Anyone used this to change links across their site? If so, how was your experience? Anything to be aware of?

I have a WordPress catalogue website where I only display product images and catalogues

A few days ago, I received an email saying my WordPress password had been changed, even though I hadn’t changed it.

I immediately changed all my passwords and updated WordPress, PHP (8.3.6), plugins, my paid WoodMart theme. My WordPress version is 7.1.3.

However, someone keeps publishing spam blog posts on my website every day. I delete them, but they reappear.

What’s the best way to fix this permanently? Could it be a backdoor or malware?

Could this security issue affect my business email deliverability or put my emails at risk? Or someone may try to contact my customers through it ( this is a serious concern )

I’d appreciate advice from anyone who has dealt with a similar issue.

Les résultats proviennent d'un seul VPS (le mien). Les ASN désignent les réseaux d'origine. Ils ne désignent absolument PAS les responsables qui se cachent derrière ces attaques.

L'audit porte sur les événements (rejets) de mon pare feu UFW du 18 au 25/10/2026. J'ai aussi ajouté/fusionné toutes les IPs bannies par mes différentes protections cette année (plus de 18 000 IPs au total).

Just wanted to share this interesting case I recently investigated. It started with an AWS suspicious activity alert and ended with around $8k in unexpected Bedrock charges..

Digging through CloudTrail, found thousands of Bedrock API requests using a compromised root access key. Someone had been using it to run Claude models through streaming responses.

Then I noticed the same key showing up in S3 backup requests from UpdraftPlus. Went ahead ahead to check the client's WordPress sites hosted on the same EC2 server, and yes! They were using the same key in UpdraftPlus across multiple websites and backup buckets.

The CloudTrail logs showed UpdraftPlus requests with different version numbers in the user-agent field, including the outdated version 1.24.3. Checked further and found an old WordPress multisite installation still running that version. There are known vulnerabilities in older versions, including one that could expose stored backup credentials under certain post-migration conditions. But we haven't found any solid evidence that this was how the key leaked.

Another interesting thing, besides the careless use of a root access key for S3 backups, was that the stored AWS secret key could be revealed right from the UpdraftPlus settings page using the browser's "Reveal Password" option. Of course, someone would need access to that admin page first.

I also found an old WordPress support forum post where someone raised the same concern, and an UpdraftPlus developer defended the approach, arguing that the credentials could be retrieved from the database anyway.

We still don't know exactly how the attacker got hold of the key. CloudTrail showed the key was first tested on August 23 using TruffleHog, a credential-scanning tool. Then came the actual Bedrock abuse around October 18–19, racking up an $8k bill.

Someone tried to save some time by using the same access key for all sites backup configuration - no fixed permission..

And maybe a little more careful credential handling on the plugin side wouldn't hurt either. But that's another debate.

Got a frantic call from a client last week. His customers were texting him screenshots of that red "this site is unsafe" page in Safari, and in Chrome the site just wouldn't load at all. Google had put the domain on its Dangerous list. It's a WooCommerce store, so basically nobody could get to it. No homepage, no checkout, nothing.

First thing I did was log in and look around, and honestly that's what made it confusing. Everything looked totally fine. Loaded the site on my desktop, poked around wp-admin, no redirects, no weird pages, nothing obviously wrong. But that's kind of the whole point with this stuff now. It's built so the owner never notices. You see a normal site, your customers and Google see something else.

The client was pretty sure he knew how it happened. He'd had a falling out with a developer he used to work with, a guy overseas, and from the way he described him he wasn't the type to care what he left behind on his way out. I try not to assume motive, but it lined up with what I ended up finding, so I kept it in the back of my head.

I used Claude Code to help me go through the server instead of grepping everything by hand. There were something like seven WordPress installs on the account (leftovers from old migrations), so I had it sweep all of them at once, searching the actual file contents for known bad patterns instead of going off file dates. That last part turned out to matter, I'll get to it.

Three things turned up.

First was a couple of fake plugins dressed up as cache/performance tools. One had its folder renamed with a .off on the end so it looked switched off, but it was still active. And it had code in it that hid it from the Plugins page, so even staring right at the admin you'd never see it was there. There was also an open AJAX endpoint acting as a backdoor.

