I have a WordPress website used to booking appointments and this was created by a company. I hired a while back.
Now I want to redesign the website, but I’m a complete beginner.
I want to test my ideas without affecting the live website. Should I use staging or duplicate
Elementor draft? ChatGPT says duplicating has more risks, but it seems like I have to pay for staging.
Need the pages to be real pages with the translated url too
The Avada 7.16.x theme crashes WordPress when define('FS_METHOD', 'ftpext'); is in wp-config.php and PHP is version 8 and higher.
This error has been an issue with Avada on our sites since PHP 8 came out.
I'd been putting off updating our PHP version because of this, hoping it would be fixed. I've brought it to the devs' attention in the past, too, but they were no help. Due to PHP2Shell, we had to upgrade our servers from PHP 7.4.xx to 8.4.xx and remove the FS_METHOD line, making updates much more time-consuming to implement.
Search results for this issue always say to set FS_METHOD to direct but I can't do that due to security concerns and write permissions that I can't change. I've tried setting it to ssh2 with a plugin that is supposed to enable that but couldn't get it to work (even though I can connect via SSH2 with PuTTY).
Some of my sites are running different themes (Newspaper and Kale) and they have no problems with FS_METHOD set to ftpext, so I don't think this is a server/permissions issue. I've also tried disabling all plugins on my Avada dev site, but it still crashes.
Error logging returns this:
LoginFatal error: Uncaught TypeError: ftp_nlist(): Argument #1 ($ftp) must be of type FTP\Connection, null given in [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php:492 Stack trace: #0 [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php(492): ftp_nlist() #1 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(465): WP_Filesystem_FTPext->exists() #2 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(307): Avada_Server_Rules->is_htaccess_writable() #3 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(116): Avada_Server_Rules->maybe_upgrade_rules() #4 [ROOT_DIR]/wp-includes/class-wp-hook.php(353): Avada_Server_Rules::init() #5 [ROOT_DIR]/wp-includes/class-wp-hook.php(377): WP_Hook->apply_filters() #6 [ROOT_DIR]/wp-includes/plugin.php(523): WP_Hook->do_action() #7 [ROOT_DIR]/wp-admin/admin.php(180): do_action() #8 {main} thrown in [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php on line 492 My best guess is this has something to do with class-avada-server-rules.php not playing nice with PHP 8 and/or WordPress, but this is moving into unknown territory for me.
Does anyone have any ideas or suggestions for things I can try to get around this issue? Maybe some edit to class-avada-server-rules.php that I can put in my child theme?
- - semi-related rant incoming - -
In the past I'd go to ThemeFusion (Avada devs) for support, but they only include one year of support per license. The only ways to extend support are to buy another license for $70 or a 6-month renewal for $50, which is ridiculous. No wonder Avada is a best-seller; if you don't buy another copy every year, you don't get support! Inflating their sales numbers that way is dishonest and should be illegal.
Anyway... I'm at my wit's end. Thanks for reading.
My performance with the pagespeedinsights scan is a 55 score
I want to start building websites for businesses and individuals. In the past, I only worked with Elementor; is there a better page builder available nowadays that offers good value for money? (The currency where I live has an exchange rate of 5 to 1 against the US dollar.)
Hello WordPressers :)
I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.
Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.
It generated the following files and directories:
Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.
The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.
The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.
The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.
Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.
At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.
A few interesting things about this virus:
![[link]](https://i.redd.it/kaq7j460vnyh1.jpeg){kind=link}
token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.function_exists() to test for various functions, so it can understand what it can do to its host server.wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.The following strings can used to grep/search for the infection:
Let me know if you need more details!
EDIT with information about the plugin*
The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.
It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.
The main code does:
Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.
On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.
It does various other things that I can't be bothered to write about :)
The site is super slow but I can't figure out why. I do have query monitor installed and its giving some of the above info but I have no idea what to do with it. Does anybody know?
Curious what agencies and developers are recommending to clients about downloading their own periodic backups. Hosting mainly on WPEngine and assume that backups are safe there, but with increased threat level from AI bad actors wondering more and more if we should force clients to periodically download complete backups in case something really goes sideways. Thoughts?
Hi! I’m the author of WP-dTree, and I’ve just released Content Trees: a fresh take on collapsible navigation for WordPress archives, pages, categories and tags.
It works with blocks, classic widgets and shortcodes. Visitors can explore branches without leaving the page, with post titles loaded as needed. If you already use WP-dTree, you can can try this alongside it - your existing widgets and settings stay intact.
It’s free and open source: https://wordpress.org/plugins/content-trees/
I’d love feedback, especially from people with years of posts or a deep page hierarchy. Is it straightforward to set up, and does it fit comfortably into your theme?
