I use WP Umbrella right now for plugin and core updates, but I’m still hesitant about just letting everything auto-update.

My main concern is a core or plugin update breaking something and not catching it right away.

For those managing 30+ sites, what are you using that’s been reliable? Do you leave auto-updates on, wait a few days on bigger releases, or have some kind of testing/rollback process?

My WordPress site was compromised — suspicious MU-plugins and heavily obfuscated JavaScript

I'm investigating a WordPress site that was compromised. My coding/security knowledge is limited, so I used AI to help me analyze the files and understand what was happening.

I found a suspicious MU-plugin called:

focal-extension-evo

The file is currently 0 bytes, but its filesystem timestamps are interesting. It appears to have been created around August 14, 2026, and there is also a serialized reference to it in wp_options.

With the help of AI, I was able to reconstruct part of the heavily obfuscated JavaScript associated with the infection.

The JavaScript makes a POST request to:

https://fashion-chicken.com/x9i32md/w1/

It also contains an eval() mechanism that appears capable of executing the response received from the remote server.

I did not execute the code or contact the remote server.

Threat-intelligence checks also show that fashion-chicken.com is associated with malicious infrastructure/C2 activity.

Plugins currently installed

These are the plugins actually reported by WordPress on this installation:

Active:

• Classic Editor 1.7.0
• Elementor 4.2.4
• Elementor Pro 3.35.0
• JetEngine 3.8.14.3
• WPvivid Backup Pro 2.2.30

Inactive:

• BDThemes Element Pack Lite 8.8.2
• JetFormBuilder 3.6.5.2
• WP Lorem Ipsum Generator 0.3
• Rank Math 1.0.277.2
• Rank Math Pro 3.0.106
• WooCommerce 11.0.1
• WP Cafe 3.0.19
• WP Cafe Pro 3.0.5
• WP Mail SMTP 4.9.0

Suspicious MU-plugins found

WordPress is also reporting these as must-use plugins:

• focal-extension-evo
• ionic-dashboard-ultra
• jolt-librarian-vox
• lumen-logger-io
• max-exporter-tag
• page-compiler-jet
• web-extension-evo

There are also these drop-ins:

• advanced-cache.php
• db.php
• maintenance.php

I'm now working on cleaning the installation and determining how the malicious files were introduced.

The AI assistance has been extremely useful because my knowledge of malware analysis and heavily obfuscated JavaScript is limited. It helped me decode the JavaScript and identify the suspicious external communication without executing the malware.

Is anyone else dealing with something similar? Are you using any of the plugins listed above? Has anyone seen focal-extension-evo, web-extension-evo, or the other MU-plugins mentioned here before?

Hi, since WordPress 7.1 my PhotoSwipe blocks have broken in the editor, fine on the frontend. How do I initialize it in the editor iframe in 'render_block_preview'? The thumbnails just link to the absolute URLs in the href now rather than triggering the lightbox. Thanks

 const lightbox = new PhotoSwipeLightbox({ gallery: '.lightbox', children: 'a', pswpModule: () => PhotoSwipe, }); lightbox.init(); window.acf.addAction('render_block_preview', ... ) 

Hello all! This might be a long-ish read but I want to give as much context as possible for this situation I'm in. I am an IT consultant for a nonprofit and was tasked with assisting with implementing a plugin into their existing WP site. It's currently hosted on WP Engine.

I want to start out by stating this: I am a technical consultant who specializes in IT troubleshooting, system administration, networking, security and tailor fit technical solutions. I am a generalist who is adept in all aspects of tech but I am by no means a WordPress dev. This consultant role for this nonprofit is the first time I had actually had to learn WordPress and how certain things work through WP Admin. I told my client directly that I could assist with technical implementations but emphasized that I do not design websites for a living and that this would be a best efforts sort of thing.

Some history: The nonprofit had apparently called on a design company to design their primary website. They seemed to have designed the layout, structure and architecture as a custom WordPress theme that, from what I could understand, had lines of code in it's CSS sheet that tells certain plugins to do certain things related to site/element layouts. I don't know the exact timeline of events but the nonprofit no longer works with the original design company and needed to call on ANOTHER design company to fix the website layout when critical layout elements broke down apparently. The second company now is in the picture on a routine maintenance contract (I believe they migrated their site to WPEngine, and they run monthly maintenance by updating outdated plugins and patching security vulnerabilities) but for anything site-design related, they charge by the hour or by the project from my understanding.

