The announcement post - https://wordpress.org/news/2026/08/browser-extension/

Hi everyone,

My website has recently been getting hammered by bots making a huge number of requests to admin-ajax.php. This is causing my server's CPU usage to frequently hit 100%.

I've enabled Cloudflare's Bot Fight Mode, which seems to help somewhat, but it hasn't solved the problem.

I also tried creating a Cloudflare custom rule to challenge all requests to admin-ajax.php. However, this breaks the forms on my website because they rely on admin-ajax.php to work properly.

I've also enabled Cloudflare's DDoS protection, but it doesn't seem to make much difference in this case.

I'm wondering what the recommended approach would be here. How can I block or rate-limit these malicious/bot requests to admin-ajax.php while still allowing legitimate AJAX requests from my website to work normally?

Any advice would be greatly appreciated. Thanks!

I’m moving a site off Thrive Theme Builder (cost + lock-in) to a native block theme with my own styles. WP 7.0 stack, theme.json v3.

The site has: blog posts, a few unique one-off pages, and the main marketing pages (home, services, etc.). Some of it was built with Thrive Architect.

My plan so far:

**1.** Build the theme locally — either a child theme of a minimal FSE theme or from scratch with Create Block Theme. Templates, patterns, colors, type scale all defined in theme.json. **2.** Push to staging, activate the new theme with Thrive still active. **3.** Convert pages one at a time, highest-traffic first. **4.** Deactivate Thrive Architect only when nothing depends on it anymore. 

I’m doing it this way because Thrive Architect stores content in post meta, not post_content — so deactivating it early can make content vanish entirely, not just lose its layout. Landing pages seem to be the worst case since they bypass the theme template completely.

What I’m trying to get right:

**•** Where’s the line between “start from scratch” and “child theme a minimal FSE theme”? For a fully custom design, does starting clean actually save time, or do you end up rebuilding what Twenty Twenty-Five already gives you? **•** For blog posts specifically — did Convert to Blocks work for you, or did you end up rebuilding? What broke? **•** Anything that bit you on the SEO side? I have a crawl baseline and CWV numbers saved, but I’m sure there’s something obvious I’m missing. **•** Any reason *not* to run the new theme in production while old pages still render through Architect? That’s the part of my plan I’m least sure about. 

Anyways, looking for advices
Thanks

If you were building a new website today, would you choose the WordPress Block Editor (Greenshift) or Elementor?

Hi all, i need some help asap. I have a new company doing amendments to my website / seo. They removed the old company’s user email and it looks like various changes have been reverted back to old ones. Email attached. How do i resolve this, i literally cant sleep atm.

Gibt es ein kostenloses Plugin wo ich über ical Link einen Google Kalender für das Frontend einbauen kann?

Ich habe eine neue Webseite für Ferienwohnungen und da ich noch keine Einnahmen habe, suche ich ein kostenloses Plugin womit ich übersichtlich die Belegung der Unterkunft anzeigen kann. Der Eigentümer der Ferienwohnung gibt die Belegung in seinen Google Kalender ein und über den ical Link möchte ich den Kalender auf der Website anzeigen.

I know, elementor is a nightmare. The website was built using it before I came along and now there’s almost 300 pages. The website is catalog style and that’s just how they want it.

Problem is, the website and the WP dashboard are so incredibly slow. Like noticeably slow. The website home page fails every speed test I’ve run and the reasons keep coming back to elementor. What can I do to fix this without rebuilding the entire thing?

I have two WordPress websites with a mid-range managed host, which I prefer not to mention since the post is not about them.

It has been two times now (v7.0.2 and v7.0.4) that I read a headline “critical security fix just released, update immediately”, I go to the updates section of the host control panel to check if the auto-update has been applied, but two hours after the official release still nothing and I have to make a backup myself and update manually from the wp dashboard.

