I’ve inherited responsibility for a wordpress site. It has a lot of plugins that I have a feeling are no longer used. For security, I’d like to disable and remove any that are not being used. Is there any good way to determine that with some certainty without going through a huge hassle?

So long story short, I used to run a webzine and used a theme from Themeforest and a couple of addons from Codecanyon, but due to health issues I had to shut it down after a couple of years.

Fast forward 5ish years and I'm eager to get back into it. However, when I log back on to the mentioned sites, all of the themes and addons I bought back then are removed from the marketplace, and theres no easy way of contacting the authors. I can still download them all except for one, but none of them are being updated.

So my question is, how do you guys deal with that? Is that just something you have to accept? It doesn't seem very viable for long-term projects.

PS. I even made sure I bought themes and addons from big and popular authors back in the day to avoid this problem, but guess that doesn't change much.

I am working on an e-commerce website using WordPress/WooCommerce and am looking for a plugin or custom logic similar to the search experience used on:

https://www.rulmeca.com/en

If anyone knows of a plugin or approach that achieves this, please let me know.

Thanks,

Getting a little frustrated and nowhere to turn - maybe someone else has an idea.

I've had a wordpress.org account for a number of years - been using WordPress for 15 years now. The other week I tried logging in to post a comment on a forum post and found my account had been disabled.

I reached out the email address they provide (forum-password-resets) and had a email chain with 4 replies and responses over the course of a couple of days. Then, crickets. So I waiting 3 weeks, then opened another email thread - crickets.

There was no solid reason for the denied access other than the genreic responses of maybe I created a duplciate account, or logged into multiple accounts etc - but I hadn't and haven't.

I do move a lot (I'm a full time RV'er) and pretty much every week I move to a new location 100+ miles from the last. I provided a documented log of places I've been in the past 4 months, and we use Starlink, Verizon and T-Mobile as connection IPs - so they are constantly changing. I have a single computer, so I'm not logged in from multiple locations either.

I provided access to our public site that documents our RV journey which shows 197 campgrounds in 39 different states in the past 927 days. Yes, we move a lot :)

Does anyone have any other ideas on how I can gain access again to the forums? I rarely post (11 posts in 5+years). The problem now however is that I need to get support from a free plugin, but they say to use the forums for support - and the forums have me blocked.

Any ideas?

I'm looking for a reliable way to migrate WordPress websites built with Flatsome UX Builder to Gutenberg, preferably using Kadence Blocks.

I have several websites built with Flatsome, and I'd like to move away from its proprietary shortcodes without having to rebuild every page manually.

I'm particularly interested in preserving the existing content, layouts, images, links, and overall design as much as possible.

Has anyone actually tried this kind of migration?

• Are there any tools, plugins, or scripts that can automate at least part of the process?
• Has anyone used AI to convert Flatsome shortcodes into Gutenberg or Kadence Blocks?
• What were the biggest challenges, and how much manual work was still required?

I'm aware of Flatsome's own migration tools, but my goal is to move away from the Flatsome ecosystem entirely.

I'd really appreciate hearing from anyone who has successfully done this, even partially. Real-world experiences and practical solutions would be especially helpful.

I am using RankMath Pro some of my websites one of my sites I was getting huge bot visit from afternoon. From my Crisp chat dashboard I see most of visit coming from Singapore then I block Singapore but after that I see coming from multiple countries.

Full email

Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC.

If an affected copy of Rank Math SEO PRO 3.0.123 was active on your website, you should treat the website as compromised. Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.

Rank Math removed the affected files and released version 3.0.124 as the clean replacement. Version 3.0.123 by itself does not prove that a website was compromised: Rank Math limits the incident to users who downloaded or updated to the affected version during the stated period.

Website owners should check when version 3.0.123 was downloaded or installed, and use Rank Math’s security notice as the authoritative source for updates about this incident.

So I think delete the previous version and install the new version.

