I use WP Umbrella right now for plugin and core updates, but I’m still hesitant about just letting everything auto-update.

My main concern is a core or plugin update breaking something and not catching it right away.

For those managing 30+ sites, what are you using that’s been reliable? Do you leave auto-updates on, wait a few days on bigger releases, or have some kind of testing/rollback process?

Building Cashvelope was a massive personal challenge. I wanted a true envelope budgeting app that put data control back in the user's hands.

Working on this late at night after my main work hours meant dealing with severe burnout, redesigning local data structures three times, and fighting through backend edge cases solo. Building a app end-to-end alone is a completely different beast than writing code for a client.

To fellow devs who built and released your own side projects:

How do you balance feature scope creep with actually getting the app across the finish line?

My WordPress site was compromised — suspicious MU-plugins and heavily obfuscated JavaScript

I'm investigating a WordPress site that was compromised. My coding/security knowledge is limited, so I used AI to help me analyze the files and understand what was happening.

I found a suspicious MU-plugin called:

focal-extension-evo

The file is currently 0 bytes, but its filesystem timestamps are interesting. It appears to have been created around August 14, 2026, and there is also a serialized reference to it in wp_options.

With the help of AI, I was able to reconstruct part of the heavily obfuscated JavaScript associated with the infection.

The JavaScript makes a POST request to:

https://fashion-chicken.com/x9i32md/w1/

It also contains an eval() mechanism that appears capable of executing the response received from the remote server.

I did not execute the code or contact the remote server.

Threat-intelligence checks also show that fashion-chicken.com is associated with malicious infrastructure/C2 activity.

Plugins currently installed

These are the plugins actually reported by WordPress on this installation:

Active:

• Classic Editor 1.7.0
• Elementor 4.2.4
• Elementor Pro 3.35.0
• JetEngine 3.8.14.3
• WPvivid Backup Pro 2.2.30

Inactive:

• BDThemes Element Pack Lite 8.8.2
• JetFormBuilder 3.6.5.2
• WP Lorem Ipsum Generator 0.3
• Rank Math 1.0.277.2
• Rank Math Pro 3.0.106
• WooCommerce 11.0.1
• WP Cafe 3.0.19
• WP Cafe Pro 3.0.5
• WP Mail SMTP 4.9.0

Suspicious MU-plugins found

WordPress is also reporting these as must-use plugins:

• focal-extension-evo
• ionic-dashboard-ultra
• jolt-librarian-vox
• lumen-logger-io
• max-exporter-tag
• page-compiler-jet
• web-extension-evo

There are also these drop-ins:

• advanced-cache.php
• db.php
• maintenance.php

I'm now working on cleaning the installation and determining how the malicious files were introduced.

The AI assistance has been extremely useful because my knowledge of malware analysis and heavily obfuscated JavaScript is limited. It helped me decode the JavaScript and identify the suspicious external communication without executing the malware.

Is anyone else dealing with something similar? Are you using any of the plugins listed above? Has anyone seen focal-extension-evo, web-extension-evo, or the other MU-plugins mentioned here before?

A feature common to a great very many HTML boilerplates is this line:

html <meta name="viewport" content="width=device-width, initial-scale=1.0">

The initial-scale=1.0 bit was present to fix an ancient issue on iPhones. When rotating the screen into a landscape orientation, the page would keep the same width as when it was in portrait, making everything appear very zoomed in.

This isn't an issue any more. I've tested it across very many devices, and it appears it was fixed in iOS 9, which released back in 2015. In addition to testing, I've consulted a great number of other professionals, and nobody has been able to find evidence of it being needed any longer.

You can safely simplify the meta viewport declaration down to:

html <meta name="viewport" content="width=device-width">

It isn't hurting you to leave it there, but it is vestigial and unnecessary.

