Hey guys, I use Envira Gallery to make video galleries for most of the posts on my website.

Since the latest updates to Envira all my video galleries old and new are broken - the video player does not show in the lightbox when you click the thumbnail, and the play button does not appear on top of the thumbnails either.

It is happening for both YouTube and VideoPress videos that I have embedded in my galleries.

VideoPress support confirmed that they believe it was an issue with the latest Envira update.

Trying to get support from Envira but all I have got so far is a generic AI reply. It's very frustrating because Envira is by far the most expensive thing I pay for on my website.

Hopefully they fix it soon as my site is broken at the moment because of this. Anyone else having issues?

Release notes: https://wordpress.org/documentation/wordpress-version/version-7-1/ - some of my pages show the update button already 👍 But they've hit the planed release date (https://make.wordpress.org/core/7-1/)

Happy to see my mailbox explode tomorrow morning 😄 Hopefully just with "successfully updated..."

Hey all — I've been building a plugin called PDF Catalog for WooCommerce and wanted to share it here in case it's useful to anyone, especially wholesale/B2B store owners.

The problem I kept running into: customers (especially B2B/wholesale buyers) often want an offline, printable version of a product catalog — for trade shows, email follow-ups, or just browsing without needing to be online. There wasn't a lightweight way to generate that straight from WooCommerce.

What it does:

• One-click PDF export for the whole shop, a specific category, or a single product
• Grid or list layout, adjustable fonts/colors/image size
• Option to hide/show price, SKU, stock, tags, description, etc.
• Exclude out-of-stock items, specific products, categories, or user roles
• RTL/LTR support for multilingual stores
• Works via shortcode or a URL param for single-product PDFs

It's free on WordPress.org (1,000+ active installs so far), there's an optional Pro version with custom headers/footers and layout extras, but the core catalog export is fully free.

Link: https://wordpress.org/plugins/pdf-catalog-woocommerce/

Would genuinely love feedback — especially from anyone running a wholesale/B2B store, since that's the main use case I built it for. Also happy to answer questions about how it works under the hood.

I am trying to build a course for my website hosted on wordpress. I am very new to the whole thing and I cannot seem to get elementor to work when trying to edit my course layout/content. I have set up the sections and the lessons, but when trying to edit how it looks with elementor, nothing happens.

Normally when i edit pages with elementor i can click the "Edit with Elementor" as the cursor turns to a pointer, it doesnt do that when i am viewing the course page.

Does anyone know how to fix?
EDIT: I have checked off courses and lessons in elementors settings

I've been working on WordPress plugins for years, and recently decided to rebuild a PWA plugin from the ground up rather than keep adding to an old codebase.

The interesting part has been dealing with the real-world stuff:

• Service-worker caching and updates
• iOS vs Android PWA behavior
• Offline support
• Caching/CDN/plugin conflicts
• Push notification permissions and subscriptions
• Making the installation experience feel more like a real app

I've recently added push notifications for Android, desktop, and iOS, and I'm still improving the project based on real-world testing.

The project is Hyper PWA.

I'd love to hear from other WordPress developers:

What has been the biggest problem you've faced when implementing or maintaining a PWA on WordPress?

I'm especially interested in feedback about things that existing PWA plugins don't handle well.

Full disclosure: I'm the developer behind Hyper PWA. I'm sharing it here because I'd genuinely like technical feedback and ideas for improving it.

https://wordpress.org/plugins/hyper-pwa/

Astra – Where can I find the Logged In / Logged Out display settings?

Hi! I'm using WordPress with Astra, Elementor and WooCommerce.

Some time ago, I configured an element in my header to only appear when a user is logged in (a “Log out” button). Now I want to remove/change it, but I can't remember where I configured this.

I think there was a setting like “Logged In / Logged Out” visibility, but I can't find it anymore in Astra or the Header Builder.

Does anyone know where this setting is located?

Thanks!

I've embedded Google Calendar into my site for client bookings. It works fine, but opens a new window whenever I click on a time slot. Apparently this some security feature. Asked Gemini and it suggested I add target="_self" to the code, but this didn't fix it. Is there something else I should add to the code to fix this or possibly a plugin that might function as a work around? My preference would be to stick to Google Calendars rather than a third-party app for ease of use.

