I’ve released a free/open-source WooCommerce plugin on WordPress.org called Custom Order Workflow for WooCommerce.

I built it to address a common requirement on WooCommerce projects: the standard WooCommerce order statuses don't always match the actual workflow a business needs.

For example, instead of only:

Pending → Processing → Completed

a store may need something like:

New Order → Review → Approved → Processing → Ready → Completed

The plugin provides a way to create and manage a more customized order workflow within WooCommerce.

🔗 WordPress.org:
https://wordpress.org/plugins/iamgsbala-custom-order-workflow-for-woocommerce/

Why I built it

I've worked on several WooCommerce projects where the order process was more complicated than the default statuses. In many cases, the choices were either custom development or adding multiple plugins to handle different parts of the workflow.

I wanted to create a simple, focused solution that could be useful to other WooCommerce site owners and developers as well.

I'm looking for feedback

Since this is still growing, I'd particularly appreciate feedback from the WordPress/WooCommerce community:

• What custom order statuses do you commonly need?
• How do you currently handle custom order workflows?
• Are there workflow transitions you would expect to automate?
• What integrations or actions would make this more useful?
• Are there any WooCommerce edge cases I should consider?

I'm the developer of the plugin, so this is a genuine community promotion, and I'm mainly hoping to get feedback from people who work with WooCommerce.

Thanks!

We were recently working on a WordPress project that relied on the Google Maps API. Out of nowhere, a rogue AI bot hammered the site. Because GCP's billing alerts have a 45-minute latency, we got hit with a €220 bill before we even knew what was happening.

Months of $0.00, and then BAM — €220 in April.

While investigating, I realized how predatory Google's UI is. They prompt you to "Enable 15 APIs with one click," but setting actual hard limits requires navigating a confusing maze of quotas. For WP developers handing over sites to clients, this is a massive liability. If a client's site gets scraped, they blame you for the bill.

The alerts arrived too late. The entire free tier and the €220 overage happened in under 45 minutes. (Cue the endless email thread begging Google Support for a refund).

I got so frustrated that I built a free, local browser extension (runs client-side) to fix this. It acts as an overlay on the GCP Console and calculates the exact API Quotas needed to guarantee a $0 bill, stopping requests instantly at the API level.

The extension calculates and sets exact daily quotas for the most heavily used services (Maps JavaScript API and Geocoding API) to mathematically guarantee a $0 monthly bill.

I published it in the Chrome Store for free. https://chromewebstore.google.com/detail/free-maps-calculator-for/bempibaijbfokllpdhkjlokmpeokkpkh/

Dropping it here because I know how many WP sites rely on Maps, and you need to protect your clients' billing accounts.

Hey everyone,

We’re auditing our WordPress site architecture. Right now, our core pages live at the root level (/service-a/, /offering-b/). We considered moving them into a CPT under a subfolder (/services/service-a/), but taking on 301 redirect risk on live, ranking pages just for "cleaner folders" feels like a bad trade-off.

A few quick questions for technical SEOs and WP devs:
Have you seen any real difference in how Google or LLMs understand a site when using physical subfolders vs. flat URLs backed by good Schema and internal links?

If we run a CPT with a root slug (/) to keep URLs flat while organizing our WP dashboard, are there any permalink or query performance bugs we should watch out for?

What specific Schema properties (like hasOfferCatalog or about) have worked best for you when optimizing for search citations?

I’ve been working with WordPress for a while and one thing I still find interesting is how different the cause of a slow website can be.
Sometimes it’s a plugin, sometimes a poorly optimized theme, database queries, images, hosting, or even third-party scripts.
For those who work with WordPress regularly, what’s usually the first thing you check when a site suddenly becomes slow?
Do you start with PageSpeed/Lighthouse, Query Monitor, server logs, plugins, or something else?
Curious to know how other WordPress developers troubleshoot this.

Hi everyone,

I’m the developer of the free version of SecureHold WP, an open-source WooCommerce plugin I’ve been working on for businesses that need refundable security deposits.