The second one was sneaky, kind of impressive honestly. The theme's JavaScript files had malware tacked onto the end of them. Normal legit library file, and then way down at the bottom this chunk of obfuscated junk. It built a URL out of base64 pieces and fired a synchronous request at a server that was already offline, and because it was synchronous and nothing ever answered, the whole page would just hang. That was the "site keeps freezing" complaint.

And the reason it was a pain to find: whoever did it had reset the timestamps on the files. So if you go looking for recently modified files, which is the first thing most of us check, you get nothing back. They all looked like they'd been sitting untouched for months. Searching by content was the only thing that caught it.

Third was a rogue admin account. Random username, some email, sitting right there next to the owner's. That was the one that made the whole former-developer thing feel a lot more believable.

Cleanup took a while but wasn't crazy. Backed everything up first so I had a copy and a way to roll back. Then I went through the theme files and cut out the injected part at the point where it started, left the real library alone, and checked the file sizes against clean copies to be sure. Pulled the fake plugins and took them out of the active list. Deleted the rogue admin. Patched the hole they came in through, updated everything from clean sources, and changed all the passwords and the salts.

Site's on Cloudflare, so once the server itself was clean I flushed the Cloudflare cache and the live site started serving clean again.

The part I'd really stress to anyone going through this: getting the files clean is only half of it. To actually get off Google's list you have to go into Search Console, into the Security Issues section, and request a review once you're confident it's clean. And write up what you actually did, what the infection was, where it was, the admin account you pulled, the entry point you closed, all of it. I've seen vague "please re-check my site" requests sit forever or get bounced. Give them a clear rundown and let the site genuinely check out, and they'll re-scan and drop the warning.

By the next day the warning was gone, Chrome opened it fine, and Safari's red screen was cleared. About 24 hours start to finish.

The thing that stays with me is how much of it was set up so the owner would never see any of it. The hidden plugin, the code only Google sees. A compromised site can be quietly injecting spam links, bouncing mobile visitors off to junk sites, spinning up pages under your domain you don't even know exist, grabbing what people type into the checkout, and you'd have no idea from just loading it yourself.

Couple things I took from it. Don't trust file timestamps, if someone resets them your "recently changed" scan is useless, go by content instead. And don't skip the Search Console review, clean files alone don't lift the warning, the documented review request is what does it.

Somewhere in the middle of all this I ended up building a Claude Code agent that runs this whole scan for you. It goes through every install on the account, searches by file content instead of dates, flags the hidden plugins and the theme-JS injections and any rogue admins, and checks what the live site is actually serving to visitors. If anyone wants a copy I'm happy to send it over, no charge, and glad to answer questions about running a scan like this on your own site.

I'm the developer of Codeep Voice for Posts. It turns an English article already on your WordPress site into an MP3 in the Media Library, then adds a play and download button to the post.

The recording is generated on your computer, inside the WordPress admin. Readers play the saved file from your site. Readers can listen on phones too.

It's free and open source, with no account, API key or word quota. You can download the MP3 and use it elsewhere too.

A few practical limits: the voices read English, recording is best on a desktop or laptop, and the first run downloads the voice files. Keep the admin tab open while it records. Speed depends on your computer, especially for longer articles.

Plugin and source: https://wordpress.org/plugins/codeep-voice-for-posts/

If you run an English WordPress blog, try it on one short post you know well. I'd like to hear whether you got a usable MP3 and which part of the setup was confusing.

I'm curious what problems WordPress users are struggling with these days.

Whether you're managing one website or several, there always seems to be something that takes more time than it should.

It could be plugin conflicts, WooCommerce issues, SEO, slow performance, backups, website maintenance, or something completely different.

What's one problem you've been trying to solve but haven't found a good solution for?

Share it in the comments. I'll do my best to help where I can, and maybe others in the community have solutions too.

Let's see what we can figure out together!

Hello,

I've had some experience creating and managing wordpress websites for awhile some time back.

I have an app idea that I would like to 'prototype' and ideate from.

I figured that since I don't need full functionality, and wordpress nowadays is mobile friendly, I could probably create a proof of concept kinda thing with it, focusing on UI and user flow.

So, I'm wondering if there are any themes you'd use, preferably free of course, or is gutenberg quite powerful enough for it to work?

Like, menus. Web tends to have top menus. I'd like a bottom based menu. Is that possible? I don't remember that ever being an option in the past. Or maybe it was but I never really explored that area

Hi everyone!

