Hi y'all. I'm looking for advice as I transition from Webflow to WordPress (please challenge any of my thinking if you disagree with any of my below decisions). I have a background as a front-end designer/developer. My PHP knowledge is…nonexistent (thank goodness for Claude Code), but otherwise I'm fairly savvy and know just enough to be dangerous.

My plan is to use Bricks as the builder and I've figured out my monthly hosting. I think the biggest concern I have is managing updates/security — Webflow was all-in-one and WordPress is 100% not. We're going to have about 10 sites hosted simultaneously to start with, and probably 15 in the next 6 months, all with the same basic bones (all are for local small businesses with one woo commerce site):

1. ACF
2. Bricks for visual builder and forms
3. Complianz for GDPR

Here are my three questions:

1. What other plugins/workflows do I need to consider?
2. At the scale I'm working in (10 sites), is it worth doing something like WPUmbrella or ManageWP (or your best recommendation)? It seems like a lot of this is covered in my unlimited hosting plan, but I think that that requires me to still do many things one-site-at-a-time, whereas these tools enable me to 1-click across a whole fleet of sites that have the same basic functionality?
3. Is Google Site Kit worth it for easy client visibility, or should I simply manage that stuff through Google dashboards?

FYI, I have managed WordPress sites for my day job, so I'm familiar with the process and needs. But this is for my husband's company, and I only really have capacity to meaningfully update sites once a month with spot-checking/testing since it's effectively a side hustle.

Hey all. WP WAF Manager is my plugin for managing Cloudflare from inside WordPress. Until now it covered WAF rules, DNS, zone analytics, zone controls, IP access rules, security events and email routing.

Version 1.0.24.1 is out and it's the biggest update so far. It's grown from 8 modules to 14, and I rebuilt the website to show it all and the github link is: https://github.com/jaimealnassim/wpwafmanager

What's new

- Clients & Reports: link clients to their sites and email them a monthly report under your own agency name, logo and colors. It covers visitors, page views, threats stopped, cache speed, top pages and what Cloudflare blocked, in plain language. The plugin is never mentioned. You can send automatically on a chosen day and hour, or send by hand after a preview and a test.

- Zone analytics detail view: click any site for traffic charts, top pages, countries, status codes, devices and security events by action, path, IP and country, compared with the previous period. Table view and CSV export.

- Bot Control: set AI crawler policy (search, assistants, training), managed robots.txt and Bot Fight Mode across many zones at once.

- SSL & Insights: scan every zone for expiring certificates, Flexible SSL and old TLS versions, with one-click fixes for the safe settings, plus Cloudflare Security Insights.

- Alerts & Health: Cloudflare alerts for DDoS, SSL and origin health, sent by email, Slack or Teams, plus Health Checks on Pro zones.

- Turnstile: create widgets, rotate secrets and copy keys for every client site. Secrets are never stored.

- Page Rules migration: Cloudflare is retiring Page Rules. The plugin finds them on every zone and moves redirects and cache rules to their replacements in one click. Nothing is deleted.

- Zones and tags: tag sites as WooCommerce, Staging, Client and more, and pick them by tag when you deploy.

- Zone Controls upgrades: purge by hostname, prefix or cache tag, Smart Tiered Cache, security headers, and Under Attack Mode on every site in one click.

Still the same: everything is in the free version (GPLv2 on GitHub), it works on Cloudflare Free for nearly everything, and nothing loads on the front end. Pro is a one-time purchase that adds automatic updates and priority support.

A few notes:

- Security Events, Health Checks and Super Bot Fight Mode need a Cloudflare Pro zone. Blocking a whole country needs Enterprise.

- Deploying the WAF rules replaces the custom rules already on that zone, so check the Zone Rules tab first if you have your own.

GitHub: https://github.com/jaimealnassim/wpwafmanager

I've been building WordPress sites from Figma designs using Claude Code, and while the initial implementation has gotten much faster, getting everything production-ready still takes a surprising amount of time.

For those using AI in real client projects, what part of the process still takes the most time or manual effort? Maybe you have a repo to share?

