❌

Reading view

[PROMO] I built a free WordPress block theme with 23 starter sites — here's how it works

Full disclosure: I'm a developer at bPlugins, and I built bBlocks, a free GPL-licensed Full Site Editing theme. I'm sharing it because I think some of its implementation choices might be useful to people working with WordPress block themes.

The theme is built entirely around WordPress core blocks. It doesn't require a page builder or an additional plugin to function.

A few things I focused on while building it:

Starter sites and patterns

  • 23 one-click starter sites covering business, agency, restaurant, clinic, law firm, school, gym, real estate, spa, magazine, and more.
  • Two WooCommerce store designs.
  • 150+ block patterns, including hero sections, pricing, team, FAQ, and testimonials.
  • The importer uses patterns bundled with the theme rather than downloading content from external sources.
  • Re-importing a starter site updates its existing pages instead of creating duplicate pages.

Design customization

  • 22 style variations
  • 6 color palettes and 5 font pairings
  • 5 interchangeable headers and 3 footers

WooCommerce and optional features

  • Templates for shop, single product, cart, checkout, and order confirmation.
  • 9 optional modules, including dark mode, sticky header, table of contents, and reading progress.
  • Modules are disabled by default. Their CSS and JavaScript are only loaded when enabled.

I also included self-hosted fonts, keyboard navigation, reduced-motion support, and RTL/translation readiness.

Technical requirements: WordPress 6.6+ and PHP 7.4+.

Theme URL : https://wordpress.org/themes/bblocks/

I'm particularly interested in discussing two implementation decisions:

  1. For starter-site imports, would you prefer updating existing imported pages on re-import, or having an option to create a completely separate copy?
  2. With 22 style variations, does that provide useful flexibility, or would a smaller, more curated selection make the Site Editor easier to use?

I'm the developer, so technical criticism is welcome too. If you've built or maintained an FSE theme, I'd especially appreciate your perspective on the importer, pattern organization, and overall Site Editor workflow.

submitted by /u/dev-prosanta
[link] [comments]
  •  

How do you use Gutenberg?

Just pure with TT5 pre-installed or do you usually add a Theme (Kadence, Blocksy, GeneratePress, Astra, OceanWP etc.)?
If yes which would you recommend working with?
I prefer working completely free or lower Lifetime Licenses/unlimited.

I worked with Elementor and Pro Elements in the past but want to convert sites slowly to Gutenberg.

Gutenberg finally has its own Responsive Controls and ive tried rebuilding a Elementor Site with Gutenberg. Worked medium well on simple sites but not good enough to bet on this Tech Stack as my primary.

The header/navigation bar and off canvas mobile menu looks ugly and i dont know how this can be edited + in general no option to add simple slide fade animations.

If more options are needed i need to install for example Kadence or Blocksy and then my whole page immediatly looks broken because i build it while having TT5 and i have to rebuild the stuff i build with gutenberg native blocks in kadence blocks which offer the animation features and pixel perfect control like iam used to in elementor.

And now i completely depend on these Third Party companies and i heard Kadence starts to become enshitted.

And i dont know if Gutenbergs workflow is still right nowdays, in Elementor V4 we have this method like in Bricks. You can graphically build your CSS classes like btn and primary-btn and still give the elements local CSS properties if they have unique stuff.

In Gutenberg i did not see this option.

V4 can maintain a site with 100 Pages easily over the years and even create resuable components.

I know how to write html css js react etc. these are familiar concepts and i like how v4 did this.

I dont know about bricks, ive heard its more performant but i dont want to spent 700€ for a lifetime license and in 5 years i suffer from being vendor locked in.
Iam not willing to pay 15 bucks monthly to elementor pro too and do not want to locked into a extreme commercial products system.
Divi costs arround 250€ but its still risky in my opinion.

Ive heard about greenshift but dont understand what it is and how popular this is.

I can live without the CSS first approach and not having 100% pixel perfect options but i can now see if i need more basic features on my demo site i have to rebuild everything in Kadence.

In a real world project i could never tell my client sorry i cant add animations to your site or there is no way to change your navigation bar otherwise your site breaks completely. This could be a compromise in a little bakery family business but not with me receiving money from clients.

Back then Gutenberg didnt even had responsive controls, the only way arround was custom css but i do not want to outsource something like this in the custom css tab or in plugins. I want to work clean and the option to leave projects while knowing the next guy can maintain everything.

submitted by /u/onur24zn
[link] [comments]
  •  

Contact Form 7 Error Message

I get the "There was an error trying to send your message. Please try again later." error message, with a red border, when trying to submit ALL forms on my website (www.rhinelanderrabbits.com). I have WP Mail SMTP set up, and the test email works fine. I'm also using Cloudflare, and everything looks good on that end. I have also tried WP Mail Logging, and it still didn't work. Any other suggestions on things I can try, please and thank you?

submitted by /u/emmer1234
[link] [comments]
  •  

Why are comments not appearing on all pages?