Fairly new to running my own WordPress site and I got a fright the first time I opened the login logs, dozens of failed attempts a day from IPs all over the place. From what I've read since, this is mostly background noise: automated bots spraying credentials at the default login on basically every install, and unless the numbers are huge or paired with other symptoms it isn't a targeted attack. I tightened the obvious things, a strong unique password, a second factor on the admin account, and capping how many tries an IP gets before it's locked out, and the volume dropped noticeably.

Two things I'd love a reality check on from people who've run sites longer: at what point should a spike in failed logins actually worry me versus just being noise, and is limiting attempts + 2FA genuinely enough on its own, or is there one more thing you'd treat as non-negotiable? Don't want to bolt on five plugins for a problem that's already handled.

Been going back and forth on this one. My logs fill up with failed logins on the default /wp-login.php every day, as far as I can tell it's just bots hitting the same path they hit on every WordPress site, nothing targeted at me. Limiting attempts and adding a challenge to the form quieted most of it, but I keep wondering whether moving the login off the default path is genuinely worth it or just security-through-obscurity that breaks more than it fixes.

For those of you who've hidden the login URL: did it actually cut the noise in your logs, or did it mostly create headaches with things that expect wp-login.php (mobile app, integrations, the odd plugin)? And if you deliberately don't hide it, what's your reasoning, rate-limiting at the edge and calling it done? Trying to figure out where the real payoff is before I fiddle with it further.

ive been making contact forms with WPforms but after having to go through WordPress → WPForms → Gmail OAuth → Google Cloud → Client ID → and much more, it is almost impossible to make a working contact form for my clients

i feel like a dumb when i try to use those tools like Elementor or even Wordpress theme editor. I simply cannot do a simple thing on it. It feels wrong for me. Yeah i have serious skill issue with Wordpress ecosystem. I just want to know if there is a way to CODE my frontend by purely opening a text editor and diving into it, testing and then deploying it. Is there a way? Jesus help me.

I posted here a bit over a week ago about using flat URLs for Destinations and Locations on a travel site I’m developing, while keeping Activities under /activity/.

The structure I'm leaning towards is:

/queenstown/ Destination CPT post /otago/ Otago term in the Location taxonomy /activity/shotover-jet/ Activity CPT post 

Internally the geography can still be hierarchical, for example:

South Island → Otago → Queenstown Lakes → Queenstown → Shotover Jet 

The hierarchy would be handled through taxonomies, breadcrumbs and navigation rather than being built into the public URL.

A few people on my original post raised good questions about collisions, WordPress's own root-level routes, canonicals and long-term maintenance, so I spent some time testing those rather than just assuming the resolver would be fine.

The current test version uses one cached registry that maps each valid root slug directly to its WordPress object. For example:

queenstown → Destination post ID otago → Location term ID about → Page ID 

Activities do not use that resolver and continue through normal WordPress routing under /activity/{slug}/.

I tested quite a few failure cases as well:

• Unknown and malformed root URLs return genuine 404s.
• A Destination and Location cannot silently share the same flat slug. The route is withheld if there is a collision.
• Draft, Publish, Trash, Restore and slug changes automatically update the registry.
• /activity/ is protected as a reserved root.
• I also explicitly tested /feed/, /search/, /page/ and /wp-json/.
• If a Destination or Location tries to claim one of those reserved roots, the resolver refuses to publish that route and the native WordPress functionality continues to work.
• /feed/ continued serving the RSS feed.
• /search/test/ continued serving WordPress search results.
• /wp-json/ and /wp-json/wp/v2/posts continued serving the REST API.

That testing exposed something I hadn't really considered before.

WordPress can still allow content to have one of those reserved slugs and generate a View/permalink for it even though the resolver refuses to publish the route.

For example, I created a Location with the slug feed. The resolver correctly blocked it from /feed/, so the RSS feed continued working, but WordPress still showed /feed/ as that Location's View URL.

The same thing happened with search, page and wp-json.

For production, would you prevent an editor from publishing a root-level Page, Destination or Location with a reserved slug in the first place, rather than just detecting the conflict and withholding the route? And would you show the editor a clear message explaining why that slug is unavailable?

I also tested the permalink/canonical/sitemap side.

For a Destination:

/queenstown/ 

The browser URL, WordPress View URL, resolver path, HTML canonical and WordPress XML sitemap URL all matched.

For an Activity:

/activity/shotover-jet/ 

All of those matched as well.

For a Location:

/otago/ 

The browser URL, WordPress term URL, resolver path and XML sitemap URL all matched. The one difference was that vanilla WordPress did not output an actual <link rel="canonical"> tag for the taxonomy archive, so I'd want to make sure the eventual SEO setup supplies exactly one canonical for /otago/.