Currently the stylistic layout of the site is all tied to the custom theme I mentioned above. There is a base/parent theme and a child theme. The child theme is the one that is currently active for the site. Being technically adept, I am able to use the Theme Editor to modify certain texts/attributes through the live WordPress site and can use SFTP to download the themes/create a new child theme if I wanted to.

Here's the problem: Nobody at this nonprofit is very technical and nobody knows how the website works in WordPress on a technical level. They have stated on several occasions that they feel extremely limited when it comes to the design elements of the site and they definitely don't know how to grab the themes off SFTP and modify it on a site dev level. On top of this: the plugin I am trying to implement requires a "global header" that allows a user to sign in through a third party platform (through API) and use it to purchase things directly through the site instead of linking to the platform via a URL link but the active theme seemingly is not allowing me to add this header or modify any of the design elements on global site things like headers, footers etc.

Here's where I could use some advice: The plugin required that we also activate and license Elementor Pro so we can control more of the design elements of the site when we implement the plugin. Playing around with Elementor it seems easier for non-technical people to modify certain aspects of the layout. In thinking of a future for the nonprofit to be able to edit design related aspects of their site without my involvement, I thought it might be worth it call on the design company to recreate the theme the site uses through Elementor Pro so that if a member of the nonprofit has to change something in the future then it is much, much more accessible... so long as they keep paying for the Elementor Pro yearly subscription that is lol.

Is this a good idea? Like I said, I am trying to think of something for the long term for this client given that they have no in-house WordPress devs or technical folk.

Thank you for reading and thanks in advance to anyone who can offer some insight here!

Hi, since WordPress 7.1 my PhotoSwipe blocks have broken in the editor, fine on the frontend. How do I initialize it in the editor iframe in 'render_block_preview'? The thumbnails just link to the absolute URLs in the href now rather than triggering the lightbox. Thanks

 const lightbox = new PhotoSwipeLightbox({ gallery: '.lightbox', children: 'a', pswpModule: () => PhotoSwipe, }); lightbox.init(); window.acf.addAction('render_block_preview', ... ) 

I have been using BlogVault on my sites for years, and now find myself looking around for an alternative. I like the smart, more fully-featured approach of BlogVault (such as migrations, control over backup schedule, granular file/table selection on restore/migration), as opposed to a bare-bones approach like CodeGuard. I have googled, but am looking for recommendations based on your experiences - stuff that goes beyond what the marketing tells me. Who is really solid, reliable, and has an overall great user experience for site managers?

Are there any free or low cost Wordpress themes that would make it easy to create an online newspaper or newsletter, with a look similar to the this site: Outdoor News? I mainly like the top section and how that site actually looks like a newspaper and is also organized similar to a newspaper.

I'm well versed on using Elementor Pro, but would be open to using other page builders if they save time. Any recommendations on themes or techniques to create such a site would be greatly appreciated!

https://preview.redd.it/y4ep5gz9a6nh1.png?width=1063&format=png&auto=webp&s=4295e6ef3381461459a89324465dd4434df771cd

Hello all! This might be a long-ish read but I want to give as much context as possible for this situation I'm in. I am an IT consultant for a nonprofit and was tasked with assisting with implementing a plugin into their existing WP site. It's currently hosted on WP Engine.

I want to start out by stating this: I am a technical consultant who specializes in IT troubleshooting, system administration, networking, security and tailor fit technical solutions. I am a generalist who is adept in all aspects of tech but I am by no means a WordPress dev. This consultant role for this nonprofit is the first time I had actually had to learn WordPress and how certain things work through WP Admin. I told my client directly that I could assist with technical implementations but emphasized that I do not design websites for a living and that this would be a best efforts sort of thing.