The basic idea is to keep the normal WooCommerce payment separate from the deposit. Instead of charging the security deposit and refunding it later, the plugin creates a separate Stripe authorization hold.

If everything is fine, the merchant releases the hold. If there’s an issue, the authorized amount can be captured instead.

I originally built it around rental use cases, but the same workflow can be useful for equipment, accommodation, vehicles and other WooCommerce stores where a temporary card authorization is needed.

The free version is available on WordPress.org:

https://wordpress.org/plugins/securehold-security-deposit-holds/

GitHub:

https://github.com/SecureHold/securehold-security-deposit-holds

I’d especially appreciate feedback from WooCommerce developers on the payment flow, edge cases and anything that feels unclear from a merchant’s point of view.

I just spent way too much time figuring this out, so maybe this'll help someone out there. I installed the newest version of Gravity Forms Multilingual on my staging site, and translated some new forms I have been working on. I couldn't for the life of me figure out why the translations were not applied to the forms. Later found out they weren't applied to my existing forms anymore, either.

Turns out the newest GF ML plugin isn't compatible with the latest production version of WPML and/or String Translation. I had to update to the beta versions (5.1.0) in order to solve the issue.

I've been building WordPress websites for years now, before elementor and now I use a combination of my aws environment / codex / WordPress to build my websites / plugins...the question, using AI to improve SEO measured by lightsail is still a false positive, even at a score of 100 my organic traffic is minimal. I'm all hooked up google search blah blah but things just dont seem to get any better! I feel like SEO is dark magic, unless youre going to pay for ads..its almost like dont bother.....what's your thought, tips and any advice would be appreciated

My website/newsletter has been very small so far so I just picked a plugin for newsletters (MailPoet) that seemed good and had a free tier. But I just started a membership style program - it's free, but I have newsletters that go out every week. People who sign up for the program after the newsletter for that week has already gone out have no way to receive the newsletter after it's been sent out. Is there a better newsletter plugin that would allow me to resend them - or better yet, automate it so people who sign up via a certain form will automatically receive all the past newsletters from the program? MailPoet says you can do that with the paid tier, which is fine, but when I look at their website and compare their tiers, the features of each tier are nearly identical, so I don't know if I trust that I know what I'll be getting by paying (ie is paying for the mid level tier going to get me what I need when the level comparison chart claims I should have it with the free tier?)

Missing the first newsletter was no big deal, but from now on I'll be using the newsletter to link to files that people will need, and I need to find a way that works to have people auto receive those even if they sign up late.

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!

Maintenance and Security Release

I recently released another major update to WP Optimizer, focused less on adding more switches and more on improving the underlying performance architecture, server compatibility and production reliability.

You can check it out here:
https://wordpress.org/plugins/wp-optimizer/

WP Optimizer is a free, modular WordPress performance and maintenance plugin. The idea is still the same: provide caching, optimization, diagnostics and maintenance tools in one place, while letting you enable only the modules you actually need.

The latest release includes some fairly substantial internal changes.

Layered cache architecture

The internal cache system has been reworked to use multiple storage layers:

request memory → Redis / Memcached when available → persistent disk storage

The goal is to avoid unnecessary repeated work during a request while still having a persistent fallback when an external cache backend is not available.

Static page cache, WP_Query cache and database query cache remain separate and keep their own lifetime, invalidation and exclusion rules.

AVIF support

The Media Optimizer can now convert images to AVIF in addition to WebP.

If both are enabled, AVIF takes priority where supported. Conversion is handled locally on the server, and failed conversions should leave the original image and attachment metadata untouched.

Navigation prefetching

I also changed how early navigation prefetching works.

On WordPress 6.8+, WP Optimizer can integrate with WordPress Core speculation rules instead of always relying on its own JavaScript implementation.

Older WordPress versions still use hover/touch prefetching.

There is also an option to disable WordPress native speculative loading when it causes unwanted requests.

Module architecture

One of the bigger changes is internal.

Modules are now registered through an explicit module catalog instead of relying on module discovery and duplicated metadata inside every module.