I changed the archive page for content from wiki to articles so content went from urls went from
https://mydomain.com/wiki/article-slug to https://mydomain.com/articles/article-slug
I am trying to write a redirect to redirect all the old URLs to the new URLs I tried this but it doesn't work.
Original url - ^/wiki/. Target url - /articles/.\*

Hello Everyone!

I wonder how do you deal with the situations, when you observe inconsistencies regarding licenses in the plugins, that you are using. Do you contact the authors/teams and give them advices to correct these, or do you simply close your eyes, saying, this is good as is, nobody notices anyway.

I'd like to hear also what you usually do with other observations as well and how do you handle the mistakes you are observing.

Thanks and wishing you a great afternoon!

You’ve probably seen it: “we build super-fast websites, 100/100 in the speed test”. Yeah, all green, wow effect. But what’s really behind it? And why do people pay money for things that make their website worse?

Here are the tricks that raise Google’s speed score and still hurt real users, and what to do instead.

Delayed loading. The “delay until interaction” option most optimisation plugins and setups have: hold something back until a mouse move, a tap, a scroll, or a timer, whichever comes first. Google’s test never moves the mouse, so the thing never loads during the test, and the score goes up.

The usual target is the big hero image on mobile. In the test it simply isn’t there. On a real phone, a visitor who taps quickly sees an empty hero until they do. One who just reads sees the image pop in 5 to 10 seconds later, and Google’s real-user data then counts that late image as the page’s main content, so the number Google actually uses for ranking goes down.

What to do instead: if most of your visitors are on slow mobile connections and the image really slows the page, don’t put an image in the mobile hero at all. Everywhere else, serve it at the right size in a modern format, let it load first, and check your real-user data. If it passes, the image is fine.

Delayed scripts. GTM, for example. Same reason: no interaction, no load. But the first interaction is usually a click on your main button, and you lose that event, because the script only starts loading at that moment. And everything you held back now runs on that first tap, which is exactly what Google’s responsiveness metric (INP) measures. If you really have to delay GTM, at least never on the page where your main conversion fires. Or catch the critical buttons and events with a small custom script that pushes them to the dataLayer: GTM picks them up as soon as it loads, so nothing is lost.

Sliders, videos, dropdowns. Slider images load only when the user starts interacting. Is that reasonable every time? The user then waits for them. Same with video. So look at real behaviour: if most people use something right away, like a dropdown menu, it can’t be loaded later at the cost of user experience. For sliders, load the next slide quietly once the page has finished loading, not on click.

And here’s what it looks like in practice. One of our client sites scores 78 in Google’s speed test. At the same time, all of its ~6,400 URLs pass Core Web Vitals in Search Console: the last 3 months in the screenshot, and it’s been like this for 2 years. And it what really matter for you, Google ranking and main for your visitors.

We load every script up front. No tricks.

https://preview.redd.it/yivvprj3tfwh1.jpg?width=1021&format=pjpg&auto=webp&s=c00f41cdf9d0df274c48d7b542131b2629b32bbd

https://preview.redd.it/6vw6dzr8tfwh1.jpg?width=929&format=pjpg&auto=webp&s=a88412228e0ec36141f54c01df9cd75c29f2ac5d

Real user experience and what Google’s speed test measures can be drastically different things

I know. That's not what we've been telling everybody for years.

But a new one making the rounds is a good reminder that sometimes the problem isn't an outdated plugin.

Sometimes the attacker is holding something your site already trusts.

Here's what's being reported. Starting around October 18, attackers were sending commands through UpdraftCentral, the remote management side of UpdraftPlus, and using them to install malicious plugins on WordPress sites.

The commands were passing authentication. That's the part that got my attention.

It doesn't look like a typical "vulnerable plugin" hack. It looks like the attacker got their hands on legitimate management keys.

So you could have:

- WordPress updated

- UpdraftPlus updated

- Strong passwords

- Nothing obviously wrong

…and still have someone installing malware on your site.

:: Updating may not fix it.

Normally my first question is "Is there a patch?" Here, a patch may not cancel a key the attacker already has.

