initial beacon, which on a live site are mostly bots and link previews — and it's on by default.
3. Your own logged-in visits aren't tracked. I added that after my own refreshing had quietly wrecked my first week of percentiles.

Everything sits in one table in your own database. The front-end script is ~2 KB gzipped, the endpoint is rate limited, no IPs are stored, Chart.js is bundled so wp-admin makes no external request, and deleting the plugin deletes its data.

Caveats, since you'd find them anyway: it went up on wp.org five days ago and I'm the only person who has used it in anger. It does no funnels, heatmaps or sessions and can't tell you why people leave. Stats are computed on the fly, so at hundreds of thousands of visits it would want caching — a normal blog won't notice.

Happy to answer anything about how the measurement works, including the parts that are my opinion rather than fact.

Ciao a tutti,

sono tre gg che sto impazzendo dietro a questo problema. Ho un sito con Elementor – Tema Otaku che, quando si collega un MAC DESKTOP, gli compare la schermata di autenticazione cloudflare.
Questa anomalia accade SOLO su mac desktop. Da mobile (IOS e Android) e WIN DESKTOP non ho nessun problema.
Il sito non ha nessun collegamento a Cloudflare.
Mercoledì il cliente mi segnala che aveva dei problemi e trovo un malware. Lancio da Cpanenl lo scan e intanto lo pulisco manualmente.
Ho installato sia Sucuri che Wordfence e non gli risulta nessuna anomalia.
Ho rifatto lo scan con Cpanel ed è tutto ok. Ho fatto fare un controllo al fornitore dell’hosting ed è tutto ok.
Come ultima mossa ho ripristinato il core e files di WP (mantenendo solo wp-config.php e wp-content) ma l’anomalia rimane.
Ho chiesto all’AI ma non mi ha dato altre soluzioni.

Avete qualche soluzione?

I have a page with an artical, at the bottom of that page I would like to post an image with a link that useres visiting the page on mobile devices or desktops other than windows don't see. I tried a JavaScript snippet but it returns an error in functions.php when trying to save it.

the snippet:

document.addEventListener("DOMContentLoaded", function() {

const isWindows = navigator.platform.indexOf("Win") !== -1 || navigator.userAgent.indexOf("Windows") !== -1;

if (isWindows) {

const targetElement = document.getElementById("windows-only-content");

if (targetElement) {

targetElement.style.display = "block";

}

}

});

how can i get a better solution?

How cost-effective are fully custom WordPress builds for clients in the long run?

On the one hand, the benefits are pretty clear: better performance, much more flexibility in design and functionality, cleaner code, and less dependence on third-party plugins (maybe using only couple official like woocommerce and so on).

On the other hand, custom builds can make maintenance more complex and expensive. With a typical plugin-based site, you can often update plugins, test the main flows, and move on. With a more custom-coded setup, even a seemingly small update can require proper staging, regression testing, and QA to make sure nothing breaks.

That obviously increases the cost of ongoing maintenance for the client.
So where do you draw the line?

At what point do the performance, flexibility, and reduced plugin dependency justify the higher maintenance cost and complexity?

For those of you building custom WordPress sites for clients, how do you approach this trade-off, and what types of clients/projects do you think actually benefit from going fully custom?

when opening photos inside a gallery block set as lightbox, the images are displayed cropped. this seems to be a known bug according to some forum posts i saw while looking around.

how can such a simple built-in feature have such an obvious bug?

With AI evolving so quickly, I think we’ll see more and more websites being built directly with code rather than using platforms like WordPress.
Maybe WordPress will eventually become less common, and honestly, it makes me a little sad to think about. I’ve spent a lot of time working with WordPress, so it would be a little bittersweet to see it slowly disappear. 😢

This is real world example how we caught this exploit on our clients website!

The exploit:

It's called wp2shell (CVE-2026-63030 and CVE-2026-60137). It affects WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. The fix was released on July 17 (7.0.2, 6.9.5 and 6.8.6). A public proof of concept exists, so bots scan the internet for unpatched sites automatically. Nobody targets you personally. Client website missed the update for about a month and got hacked on August 22. While checking our own servers we could see that other websites got the same attack in September, but they were already updated and it failed.