UpdraftPlus paid, premium version used to back up my sites within 3-5 minutes at the most to Google Drive AND Updraft Vault. Now it just runs and runs indefinitely and never completes unless I stop it, turn off or disable the UpdraftPlus feature and just use it as I did with the free version and only backup to Google Drive. If I only backup to Google Drive, it's done in 33-4 minutes again without stopping or slowing down.

When will it work as normal again? I'm wondering how long it should take them to recover after the hack. It just has not worked the same since the hack and I'm trying to get an idea on when it might be able to run backups again without it taking hours to run or timing out.

Hey everyone,

I recently released Veridis Fraud Guard for WooCommerce, a free, open-source plugin built around a fairly specific problem: repeat customers who place problematic orders, particularly Cash on Delivery orders that end up uncollected.

Instead of relying on automated fraud scoring or third-party services, it lets store owners maintain their own blocklist using email addresses, phone numbers, IP addresses, or email domains.

Depending on the selected mode, a matching checkout can be blocked, flagged with a private warning, or, for COD orders, placed on hold for review.

It supports both Classic Checkout and Checkout Blocks, HPOS, and runs locally on the WordPress server. No subscription or external account is required.

It's not an AI fraud detector, and it won't automatically identify first-time fraudsters. It's intended to give merchants more control over recurring problems they've already identified.

The plugin is available on WordPress.org:

https://wordpress.org/plugins/veridis-fraud-guard/

I'd particularly appreciate feedback from people who manage WooCommerce stores:

How do you currently handle customers who repeatedly place orders and never collect their parcels?

I'm interested in both the technical feedback and whether this approach is actually useful in real-world store operations.

It is time to have a serious discussion about the creaking infrastructure that underlies Wordpress which allows:

• Invisible Users
• Invisible Admin Users
• Invisible Posts
• Invisible Pages
• Invisible Plugins
• Conditional Content with no way to view or search it
• XML-RPC activity by default, with no log, and cannot be disabled without editing a config file
• Loose .htaccess files in subdirectories of /wp-content/.

As a consequence of Wordpress being a swiss army knife that allows the software to be used for Forums, Shopping Carts, and all manner of non-bloggy things, the security situation has gotten completely out of control and it doesn't seem like Wordpress is giving us any tools to fight.

At the very least, Wordpress needs:

• Content Inspector that gives a bird's eye view of content that does not appear under Pages or Posts. Yes I understand people use Wordpress for Forums and Shopping Carts, etc. but there should still be a warts-and-all Content Inspector that lets you at least see and search for content in the database that might be malicious. There should be a judicious warning that deleting unrecognized content could break or cause data loss to third-party plugins.
• Plugin Inspector which gives a bird's eye view of what's going on in /wp-content/plugins/. This would be a sort of File Manager type UI which flags directories and files which might not appear in the Plugins manager. It would display AND flag directories which aren't appearing in Plugins and flag dot (.) files as these shouldn't exist except for one .htaccess in the main dir. Plus git directories of course.
  • It should also be possible to view Multiuser (MU) Plugins and active plugin files from within the Plugin Inspector. None of this shows in subsites.
  • It should flag PHP files in /wp-content/uploads/. Hell, there should be a red banner across your site if a PHP file is found anywhere in /wp-content/uploads/.
• Users Manager Upgrades. There should be a mechanism to display and manage ALL the Users on a Wordpress site. Right now it is trivial to create a phantom/hidden user with Admin access which does not appear in the Users Manager.
• XML-RPC Manager. First, Wordpress should ship with XML-RPC turned off by default. Then, this new UI would allow turning it on and off within the UI, allow setting restrictions to specific whitelisted IP addresses, and finally display a log of recent requests.
• Add Plugin Install/Update Queue. It should not be possible for an AJAX session alone to install or reinstall a plugin without any user intervention. All plugins should be required to be added to an install queue which has visibility in the Wordpress UI. Right now, plugin updates/installs happen behind the scenes with no visibility so you can clean up a site and be immediately reinfected. It needs to be possible to view as well as pause or stop the Plugin Install Queue.
• Add a "Close All Admin Sessions" button which kicks every Admin out and requires them to relogin.

