I got this from Wordfence: Wordfence Argus Discovers Critical Vulnerability in Ghostscript

I see I have 10.05.1 even with latest docker image. Does anyone know when this fix will get put into the docker image (or where to find out)?

Hi, I am a lurker who reads stories on wordpress. At the top of EVERY page I visit is this banner. I am not going to design a site; I have no interest in designing. But it gets in the way of my reading. Is there any way to remove it? Please let me know if this is the wrong place to ask this info; I am just so confused.

Hi, I have a need to add some code to my functions.php in my Wordpress installation(s).

I'm not a developer, but I am handy with a text editor and can edit config files carefully which I can upload via ftp.

The alternate is to use a plugin like wpcode to insert custom code (although I don't want to pay for a premium version; I'd be only using wpcode lite).

I'm inclined to edit the functions.php myself (and keep a log of edits/changes, etc).

But when Wordpress core updates, does functions.php also get overwritten sometimes? How often is this specific file updated? I wouldn't want to keep editing the file with my edits every time WP has an update.

If functions.php gets overridden sometimes, is that a good reason for preferring to use a plugin like WPcode Lite instead? Thanks.

(PS, if you must know, I want to disable email notifications every time a #$#$#$ plugin is updated; that's why I want to add code to functions.php)

Hi everyone,

One of the most frustrating WordPress problems I deal with is this:

The site — or wp-admin — feels slow, but there’s no obvious reason why.

People clear caches, disable random plugins, optimize the database and hope something improves.

I wanted something that approached the problem differently.

So I rebuilt an old plugin of mine, Cache Cleaner – Scheduled, into:

Cache Cleaner X-Ray – Performance & Database Diagnostics

The idea is not simply to clean more things.

It is to help answer:

What is actually creating pressure inside this WordPress installation?

X-Ray checks areas such as:

• cache configuration and the active caching system
• autoloaded options
• database size and growth
• Action Scheduler / background jobs
• failed and overdue actions
• WP-Cron
• revisions and expired data
• likely plugin ownership where it can be identified safely

It then tries to explain the findings in normal language instead of just throwing database tables and technical values at you.

For example, rather than saying:

autoload = 2.8 MB

the goal is closer to:

“WordPress is loading around 2.8 MB of options on every request. These three options account for most of it.”

Safety was also a big priority.

If the plugin cannot confidently determine that something is disposable, it doesn't automatically delete it.

Unknown plugin data stays review-only.

The original cache features are still there too: cache-system detection, Smart Purge, scheduled maintenance and cache warming.

It is completely free

• No Pro version
• No locked features
• No telemetry
• No required external service
• Diagnostics stay local

WordPress.org:

https://wordpress.org/plugins/cache-cleaner/

I’d especially like feedback from people running older WordPress/WooCommerce sites, sites with slow wp-admin, large databases, or lots of background jobs.

If you test it, I’m most interested in this:

Did X-Ray actually reveal something useful about why the site was under pressure?

And if it reports something that looks wrong or confusing, I want to hear that too.

Thanks

A wine club member emailed us last Thursday to ask if we knew Google shows "This site may be hacked" under our name. I didn't. I'm the office manager and bookkeeper here, and I ended up with the website because nobody else would take it.

I searched site: with our domain and Google says about 2,300 results, almost all Japanese. Google translate says it's mostly handbags and watches. When I click one I just get our normal 404 page, which I don't understand. There are also two admin users I've never seen, one is just random letters.

Background. A local agency built the site in 2018 with Elementor. The owners canceled their $150 a month maintenance plan in 2023 because it never seemed like anything was happening, which in hindsight, yeah. We have 31 plugins and 9 are out of date, and the dashboard has been nagging me since this summer about WordPress updates I kept putting off because I was scared of breaking the shop. Hosting is $12 a month shared and they keep 14 days of backups. Nobody knows when this started.

