I’ve inherited responsibility for a wordpress site. It has a lot of plugins that I have a feeling are no longer used. For security, I’d like to disable and remove any that are not being used. Is there any good way to determine that with some certainty without going through a huge hassle?

So long story short, I used to run a webzine and used a theme from Themeforest and a couple of addons from Codecanyon, but due to health issues I had to shut it down after a couple of years.

Fast forward 5ish years and I'm eager to get back into it. However, when I log back on to the mentioned sites, all of the themes and addons I bought back then are removed from the marketplace, and theres no easy way of contacting the authors. I can still download them all except for one, but none of them are being updated.

So my question is, how do you guys deal with that? Is that just something you have to accept? It doesn't seem very viable for long-term projects.

PS. I even made sure I bought themes and addons from big and popular authors back in the day to avoid this problem, but guess that doesn't change much.

I am working on an e-commerce website using WordPress/WooCommerce and am looking for a plugin or custom logic similar to the search experience used on:

https://www.rulmeca.com/en

If anyone knows of a plugin or approach that achieves this, please let me know.

Thanks,

Getting a little frustrated and nowhere to turn - maybe someone else has an idea.

I've had a wordpress.org account for a number of years - been using WordPress for 15 years now. The other week I tried logging in to post a comment on a forum post and found my account had been disabled.

I reached out the email address they provide (forum-password-resets) and had a email chain with 4 replies and responses over the course of a couple of days. Then, crickets. So I waiting 3 weeks, then opened another email thread - crickets.

There was no solid reason for the denied access other than the genreic responses of maybe I created a duplciate account, or logged into multiple accounts etc - but I hadn't and haven't.

I do move a lot (I'm a full time RV'er) and pretty much every week I move to a new location 100+ miles from the last. I provided a documented log of places I've been in the past 4 months, and we use Starlink, Verizon and T-Mobile as connection IPs - so they are constantly changing. I have a single computer, so I'm not logged in from multiple locations either.

I provided access to our public site that documents our RV journey which shows 197 campgrounds in 39 different states in the past 927 days. Yes, we move a lot :)

Does anyone have any other ideas on how I can gain access again to the forums? I rarely post (11 posts in 5+years). The problem now however is that I need to get support from a free plugin, but they say to use the forums for support - and the forums have me blocked.

Any ideas?

I'm looking for a reliable way to migrate WordPress websites built with Flatsome UX Builder to Gutenberg, preferably using Kadence Blocks.

I have several websites built with Flatsome, and I'd like to move away from its proprietary shortcodes without having to rebuild every page manually.

I'm particularly interested in preserving the existing content, layouts, images, links, and overall design as much as possible.

Has anyone actually tried this kind of migration?

• Are there any tools, plugins, or scripts that can automate at least part of the process?
• Has anyone used AI to convert Flatsome shortcodes into Gutenberg or Kadence Blocks?
• What were the biggest challenges, and how much manual work was still required?

I'm aware of Flatsome's own migration tools, but my goal is to move away from the Flatsome ecosystem entirely.

I'd really appreciate hearing from anyone who has successfully done this, even partially. Real-world experiences and practical solutions would be especially helpful.

I am using RankMath Pro some of my websites one of my sites I was getting huge bot visit from afternoon. From my Crisp chat dashboard I see most of visit coming from Singapore then I block Singapore but after that I see coming from multiple countries.

Full email

Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC.

If an affected copy of Rank Math SEO PRO 3.0.123 was active on your website, you should treat the website as compromised. Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server.

Rank Math removed the affected files and released version 3.0.124 as the clean replacement. Version 3.0.123 by itself does not prove that a website was compromised: Rank Math limits the incident to users who downloaded or updated to the affected version during the stated period.

Website owners should check when version 3.0.123 was downloaded or installed, and use Rank Math’s security notice as the authoritative source for updates about this incident.

So I think delete the previous version and install the new version.

I changed the archive page for content from wiki to articles so content went from urls went from
https://mydomain.com/wiki/article-slug to https://mydomain.com/articles/article-slug
I am trying to write a redirect to redirect all the old URLs to the new URLs I tried this but it doesn't work.
Original url - ^/wiki/. Target url - /articles/.\*

Hello Everyone!

I wonder how do you deal with the situations, when you observe inconsistencies regarding licenses in the plugins, that you are using. Do you contact the authors/teams and give them advices to correct these, or do you simply close your eyes, saying, this is good as is, nobody notices anyway.

I'd like to hear also what you usually do with other observations as well and how do you handle the mistakes you are observing.

Thanks and wishing you a great afternoon!

You’ve probably seen it: “we build super-fast websites, 100/100 in the speed test”. Yeah, all green, wow effect. But what’s really behind it? And why do people pay money for things that make their website worse?

Here are the tricks that raise Google’s speed score and still hurt real users, and what to do instead.

Delayed loading. The “delay until interaction” option most optimisation plugins and setups have: hold something back until a mouse move, a tap, a scroll, or a timer, whichever comes first. Google’s test never moves the mouse, so the thing never loads during the test, and the score goes up.