If you're wondering why all these suggestions are necessary, read this link:

https://www.reddit.com/r/Wordpress/s/LhMnsJzBnW

It is now a relatively commonplace thing for a vulnerable plugin to install phantom plugins, create phantom users and grant them admin access, and then add phantom posts and pages which get indexed by Google and drive traffic all without ANY visibility within the Wordpress Admin UI. It's all completely invisible.

P.S. I wrote this myself. F--- AI.

I am very beginner at wordpress. On my own i built a website on elementor pro. The website is ready, and everything works fine, but I need help with two things.

1. Mobile and tablet design

My website looks okay on desktop, but I want it to look good on mobile phones and tablets too. Is there an AI agent that can automatically fix the layout for different screen sizes?

2. Website speed

My website speed score is around 65, and I want to improve it to 90+. Is there an AI tool or agent that can help me do this?

Has anyone tried an AI tool that actually works for these tasks? I'd really appreciate your recommendations and experience.

Note: I am student, i was able to afford only domain and hosting, i can't afford to pay for both above task ( i have like $10 in my pocket ).....

Edit: This is the website i am talking about https://ikhlax.com/

if you have an opinion on current design, any changes i would love to get your feedback. its first website that i built....

Hi, all. I need to build a WordPress site with a form where users can drag options from a list into a field. However, when I search for how to do this, all the results show drag-and-drop builders for forms (i.e., the drag-and-drop is on the backend). Is this a thing that exists, and if so, what would be a better set of search terms for me to use?

Thank you.

Since 7.1 ACF fields are now in a pop over from the tight in the admin panel. My users are complaining - is there a way to get the 7.0 behavior of inlining the fields?

Can this be done per user? ( something tells me other users will complain when I switch it back)

If it matters my ACF mode key in the block.json file is set to “edit”

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

The site good for about 2-3 years then suddenly the site slows to a crawl and the hosts say the website needs optimization or I need a bigger hosting account.

1 The site is Wordpress. It is updated.

2 Old and no longer supported plugins are deleted and replaced when needed. Sometimes Wordpress gives us built in abilities that plugins used to do and we no longer need them so we delete them.

3 Our traffic remains steady according to Jetpack.

4 We have about 3000 word based articles with two images each which are optimized to be small. None of that has suddenly changed.

5 When we move our website to another host then it is fixed for about 2-3 years.

So why, Reddit folks, is this a continuous cycle?

Does something build up that needs to be purged?
Is this a Wordpress issue in general?
Is there something I can check on Wordpress or set or test that could provide an answer?

Edit: Thanks everyone for the answers and ideas. I have some solid plans forward now. Appreciate it.

Also want to say that social media is often unhelpful and aggressive so I was happily surprised by the amount of genuine help. I have heard that the Wordpress community is a good one and am happy to have personally experienced it.

Big high fives to you all. May your weekend be filled with joy.

WordPress DB_PASSWORD usually sits plaintext together with DB_HOST and DB_USER in wp-config.php in the root directory of your WP.

Usually, it's not a problem, the .php files are executed so nobody should be able to read them.

But what if a plugin backs them up and stores it in a .zip? And this .zip is somewhere accessible?

Hi all, I am rebuilding my WP site. I have created a new design with Ai html but I need to do this on a WP theme. Wondering if AI can connect to my WP site and customize the theme by vibe coding?

Earlier this week, a critical security flaw in PHP was published. PHP runs a huge share of websites, including every WordPress site, and this flaw lets attackers take over the server. If your site runs PHP, it needs an update.

I noticed that most people don't know whether their site uses PHP, so I built doiusephp.com for them. Type in your website and within seconds it tells you:

• Whether your site runs PHP, and through what technology (e.g. WordPress or WooCommerce)
• Which PHP version your site uses and whether that version is already fixed (if your site shows it)
• What to do next, depending on who is responsible for your site

It also writes a short, personalized message you can copy and send to your web developer or host, so you don't need to dive into the technical details yourself.

The tool is free, needs no sign-up, and doesn't save anything about you or your website.

Hope this helps!