The goal is simpler initialization, more predictable lazy loading and less unnecessary work on normal WordPress requests.

This is part of a broader effort to keep the plugin modular not only in the UI, but also internally.

LiteSpeed / OpenLiteSpeed compatibility

I fixed generated .htaccess directory protection rules that could be rejected by LiteSpeed.

Existing installations also refresh the WP Optimizer-managed security rule block during the upgrade, so old invalid rules should not remain behind after updating.

The plugin now distinguishes more clearly between Apache, LiteSpeed Enterprise, OpenLiteSpeed and Nginx behavior instead of assuming all Apache-compatible servers behave identically.

There have also been smaller improvements around the admin UI, debugging infrastructure, cache backends and internal storage.

WP Optimizer currently includes:

• Static page cache
• Object cache with Redis / Memcached
• WP_Query and database query caching
• HTML / CSS / JavaScript minification
• Browser caching and GZIP / Brotli
• Image optimization, WebP and AVIF
• Lazy loading and LCP optimization
• Navigation prefetching
• Page Test performance comparisons
• Performance Monitor
• Database cleanup and backups
• Cron Manager
• Media Cleaner
• Cloudflare integration
• Activity logging
• WordPress / server diagnostics
• Security hardening
• Update controls
• Mail logging / SMTP
• WordPress feature / admin cleanup
• Configuration backups, restore and module resets

The direction I’m trying to take is increasingly less “another cache plugin” and more a self-hosted WordPress performance toolkit where you can measure a problem, enable the relevant optimization and then verify whether it actually improved anything.

I’d be particularly interested in feedback from people managing production WordPress sites:

Would you actually use AVIF conversion directly inside an optimization plugin, or do you prefer handling images elsewhere?

Do you use WordPress speculative loading / navigation prefetching, or have you found it causes more problems than it solves?

For caching, do you prefer plugins to automatically choose the best available backend, or expose the individual cache layers?

How important is LiteSpeed / OpenLiteSpeed support when choosing a performance plugin?

And more generally: what would WP Optimizer need before you would trust trying it on a production site?

What am I still missing? Which part would you test first?

My WP site for my self-published books has very low traffic counts, but these last two days, it's seeing hits from all over China. Never seen that before. Any thoughts?

I’ve been thinking about the WordPress feature that provide value after a website is launched.

Sometime it’s not a major redesign or complicated functionality. It'd be something simple like automated booking, connecting forms to a CRM, making content easier for the client to update, improving WooCommerce workflows, or replacing a repetitive manual task.

Those small improvement can end up saving a business hours every week or reducing the need for additional tools and ongoing developer help.

For developers who work with client websites, what WordPress feature or setup have you implemented that ended up saving your client the most time or money?

Would love to hear some real examples.

i'm looking for some advice from people who have actually built headless wordpress sites.

i'm working on a small experimental/art website for a client. i'm fairly new to building websites end-to-end — my background/strengths are much more in creative direction and design, and i'm currently vibe-coding a lot of the development. i do have a background in computer science but coding is def not my biggest strength.

the frontend is going to be completely custom react because the site has a pretty specific visual direction. the homepage has a custom interactive 3d element, and i don't want to be constrained by a wordpress theme.

there's also a small shop with around 20–30+ products.

what i'm thinking is basically -
wordpress/woocommerce would be responsible for the following:

• product catalogue
• inventory
• prices
• product images
• orders
• client admin
• editable website content

and react would be responsible for:

• the entire visual frontend
• homepage / 3d interaction
• animations
• product pages
• shop UI
• cart
• potentially checkout

the main reason i'm considering this is that i absolutely do not want to build the admin/cms/inventory/order infrastructure myself.

the client has also explicitly said they think shopify is too expensive, so woocommerce seems attractive because they can manage the store themselves without me having to build an admin system.

for payment/shipping, i'm also open to using something like razorpay, shiprocket, etc. rather than trying to build or own that infrastructure myself.

my main question is whether wordpress + woocommerce is actually a good backend for this kind of setup.

for the non-commerce content, would you use regular wordpress pages/custom post types + acf? or is there a better way to structure content that a headless react frontend can consume?

and for anyone who has done this:

• did clients find the wordpress/woocommerce admin easy enough to use?
• did you run into problems with plugins because the frontend was headless?
• how painful was maintenance?
• would you choose wordpress/woocommerce again for a small headless site?

i'm basically trying to avoid getting 70% of the way through the frontend and then discovering that the backend architecture is going to make everything horrible ;-;

would love to hear from anyone who's actually done this in production.