If you use UpdraftCentral, the safest move right now is to disconnect the existing connection until the vendor gives clear guidance. Your regular backups aren't affected by that.

:: Don't trust the Users screen alone.

The malware can create an account that looks like a plain Editor while quietly holding extra admin powers. If you're only hunting for a new "Administrator," you could walk right past it. [hint]

Once a site is compromised, I don't take WordPress's word for what's going on. I want to see the database and the files. The dashboard is helpful, but it isn't evidence.

:: The bigger lesson:

Our sites now connect to backup tools, management dashboards, CDNs, email services, payment systems and, more and more, AI tools. Every one of those trusted connections is another door.

And sometimes the attacker doesn't pick the lock. They steal the key.

If anything on your site has acted strangely since October 18, have someone look at it. Updating the plugin won't remove malware that's already in.

And treat any outside service that can change your site remotely like you'd treat an admin password.

While working on client websites, I kept encountering the same issue. Whenever you change a theme, add a plugin, or modify cache settings, the "field data" in Google Search Console or PageSpeed ​​Insights takes weeks to update - this is because it is based on a 28-day rolling average. For smaller websites, this data is often unavailable altogether.

That is why I created the "CartHacker Core Web Vitals Monitoring" tool.

It measures LCP, INP, and CLS metrics during every real user visit and, following Google’s methodology (where 75% of visits must meet specific thresholds), indicates within your WordPress dashboard whether your site meets the requirements. Results are available from the very first visit. A daily chart allows you to pinpoint exactly when a site’s performance began to decline; the chart also displays the TTFB (Time to First Byte) metric. The tool works on any WordPress-based site, not just online stores.

Key principles I followed while developing this solution:

• The measurement script is served from your own website and loaded in a "deferred" mode, ensuring it does not slow down page loading.
• No cookies are used; no data is stored on the user's device, no need to update your cookie banner.
• Activity from logged-in administrators, editors, and authors is excluded from the statistics, so your own clicks do not skew the results.
• For the CLS (Cumulative Layout Shift) metric, the tool identifies the element that shifted the most: for example, a cookie banner or a section displaying related products.
• The tool also tracks traffic (page views, unique users, devices, browsers) without the use of cookies.
• The source code for every file is fully readable and requires no additional build step. The measurement script is located in `assets/js/ch-monitor.js`, and the `readme` file lists all the requests it sends.

Using the tool requires a free CartHacker account, as data is stored and processed on the carthacker.com platform. The free plan includes up to 1,000 page views per day, a 7-day data history, weekly email reports (when agreed), and performance drop notifications. Paid plans offer longer data retention and higher page view limits.

You can try it for free here:
https://wordpress.org/plugins/carthacker-core-web-vitals-monitoring/

I would appreciate any feedback - especially if you notice discrepancies between the results provided by my tool and those you see in PageSpeed ​​Insights or Google Search Console.

I run a WordPress site that uses UpdraftPlus. On 19 Oct I found an unknown plugin had been uploaded and a hidden admin user was attempted on my site. I traced it, reported it to Team Updraft, and they confirmed to me (via support ticket) that their own site was breached on 18 Oct and they believe UpdraftCentral connection keys were compromised too. As far as I can tell this isn’t publicly announced yet, so I’m posting because anyone using UpdraftCentral should act today.

What matters most: this is not a plugin vulnerability you can fix by updating. My site was running a fully patched UpdraftPlus (well past the CVE-2026-10795 fix). The attacker didn’t bypass the patch — they used a genuine, stolen UpdraftCentral key to send a signed command to my site. Updating the plugin alone does not protect you. You have to remove the connection key.

What happened on my site (timeline, UTC):

• The attacker sent one command via the UpdraftCentral RPC channel: plugin.upload_plugin.
• It dropped a fake plugin (“Feed Stack 90E”, author “CommonGantry”) — a backdoor that, when visited with a secret URL parameter, creates a hidden admin user, logs the attacker in, and redirects to wp-admin.
• In my case it failed by pure luck: the attacker’s own code had a bug (referenced class constants that were actually defined globally), so it fatal-errored before creating the user. Had their code been correct, it would have worked on a fully hardened, patched site. Don’t count on being this lucky.
• The only trace left was a DB option feed_stack_90e_sync_token, written by the plugin’s activation hook.