I'm working on my first videography portfolio website for a client, and they shared this website as a reference:

https://www.zakmulligan.com/

I really like its cinematic design, minimal navigation, video presentation, project selection layout, and overall user experience. I want to clone the website as closely as possible using WordPress, Elementor Free, and custom code, without purchasing a premium theme or Elementor Pro.

I'm currently working with LocalWP on Ubuntu and am comfortable following technical instructions, including HTML, CSS, JavaScript, and PHP if needed.

Is there a free way to clone the complete website in WordPress while keeping it editable in Elementor?

Are there any free tools or workflows that could save me time?

I'm looking to learn the right approach rather than simply import a static HTML page that I can't edit properly.

Any guidance, tutorials, or examples of similar projects would be greatly appreciated. Thanks!

I’m looking for someone who can assist me with WooCommerce and WordPress. I need help fixing a font-size issue with my KOT (Kitchen Order Ticket) receipts.

The issue: The KOT print sample displays the correct font size and style, but when I print the actual receipt, the font is much smaller than it appears in the sample.

I’ve already tried increasing the font size in the settings, saving the changes, but the issue persists. The actual printed receipt still has very small text.

If you have experience with WooCommerce POS and can identify and fix this issue, please DM me.

Thank You.

I know in the age of AI & Short video content,
Blogs are no longer irrelevant but after deleting Instagram, my dopamine got stabilised and im enjoying my old hobbies again. I like writing and wish to restart blogging. I have articles written and saved as draft. What are the tips I should be aware of in 2026?

Its a gaming blog with my own domain. I dont plan to be a full time writer and exoect millions of views and alot of money. I just wanna put my thoughts online without clickbaits or AI slop

How do I do all these SEO stuff and ensure my blog comes up in the search list? Any articles or videos you recommend?

Sort of a basic request (I’m very new to this). I’ve started a blog and wanted to have a continuous white text box that separates my writing from the background. Any idea how to get the white box to stay between line breaks using the blocksy plugin? Many thanks

Edit: Don’t panic guys I figured it out

Greetings!

I have built sites (for personal projects or for family members’ small businesses) using Weebly (RIP), Wix, and Google Sites. All ran well and did what they needed to do.

Now I’m volunteering for a small nonprofit organization, and they want me to re-do their website, currently hosted with Dreamhost. They are tired of having to email the webmaster for every small edit they need to do, plus waiting about a week to see each edit done (as you can imagine, this is not high in the priority list of the webmaster).

At first, I thought Google Sites was a no-brainer, because it will be easy for them, and free (with their Google for Nonprofit Workspace, they have a huge space in Drive to house all their PDF archives that are currently in Dreamhost…).

So, here’s the thing: they have decades (going back to the 1950s) of PDF magazines that they make available to their membership. Right now, they’re hosted in Dreamhost, and are links on the website. I’m tempted to try WP for this project, using Elementor and Document Library Pro for the archive… but the few tutorials I watched for WP and the latest posts I saw in this community all made me second guess this because of security concerns… What do you say?

TIA

I was hit with a malware attack over the summer, around July. My sites are on Hostgator's share servers (paid). I see in the error logs, where their security where fighting the infected files, by removing them and the file would re-populate and eventaly over powered them. Looks like attack came from some plugins.

Htaccess files were placed on EVERY file to lock the user out. I contacted Hostgator support, they want over $300 to fix and restore. I already have a back up so I wanted to do it myself. Every folder had the htaccess and php files deep in the directory tree. Some could just be deleted, others had to be change permissions and then deleted. It took hours over a couple days. (I understand why Hostgator charges so much).

Anyway, in short, after deleting and changing permissions, those file 're-populated' themselves. Back a square one. Hostgator say those files have to be deleted before 'restored' files can override the corrupted ones. I plan to use Filezilla to restore files.

Is there a way to add a malware removal tool to scan, quarantine and eliminate infected files? I would delete the whole directory and restore it but some folder wont delete without changing permissions five levels deep.

If you been through this how did you rectify the problem?

Thanks.

It's my first time building a website and I just gotta know about elementor plugin.

Guide this newbie, guyss

Ive gotten really good at Elementor Pro and can pretty much build any design in it … however I do not want to do a subscription.

I’m looking for a builder that is similar to Elementor BUT has a lifetime license.

I just purchased Divi, but I am not liking it at all — so I will be doing a refund on it, unfortunately. I don’t really want to keep randomly spending money to find what I’m looking for. Is there any builder that has similar structure and feel as Elementor that has a lifetime license that you guys are aware of ? Thanks so much for for your time.