So Liquidweb who have bought out LearnDash and seem to be pushing everyone into their software packages most of which I don't need. We currently pay $199 a year and they're forcing us onto a $350 a year package that includes Events Calendar, Kadence and Give. I'm looking at alternatives and both TutorLMS and Masteriyo look good but I'm undecided about which one to try.
We have a site with 25 courses currently and use Groups to auto enrol users into these, some courses are in multiple groups. Each course has a certificate that uses get at the end. I've currently got BBForums linked to each Group although so that users can ask questions and open discussions. I might look at more polished alternatives to BBForums in the future. Lessons mostly consist of text, video presentations hosted on Vimeo, sometimes resource downloads and a quiz, once all lessons in the course have been completed there is an end of course quiz. So I think fairly standard.
Enrolment is through group codes at the moment although we are looking at building more courses and offering paid subscriptions in the future.
Thanks for any advice or experience you can give as I'm going to have to make a decision fairly quickly to make a move before December.
I created a page, designed and published it. It's live now. But when I go to the pages I can see the pages with no content but can't see the live page which I published a few days back.
I have a bunch of Woocommerce URLs being found in Google and they are definitely not in the sitemap.xml.
They are like:
I feel like I've ogne through every option in TSF. Any key settings I need to look at here?
I've blocked it in Search Console but wondering if there more of a solution that is at the root.
Title. When something like the php notice came out Oct 2026- I had next to no idea what the risk was, how to protect my site, etc. I'm scrolling through the sub and seeing people talking about have to use plug-ins to scan their database and files to check for malware being injected- I don't even understand how malware gets injected or how to protect my site from it. I've read about spam issues from contact forms and needing XYZ layered protection- I couldn't understand if these were plugins or something else. I've tried to do some research but it's essentially like trying to read a foreign language which takes understanding three other foreign languages to even begin.
I literally know nothing; I'm just a person who got a domain, a host, hopped onto wordpress and started designing. I haven't gone plug-in crazy, pretty picky about that because I'm already paranoid, but the point still stands that I've done nothing special except for start building. It's aiming to be a research archive.
It concerns me whether it's safe or responsible for me/anyone like me to be making a website.
TIA
On my some posts in my stupid blog I justify an image to the right of text. This allows text to automatically wrap around and under the image, like a newspaper. However, text gets squished to the side in portrait mode on a tablet or small mobile.
If i separate image and text into columns, they stack before the text smooshing can occur. This is good. However, text doesn't wrap in landscape mode so there's a long blank area below the image.
What do I want? On wide views I like the text-wraparound feature. As the view narrows toward portrait, I want image and text to stack like columns before text gets smooshed on the side. Can WordPress do this combination?
I already tried combining a justified image/text group with columns, yet it breaks the layout in weird ways.
Hello, i'm using a ten year old e commerce template that the developers no longer offer updates for. Is it okay to keep using it?
For reference, we use a number of different hosts and most of them update WP Core within 6 hours. We've been noticing that WP Engine always seems late and have been running them manually.
I opened a ticket today to talk to support about the timeframe for v7.4.1 updates, and they told me that automatic updates for the release will occur weeks from today to allow for testing. I pressed them a bit on the RCE fix (no published CVE or POC) and the eMudhra certificate revocation after they claimed this not to be a critical update, but no real answers. They have escalated the ticket though.
For my blog (www.moppermijmer.eu) I have a specific image set as icon. But when I look in the jetpack reader, the only image is the default placeholder. The image also doesn't show up when I post a link in social media. Where can I set an image to be the default representation of my blog? (Putting an image in each post is going to put a lot of pressure on my already fragile workflow.).
Forms, SEO, backups, security, page builders, caching. Which one would be the first to go if a solid free alternative existed, and what does it cost you a year?
I need help to build a online client evaluation form.
The basic function is when client input the necessary information and submit the form, it will automatically give a result based on the information given.
Anyone knows what plugin could achieve this function? Paid one is fine.
Thank you.
Hey,
I am looking to get into web design and development but am coming from a design only background. I'm a professional graphic designer and know all the design side of UX/UI and web but don't have much knowledge on the technical aspect of building a site from my designs.
I have tried looking at all sorts of video tutorials but nearly all of them seem to be paid ads now or require a subscription to properly use the tools like Elementor. Does anyone have any decent tutorials or courses to learn wordpress without needing a paid subscription to various products?
![[link]](https://i.redd.it/n49on3gk7lyh1.png){kind=link}
![[link]](https://i.redd.it/u76qo12s5myh1.png){kind=link}