Some interesting findings here as to whether AI agents choose WordPress or not and whether AI agents do the work.

https://wpab.view.fast/

WordPress.org has almost everything a mature platform needs, except a built-in marketplace for paid plugins. Instead, we have the free plugin directory, while premium plugins are sold independently across hundreds of different websites.

As a plugin developer, I sometimes feel WordPress is missing an opportunity here. The current model makes the premium ecosystem quite fragmented, with different stores, licenses, subscriptions, update systems, refund policies, and levels of trust.

A proper WordPress marketplace could potentially make discovering and buying premium plugins easier for users while giving developers a more reliable distribution channel.

Of course, centralising this also comes with downsides: platform fees, stricter rules, gatekeeping, and giving WordPress.org/Automattic more influence over the ecosystem.

Curious what others think. Would an official marketplace for premium WordPress plugins make the ecosystem better, or is the decentralised nature of WordPress actually one of its strengths?

EDIT:
Thanks for the downvotes; I get the concerns, but this is what I had in mind when I wrote the post.

Selling movie tickets or DVDs worked well, especially for established movies. But smaller or experimental films had a much harder discovery problem. Platforms like Netflix reduced some of that friction, so consumers could discover and try something unfamiliar with less perceived risk, while creators had another way to become discoverable.

Obviously there are pros and cons to centralization, and I'm not suggesting WordPress should copy Netflix or Apple's model.

My point is simpler: if there were a platform that reduced the risk and friction of purchasing premium plugins, while also helping smaller/new developers get discovered and build trust, I think there could be value for both sides.

The question is whether that can exist without taking away the independence that makes the WordPress ecosystem valuable in the first place.

Patching PHP fixes PHP2Shell (CVE-2026-109618 / 109619), but it does nothing about a backdoor someone planted before the patch. Amazon's honeypots caught an exploitation attempt on Oct 17, four days before disclosure, and Amazon's advice is to investigate from at least that date.

So I used Claude Code to spin up a bash script to triage WordPress sites. It checks:

* PHP CLI version vs. the fixed releases

* Core and plugin checksums (via WP-CLI)

* PHP files in uploads

* Files modified since Oct 17 (adjustable)

* auto_prepend_file hooks in .user.ini / .htaccess / php.ini

* mu-plugins

* Common web-shell patterns in wp-content

* Admin accounts and any users created in the window

* Injected scripts in options and posts

* WP-Cron, the site user's crontab, and SSH authorized_keys

It's read-only and never modifies or deletes anything. It runs WP-CLI with --skip-plugins --skip-themes so a backdoored plugin can't execute during the check. It works on one site, every site on a server, or a list of remote servers over SSH, and it writes a Markdown report per site plus a summary.

Repo (MIT): https://github.com/brentmartinmiller/php2shell-check

Caveats: a clean report lowers the odds of compromise but doesn't prove a site is clean. It doesn't parse web server logs, so pull those separately before rotation eats the Oct 17+ window. A few false positives are expected, like Wordfence's prepend file, header-script plugins, and obfuscated premium plugins. The README covers how to read them.

I'd appreciate feedback, especially false positives you hit, indicators I'm missing, or quirks on shared hosts. Issues and PRs welcome.

does anyone else who has sites hosted on GoDaddy notice that they only patched to 8.3.35, not 8.3.36? trying to get more information before I contact their support team. I have no control over where these certain few sites are hosted (I work at an agency, we do have a few stragglers left on GD)

So I've read through like 4 million threads on here re: the best options for image compression on Worpress. Very long story short, I help run a music website and the vast majority of our contributors are concert photographers. We've taken to having people use their own personal IG pages and using the IG plugin for bulk photos and it's fine, but we still obviously need a few pictures per post that live on the site. I use Smush for now and it's fine but I feel like I need a way to batch-edit a large volume of .jpg images into something that'll take up a lot less space before the site caves in on itself. Again. I know there are probably 4 million directions people will point me in, but if there's a consensus of top 3/4 options that'll be easier to pare down.

Gracias, comrades.

I have had this idea for a while: a simple tool to query a copy of the WordPress database in DuckDB WASM, and then you can apply the row changes you preview. SQL runs in the browser.