Update: I finally got the comment section working, I put it in a block, I was doing it wrong previously, but figured it out.

I've been going in circles trying to enable the comment section, I've followed all the steps to add comments, tried adding a code, made sure comments were allowed on each page, and even made a few test posts for each page, the comments don't appear anywhere.

submitted by /u/illustratious
[link] [comments]
  •  

Selling my blog in 2026, where?

Hi all,

I’ve been running a lifestyle blog on sustainable living since 2019, and I’m thinking about selling it. My focus has moved to other things, and I don’t have the time to give it the attention it deserves anymore.

I sold my first website in 2018, but I feel things have changed a lot, and I have a few questions:

  1. Do people still buy small content sites in 2026 at all?

  2. I sold my first blog on FB. I found a buyer in one of the groups there, but I wonder where people actually sell sites nowadays? My blog is too small for big platforms that have high requirements for monthly income.

  3. Is it worth reaching out to bigger sites or brands in the same niche directly and seeing if they’d be interested in buying my blog?

Here’s some general info about the site in case anyone’s curious:

  • Niche: zero waste, slow fashion, plant-based living, conscious consumption
  • Around 7 years old, all original content written by me (225 articles)
  • Traffic around 8K sessions/month
  • Income (mainly ads, Mediavine) has been steady at around $150-200/month for the past year and a half (plus a bit of extra on top of that from Amazon)
  • Email list of ~450 subscribers
  • Two ebooks with a welcome email sequence already built
  • YouTube channel: 3.7K subs and Instagram: 5.6K, though Instagram is a bit connected to me personally, so IDK if I can untangle it

I’d really appreciate any advice! Thanks.

submitted by /u/CryptographerTop4006
[link] [comments]
  •  

Why is WordPress so slow to find internal links?

I just learned that WordPress prioritizes the title and image title over links in the body. I was thinking maybe I had a plugin issue or something causing it, because when I search to get an internal link and I know there is a post with that word in it, it can take four to six seconds before it even finds it. It always puts images and tags first, which I found very annoying, so I didn't realize that was actually a problem with WordPress itself.

Anyhow, I fixed that with my own search mod which I have in a free plugin.

I just thought it was kind of weird. What do you guys think of some of the little quirks of WordPress that bug you? What is the most annoying thing that should have been fixed by now?

submitted by /u/andrewmurray1
[link] [comments]
  •  

How do you think WordPress and its plugin ecosystem will be affected by AI assisted "vibe coded websites"?

As above... Especially for those who have built their entire businesses around the WordPress framework and ecosystem - either as an end result user, or as a plugin developing producer.

At the same time, what can existing WordPress website users and plugin producers do to ensure that their existing and long-term efforts and plans don't get overshadowed by those who are able to create similar results using "vibe coding" (that requires only a small fraction of the time and effort)?

submitted by /u/prankster999
[link] [comments]
  •  

Kadence big price inrease?

Is that true, or did I miss something?

The Kadence Essential” plans, etc., are no longer available, and now there are only plans based on the number of websites.

One website costs $350. Not long ago, there were still $160 plans for Plus and $99 plans for Essentials.

Right now, I'm using Plus myself for 160 dollars, and it looks like it will be renewed for the same price.

If that's true, how do you deal with it?

submitted by /u/LaserLux_
[link] [comments]
  •  

Beginner) staging or duplicate Elementor draft?

I have a WordPress website used to booking appointments and this was created by a company. I hired a while back.
Now I want to redesign the website, but I’m a complete beginner.
I want to test my ideas without affecting the live website. Should I use staging or duplicate
Elementor draft? ChatGPT says duplicating has more risks, but it seems like I have to pay for staging.

submitted by /u/chunchun12345
[link] [comments]
  •  

Avada Theme crashes on PHP 8+ when FS_METHOD set to ftpext

The Avada 7.16.x theme crashes WordPress when define('FS_METHOD', 'ftpext'); is in wp-config.php and PHP is version 8 and higher.

This error has been an issue with Avada on our sites since PHP 8 came out.

I'd been putting off updating our PHP version because of this, hoping it would be fixed. I've brought it to the devs' attention in the past, too, but they were no help. Due to PHP2Shell, we had to upgrade our servers from PHP 7.4.xx to 8.4.xx and remove the FS_METHOD line, making updates much more time-consuming to implement.

Search results for this issue always say to set FS_METHOD to direct but I can't do that due to security concerns and write permissions that I can't change. I've tried setting it to ssh2 with a plugin that is supposed to enable that but couldn't get it to work (even though I can connect via SSH2 with PuTTY).

Some of my sites are running different themes (Newspaper and Kale) and they have no problems with FS_METHOD set to ftpext, so I don't think this is a server/permissions issue. I've also tried disabling all plugins on my Avada dev site, but it still crashes.