Further details: - https://vale.rocks/micros/20260902-1350 - https://quirksmode.org/quirksblog/2026/0902-initial.html

I'm parting with my ElePHPant collection after 13 years of collecting them. I'm raising money for my startup and also will need open heart surgery in the next 5 years. As the UG leader of PHP Vegas for over 10 years, its been a hell of a run. I still love PHP and my startup is built in it, but I also need funds as I'm quitting my full time to do all this. If we crossed paths before, thank you for all the fish. You can find my collection for sell here: https://www.ebay.com/sch/i.html?_dkr=1&iconV2Request=true&_blrs=recall_filtering&_ssn=pokemastercenter&store_cat=0&_nkw=elephpant&store_name=pokemastercenter&_oac=1

hi! I didn't think I'll need that in my life, but I very need to know how to use CSS properly. I mean what are the differences between one thing and another, what's more popular to use etc. So, I'm trying to relearn CSS.

For the context: I learned CSS in 2022 only to pass the exams and that's all, and then I was like "yahoo! I won't return to the web design ever again!". So, I can use the atributes with classes, id etc, but I can't understand what are the important things to properly use them. I didn't think I'll need to program projects related to web programming. I find JS and PHP quite easily to understand, bcz every thing has one meaning there. It was a bit hard to understand HTML for the first time, bcz I thought every tag has its own function, but when I understood that plenty of tags are semantical and I can just use <div> and <span> if I want, I started to use the semantical tags properly. CSS is the hardest part in Front-End for me, bcz Idk if plenty of things are similar to the HTML ones(an atribute is optional and it depends on you if you want/need to use that) or the programming languages(1 thing = 1 meaning).

Here are my questions about CSS to understand it better:

1. which position is the best? Bcz usually I used "position: absolute";
2. why to use the coordinates(except for the z-index) if you have the margins?;
3. why a lot of web developers prefer to use the paths from a vector image instead of uploading the .svg file itself?;
4. what to use: the standard shadow or something like "filter: drop-shadow(10pt 10pt 6pt);"?;
5. I liked the grid, but I saw a lot of developers use flexbox. Is it important to choose one thing over another or is it something optional?;
6. are the CSS similar, but different atributes important only for the browsers?;
7. what's the point in making something like "p.name1 {}", when I could just create a new class?;

I hope I didn't forget anything, but if I did, I'll make a new post about them

Edit: I can't change the title, but I meant questionS*

I am currently using Meevo.
It’s just not amazing and for the price I am disappointed.
It is however 20x better than booker/ Mindbody.

I am looking at Momence. The reason is they have an ai agent for online booking and text messaging. And it great with lead capturing, it can do all the things- especially that it can integrate with ClassPass- however there are 2 kinda weird things:
One is they want you to use their phone number that they provide to capture leads… which is ok but not ideal and also I don’t love their merchant processing rate. But it looks great other than that.
Does anyone else use Momence and what do you not like about it??

I know it’s not a traditional salon software because it’s more for gyms etc but it seems like it can do everything and the reporting looks good too.

I know boulevard looks sexy etc- but I’m not sure I care as long as it is functional.

Any words of advice??
I’m terrified if I leave MEEVO, that they will get all the upgrades and I’ll be bummed I left- like it’s the devil you know…. Etc etc….

Thanks!!

Hi, since WordPress 7.1 my PhotoSwipe blocks have broken in the editor, fine on the frontend. How do I initialize it in the editor iframe in 'render_block_preview'? The thumbnails just link to the absolute URLs in the href now rather than triggering the lightbox. Thanks

 const lightbox = new PhotoSwipeLightbox({ gallery: '.lightbox', children: 'a', pswpModule: () => PhotoSwipe, }); lightbox.init(); window.acf.addAction('render_block_preview', ... ) 

Hello all! This might be a long-ish read but I want to give as much context as possible for this situation I'm in. I am an IT consultant for a nonprofit and was tasked with assisting with implementing a plugin into their existing WP site. It's currently hosted on WP Engine.

I want to start out by stating this: I am a technical consultant who specializes in IT troubleshooting, system administration, networking, security and tailor fit technical solutions. I am a generalist who is adept in all aspects of tech but I am by no means a WordPress dev. This consultant role for this nonprofit is the first time I had actually had to learn WordPress and how certain things work through WP Admin. I told my client directly that I could assist with technical implementations but emphasized that I do not design websites for a living and that this would be a best efforts sort of thing.