I am mildly irritated by this delay, since I have set the minor auto-updates to “immediately” but it takes hours instead, and especially with v7.0.2 the vulnerability was being exploited very quickly.

Is that delay normal?

How long does it take with your managed hosts for the auto-updates to be applied after the official release?

Hi, I’m currently researching how small web agencies and freelance developers handle website security for their clients.

I’m not trying to sell you anything. I’m simply trying to understand the current workflow and the problems people actually face.

If you have a few minutes, I’d really appreciate your honest answers to these questions:

1. How many client websites do you currently manage?

2. What tools or methods do you currently use to check the security of those websites?

3. How often do you perform security checks?

4. When a security tool reports multiple issues, how do you decide which issue needs to be fixed first?

5. What part of the security-checking process takes the most time or effort?

6. Do you ever find security reports difficult to understand or difficult to explain to your clients? If yes, what makes them difficult?

7. After discovering a vulnerability, how do you usually figure out how to fix it?

8. Do you have to manually search Google, documentation, GitHub, or vendor websites to find the correct solution?

9. Have you ever received a false alarm from a security scanner? If so, how did you handle it?

10. What is the biggest frustration you currently have with website security management?

11. If you could completely remove one part of your current security workflow, what would it be?

12. Approximately how much time do you spend each month dealing with website security across your clients?

13. Are you currently paying for any security tools? If yes, which ones and approximately how much?

14. If a tool could automatically monitor your clients' websites, identify the most important security problems, explain them in simple language, and give you clear step-by-step instructions for fixing them, would that be useful to you?

15. What would make a tool like that genuinely valuable enough for you to pay for?

There are no right or wrong answers. I’m particularly interested in your actual experience, even if it means telling me that this idea wouldn't be useful.

Thank you for your time.

still down as of now... insane..

I'm having a rendering problem on my homepage. Individual post pages rendered properly on all browsers.

I recently got notification that the latest Jetpack update caused a fatal error. When I checked, everything seemed normal.

But I didn't notice any rendering problem until a wk or so later when a visitor told me about it. He noticed it in Opera. I checked and there were other browsers with the same issue (though not all).

I deactivated Jetpack & some of those browsers which were not rendering properly reverted to normal behavior. But I'm still having the issue w. mobile versions of Bing, Edge, Opera (both mobile & desktop) & Ecosia.

I've purged the site cache and cleared the caches of all the browsers.

Is there any known issue with this Jetpack update? Any suggestions about how to address this?

UPDATE: It appears to be a conflict with LiteSpeed. I disabled it & rendering returned to normal on all browsers.

My client has a simple Gravity form that has been live for years, averaging a dozen entries a month.

Starting Tuesday this has blown up to hundreds and hundreds a day. I have CloudFlare Turnstile installed and running, Gravity Forms Zero Spam also activated, Gravity Forms Honeypot and Submission Speed check activated, I also just installed Spam Hexer from Gravity Wiz, nothing is stopping the submissions.

I've even gone and and duplicating the existing form and embedding the new version on the page, clearing WP Engine cache, and entries immediately come in. The Gravity Forms Forms page shows only 8 Views on the new Form, but 15 submissions in the past 15 minutes.

I'm unsure of what else to try at this point. I've dug through all of the logs from WP Engine and there is no consistent pattern, all IP's are unique, all emails/names are unique, country all seems to be US, browsers fluctuate although a lot are from Facebook Browser so there is nothing to block.

Other forms on the site don't seem to be having this issue, it's only this one form. It's a simple form with just checkboxes, name, email, address fields to request a guide.

Any ideas on something to try next?

Howdy!