The native WordPress sitemaps also came out as I hoped:

/queenstown/ /otago/ /activity/shotover-jet/ 

At this point I'm reasonably confident the routing itself can be made to work. Would experienced WordPress developers actually be comfortable maintaining something like this for years?

If you were building this for production, how would you handle the reserved root namespace over time? Would you keep an explicit list of protected roots, derive them from WordPress rewrite rules somehow, or use another approach?

If the reserved-slug validation, canonicals and sitemaps are handled properly, would you be comfortable keeping the flat public URLs:

/queenstown/ /otago/ 

or would you still prefer:

/destination/queenstown/ /location/otago/ 

Would you still prefer those prefixed URLs simply because they reduce the amount of custom routing that has to be maintained?

I'm much more interested in the long-term maintenance trade-offs than in shaving a few characters off the URLs.

If there’s anything important I’ve overlooked with this approach, I’d be interested in hearing about it. Your help would be much appreciated.

From an agency owner who's been using WP since 2013 and now also quickly becoming a Claude expert, here's a few truth bombs. I'm offering all of my clients a choice between WP or a site built with Claude code, not holding back on any positives or negatives. Just over 70% are picking WP.

The main reason? The total inability for them to update anything or log into a CMS. They feel they have more control and more ownership of a WordPress site. It starts to fall apart when I tell them that every change with Claude built sites would require my team. Yes, that's included in our monthly package but savvy owners are asking "so if I need to charge or update anything outside of your business hours....." then yep, they have to wait.

This is not an issue for the 30% who choose a Claude built site where they don't anticipate any changes, or very few. Also AI has an very negative stimaga, especially to the slightly older business owners; "you're gonna build my site using what?"

Other huge AI issues? Backend functionality. Setting up a database using Supabse, definitely a learning curve. Plugins? Obviously non-existent which means coding one or duct taping a third party solution onto the site.

Hey everyone, I’m curious that what plugin or tool are you using to handle form submissions on your WordPress websites?

I've been using the free version of Wordfence for a few years. Today I got an alert listing every single plug-in on my site. I'm attaching an image of the warning, and an example of what Wordfence found. Usually I'd just go ahead on use Wordfence to fix this, but now I'm getting a warning:

"Download Backup File

Please make a backup of this file before proceeding. If you need to restore this backup file, you can copy it to the following path from your site's root:

wp-content/plugins/wpforms-lite/src/Requirements/Requirements.php

Learn more about repairing modified files."

So there would be a lot of downloading, since there's a bunch of plug-ins.

Any advice would be appreciated!

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

Hellooo, I’ve worked with Elementor and Elementor Pro for over 2 years. It’s not bad, but honestly, I’m not a big fan of it.

I’ve had sites where the design took way too long to load, even with caching properly configured, decent server and etc. Sometimes I suspect Litespeed server cache configuration, but still, it’s frustrating.

I’m thinking about switching to another builder, but I’m on a limited budget, so I’d really like to hear from people who have actually used different builders in real projects, not just tested them for a few days. 😀

I’ve heard about so many alternatives, including Bricks, Breakdance, Divi and even some cheaper options with lifetime licenses.

What’s your favorite WordPress builder, and why? What has your experience been with it in real-world projects?

Attention! Even if you changed all passwords, reinstalled WordPress/plugins/themes, and checked both the filesystem and database, don’t forget to check Service Workers in the browsers you use for wp-admin.

I found a heavily obfuscated malicious Service Worker still registered after the site itself was cleaned. It could intercept WordPress login credentials, grab admin nonces, inject code into /wp-admin/, and abuse the authenticated browser session to perform actions such as installing plugins.

The files can be clean while the browser remains compromised.

Check: DevTools → Application → Service Workers.

I'm looking for a way to allow visitors to view one post for free, and subsequent posts triggering a content wall requiring account registration.
All of the membership plugins I've found seem to want you to manually set which posts are public and which are gated, but I want whatever the first article someone visits to be free regardless, and then they need to make an account to view the rest.

Does this exist?

Site's 9 years old and the marketing pages are the part that keeps breaking, plugin update, security patch, some builder conflict, and the homepage looks off til I go dig through it. The blog's fine, ranks well, I'm leaving it alone. Anyone split the marketing side off and keep the blog on WP, or was running two setups more hassle than it was worth?