So do I restore the 14 day backup, or is that pointless if the hack is older than that? Is cleaning it in place realistic for someone non-technical with a lot of googling, or is this pay-a-professional territory?

Wine club signups and online orders go through WooCommerce. Do I need to be worried about card data?

If you've been through this, how long did Google take to drop the hacked warning once it was clean? One of the owners asked me if the shop should even be on the same site as the regular pages (hours, events, tasting room stuff). Is that a real thing or is that overreacting to one hack?

It's harvest, our busiest month, and I'm doing this at night after payroll. Please tell me this is fixable.

Hi, I'm a beginner using LocalWP on macOS to set up a WordPress site.

Whenever I activate WooCommerce, my site starts showing 502 Bad Gateway. WordPress Admin also becomes inaccessible.

The site works with plugins disabled, but activating WooCommerce appears to trigger the 502 error.

What should I check next? Could this be a PHP fatal error, a Local configuration issue, or something else?

Thanks!

UPDATE:
I switched PHP from 8.2.30 to 8.3.30 in LocalWP, and now WordPress Admin is working with WooCommerce active. I'm not sure if switching PHP fixed it, but works for now.

Edit: the site I'm troubleshooting is https://aspirecounseling.com/

I'm troubleshooting an intermittent issue with Elementor Pro popups on a live WordPress website and would appreciate some outside perspectives.

Website stack:

• WordPress
• Elementor + Elementor Pro
• Blocksy theme + Blocksy Companion
• SiteGround hosting with Speed Optimizer
• PixelYourSite Pro (GA4/Meta tracking)
• Tidio live chat

The problem:

On Friday, October 9, we performed routine WordPress plugin/theme updates, including Blocksy.

Before the updates, our website was consistently receiving form submissions through an Elementor Pro popup triggered by "Get Started" buttons throughout the site.

Immediately afterward, GA4 showed a dramatic decline in both form_start and form_submission_successful events, despite website traffic remaining relatively normal.

The concerning part is that the issue is intermittent.

The popup works perfectly in some browsers and sessions, but in others, clicking the button does absolutely nothing. The page itself renders normally, and there are no obvious visual problems.

What we've discovered:

1. Reproduced the issue in Microsoft Edge. Clicking an Elementor popup button did nothing.
2. Checked DevTools and found that typeof elementorProFrontend returned "undefined".
3. Further testing confirmed that Elementor Pro's popup functionality was unavailable during the failed load.
4. Refreshed the exact same page, and the popup started working normally.
5. Network inspection showed Elementor JavaScript files returning HTTP 200 responses, although this doesn't necessarily confirm successful execution or initialization.
6. Console warnings were primarily related to third-party tracking prevention (Google/Tidio), without an obvious Elementor-specific error.
7. Independent testing from another user successfully opened and submitted the form.
8. We have since received another legitimate form submission, so the system is functional at least some of the time.

Caching/optimization configuration:

SiteGround Speed Optimizer originally had:

• JavaScript minification: Enabled
• JavaScript combination: Disabled
• JavaScript deferral: Disabled
• Remove query strings from static resources: Enabled
• Dynamic caching: Enabled
• Memcached: Enabled
• NGINX Direct Delivery: Enabled

We've since disabled "Remove Query Strings from Static Resources" to preserve version parameters on JS/CSS asset URLs.

We've also cleared Elementor-generated files/data, SiteGround Dynamic Cache, and Memcached.

JavaScript minification remains enabled.

Elementor's CSS Print Method is set to External File, and Element Cache is set to 1 Day.

Why I'm suspicious of caching or script initialization:

The biggest clue is that the popup can fail on the initial page load but work immediately after refreshing.

When it fails, elementorProFrontend is undefined. When it works, the Elementor Pro frontend object is available.

This makes me wonder whether we're dealing with stale/mismatched JavaScript assets, an initialization race condition, a SiteGround optimization conflict, or a compatibility issue introduced by the recent Blocksy update.