I have an old WordPress site that is a website with the blog hidden, same as any other site. Now this is a very old site that hasn't been touched in years. Somehow some bots got into the blog a few days ago and started making accounts and posting and commenting spam. And I had all that stuff ironclad lockdown for years, never had a problem. They kicked me out of the WordPress admin. But the craziest thing is the site remained perfectly normal, no visible blog, but I was getting 40 of these notifications a day, spam for all the usual stuff. So today I just pulled the plug or so I thought by going into my host ftp and deleting that entire site, all the files. Sites gone right? Even though the site is gone I am STILL getting these, and they are legit with legit TLS signatures and host. How could my WordPress site still exist if all it's files were nuked from my host server? This one has me stumped.

Something is causing PHP workers to hang for anywhere from 10–60 seconds. During these incidents, OpenLiteSpeed reports:

No request delivery notification has been received from LSAPI application, possible dead lock.

I have confirmed that the problem is not originating from MariaDB. The suspicion is that something in the PHP/WordPress layer is causing the workers to stop making progress, potentially a plugin.

What I need is a FOSS PHP profiler/tracer that can automatically identify the root cause — ideally showing the PHP call stack, function, source file/line, and what the process was waiting on when the problem occurred.

Current stack:

Ubuntu → OpenLiteSpeed → PHP 8.4 (LSAPI) → WordPress → MariaDB

I've already collected Linux/kernel-level evidence (D state, wchan, kernel stacks, strace, etc.), but that only tells me where the process is waiting; it doesn't identify the originating WordPress/PHP code.

What FOSS tool would you recommend for tracing this all the way back to the PHP/WordPress function responsible?

Every gallery plugin I tried for client sites did the same things. jQuery, a lightbox library, a slider library, 200+ KB of JS on every page, and PageSpeed dropped as soon as a gallery went on the homepage. Plus upsell banners in the dashboard.

So I wrote my own on top of core blocks and the Interactivity API:

- about 3 KB of JS to start; the lightbox/carousel code only loads when a gallery uses it
- no jQuery; the lightbox is just the native <dialog>
- the scroll reveal and hover effects are plain CSS
- it uses normal Image and Query Loop blocks, so nothing gets locked into shortcodes

It's free on wp.org, with no ads or nags: https://wordpress.org/plugins/wisp-gallery/

Full disclosure: I'm the dev. I'm mainly after feedback, especially from anyone who checks it with Lighthouse on a heavy page. And what's your current go-to for galleries that don't wreck Core Web Vitals?

Hello!

My wife runs a fairly popular food blog (nothing insane) but makes decent income revenue from it, and had grown in popularity over the past 8yrs or so.

Recently - let's say the last 6mos, the site will randomly get a "too many requests" error when trying to connect to the site (or admin page) which basically blocks the site for 30min-1hr. It happens randomly and no idea why or when or how, but it's causing her a fair amount of stress.

Will be happy to provide more info, but she hasnt changed any services or anything, and she's had a webmaster look at things as well... In terms of traffic, it's probably a little less than it was 2yrs ago (due to AI stealing a lot of her work and getting buried in google results) so it's not due to an increase in traffic I would say... So it's odd this error has come about.

Any ideas on where to start or what to try? Much appreciated! Again, happy to provide any relevent additional info needed

Hey I am working on my CV website but I can't find any licenced templates for my website.

Can someone help me with how to get licenced for free so I can sell on my website it would save me a lot of time. Pls