What Updraft told me (paraphrased from their ticket): they detected unauthorised access to teamupdraft.com on 18 Oct, closed the route, signed everyone out, and reset affected keys. They believe their customer database was accessed (names, emails, order history; passwords are hashed, no payment data stored). They’re asking every UpdraftCentral customer to disconnect and check each connected site now, even if it looks fine.

What YOU should do right now (from their guidance + my experience):

1. Log into each site’s own WordPress dashboard (not through UpdraftCentral).
2. Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → delete the connection key.
3. Check Users and Plugins for anything you don’t recognise and remove it. Important: a competent backdoor hides the admin user from the Users screen — so also check directly in the database if you can: SELECT u.ID,u.user_login,u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id=u.ID WHERE m.meta_key='wp_capabilities' AND m.meta_value LIKE '%administrator%'; Compare that to what wp-admin shows. Also check for the option feed_stack_90e_sync_token or any plugin/user you didn’t create.
4. Change your WordPress admin passwords.
5. Update UpdraftPlus to the latest version.
6. Change your teamupdraft.com password — type the address manually, don’t click email links — and change it anywhere else you reused it. Reset 2FA there if you use it.
7. If you use UpdraftVault, they’ve disconnected it as a precaution; reconnect to resume backups.

IOCs from my case, so you can grep your logs/DB:

• Dropped plugin slug: feed-stack-90e / name “Feed Stack 90E” / author “CommonGantry”
• Attempted hidden user: media.team14 (editor + manage_options + install_plugins)
• Backdoor trigger GET param: _0dff5c
• DB option written: feed_stack_90e_sync_token
• UpdraftCentral RPC command used: plugin.upload_plugin

The attack came in over the normal UpdraftCentral channel, so your login protection (2FA, Cloudflare Access, etc.) does not stop it — it isn’t a login. The only thing that closes it is removing the key.

I’m posting this because many people might be affected, just like I was. Our website was compromised, but thankfully – no damage was done due to hacker's own incompetence.

Full source of the dropped plugin (credentials redacted): https://paste.ofcode.org/WhBgBZtkHjDYQiQmNkTpMb

Update: Thanks everyone! Site is back up and updated, free from the malware and outdated plugins. Appreciate all of the help while I spiraled last night! 🙏🏼 Leaving it up in case the comments help others.

I was looking up a specific blog on my site and when I clicked on the specific blog links it redirects to a shady looking shopping site. So I went to my main website link and received this critical error message. Currently having a panic attack, messaged my webmaster but she’s probably asleep. Will my site be ok and able to be restored? Is it hacked?

Note: Similar to CVE-2026-10795, but I was on 1.26.8, I did not restore a backup or take any action for this to occur, to my knowledge.

TEAM UPDRAFT CONFIRM BREACH TO UPDRAFT-CENTRAL:
Looks like I was lucky to spot it as it happened, killed it, then posted here. Hopefully some of you caught it.

"On October 18, we identified unauthorized access to TeamUpdraft, which we believe may have exposed UpdraftCentral connection keys. Our team has since closed the access route.

Based on our development team’s recommendations, please take the following precautions:

1. Remove the malicious plugin and check for any unfamiliar WordPress users.
2. Delete your existing UpdraftCentral connection keys under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → Manage existing keys.
3. Change your WordPress administrator and TeamUpdraft account passwords.
4. Update UpdraftPlus to the latest version, then reconnect to UpdraftCentral using a new c"

-----------

My original post:

This morning my site started throwing fatal errors on every page. The cause was a plugin I never installed, called “Image Core” (folder wp-content/plugins/image-core/, author “StoneDock Tools”, version “3.1.1”, described as a “small maintenance toolkit”).

