Hi,

I found out my webhosting space is flooded with malware. I removed it from one site but after an hour it was back, probably from one of the other sites. I remove the files with my FTP-client WinSCP but it is sooooo slooooowwww.... I am working on it all day already.

Is there a way to do this faster? I mean, should I be able to login to the server directly, I could do a del *.* or not?

EDIT: support from my webhost has wiped the entire hosting package. I restored the site and updated WP + all plugns and installed iThemes for security. Now fingers crossed!!

Hi, 19F here.

So the thing is I am a CS major and for some time, I have been practicing and making websites on wordpress with different builders ( Elementor etc ) for a friend of my brother. He is basically guiding me through the process. And he makes decent money.

Recently, I needed some money for some reasons so I am thinking, why not make a gig on Fiverr and Upwork?

I can't do anything toooo fancy like some custom retro website or some very fancy animation, but some basic to almost mid website I can make.

Do any of you guys have some suggestions on how to start freelancing.

Thanks.

P.S. I also know HTML and CSS and some basic troubleshooting will learn JS and some frameworks as time passes to, so I can properly be a web designer.

I have a bunch of sites inundated by bots. I'll have a site in the US that all of a sudden uses all my server memory at a time where 99% of the country is asleep. I've used some of the security plug-ins, but have not found them to be very helpful in terms of blocking all these malicious bots. Has anybody else found something that will actually block all these attacks??

Hi everyone, I’m running into a baffling issue while building a custom post ticker shortcode.

My WP_Query successfully fetches the latest posts and grabs their titles and permalinks perfectly. However, has_post_thumbnail() is returning false for every single post in the loop, forcing my code to output my text fallback instead of the images.

I know for a fact that all the post have feature images

Here is my code (running via Code Snippets plugin):

add_action( 'after_setup_theme', function() {

add_theme_support( 'post-thumbnails' );

add_image_size( 'blog-card', 600, 400, true );

} );

add_shortcode('custom_post_ticker', 'build_smooth_ticker'); 1

function build_smooth_ticker() {

$query = new WP_Query(array(

'post_type' => 'post',

'posts_per_page' => 10,

'post_status' => 'publish'

));

if (!$query->have_posts()) return '';

$items = '';

while ($query->have_posts()) {

$query->the_post();

$current_id = get_the_ID();

// TEMPORARY DEBUG LINE

$items .= '<!-- ID: ' . $current_id . ' | Has thumb: ' . (has_post_thumbnail($current_id) ? 'YES' : 'NO') . ' -->';

if (has_post_thumbnail($current_id)) { $content = get_the_post_thumbnail($current_id, 'blog-card'); } else {

// This fallback always triggers

$content = '<div style="color: white; font-weight: bold; padding: 0 20px; line-height: 180px;">' . get_the_title() . '</div>'; }

$items .= '<div class="ticker-item"><a href="' . get\_permalink() . '">' . $content . '</a></div>';

}

wp_reset_postdata();

return '<div class="ticker-wrap"><div class="ticker-track">' . $items . $items . '</div></div>'; }

hey there I'm not really sure how to go about this, I'm reaching out for a friend he is running a website for a hobby he likes to post his art he makes and other various topics in a community based forum kidna thing he has setup, I'm wondering if i could get some advice to help him get it out there more, he currently posts to his youtube which gets a bit of traction that satifies him, one big problem i noticed is he just gets a bunch of fake accounts signing up they dont last long because of their malicous attempts being blocked is there a way to weed the fake accounts out that are signed up also? would love any advice like i said before its just a hobby he enjoys doing it for fun keeps him happy dont really know where else i can reach out.

Hello,

I'm struggling to remove a blank space after the last block on the home page of this site. I have tried to adjust the padding in the site editor and on the block itself. Both are set to zero. I looked for hidden paragraphs and could not find any. This is a Wordpress site hosted through BlueHost.

Any help would be greatly appreciated!!!!

Hi everyone,

I'm trying to understand a strange issue affecting a client's WordPress website:

https://sarltib.fr/

This client is currently in a dispute with their former web agency. I'm supposed to take over the website, but I don't have access to the hosting, WordPress admin, FTP or database yet.

While we're waiting to recover everything from the former provider, this new issue suddenly appeared on the website.

When accessing the site, I get the following error:

“Server IP address could not be found for cloudflare-check.net”

The strange part is that the actual WordPress website is still there and seems to load normally in the background.

In Chrome, when I inspect the page, I can see a full-screen iframe with the title “Security check” displayed on top of the website. If I manually delete this iframe from the DOM using Chrome DevTools, the normal website immediately appears behind it.

In Firefox, I only see the cloudflare-check.net error page.

The WordPress login page at /wp-admin is also still accessible.