My questions:

1. Has anyone encountered Elementor Pro's elementorProFrontend being intermittently undefined after updates?
2. Could SiteGround's JavaScript minification cause this behavior even with JS combination and deferral disabled?
3. Is there a reliable way to determine whether Elementor Pro scripts are failing to execute versus simply initializing too late?
4. Could the Blocksy update have introduced a script-loading conflict?
5. What would you investigate next to identify the actual root cause without repeatedly changing settings on a production website?

This is a lead-generation website, so reliable popup functionality is extremely important. I'm trying to identify the underlying cause rather than randomly disabling plugins or optimization features.

Any suggestions from developers who've encountered something similar would be greatly appreciated.

Looking for answers in the ”all else being equal” logical process to be able to answer what actions to take.

Im troubleshooting a restore from a complete backup from an old hosting environment (including files, database, plugins etc) in a new hosting environment. No specific settings or for example special htaccess rules are transferred or part of the backup.

1. I begin with only webhosting space

2. Install wordpress (default theme, no plugins)

3. Install one plugin from official wordpress drectory (used for backup/restore)

4. Manually provide the backuped files

5. Restore

The trouble is rooted in the use of http/https path for the database structure. Im getting a warning/prompt that the database is using https paths while the untouched new environment uses http.

Im thinking that https should not be the default install path, and that the ”https upgrade” is handled by the ssl certificate of choice. Is this correct?

Hi. I'm looking for a plugin for my astronomical society website where we can display details of all the books we have in our library. We're not looking to sell books or have a full blown library system that handles loans, recalls, fines etc. All we need is to display the title, author, year published and subject and allow users to search by subject and keyword. All the plugins I've found so far (RS WP Book Showcase, Library Management System, Books Gallery, Book Review Library, etc.) are way overblown for what we need.

Any suggestions please?

A few days ago, I was looking through my old backups and found a WordPress SQL export and thought it’d be great to have the content in my Obsidian vault for memory lane. Wrote up the experience here: https://medium.com/@noteapps/turning-a-2007-wordpress-backup-into-an-obsidian-archive-7850632ff63c

Hallo guys I am on wp 7.1 and i am using the wp-dequeue-style for the global styles also the wp block library and wp block library theme and I still see wp block classes in the html elements that are coming from gutenberg, can somebody help?

Disclosure first: I built this, it's my plugin, and it's free on WordPress.org.

I kept seeing TranslatePress users run out of AI words: the free version has a 2,000 AI words limit, and the paid plans count words too (from €99/year for 50,000 AI words on one site, with extra 100,000 words for €24). With several languages that allowance goes quickly.

So I made an add-on that puts a Translate page button in the TranslatePress visual editor. You pick a language, click once, and every untranslated string on that page is sent to the AI you choose, checked, and saved into TranslatePress as a machine translation you can review and edit as usual.

What it does:

• Works with the free TranslatePress plugin. No TranslatePress paid plan or add-on needed.
• Bring your own API key for Claude, ChatGPT, Gemini or Groq. You pay the provider directly at their API rates; there is no subscription and nothing goes through me. Gemini and Groq have free tiers with limits.
• Or use Free basic with no key: it uses the translator built into Chrome and Edge on desktop, so the text never leaves your computer. Quality is basic.
• By default only untranslated strings are sent. Translations you wrote or edited yourself are never overwritten.
• Undo last run and Clear machine translations on this page, both keeping your own edits.
• Every result is checked against the original before it's saved. If the AI changed an HTML tag, link, placeholder like %s or {{name}}, or a shortcode, the string is retried once with stricter instructions, and if it's still wrong it's left untranslated instead of breaking your page.
• Warns when a result looks like the wrong script (for example Latin instead of Cyrillic) or the wrong Chinese variant (Traditional vs Simplified).
• Keys are encrypted per user and never sent to the browser. Administrators only.

What it doesn't do (so nobody is surprised): it translates one page at a time from the editor, not the whole site in one go. Strings shared between pages, like menus, are translated once and reused. It doesn't support DeepL.