What they did?

- Created hidden admin accounts. They don't show up under Users in wp-admin.

- Installed a backdoor that puts itself back if you delete it. It lives in several places at once: `wp-content/db.php`, a file in `mu-plugins`, code at the end of `wp-config.php` and in theme files, hidden files in `wp-content/upgrade` and `wp-content/uploads`, and copies in the database. Clients host's malware scanner kept deleting files for weeks and they kept coming back.

- Got full remote control of the site.

- Turned off page caching for the whole site. That made the site slow: Search Console flagged slow mobile loading.(could be a sign)

Who they linked and why

Only when Googlebot opened the homepage, the site showed 89 links to UK websites (.co.uk and .org.uk) promoting "non GamStop" casinos. GamStop is the UK program people use to block themselves from gambling, so these casinos target people who are trying to stop. Regular visitors saw a normal page. The linked UK sites look like old small business and charity sites that were taken over too. The point is to borrow Google trust from real websites and pass it to casino pages. We found no redirects and no stolen passwords or form data.

What it means for the site owner

- Google sees your site linking to casino spam. That can bring a manual action or a security warning in Search Console.

- The site is slow because caching is off.

- The attacker could read everything on the hosting account, so treat database passwords and other secrets on that account as leaked.

How to check your site

1. Check your WordPress version under Dashboard > Updates. If it's below 7.0.2 (or 6.9.5 / 6.8.6 on older branches), update now. If it was below that at any point after July 17, do the checks below.
2. Open the users table in phpMyAdmin, not in wp-admin, and look for admins you don't recognize. They used emails ending in u/wordpress.org and names like backup_manager and cache_sync.
3. In File Manager, look for `wp-content/db.php`, unknown files in `wp-content/mu-plugins`, files starting with a dot in `wp-content/upgrade` and `wp-content/uploads`, and anything after the `require_once ABSPATH . 'wp-settings.php';` line in `wp-config.php`.
4. Load your homepage as Googlebot: `curl -A "Googlebot/2.1" https://yoursite.com/ | grep -i gamstop`. If anything comes back, you're infected.
5. If you use LiteSpeed Cache, check "Do Not Cache URIs". A single `/` there turns off caching for every page.
6. Check Security issues and Manual actions in Search Console.

If you find it

Make a backup first. Then remove every part in one go: files, database entries and hidden users. If you miss one, it brings the rest back. Reinstall WordPress core, your theme and plugins from clean copies, and change the salts and database passwords. Then request indexing of your homepage in Search Console. You are welcome stay stafe!

I’m developing Block Class Manager (BCM), a free plugin for Gutenberg, and I’d like to test something very specific: is the workflow understandable on its own?

BCM is built around a simple class-based workflow for Gutenberg. Instead of adding a large collection of blocks, it provides a lightweight foundation block with a few essential variations (Text, Media, Heading and Button) all using the same styling interface.

You can work with responsive styles, reusable Global CSS Classes, and HTML attributes within the same workflow, making it easier to build and maintain consistent layouts across screen sizes.

The other main part is Global CSS Classes: instead of recreating the same styling for every block, you can define a class once and reuse it across your layouts. You can also combine Global Classes with local block styles when you need something specific to a single element.

The goal is to have a more reusable and consistent way of styling Gutenberg layouts, while keeping the workflow lightweight and close to the native block editor.

BCM workflow inside the Gutenberg editor.

I know there are already plugins that provide some of these features. I’m not trying to reinvent everything. I’m exploring a particular workflow where you can create and apply reusable Global Classes directly while working with a block, rather than having to manage styles separately. I’d like to see how intuitive this feels to Gutenberg users.

If you use Gutenberg, I’d really appreciate it if you could install it and try it without reading the documentation or watching a tutorial first.

Try to:

• Create a simple layout with the BCM blocks
• Change the layout responsively
• Create and use a Global Class
• Figure out the difference between local styles and Global Classes

Then tell me:

• What did you understand immediately?
• Where did you get stuck?
• Was anything confusing?
• Did anything work differently from what you expected?