Since I don't have access to the website yet, I'm mainly trying to identify what we're dealing with so I can advise the client while the current provider still has control of the hosting.

Has anyone seen this kind of behavior before?

In particular:

• Could this simply be a DNS configuration issue?
• Does this look like a compromised WordPress installation / malicious iframe injection?
• Is cloudflare-check.net actually related to the legitimate Cloudflare service, or is the name just being used to make the page look legitimate?

Thanks for any help or feedback!

https://preview.redd.it/unnt5cwx8xlh1.png?width=2544&format=png&auto=webp&s=56e1d4f3d78871dda759a65e5e4e797a87e53d05

Basically a notes app that stores data by modifying PHP on every save. So no database at all

Sharing a free, open-source project that works well with WordPress

halloween.js is a zero-dependency library that adds Halloween-themed ambient effects to a page (blinking eyes, flying witches, a dropping spider, a rising tombstone, corner spider webs).

No plugin needed, just one script tag pasted into the Theme Editor's header.php (or any "Insert Headers and Footers" type plugin if you'd rather not touch theme files directly), plus one CSS class on <body> to turn it on. Styles are injected automatically, no separate CSS file, no build step.

Under 10 KB gzipped, MIT licensed, source on GitHub.

Live demo + WP instructions: https://halloween.js.org/
GitHub: https://github.com/rogulia/halloween.js

When a website has performance problems, the usual response is to optimize what is already there.

Minify CSS.
Delay JavaScript.
Remove unused styles.
Compress assets.
Improve the PageSpeed score.

But there is a more basic question:

Why deliver something that a device does not need in the first place?

A phone does not necessarily need the same frontend resources as a desktop. Yet conventional responsive web design often sends the same CSS and JavaScript to every device and lets the browser decide which parts are actually used.

That works. But it also means we may spend time optimizing resources that never needed to be delivered.

There is an older concept called RESS - Responsive Design + Server-Side Components.

The idea is simple:

Desktop → desktop.css
Tablet → tablet.css
Phone → mobile.css

The server decides which resource set is appropriate before the page reaches the browser.

And this does not mean abandoning responsive web design. Each device-specific stylesheet can still use normal media queries and responsive techniques.

RESS simply adds an earlier decision:

First decide what the device actually needs. Then optimize what remains.

Maybe "performance optimized" should therefore mean more than minification, caching and delayed loading.

Maybe users should also start asking theme and plugin developers:

Does your solution avoid delivering frontend resources that the device will never need?

EDIT: Judging from some comments, my CSS example may have been too narrow. RESS is not about the server replacing media queries. I made a small demo showing the actual idea: the server delivers different PHP, HTML and assets depending on the device, while responsive design can still be used normally inside each version.

Demo: https://www.imedes.dev/ress/

Since March, I've offered every new client at my two-person web shop a choice: WordPress or a faster AI-built site, and of the last 30 clients, 70% chose WordPress.

The reason is rarely design - it's control, clients can't self-edit the AI-built sites, because every change goes through us, and the moment someone asks "so if I need to update my price list Saturday night, I just wait?" - they switch to WordPress, ofc they'll take a clunkier CMS over zero control.

There's also an image problem, especially with owners over 50: one asked, "so my site's basically a chatbot wearing a website costume?" uhh...fair point ig, and no plugin ecosystem means anything beyond a static page requires custom code or a bolted-on database like Supabase, tho the 30% who go AI are almost always clients who won't touch the site again post-launch, like a mobile detailer who just needed a page and a booking button. Hosting is a non-issue by comparison - I've got clients running fine on Hostinger, a couple of older accounts still sitting on SiteGround from before I inherited them, one holdout still on Wix who refuses to migrate, the real question here is wether clients can fix sth themselves at 11pm wo texting me first.

I have my main site on wordpress and i a subdomain which is not on wordpress so is there a way when user visit my subdomain i will getect if the use is logined on my main site or not

What type of plugin form could I use for a cabin that wants the reservations made through WhatsApp...

The client completes the form and it sends the message or redirects them to whatsapp with the message constructed with the info they provided (name, dates, number, email, etc.)

My website recently started having some issues:

• Random .html files containing gambling content are being generated in wp-includes and some plugin directories
• A user named tester appeared, and I have no idea where it came from
• A strange GTM code was injected into the theme's header.php and footer.php
• Some unknown PHP files were also found

What I've done:

• Changed all passwords for Hosting, cPanel, SSH, FTP, Database, and WordPress; enabled 2FA and replaced the Security Keys/SALTs
• Replaced wp-admin and wp-includes with fresh copies downloaded directly from WordPress
• Updated all plugins/themes and removed suspicious files
• Ran Wordfence in High Sensitivity mode and scanned with Imunify360

However, the website is still being reinfected with HTML files, PHP files, and the GTM code.