Some history: The nonprofit had apparently called on a design company to design their primary website. They seemed to have designed the layout, structure and architecture as a custom WordPress theme that, from what I could understand, had lines of code in it's CSS sheet that tells certain plugins to do certain things related to site/element layouts. I don't know the exact timeline of events but the nonprofit no longer works with the original design company and needed to call on ANOTHER design company to fix the website layout when critical layout elements broke down apparently. The second company now is in the picture on a routine maintenance contract (I believe they migrated their site to WPEngine, and they run monthly maintenance by updating outdated plugins and patching security vulnerabilities) but for anything site-design related, they charge by the hour or by the project from my understanding.

Currently the stylistic layout of the site is all tied to the custom theme I mentioned above. There is a base/parent theme and a child theme. The child theme is the one that is currently active for the site. Being technically adept, I am able to use the Theme Editor to modify certain texts/attributes through the live WordPress site and can use SFTP to download the themes/create a new child theme if I wanted to.

Here's the problem: Nobody at this nonprofit is very technical and nobody knows how the website works in WordPress on a technical level. They have stated on several occasions that they feel extremely limited when it comes to the design elements of the site and they definitely don't know how to grab the themes off SFTP and modify it on a site dev level. On top of this: the plugin I am trying to implement requires a "global header" that allows a user to sign in through a third party platform (through API) and use it to purchase things directly through the site instead of linking to the platform via a URL link but the active theme seemingly is not allowing me to add this header or modify any of the design elements on global site things like headers, footers etc.

Here's where I could use some advice: The plugin required that we also activate and license Elementor Pro so we can control more of the design elements of the site when we implement the plugin. Playing around with Elementor it seems easier for non-technical people to modify certain aspects of the layout. In thinking of a future for the nonprofit to be able to edit design related aspects of their site without my involvement, I thought it might be worth it call on the design company to recreate the theme the site uses through Elementor Pro so that if a member of the nonprofit has to change something in the future then it is much, much more accessible... so long as they keep paying for the Elementor Pro yearly subscription that is lol.

Is this a good idea? Like I said, I am trying to think of something for the long term for this client given that they have no in-house WordPress devs or technical folk.

Thank you for reading and thanks in advance to anyone who can offer some insight here!

Hi everyone, I’d like to share my first publicly released plugin. I built it because I was tired of seeing AVIF support locked behind paywalls in other image optimization plugins.

PDEV Image Optimizer is a free WordPress plugin for converting images to WebP or AVIF. Everything runs locally on your server: no account, no tracking, no Pro version, and no features locked behind a paywall. The only real limitation is what your hosting environment supports.

After installation, the plugin checks your server capabilities and gives detailed information about potential conversion or image-delivery issues. It can also detect conflicts with other popular image optimization plugins.

It includes thumbnail regeneration, safe cleanup of generated optimized images, and optional Cloudflare support.

It’s still missing features such as WP-CLI support and direct conversion from the Media Library. Both are planned for future updates. Feel free to suggest other features you’d like to see.

Free, no account, no tracking, no paywall:

https://wordpress.org/plugins/pdev-image-optimizer/

Feedback from real WordPress setups is very welcome.

I am building a website for a non-profit dirt bike club. We want to have a membership application on the site and collect the dues as easily and painlessly as possible - and also on the cheap since we have no membership money coming in yet. What are my options? I am very new to WP and do not know much about plugins. Thank you!

So the idea is to register a new service provider with their location and the area served that he'll select (from 1-50km radius).

I want to make the radius visible on the map. I tried using a HTML field with a JS code that AI suggested, but it didn't work.

I also don't know how I'll retrieve this information later to match a client's location inside the service provider's area.

I'm completely blind in this scenario; any piece of advice will be very helpful.

I'm using WS Form for this, and I'll save the information in a CPT (Metabox) and in FluentCRM; I also have WPCodeBox 2 if needed.

Hey everyone!

Posting under the [PROMO] guidelines today to share a free plugin I just released on WordPress.org, and I'd love to get some honest feedback from the community.

I just opened up access to OrdoLink on the WordPress.org directory.

TL;DR: It’s a modern tool for internal link building and management directly inside Gutenberg.

Quick back-story: Many years ago, I built an internal linking plugin for a client. It worked, but it was built for a single site. With another 15 years of dev experience and modern vector tools, I decided to rebuild the concept from scratch for the broader community.