Error logging returns this:

Fatal error: Uncaught TypeError: ftp_nlist(): Argument #1 ($ftp) must be of type FTP\Connection, null given in [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php:492 Stack trace: #0 [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php(492): ftp_nlist() #1 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(465): WP_Filesystem_FTPext->exists() #2 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(307): Avada_Server_Rules->is_htaccess_writable() #3 [ROOT_DIR]/wp-content/themes/Avada/includes/class-avada-server-rules.php(116): Avada_Server_Rules->maybe_upgrade_rules() #4 [ROOT_DIR]/wp-includes/class-wp-hook.php(353): Avada_Server_Rules::init() #5 [ROOT_DIR]/wp-includes/class-wp-hook.php(377): WP_Hook->apply_filters() #6 [ROOT_DIR]/wp-includes/plugin.php(523): WP_Hook->do_action() #7 [ROOT_DIR]/wp-admin/admin.php(180): do_action() #8 {main} thrown in [ROOT_DIR]/wp-admin/includes/class-wp-filesystem-ftpext.php on line 492 

My best guess is this has something to do with class-avada-server-rules.php not playing nice with PHP 8 and/or WordPress, but this is moving into unknown territory for me.

Does anyone have any ideas or suggestions for things I can try to get around this issue? Maybe some edit to class-avada-server-rules.php that I can put in my child theme?

- - semi-related rant incoming - -

In the past I'd go to ThemeFusion (Avada devs) for support, but they only include one year of support per license. The only ways to extend support are to buy another license for $70 or a 6-month renewal for $50, which is ridiculous. No wonder Avada is a best-seller; if you don't buy another copy every year, you don't get support! Inflating their sales numbers that way is dishonest and should be illegal.

Anyway... I'm at my wit's end. Thanks for reading.

submitted by /u/neopifex
[link] [comments]
  •  

Site compromised, interesting implementation of a persistent virus

Hello WordPressers :)

I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.

Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.

It generated the following files and directories:

  • /home/foobar/public_html/wp-content/.sc_494g1672
  • /home/foobar/public_html/wp-content/.gk_eb46c3gc
  • /home/foobar/public_html/wp-content/.kk_cb505c82
  • /home/foobar/public_html/wp-content/ab743742.zip
  • /home/foobar/public_html/wp-content/uploads/2026/10/ab743742.zip
  • /home/foobar/public_html/wp-content/plugins/agile-beacon-go
  • /home/foobar/public_html/wp-content/plugins/hyper-proxy-cue
  • /home/foobar/public_html/wp-content/plugins/nexus-curator-rig
  • /home/foobar/public_html/wp-content/plugins/swift-keeper-dex
  • /home/foobar/public_html/wp-content/mu-plugins/.bt_hyper-proxy-cue
  • /home/foobar/public_html/wp-content/mu-plugins/.pv_hyper-proxy-cue
  • /home/foobar/public_html/wp-content/mu-plugins/.sd_hyper-proxy-cue
  • /home/foobar/public_html/wp-content/mu-plugins/.swm_hyper-proxy-cue
  • /home/foobar/public_html/wp-content/mu-plugins/hyper-proxy-cue.php
  • /home/foobar/public_html/mu-plugins/hyper-proxy-cue.php

Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.

The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.

The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.

The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.

Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.

At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.

A few interesting things about this virus:

  • It uses token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.
  • It uses function_exists() to test for various functions, so it can understand what it can do to its host server.
  • It generates a padding size for modified files, so that it matches the target size and avoid detection from scanners that check file size.
  • It generates various "sidecar" files with quality markers in MD5, a version file, rate limits (regenerate itself every 4 minutes) and a write race/lock flag.
  • It executes hidden commands from wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.

The following strings can used to grep/search for the infection:

  • SCV:
  • SC_TH_BEGIN
  • hyper-proxy-cue
  • _sc_fam
  • _sc_commit

Let me know if you need more details!


EDIT with information about the plugin*

The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.

It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.

The main code does:

  • List Ethereum JSON-RPC endpoints and contract addresses.
  • Receives an Ethereum contract with remote commands.
  • It sends server information like domain, plugins, admin users+passwords, session cookies, etc.
  • It receives remote code and executes it.
  • It has some obfuscated code to detect legitimate plugins, it modifies some of them.

Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.

On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.

It does various other things that I can't be bothered to write about :)

submitted by /u/Maria_Thesus_40
[link] [comments]
  •  

Backups off site

Curious what agencies and developers are recommending to clients about downloading their own periodic backups. Hosting mainly on WPEngine and assume that backups are safe there, but with increased threat level from AI bad actors wondering more and more if we should force clients to periodically download complete backups in case something really goes sideways. Thoughts?

submitted by /u/ksparkman
[link] [comments]
  •  
❌