Some history: The nonprofit had apparently called on a design company to design their primary website. They seemed to have designed the layout, structure and architecture as a custom WordPress theme that, from what I could understand, had lines of code in it's CSS sheet that tells certain plugins to do certain things related to site/element layouts. I don't know the exact timeline of events but the nonprofit no longer works with the original design company and needed to call on ANOTHER design company to fix the website layout when critical layout elements broke down apparently. The second company now is in the picture on a routine maintenance contract (I believe they migrated their site to WPEngine, and they run monthly maintenance by updating outdated plugins and patching security vulnerabilities) but for anything site-design related, they charge by the hour or by the project from my understanding.

Currently the stylistic layout of the site is all tied to the custom theme I mentioned above. There is a base/parent theme and a child theme. The child theme is the one that is currently active for the site. Being technically adept, I am able to use the Theme Editor to modify certain texts/attributes through the live WordPress site and can use SFTP to download the themes/create a new child theme if I wanted to.

Here's the problem: Nobody at this nonprofit is very technical and nobody knows how the website works in WordPress on a technical level. They have stated on several occasions that they feel extremely limited when it comes to the design elements of the site and they definitely don't know how to grab the themes off SFTP and modify it on a site dev level. On top of this: the plugin I am trying to implement requires a "global header" that allows a user to sign in through a third party platform (through API) and use it to purchase things directly through the site instead of linking to the platform via a URL link but the active theme seemingly is not allowing me to add this header or modify any of the design elements on global site things like headers, footers etc.

Here's where I could use some advice: The plugin required that we also activate and license Elementor Pro so we can control more of the design elements of the site when we implement the plugin. Playing around with Elementor it seems easier for non-technical people to modify certain aspects of the layout. In thinking of a future for the nonprofit to be able to edit design related aspects of their site without my involvement, I thought it might be worth it call on the design company to recreate the theme the site uses through Elementor Pro so that if a member of the nonprofit has to change something in the future then it is much, much more accessible... so long as they keep paying for the Elementor Pro yearly subscription that is lol.

Is this a good idea? Like I said, I am trying to think of something for the long term for this client given that they have no in-house WordPress devs or technical folk.

Thank you for reading and thanks in advance to anyone who can offer some insight here!

I'm not sure if this is the correct sub, but I recently hired someone to make a new updated website for me that will replace our old one. However, despite asking for up-front pricing, they keep adding more charges for services that would have been otherwise included in the beginning. Because of this, I am not keen on paying them to migrate the files.

They have since given me the file to download (WPRESS File) but whenever I try to download it into the transfer option on GoDaddy, it says the file is too big. Any advice is appreciated

Introducing a new major update for the "Electron React App" desktop app's starter kit.

Let's talk about the worst part of building Electron apps. You want to minimize a window from a button. So you write a handler in main. Then invent a channel name. Then add a preload bridge entry. Then declare the types. Then finally make the call in the renderer. Five files for one button, and the whole thing silently rots the day you rename something.

v13 throws that out. You define the feature once in main, and the renderer just has it. Typed, auto-completed, React hooks attached. No channel strings anywhere.

Read more about the new changes in the Repository page:
https://github.com/guasam/electron-react-app

Feature Highlights:

- Type-safe IPC: queries, commands, streams, and events, inferred end to end
- Cross-window state owned by main, synced live, with opt-in persistence
- Sandboxed renderer with a two-line preload
- Custom window frame, titlebar, and menus with keyboard shortcuts
- Light and dark theme
- React error boundary with detailed dev reporting
- Import path aliases for app, lib, conveyor, and resources
- Shadcn UI on Radix, styled with TailwindCSS
- Vite HMR, with ESLint and Prettier preconfigured
- VS Code debug configs for both main and renderer
- electron-builder packaging for Windows, macOS, and Linux

If you were starting an Electron app tomorrow, what would you want already handled for you?