Plugin: https://wordpress.org/plugins/melotools-ai-translation-translatepress/

It's brand new, so honest feedback is the most useful thing I can get, especially from people translating into non-Latin scripts. I'll answer questions here.

A client of our recently attended the 2026 Health Sector SMB Cyber Resilience Summit Melbourne - https://cx.cybercert.ai/2026-health-sector-smb-cyber-resilience-summit-melbourne#eventinfo

It was organised by Coalition Insurance operates in Australia through Coalition Insurance Solutions Pty Ltd, which provides active cyber insurance and risk management services https://www.coalitioninc.com/au

Apparently one of the Coalition Insurance speakers advised the audience that anyone using WordPress should move off this platform ASAP. They did not make any another suggestion leaving our client confused so they reached out to us for advice since we manage their WordPress site.

While WordPress is not perfect, I want to call out companies like this who make out-of-context declarations regarding cyber security. Telling every WordPress user to "move off the platform ASAP" without nuanced guidance is unprofessional. It will cause nothing but panic, especially in sensitive fields like healthcare.

They also run a blog and have this article about WP2Shell Vulnerabilities

https://www.coalitioninc.com/blog/security-labs/wp2shell-vulnerabilities-exploited-in-the-wild

There is no mention in their formal literature telling millions of organizations to abandon the world's most popular CMS but instead, they focus on proper patching and lifecycle hygiene, which applies to literally any software .

What are your thoughts?

Hi everyone!

I wanted to share a free plugin we recently published on WordPress.org designed to solve a common conversion problem for WooCommerce store owners: poor social media link previews.

The Problem

When you or your customers share a WooCommerce product link on WhatsApp, Facebook, or iMessage, the default og:image preview usually looks broken:

• Images get awkwardly cropped or stretched.
• Crucial details like price, sale badges, or ratings are missing.
• It looks like a generic web link rather than an engaging product banner.

Existing SEO plugins allow you to set static images, but they don't dynamically overlay real-time product data directly onto the visual card.

How FastOG Solves This

FastOG automatically transforms standard WooCommerce product links into dynamic, high-converting social preview cards.

Key Features:

• Real-time Product Banners: Automatically embeds the product price, sale discounts, currency, and CTA directly into the preview image.
• Zero Server Overhead: Rendering happens externally on edge infrastructure (~191ms average latency) cached via Cloudflare CDN — your WordPress server doesn't waste CPU or RAM generating images via PHP.
• Plug & Play: Zero complex configuration needed. Just activate it, and your social link previews immediately update.
• Automatic Cache Management: Sends proactive re-crawl signals to Meta/Facebook whenever product details or prices change.

Try it out & Feedback Welcome

The plugin is completely free and available on the official repository:

👉 WordPress.org Link: FastOG — Dynamic Social Cards & Link Previews for WooCommerce

Would love to hear your feedback, bug reports, or feature requests from WooCommerce store owners and developers!

Hey everyone,

Over the last month, I’ve been analyzing access logs and crawler behavior specifically looking at how AI search engines (OpenAI's GPTBot, Anthropic's ClaudeBot, and PerplexityBot) interact with WooCommerce product catalogs.

Since LLM-driven shopping and search is picking up, a few observations stood out:

1. Heavy HTML vs Markdown (Crawl Efficiency)
Product pages with heavy builders (Elementor/Divi) and 60+ scripts get crawled noticeably slower. When providing a clean, token-efficient /llms.txt or markdown feed, the bot hits almost the entire catalog in a single pass without getting choked by server limits.

2. Perplexity relies heavily on FAQ schemas
For product recommendation queries ("best X for Y under $Z"), Perplexity seems to prioritize structured FAQ and product metadata (JSON-LD) over standard paragraph descriptions.