So on one of the sites I run a lot of commenters add links and I couldn't find a decent plugin to render them so I wrote my own:

https://wordpress.org/plugins/vern-comment-embeds/

The GitHub repo is here:

https://github.com/clubside/vern-comment-embeds

And the basic information is:

Easy Comment Embeds improves comment readability by automatically enhancing standalone URLs:

Responsive oEmbed video

Inline image embeds

Twitter/X blockquote fallback

OpenGraph link preview cards

Smart URL detection (standalone URLs only)

Basically just like here on Reddit you put in a URL on its own line in a comment and it is run through WordPress' native oEmbed first and failing that there are fallbacks for images, X/Twitter and standard web pages where I try to build a Facebook-style OpenGraph card.

Hope some others find a use for it, and I'm bothering you all because of WordPress.org's search being so lousy 😜

Chris

I’ve had a site running for 2 years now using Wordpress. Late last year I had a professional company redesign our site. They said at the time they had issues with some of our images but got everything fixed (they had to redo them all or something)

Anyway we recently noticed that some of our articles pre redesign suddenly didn’t have any images. We’re a news site so we had 3,000 articles at the time and wernt going through them all. Looking into it today we noticed that a bunch were blank and had the “this image has an empty alt attribute” message where all the images should be.

This is a huge pain and likely affected our ranking on many articles and we’re not sure how to fix it. No alt text should affect SEO not outright make the image blank.

Any suggestions?

Optimized my stores 200+ images to small jpg files. Now I understand that webpg should always be our go to but when I convert a single jpg of 101kb to webpg it becomes 168kb+ in size. Way forward? Change the image converter maybe?

I am creating e-commerce website using wordpress for my client. But I am facing very big issue . Website is very slow from backend side , it takes long time to update or load something . If I switch from one page to another page in backed it takes long time 5 to 10 secong something . I tried all solutions like memory limit 512mb , litespreed cache plugin, removed heavy and unnecessary plugins and pages . All versions like php wordpress are letest however I unable to find solution . This issue taking long time dead line is comming . Now what can I do ?

If I have a wordpress site with a CRM integrated, what is a safe way to get the media library specifically the files? the media library has upwards of 4,000 items so what’s the best way to do it. Are plugins safe considering that I have a CRM integrated with my WordPress?

My site isn't particularly complicated yet over the years I've accumulated plugins for forms, SEO, backups, security, page building and about five things I've forgotten the purpose of. It kinda feels like owning an old house where I’m permanently waiting for something else to break. Most discussions I find are about moving to WordPress but I'm curious about going the other direction and starting fresh.

Are there any downsides to moving a fairly straightforward business website from WordPress to Squarespace or an AI builder like Durable etc. that I’m not seeing? Or if you’ve already done a migration like this, is there anything you found yourself missing after moving?

Our non-profit org uses WordPress with the free Event Manager plug-in. Would this have the capability of offering .ics events for Google Calendar and how would we do this? Or would that be a separate plug-in? I did try going to Google calendars and subscribing by URL (http://OurWebsite.org/events.ics) and that calendar came in empty. Previously our other calendar offered Links for both Google and Iphone users to subscribe, but our website person doesn't see that option within this new Event Manager plug-in.

Don't know how much the title sounds good, but here's the story -

I have a tool website on domain suppose abc. com. Now I have plan in making to make country specific tools on same niche and post it on country specific sub domain like us. abc. com or ca. abc. com.

Now I have a wordpress on abc. com/blog to u know publish blogs on same niche, now previously I had plan to create it country specific too like us. abc. com/blog etc. But it's very hectic to manage everything n I asked ChatGPT, it suggested to make the /blog central and managing the urls like this

abc. com/blog/ (central generic topic)
abc. com/blog/us/ (US Based)
abc. com/blog/ca/ (Canada Based) like this.

Now I have no idea how to add this to every link without creating sub-directories actually from one WordPress dashboard which is on abc. com/blog. Tried so many things, still not working, I also thought to put it directly on post editor, but there when I'm including /us/postname, it's automatically getting converted to /us-postname.

Beside creating a category and name it blog, also won't work as the wordpress site itself is on /blog. I can't install wordpress on main site as it's custom coded.

What should I do now? :-D