What’s the best way to protect wp login and wp admin with Cloudflare now days. I’ve done this in the past with page rules but recently read something about them being retired.

I have the content:

 Columns └─ Column └─ Group └─ Accordion 

But I dont need the columns. The admin of my site made a two column page the default format, but the second column has just been useless for my case. Is there a way to remove the column section and just keep the group? I've tried copy and paste methods, but nothing seems to get what I want. I'm still new to WordPress, so it may be easy but I'm screwing it up. TIA.

Hi y'all. I'm looking for advice as I transition from Webflow to WordPress (please challenge any of my thinking if you disagree with any of my below decisions). I have a background as a front-end designer/developer. My PHP knowledge is…nonexistent (thank goodness for Claude Code), but otherwise I'm fairly savvy and know just enough to be dangerous.

My plan is to use Bricks as the builder and I've figured out my monthly hosting. I think the biggest concern I have is managing updates/security — Webflow was all-in-one and WordPress is 100% not. We're going to have about 10 sites hosted simultaneously to start with, and probably 15 in the next 6 months, all with the same basic bones (all are for local small businesses with one woo commerce site):

1. ACF
2. Bricks for visual builder and forms
3. Complianz for GDPR

Here are my three questions:

1. What other plugins/workflows do I need to consider?
2. At the scale I'm working in (10 sites), is it worth doing something like WPUmbrella or ManageWP (or your best recommendation)? It seems like a lot of this is covered in my unlimited hosting plan, but I think that that requires me to still do many things one-site-at-a-time, whereas these tools enable me to 1-click across a whole fleet of sites that have the same basic functionality?
3. Is Google Site Kit worth it for easy client visibility, or should I simply manage that stuff through Google dashboards?

FYI, I have managed WordPress sites for my day job, so I'm familiar with the process and needs. But this is for my husband's company, and I only really have capacity to meaningfully update sites once a month with spot-checking/testing since it's effectively a side hustle.

Hey all. WP WAF Manager is my plugin for managing Cloudflare from inside WordPress. Until now it covered WAF rules, DNS, zone analytics, zone controls, IP access rules, security events and email routing.

Version 1.0.24.1 is out and it's the biggest update so far. It's grown from 8 modules to 14, and I rebuilt the website to show it all and the github link is: https://github.com/jaimealnassim/wpwafmanager

What's new

- Clients & Reports: link clients to their sites and email them a monthly report under your own agency name, logo and colors. It covers visitors, page views, threats stopped, cache speed, top pages and what Cloudflare blocked, in plain language. The plugin is never mentioned. You can send automatically on a chosen day and hour, or send by hand after a preview and a test.

- Zone analytics detail view: click any site for traffic charts, top pages, countries, status codes, devices and security events by action, path, IP and country, compared with the previous period. Table view and CSV export.

- Bot Control: set AI crawler policy (search, assistants, training), managed robots.txt and Bot Fight Mode across many zones at once.

- SSL & Insights: scan every zone for expiring certificates, Flexible SSL and old TLS versions, with one-click fixes for the safe settings, plus Cloudflare Security Insights.

- Alerts & Health: Cloudflare alerts for DDoS, SSL and origin health, sent by email, Slack or Teams, plus Health Checks on Pro zones.

- Turnstile: create widgets, rotate secrets and copy keys for every client site. Secrets are never stored.

- Page Rules migration: Cloudflare is retiring Page Rules. The plugin finds them on every zone and moves redirects and cache rules to their replacements in one click. Nothing is deleted.

- Zones and tags: tag sites as WooCommerce, Staging, Client and more, and pick them by tag when you deploy.

- Zone Controls upgrades: purge by hostname, prefix or cache tag, Smart Tiered Cache, security headers, and Under Attack Mode on every site in one click.

Still the same: everything is in the free version (GPLv2 on GitHub), it works on Cloudflare Free for nearly everything, and nothing loads on the front end. Pro is a one-time purchase that adds automatic updates and priority support.

A few notes:

- Security Events, Health Checks and Super Bot Fight Mode need a Cloudflare Pro zone. Blocking a whole country needs Enterprise.

- Deploying the WAF rules replaces the custom rules already on that zone, so check the Zone Rules tab first if you have your own.

GitHub: https://github.com/jaimealnassim/wpwafmanager