What the plugin does: it hooks init. If a request has ?_6212fc=_BEQI71sdL1mVAkslzjLMnG8ffyJfBwi, it creates a user called render_maint13 (email [render_[email protected]](mailto:[email protected]), display name “Site Tools”). That user gets the Editor role plus the manage_options and install_plugins capabilities. It then logs the visitor in as that user and redirects to wp-admin.

On my site it never got that far. The attacker referenced self::FIELD but had defined the values as global constants, so it died with Undefined constant ImageCore::FIELD before it could create the user. A working version would have been silent.

How it got in: the access logs show no wp-admin login, no plugin upload and no file editor use. Instead there were two POSTs to / with this user agent:

class-udrpc.php is UpdraftPlus’s remote-control library (UpdraftCentral).

Source IP for both: 2a09:bac5:4e21:2e3c::49b:9 (a Cloudflare WARP address, so not the attacker’s real IP).

UpdraftPlus was 1.26.8. An UpdraftCentral key had been created on my site, maybe that leaked somehow, or could be a bug.

Check your site:

Search your access logs for class-udrpc.php in the user agent, or _6212fc in URLs.

Look for wp-content/plugins/image-core/ and a user called render_maint13.

If you run UpdraftPlus: go to Settings → UpdraftPlus → UpdraftCentral, delete any keys you don’t use, and update. Or remove it. Reset your UpdraftPlus login password.

If you were hit: delete the plugin and the user, then rotate your passwords, salts, Application Passwords and API keys.

I got an email this evening that a site I managed had crashed. I logged in using recovery mode and found the offender was a plug-in called Content Module 987 published by QuietPress Labs. A quick search online returned no such publisher or any such plug-in.

I quickly disabled the plug-in and my site started working again. I examined the plug-in. I didn't seem to do much that I could tell looking at the code. I fear the site has been hacked. Anybody heard of something like this before??

Hey everyone,

I'm looking to gather some feedback from fellow WordPress users and email marketers who are currently using or have recently used Mailster.

A bit of context: I bought a lifetime license back when it was sold as a one-time purchase on CodeCanyon (formerly MyMail). Back then, it was a solid, reliable plugin for self-hosted email campaigns.

However, over time I’ve noticed a few changes and concerning trends, and I'd like to see if others are experiencing the same:

1. Abandonment on ThemeForest / Marketplace: A lot of third-party email templates sold on ThemeForest/Envato specifically for Mailster seem abandoned. Authors barely reply to support tickets or pre-sale queries anymore.
2. Shift to Annual Subscription Model: The plugin moved away from CodeCanyon / lifetime updates to its own website with an annual subscription pricing structure for support/updates.
3. Database Bloat & Performance Issues: On larger lists or active setups, the wp_mailster_* database tables tend to bloat significantly with logs, tracking data, and queue records, which can heavily impact site performance if not cleaned manually on a regular basis.
4. Support & Maintenance: General response times and overall maintenance quality seem to have shifted after transitions in ownership/pricing models.

For those still running Mailster:

• How is it holding up on your current WordPress sites?
• Have you noticed severe database bloat or server overhead?
• Have you sticked with Mailster or migrated to options like FluentCRM, MailPoet, or external SaaS (ActiveCampaign, Brevo, etc.)?

Would love to hear your honest thoughts and recent experiences. Thanks!

I run s small VPS for around 10 WP installs. I have DirectAdmin with JetBackup running.

has anyone ever use Backuply? What was your experience, and how was the restore process?

thanks.

I have been working on my WordPress website for about a month now. I want to start selling stickers and other little goods. It was between this and Shopify, but Shopify was expensive and with WordPress it was cheaper and you would pretty much own the site.

I knew it would be a bit harder but I didn't realize how much there is with building on WordPress. I have my plug-ins for the shop, designed it, optimized my website speed, made sure I have security like CloudFlare. I keep running into more things that make me second guess myself. I made myself a maintenance checklist for it.

But I don't see a lot of people with art shops that are on WordPress, so I had to really research and find what I needed. What I'm concerned about is safety, I heard if you don't upkeep the site or make a mistake it can get hacked, and I wouldn't want that for my customers.