3. Bot Spoofing is real
A surprisingly high number of scraper bots pretend to have user-agents like GPTBot or ClaudeBot to bypass standard blocks. If you're analyzing this, running Forward-Confirmed Reverse DNS (FCrDNS) checks on their IPs is mandatory, otherwise half your "AI crawler" data is just random scraping bots.

4. Revenue is starting to trickle in
By passing native UTM tags into order attribution (utm_source=chatgpt / perplexity), we saw about 8 orders ($800+) across a couple of stores that originated directly from AI chat sessions.

Are any of you currently preparing your store architectures for generative engine optimization (GEO), or are you treating it as standard SEO for now? Curious to hear how other store owners/devs are approaching this.

Edit: Thanks for the thoughtful feedback. To be clear, these were small-sample observations from limited testing, not controlled results, and shouldn't be read as proof that llms.txt or FAQ schema improves AI visibility. Disclosure: I'm the developer of a WordPress plugin in this space (Zoventic GEO). Method and sample sizes to follow if I run a proper holdout test.

I’ve been wondering how people track the journey from content to purchase.

Something like:

Blog Post / Page → Product → Cart → Purchase

Do you currently know:

• Which posts influence purchases?
• Which landing pages generate the most revenue?
• Which articles get traffic but almost no product clicks?
• Which products perform best from specific content?

If you track this already, what tools are you using?

One thing I've learned about WordPress development is that building a website and maintaining it are two different challenges.

A website can look great at launch but become difficult to manage if it relies on poorly maintained plugins, unnecessary customisations, or a complicated editing setup.

That doesn't mean using multiple plugins or page builders is automatically bad. What matter more is how well they're chosen, configured, and maintained.

I think a good WordPress setup should make routine content updates straightforward and avoid unnecessary dependencies.

I'm curious how other developers approach this.

Hey everyone,

I’ve built a free WordPress plugin that lets webadmins disable unused WordPress features like emoji scripts, XML-RPC, Heartbeat and a million other features. But building it is the part I’m comfortable with - getting it in front of people is where I could use some advice.

For anyone who’s launched a plugin, what actually helped you get your first users?

• Tutorials targeting specific problems?
• Sharing in WordPress communities?
• Reaching out to bloggers or YouTubers?
• Improving your WordPress.org listing?

I’d especially appreciate firsthand experiences: what was worth the effort, and what turned out to be a waste of time?

Hello everyone!

I am the developer of Spectral Dot plugin which is a free WordPress plugin that I managed to release this week.

First of all, this plugin was designed to let store owners offer temporary product reservation, also provide a temporary solution for customers that need to think more when they want to purchase an item (luxury or non-luxury).

How Spectral Dot works:

- You are able as a customer to reserve a product for a limited time while you decide whether to purchase it
- Once you do this reservation, one unit of stock is held for you for the amount of time that the administrator set.

- In that time you can add the reserved item to your cart and complete checkout in your account-> Reserved products.

- If someone does not purchase the item when the time expires, the reserved unit is automatically returned to available stock and you will not need to manually update stock levels.

In this version that was released, an account for the customer will be required in order to be able to reserve products.

For more safety for the administrators, we implemented the admin approval feature that will save you from spam requests as you can approve or deny any reservation made (in case this happens, this feature allows you to not reserve a stock until you approve it).

You can test it on your website and see if this will suit your store:

Wordpress.org: https://wordpress.org/plugins/spectral-dot-reservations/

For all the store owners, here are my questions for you:

• Would product reservations be useful for your store?
• What concerns would you have about customers holding stock?
• What features or settings would make this more useful for you?

I’d appreciate your honest feedback about this and I'm here to answer any questions you have regarding Spectral Dot.

Thank you all for your time!

BlogHub (bloghub.app) is a community-curated discovery platform for blogs and Substack publications.

It helps readers find great independent writing without relying on algorithmic feeds.

Writers get a place to be discovered by readers who actively look for new voices.

Recommendations come from the community, so quality rises to the top naturally.

Link: https://bloghub.app