My phone just stopped ringing (pacific time), so I hope everyone is getting some dowm time after today.

I build WP websites using Elementor and currently have around 30 client websites. I don’t offer hosting or ongoing maintenance packages, but I’d like to recommend a reliable security solution that each of my clients can purchase and manage independently.

Ideally, I’m looking for something that offers strong protection, malware scanning, firewall protection, and minimal hands-on management.

With all things AI, I’ve already had to deal with too many breaches this year and I’d like to find a solution.

For those who build WordPress websites, what security solutions do you recommend?

I'm new to WordPress and creating websites in general. I'd like my links to provide preview on the first image in that particular page. But for the time being, all I get is link with no featured image at all. I'll welcome any advice.

First pic is how my links are now. Second pic is how I'd like them to look.

In light of the PHP CVEs, solutions like Simply Static seem like an attractive option.

Has anybody used them? Thoughts?

Edit: I'm referring to the managed service which has has no public PHP/WordPress runtime, rather than the plugin

Hi, I wanted to change the table width narrower (which I figured out) but I can't seem to align it to the left of the page. Can someone help with the css? It's for https://unrecables.org/photos-and-videos/ Thank you!

I have a lot of websites with them, alongside some decent-sized clients. Everyone in Slack is asking and we haven't heard anything yet.

My SiteGround websites were all updated within an hour this morning. I would've expected the same.

Think this is... illuminating to say the least.

I really like Galleryberg, but I was wondering if there's an alternative one that allows comments for free?

How do you handle this mentally and practically? Instead of using the support form, some users immediately leave a 1-star review to ask a question. I've spent an enormous amount of time developing, and I have over 380+ five-star reviews, but occasionally, these strange situations still happen. How do you deal with this?

My wordpress editor is broken.... The internal pages are editable, but this shows up when I try to edit the homepage. Help please!

Hey everyone, I really need some advice from people who actually know their stuff.

A little background: I haven't touched HTML/CSS in 20 years (since high school back in the day, when you'd manually build a frame and then write CSS for it). I have zero modern web dev experience.

For the past two weeks, my site has been trapped in a nightmare loop: breaking, patching, breaking again, and patching again. I tried using AI tools Codex, and while it gets the site looking decent on the surface, the code underneath is an absolute disaster—pure, chaotic spaghetti code.

I’m ready to wipe the slate clean and start from scratch.

All I want is a clean, simple site to showcase some pictures, text, and blog posts. Nothing crazy.

Given today's AI landscape, what is the right way to do this without creating a pile of tech debt? Do I use Gutenberg block themes, lightweight page builders, or something else? How can someone with my background leverage AI properly without ending up with broken code?

Any workflows, tips, or sanity checks would be massively appreciated!

I'm a Wordpress freelancer and a while ago i started creating my own themes for clients, either forking from a default theme (like Twenty Twenty-Five) or occasionally creating something completely blank.

How do I ensure these are secure? If Twenty Twenty-Five gets updated, obviously my themes are not being updated. How do I keep on top of what needs updating?

Update: PHP updates are live. Update now https://www.php.net/archive/2026.php#2026-10-21-5

PHP has announced an upcoming security release, scheduled for today, 21 October. It will fix two severe vulnerabilities that affect all versions of PHP.

Changes to PHP configuration and web application firewall (WAF) rules can help reduce exposure to the known attack vectors. However, the PHP team has said these measures don’t give full protection. The only full fix is to update PHP itself.

If you run PHP, apply the updates as soon as they’re released. Treat this as emergency maintenance and plan to roll the updates out across all your environments.

What to do now

• Get your environments ready to update straight away. Attacks on the known vectors have already started. Once the patch is public, attackers will use it to work out the remaining vectors, so expect a new wave of attacks as soon as it’s released.
• Ask your hosting provider what they’re doing to protect you, both at the WAF level and in your PHP configuration.
• Apply the PHP updates as soon as they’re released. Treat this as emergency maintenance and roll the updates out across all your environments.

Fixes are expected for PHP 8.2, 8.3, 8.4 and 8.5, which are the currently supported versions. PHP 8.1 is not expected to get a patch, so if you’re still on 8.1, upgrade to PHP 8.2 or later straight away.

This post is born from a discussion here in this subreddit.
how many times a project for a client need a custom post type and how many time the client asked for a blog / news section?

i wonder coz in my personal experience most of the projects in the 2020s has beed a website without any blogging section (or just "10 posts coz i read it drive traffic").

I d go to say that:

• a good 50% just needed pages (or ecommerce/both *)
• 30% extra CPT
• 10% needed both CPT and post
• and only 10% asked for Blogs /news.

* yes, the "product" section is a CPT but it s created by the plugin.