How can I be absolutely sure that the website will be safe and continue to be safe? (Also when I am editing and viewing my site it is pretty slow, when i check the Google speed it is at 100 and 90. Is that normal?)

I'm currently at the leadership level at a digital marketing agency. I've been here around 8 years. I have always been at digital marketing agencies my entire career. I actually love agencies. I'm one of the crazy ones. I run all things technical at this agency. I'm wondering what skills I should focus on and learn to stay valuable.

Throughout my stay at this company, I've managed a few full timers, and a few freelancers. Right now though, it's just me. Actually, the majority of my time at this company, it has just been me.

From a pure programming standpoint, it's marketing websites. Mostly custom WordPress websites with various degrees of complexity. We use as little plugins as humanly possible. This could mean anything from a 4 page brochure website to a large multi-site with a custom single-sign on member portal using a 3rd party API no one has ever heard of, all hand-coded by me. Tons of bespoke solutions to unique problems over the years. Tons of APIs, platforms, etc.

I also run the hosting side of the business. What this means is managing our reseller account, administering clients, choosing what packages we offer, how much they cost, managing our client backup strategy, managing monitoring and outages (I am the one getting out of bed at midnight when my phone lights up), launching new websites, etc. etc.

I've also created our devops strategy and implementation. Not especially complex for a marketing agency, but it's there. Every client in git, deploys to a staging server, deploys to a prod environment, etc. Normal stuff. In the past I have managed our full timers and freelancers access to this system. In rare cases a client dev also needs access and I will manage that as well.

Along with all of this, there is also lots of technical marketing tasks that I help with. I help create and debug Google Analytics triggers, campaign attribution, things like "why are there 5 form entries with UTM strings but Facebook only says 3 conversions", technical SEO cleanups, etc. Over the years I have integrated with lots of CRMs and marketing platforms. Hubspot, Salesforce, Pardot, Slate, Mailchimp, etc. Setting up marketing emails, setting up editable templates in those platforms, setting up forms that will embed on the site, setting up the site to pass hidden data into these forms, API calls that trigger CRM emails based on an action taken on the website, etc. Lots of client needs over the years.

Lastly, I am very client-facing. I am in most client meetings. There are lots of meetings that I set up and run myself, being the lone rep from my company in the meeting. I train all the clients on their systems. In lots of cases I am the one they email and interface with for a request.

With AI, I honestly don't know how valuable any of this stuff is that I do, lol. I've been using AI daily, and I'm not an idiot. I can clearly see a world where AI does everything I have mentioned above. Right now my strategy is to try and become an AI expert, and try to figure out new ways to use AI to benefit our customers. At the core of who I am, the reason I have stayed with agencies forever, is because I love helping a wide array of people. Always new people, always new problems. I like being their technical resource.

What would you guys do? I don't even know if agencies will exist in 5 years. What skills should I learn? What jobs should I be aiming for?

Hey everyone,

I've been working on a WordPress plugin recently because I kept running into the same problem over and over.

**I'm the developer of this plugin and I'm mainly looking for feedback from the WordPress community.**

A user reports a bug, and the entire report is basically:

"It doesn't work."

Now I have to figure out what page they were on, what they clicked, what they expected to happen, and how to reproduce it.

So I started wondering if it would be easier to just let people explain the problem out loud while they're using the site.

That idea turned into a plugin called Nik Voice Ticketing AI.

Instead of filling out a support form, visitors can record a short voice message and click through the page while explaining what's wrong. The plugin records their voice along with a timeline of clicks and page interactions. It can also use AI to turn everything into a cleaner support ticket.

It's completely open source and free.

WordPress:

https://wordpress.org/plugins/nik-voice-ticketing-ai/

GitHub:

https://github.com/Nik-Neural-AI-Inc/nik-voice-ticketing-ai

I'm genuinely curious what WordPress site owners and developers think.

Would love honest feedback, even if your reaction is "I'd never install this."