I’m not looking for compliments. I’m trying to find the parts of the workflow that aren’t obvious enough.

Even if you find the workflow confusing or something doesn’t make sense, that’s useful feedback for me.

I’d love to hear what you think in the comments, especially if something feels confusing or unintuitive.

👉 Block Class Manager on WordPress.org

Thanks to anyone who takes the time to give it a try!

Every events plugin I tried puts the same three things behind a paywall: recurring events, shortcodes, and a grid view. The big one is $99/yr for recurring alone, and it went up 33% in February.

For a church, a library, a running club — the calendar is the recurring events. "Every second Tuesday" is the whole use case. Paying $99/yr for that felt backwards, so I put out a free one where it isn't paid:

• Recurring events: daily/weekly/monthly/yearly, "second Tuesday", "last Friday", end after N times or on a date, skip dates
• Google Calendar / ICS import on an hourly schedule, with a visible log of what changed each sync — no silent drift
• Month and list views as blocks and shortcodes, styled by your theme, not by me
• Venues with an address and a map link (a link, not an embedded map slowing your page down)
• ~30 KB, styles load only on pages that show events, no add-on store, no upsell banners anywhere in wp-admin
• "Delete everything on uninstall" is an option you turn on, off by default

Everything above is free and stays free — I'm not going to paywall the calendar.

It's new, so it's unproven. If you try it and something's broken, tell me here or in the support forum and I'll fix it that day. GPL, on the repo: https://wordpress.org/plugins/beacon-events/

I've been freelancing as a WordPress developer for a few years now, and over the past 6 months, one issue has come up in almost every client conversation: AI disclosure.

Clients are using AI tools for drafting, images, product descriptions — but almost none of them have any system for tracking what was AI-generated, how much AI was involved, or how to prove it if asked.

I tried a few approaches:

· Spreadsheets and manual notes (fell apart immediately at scale)

· Client-side disclaimers buried in footers (not compliant, easy to miss)

· Custom post meta fields (no audit trail, no visitor-facing transparency)

None of it worked. So I ended up building a lightweight toolkit for myself called MegaGovern.

Here's the workflow I landed on:

1. Declare — Every post gets classified as one of four states: Human, AI-Assisted, AI-Generated, or Synthetic Media. You can do this per-post or bulk-update legacy archives.

2. Disclose — A visitor-facing badge shows the disclosure status directly on the front end. No hiding it in a footer.

3. Verify — For images, it scans EXIF metadata and C2PA standards so you know what's actually in the file.

4. Preserve Evidence — It generates cryptographic PDF logs and ai.txt protocols that you can hand to a client or regulator. Tamper-evident audit records.

The whole thing runs local-first — all data stays in your WordPress database. No external API calls, no cloud service scanning your content.

Why I'm sharing this:

The EU AI Act transparency requirements (Article 50) are already in effect, and a lot of WordPress agencies and freelancers I talk to are completely unprepared. I built this for my own client work, but I've since released it as a plugin.

Full disclosure: I'm the developer behind MegaGovern. There's a free tier that covers manual classification, branded badges, ai.txt generation, and 30-day audit logs — genuinely free, no feature locks. Paid tiers add AI scanning, C2PA checks, and signed PDF reports.

If you're dealing with AI disclosure for clients, I'm happy to answer questions about the compliance side, the WordPress implementation, or anything else. What approach are you all taking right now?

Local has really been a great tool for my work flow, but I have one question.

I keep my staging sites on external drives and I work from a couple of different laptops. On the external drive I have a folder 'local sites' and within that folder I have different staging sites. I am using updraft to backup and restore between online production and offline staging sites. The question is; how can I move that external drive between various laptops and desktops without having to create unique copies of the sites?

Hypothetical: a service business changes the email address for its WordPress contact form. The form still says 'sent', but new inquiries stop reaching the team.

Send one test from a phone with a unique phrase in the message. Look for that phrase in the form plugin's saved entries, then the inbox and spam folder, then the CRM. The first missing handoff tells you where to investigate. A success screen alone doesn't prove anyone received the lead.

Which step has failed for you: the form, email delivery, or CRM sync?