Edit: i added "news" to better specify the blog section

Context. PHP ships an emergency security release today (14:00 UTC) fixing CVE-2026-109618 and CVE-2026-109619 — two critical (CVSS 9.2) unauthenticated RCE vulnerabilities in session.upload_progress. Sources: PHP.net notice at https://www.php.net/archive/2026.php and the CERT-EU advisory at https://cert.europa.eu/publications/security-advisories/2026-018

Every current PHP build is vulnerable, the feature is enabled by default, and it's reachable via ANY multipart POST to ANY PHP endpoint — no upload form required. Once details go public today, PoCs will follow and every PHP server on the internet gets sprayed.

I wanted early-warning plus edge-blocking that doesn't need ModSecurity or a paid WAF plan, so I wrote a small Cloudflare Worker (free tier, about 6 KB, no KV) and open-sourced it:

https://github.com/codewizdevs/php2shell-watcher

What it does:

• Inspects multipart POST bodies at the Cloudflare edge; all other traffic passes through untouched
• Returns 403 for any request containing the PHP_SESSION_UPLOAD_PROGRESS trigger field — same detection Sansec proposed as a ModSecurity rule (https://sansec.io/research/php2shell), packaged as a Worker
• Heuristics for the leaked PoC shapes (PHPSESSID sent as a form field, t[] heap-spray pattern)
• Discord alert per attempt: IP, country, ASN, CF-Ray, path, user-agent, sanitized body excerpt — deduplicated so a spray doesn't flood your channel
• Monitor-only mode is a one-line config change

What it does NOT do (please read before deploying):

• It does NOT patch anything. Update PHP today, and/or set session.upload_progress.enabled = Off in your php.ini or FPM pool config — that's the real mitigation. This buys time and visibility, nothing more.
• It only sees Cloudflare-routed traffic. If your origin answers directly on its IP, attackers skip the edge — lock the origin down to Cloudflare IPs (https://www.cloudflare.com/ips/).
• Free tier is 100k Worker invocations per day; scope your route to PHP paths (for example /blog/*) on busy sites.

Verify it works (two commands, full proof in the README):

curl -X POST https://your-domain/ -F "PHP_SESSION_UPLOAD_PROGRESS=x" -F "f=@/etc/hostname"

Expected result: HTTP 403 plus a Discord alert containing your own IP.

Deploy is about 5 minutes with wrangler or dashboard paste; MIT licensed. Feedback and issues welcome — and patch your PHP today regardless of whether you use this.

Assumes you have root on the Linux server running your WordPress sites (including via using sudo), it's one that uses systemd, and you use php-fpm to provide PHP rather than having it in every webserver instance.

Replace 8.4 with your version as necessary.

When the PHP has been patched, you can do systemctl start php8.4-fpm.service to get everything back running. In the meantime, visitors see a 503 'system unavailable' error.

https://www.wordfence.com/threat-intel/vulnerabilities/detail/duplicator-1517-and-duplicator-pro-4610-unauthenticated-php-object-injection

Roller coaster is the only word I can find describing WP landscape.

I've worked with WordPress for years in enterprise and freelance projects. One thing I keep running into is users putting a page together with blocks but the result doesn't look great. Even with the blocks and styles already set up, putting a layout together still takes time.

As developers/designers we can set up a good starting point (patterns, reusable templates, custom blocks, etc) but I still see users needing developer help to add fairly simple pages. Knowing which blocks to use, how to arrange them, where the settings are.. takes some learning.

I've been working on a free plugin called AI Editor to help with this. You describe what you want in a conversation inside the block editor and it adds the blocks. You can also select existing blocks and ask it to change them in the same conversation.

It uses the blocks already available in the editor. It doesn't create new block types and the result stays editable. It works with themes that define their styles through theme.json so it can use the theme's existing styling.

The plugin is free, no ads or distractions. It currently supports OpenAI models and uses your own API key. It uses native WordPress styling and stays in a custom Gutenberg sidebar until you need it.

https://wordpress.org/plugins/ai-editor/

I also added features for devs, like connecting custom abilities through the Abilities API to AI tool calls. For example you could expose an ability that retrieves WooCommerce product details or performs an action through a custom plugin. It can also search existing posts, pages and public custom post types for context.

If you try it feedback is welcome.

I use the free version of UpDraft Plus to back up my site every day. My host - NetNerd - say this is not necessary as they make daily backups anyway.

Is it safe to rely on backups by NetNerd? Given the posts about sites being hacked via UpDraft I wonder if this plugin is an unnecessary risk?

I first subscribed to WP rocket in 2018. $129 for infinite.

In 2024 they double charged us so we've not had to renew since then but it was $299.

Today we received an email they want $599 for a max of 500 sites.

For those of you using it, how are you feeling about it?

We've cancelled our auto renewal.