The problem with existing tools in this space:

1. Local DB heavyweights: Tools that run heavy SQL queries or matrix scans directly on your local wp_posts table, causing slow load times or 503 errors on shared hosting.
2. String replacers: Tools that force exact keyword-to-URL matching and auto-insert links via cron jobs, leading to awkward, unnatural anchors.

How OrdoLink works:

• Off-site processing: Content analysis and vector matching are handled on a remote backend. Zero processing or table scans on your local database.
• Gutenberg sidebar integration: Hit "Scan Draft" inside the editor, and OrdoLink surfaces semantically relevant past posts with context snippets.
• 1-Click insertion: Inserts links directly into your active block without breaking block markup or messing up HTML overlays.
• Search & RAG friendly: Focuses on building natural topical clusters for both Google crawlers and modern AI/LLM retrieval tools.

Usage & Privacy:

• Free on WordPress.org: Fully functional for up to 100 indexed posts (no registration, no credit card required).
• Privacy: Draft text is processed off-site via a secure connection solely to compute vector matches in memory. It is not stored, sold, or used to train third-party LLMs.

Where to check it out:

• WordPress Plugin Directory: https://wordpress.org/plugins/ordolink
• Guides & Documentation: https://ordolink.net/articles

I’m actively building and maintaining this, so I’d love feedback on the Gutenberg UI flow or matching quality.

But more than anything: Have a great day!

https://preview.redd.it/xwaqh4c5c3nh1.png?width=1544&format=png&auto=webp&s=5a6218168d516ae0fe0272ad0af418dd468dfa6d

I’m new to WordPress and don’t have much experience, so please bear with me, but I really don’t know where to go from here.

I have a sticky header containing a logo, site name, navigation, and buttons linking outside the site, as shown in the screenshot with the block structure. The Group, which is the parent block, is sticky using Spectra’s “Make this block sticky” setting.

I need it to stay sticky on mobile as well, but when I open the hamburger menu on mobile, the overlay doesn’t open across the whole page. It only appears within the area of the header itself, almost as if overflow: hidden was applied.

If I add overflow: visible to the Group’s Additional CSS, nothing changes.

I don’t know where else I should set this or whether I’m missing something. Any idea what could be causing this?

Thank you so much!

The WordPress project has formalized a core security effort in response to 15x spike in reports and an unprecedented period of core security releases.

The WordPress project has formalized a core security effort in response to 15x spike in reports and an unprecedented period of core security releases.

I've been working with WordPress + Cloudflare for a while, and one thing that still feels unnecessarily complicated is full-page HTML caching.

Cloudflare works great for static assets out of the box, but getting WordPress pages cached properly usually means setting up Cache Rules, figuring out what should bypass the cache, handling cache purges, and making sure things like /wp-admin/, logged-in users, and dynamic pages aren't accidentally cached.

I've been trying to find a simple setup that works well on the Cloudflare Free plan without adding another heavy WordPress caching plugin.

So I'm curious:

• Are you using Cloudflare Cache Rules for full-page WordPress caching?
• Are you using a WordPress plugin to manage it?
• Or do you prefer keeping HTML caching completely separate from WordPress?

Note: I'm the developer of a WordPress plugin called SuperFlare Cache that I originally built to simplify this Cloudflare + WordPress setup.

I'm not looking to turn this into an ad — I'm mainly interested in how others are handling it and what problems you're running into.

If you've got a setup you're happy with, I'd genuinely like t

Why are global patterns not recognized in widgets?

I register them in functions

 function theme_widgets() { register_sidebar( array( 'name' => 'Global widget', 'id' => 'global-pattern', 'before_title' => '<h2 class="widget-title">', 'after_title' => '</h2>', ) ); } add_action( 'widgets_init', 'theme_widgets' ); 

When I go to widgets, I can build it there with Gutenberg

https://preview.redd.it/ma5ak297d2nh1.png?width=1099&format=png&auto=webp&s=01430eb72dd9922c9a7a7d34d595bdbe2793fd18

It's empty even though I have a bunch of patterns that I'm using in the theme on pages/posts