I'm not a technical person, so I'm not sure what else I should check or where to start.

If anyone has experience dealing with a WordPress site that keeps getting reinfected, I'd really appreciate some guidance.

Thanks!

I got two emails saying the admin password was changed on different sites, but I'm the only admin and I didn't change it. On one site, two admins with random names were added, but I didn't see any other tampering with the site or data. The version is 7.1 I deleted the new admins and enabled 2FA. Has anyone else experienced this?

The Featured tab is the one that loads by default when you go to Plugins > Add New. Eight plugins, hand-picked, rotated every couple of weeks. It has been running since March.

I went looking for a first-hand account from anyone it happened to, someone writing up what it did to their installs or whether any of it stuck, and I couldn't find one. The curator published figures for the first cohort back in March and said more would follow, but there hasn't been a second report. When someone asked publicly for a list of previously featured plugins, the question went unanswered.

So there is a placement that puts eight small plugins in front of a very large number of admins, and no public record of what it does or who has been in it.

Disclosure: my plugin is in the current rotation, which is why I started looking. I'm logging the numbers daily and I'll publish them either way, including if the answer turns out to be "not much".

One thing I haven't seen mentioned anywhere: the order of the eight is randomised daily. Same plugins, different sequence, stable within a given day. If you're featured and your download numbers move around day to day, that might be why rather than anything you did.

If you have been featured before and kept any figures at all, even rough ones, I'd like to compare.

I've been working on protections around destructive WordPress operations, and recent compatibility testing made me rethink an assumption I originally considered fairly safe.

My starting point was simple:

If I restrict a protected user's relevant WordPress capability, the operation should not happen.

For example, I denied `activate_plugins` as part of the protection and tested plugin activation.

That worked as expected through the normal WordPress admin workflow: the user could no longer activate a plugin from the admin interface.

I then tested the same operation through an automated WordPress tool.

The tool had its own permission check before execution:

`current_user_can( 'activate_plugins' )`

But the underlying operation was then performed by calling `activate_plugin()` directly.

Despite the capability-based protection blocking the normal admin path, the operation could still reach the underlying activation logic through this different execution path.

That exposed an important distinction.

The normal admin flow and the underlying operation are not necessarily the same protection boundary. A function such as `activate_plugin()` can assume that authorization has already been handled by its caller.

From the perspective of the calling tool, that may be perfectly valid.

But from the perspective of a site-level protection designed to prevent the plugin state from changing, relying only on capability removal was not enough for every execution path we tested.

I found that observing and enforcing the actual state transition through `pre_update_option_active_plugins` allowed the protection to stop the activation regardless of that particular caller path.

The same line of testing has led us into plugin installation and other destructive administrative operations as well. Different operations have different hooks and execution paths, so I don't think there is one universal answer.

I'm not claiming that WordPress capabilities are broken, or that every underlying WordPress function should perform its own permission check. The important distinction is that the capability check and the underlying operation are separate layers, and reaching the operation directly can produce a different protection outcome.

The question that came out of this testing is different:

If you are building a site-level guardrail whose purpose is to prevent a particular destructive state change, should the protection depend entirely on every possible caller enforcing authorization before reaching that operation?

Or should some protections be enforced closer to the operation or state transition itself?

As more automated and AI-driven tools perform WordPress administration, I suspect this distinction will become more important.

I'd be genuinely interested to hear how other WordPress developers think about the boundary between authorization and operational protection.

https://preview.redd.it/dnjjleyl1ulh1.png?width=970&format=png&auto=webp&s=a30b65c87fb11016c2f9dd204a81c50df836c97f

Well, sorry. I’m a WordPress newbie, and I’m already starting to hate it.

I don’t see a CMS; I see an aggressive marketplace full of ugly themes and plugins that ask me to subscribe before I can even use them, ads everywhere, and horrendous designs that ruin the aesthetics of the WordPress admin area.

I’ve been installing, trying out, and uninstalling things for a while, and I could really use some help. I don’t want to end up creating the design with a Custom HTML block. It’s very tempting, though.

Hi everyone,

I'm using the SheetLink plugin to send all the inputs from my free WPForms form to a Google Sheet. SheetLink is connected to my Google Sheet, but no matter what I do, the form inputs don't appear in the Google Sheet.

I've attached screenshots of:

- My WPForms form and a field ID

- My SheetLink rule

- The Google OAuth settings

- My Google Sheet after I click "Test" on the rule

I'm not sure how I should fill out the fields in the SheetLink rule. The SheetLink documentation doesn't seem to provide an example either. Whatever I enter in the Field ID and Keyword fields, it doesn't work.

Could someone please explain how these fields should be configured or point me in the right direction?

Thank you for your help!

It first loads fine, then squishes into this with a robot in pieces. What in the?