The usual target is the big hero image on mobile. In the test it simply isn’t there. On a real phone, a visitor who taps quickly sees an empty hero until they do. One who just reads sees the image pop in 5 to 10 seconds later, and Google’s real-user data then counts that late image as the page’s main content, so the number Google actually uses for ranking goes down.

What to do instead: if most of your visitors are on slow mobile connections and the image really slows the page, don’t put an image in the mobile hero at all. Everywhere else, serve it at the right size in a modern format, let it load first, and check your real-user data. If it passes, the image is fine.

Delayed scripts. GTM, for example. Same reason: no interaction, no load. But the first interaction is usually a click on your main button, and you lose that event, because the script only starts loading at that moment. And everything you held back now runs on that first tap, which is exactly what Google’s responsiveness metric (INP) measures. If you really have to delay GTM, at least never on the page where your main conversion fires. Or catch the critical buttons and events with a small custom script that pushes them to the dataLayer: GTM picks them up as soon as it loads, so nothing is lost.

Sliders, videos, dropdowns. Slider images load only when the user starts interacting. Is that reasonable every time? The user then waits for them. Same with video. So look at real behaviour: if most people use something right away, like a dropdown menu, it can’t be loaded later at the cost of user experience. For sliders, load the next slide quietly once the page has finished loading, not on click.

And here’s what it looks like in practice. One of our client sites scores 78 in Google’s speed test. At the same time, all of its ~6,400 URLs pass Core Web Vitals in Search Console: the last 3 months in the screenshot, and it’s been like this for 2 years. And it what really matter for you, Google ranking and main for your visitors.

We load every script up front. No tricks.

https://preview.redd.it/yivvprj3tfwh1.jpg?width=1021&format=pjpg&auto=webp&s=c00f41cdf9d0df274c48d7b542131b2629b32bbd

https://preview.redd.it/6vw6dzr8tfwh1.jpg?width=929&format=pjpg&auto=webp&s=a88412228e0ec36141f54c01df9cd75c29f2ac5d

Real user experience and what Google’s speed test measures can be drastically different things

I know. That's not what we've been telling everybody for years.

But a new one making the rounds is a good reminder that sometimes the problem isn't an outdated plugin.

Sometimes the attacker is holding something your site already trusts.

Here's what's being reported. Starting around October 18, attackers were sending commands through UpdraftCentral, the remote management side of UpdraftPlus, and using them to install malicious plugins on WordPress sites.

The commands were passing authentication. That's the part that got my attention.

It doesn't look like a typical "vulnerable plugin" hack. It looks like the attacker got their hands on legitimate management keys.

So you could have:

- WordPress updated

- UpdraftPlus updated

- Strong passwords

- Nothing obviously wrong

…and still have someone installing malware on your site.

:: Updating may not fix it.

Normally my first question is "Is there a patch?" Here, a patch may not cancel a key the attacker already has.

If you use UpdraftCentral, the safest move right now is to disconnect the existing connection until the vendor gives clear guidance. Your regular backups aren't affected by that.

:: Don't trust the Users screen alone.

The malware can create an account that looks like a plain Editor while quietly holding extra admin powers. If you're only hunting for a new "Administrator," you could walk right past it. [hint]

Once a site is compromised, I don't take WordPress's word for what's going on. I want to see the database and the files. The dashboard is helpful, but it isn't evidence.

:: The bigger lesson:

Our sites now connect to backup tools, management dashboards, CDNs, email services, payment systems and, more and more, AI tools. Every one of those trusted connections is another door.

And sometimes the attacker doesn't pick the lock. They steal the key.

If anything on your site has acted strangely since October 18, have someone look at it. Updating the plugin won't remove malware that's already in.

And treat any outside service that can change your site remotely like you'd treat an admin password.

While working on client websites, I kept encountering the same issue. Whenever you change a theme, add a plugin, or modify cache settings, the "field data" in Google Search Console or PageSpeed ​​Insights takes weeks to update - this is because it is based on a 28-day rolling average. For smaller websites, this data is often unavailable altogether.

That is why I created the "CartHacker Core Web Vitals Monitoring" tool.

It measures LCP, INP, and CLS metrics during every real user visit and, following Google’s methodology (where 75% of visits must meet specific thresholds), indicates within your WordPress dashboard whether your site meets the requirements. Results are available from the very first visit. A daily chart allows you to pinpoint exactly when a site’s performance began to decline; the chart also displays the TTFB (Time to First Byte) metric. The tool works on any WordPress-based site, not just online stores.

Key principles I followed while developing this solution:

• The measurement script is served from your own website and loaded in a "deferred" mode, ensuring it does not slow down page loading.
• No cookies are used; no data is stored on the user's device, no need to update your cookie banner.
• Activity from logged-in administrators, editors, and authors is excluded from the statistics, so your own clicks do not skew the results.
• For the CLS (Cumulative Layout Shift) metric, the tool identifies the element that shifted the most: for example, a cookie banner or a section displaying related products.
• The tool also tracks traffic (page views, unique users, devices, browsers) without the use of cookies.
• The source code for every file is fully readable and requires no additional build step. The measurement script is located in `assets/js/ch-monitor.js`, and the `readme` file lists all the requests it sends.

Using the tool requires a free CartHacker account, as data is stored and processed on the carthacker.com platform. The free plan includes up to 1,000 page views per day, a 7-day data history, weekly email reports (when agreed), and performance drop notifications. Paid plans offer longer data retention and higher page view limits.

You can try it for free here:
https://wordpress.org/plugins/carthacker-core-web-vitals-monitoring/

I would appreciate any feedback - especially if you notice discrepancies between the results provided by my tool and those you see in PageSpeed ​​Insights or Google Search Console.

I run a WordPress site that uses UpdraftPlus. On 19 Oct I found an unknown plugin had been uploaded and a hidden admin user was attempted on my site. I traced it, reported it to Team Updraft, and they confirmed to me (via support ticket) that their own site was breached on 18 Oct and they believe UpdraftCentral connection keys were compromised too. As far as I can tell this isn’t publicly announced yet, so I’m posting because anyone using UpdraftCentral should act today.

What matters most: this is not a plugin vulnerability you can fix by updating. My site was running a fully patched UpdraftPlus (well past the CVE-2026-10795 fix). The attacker didn’t bypass the patch — they used a genuine, stolen UpdraftCentral key to send a signed command to my site. Updating the plugin alone does not protect you. You have to remove the connection key.

What happened on my site (timeline, UTC):

• The attacker sent one command via the UpdraftCentral RPC channel: plugin.upload_plugin.
• It dropped a fake plugin (“Feed Stack 90E”, author “CommonGantry”) — a backdoor that, when visited with a secret URL parameter, creates a hidden admin user, logs the attacker in, and redirects to wp-admin.
• In my case it failed by pure luck: the attacker’s own code had a bug (referenced class constants that were actually defined globally), so it fatal-errored before creating the user. Had their code been correct, it would have worked on a fully hardened, patched site. Don’t count on being this lucky.
• The only trace left was a DB option feed_stack_90e_sync_token, written by the plugin’s activation hook.

What Updraft told me (paraphrased from their ticket): they detected unauthorised access to teamupdraft.com on 18 Oct, closed the route, signed everyone out, and reset affected keys. They believe their customer database was accessed (names, emails, order history; passwords are hashed, no payment data stored). They’re asking every UpdraftCentral customer to disconnect and check each connected site now, even if it looks fine.

What YOU should do right now (from their guidance + my experience):

1. Log into each site’s own WordPress dashboard (not through UpdraftCentral).
2. Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → delete the connection key.
3. Check Users and Plugins for anything you don’t recognise and remove it. Important: a competent backdoor hides the admin user from the Users screen — so also check directly in the database if you can: SELECT u.ID,u.user_login,u.user_email FROM wp_users u JOIN wp_usermeta m ON m.user_id=u.ID WHERE m.meta_key='wp_capabilities' AND m.meta_value LIKE '%administrator%'; Compare that to what wp-admin shows. Also check for the option feed_stack_90e_sync_token or any plugin/user you didn’t create.
4. Change your WordPress admin passwords.
5. Update UpdraftPlus to the latest version.
6. Change your teamupdraft.com password — type the address manually, don’t click email links — and change it anywhere else you reused it. Reset 2FA there if you use it.
7. If you use UpdraftVault, they’ve disconnected it as a precaution; reconnect to resume backups.

IOCs from my case, so you can grep your logs/DB:

• Dropped plugin slug: feed-stack-90e / name “Feed Stack 90E” / author “CommonGantry”
• Attempted hidden user: media.team14 (editor + manage_options + install_plugins)
• Backdoor trigger GET param: _0dff5c
• DB option written: feed_stack_90e_sync_token
• UpdraftCentral RPC command used: plugin.upload_plugin

The attack came in over the normal UpdraftCentral channel, so your login protection (2FA, Cloudflare Access, etc.) does not stop it — it isn’t a login. The only thing that closes it is removing the key.

I’m posting this because many people might be affected, just like I was. Our website was compromised, but thankfully – no damage was done due to hacker's own incompetence.

Full source of the dropped plugin (credentials redacted): https://paste.ofcode.org/WhBgBZtkHjDYQiQmNkTpMb

Update: Thanks everyone! Site is back up and updated, free from the malware and outdated plugins. Appreciate all of the help while I spiraled last night! 🙏🏼 Leaving it up in case the comments help others.

I was looking up a specific blog on my site and when I clicked on the specific blog links it redirects to a shady looking shopping site. So I went to my main website link and received this critical error message. Currently having a panic attack, messaged my webmaster but she’s probably asleep. Will my site be ok and able to be restored? Is it hacked?