Anyone that has time can take a look at my site and find out what’s wrong with it?

MikeCunsolo.com

We clean up hacked WordPress sites for our clients and since July we've been fighting the same malware family over and over. It calls itself "SC" in its own files. If you've ever had a site get hacked again right after it was cleaned, some of this might sound familiar.

The weirdest one was a browser tab. We'd done a full cleanup, and then the malware plugin got uploaded again from a real admin's computer, logged in as that admin. We were about to tell the client their laptop was infected. It wasn't. That admin still had a tab open on the site from back when it was hacked, and the bad code in that tab was still running. Every minute it checked whether an admin was logged in, and as soon as one was, it uploaded itself again. They closed the tab and that was the end of it.

So now after every cleanup we tell everyone who uses wp-admin to close every tab on the site and restart their browser. Sounds silly. Cost us days.

The other big one was a saved password. This thing records every username and password typed into the login page. A site we cleaned in September got reinfected this week by someone who just logged in with a password it had saved back then. The owner never changed it. So everyone who logged in while the site was infected needs a new password, and 2FA on the admin accounts would have stopped that login cold.

Other stuff that tripped us up

• It makes admin accounts that don't show on the Users screen, so the user list looks totally normal
• It hides in files with normal WordPress names, so you won't spot it scrolling through the files
• Part of it lives in the database, so restoring files or reinstalling plugins leaves that bit behind and it comes back later
• Newer versions run a background process on the server that puts the files back within minutes, and restarting PHP doesn't kill it. If a host cleaned your site and it was back the same afternoon, that's one way it happens

Anyone else seen the browser tab thing? That was a first for us.

I currently manage around 20 sites, mostly for small businesses and nonprofits. I've been experimenting with MainWP, ManageWP, and more recently WPMU DEV, trying to find the best balance of reliability, backups, security, and ease of use. None seems to check all the boxes.

There has been a recent history of security vulnerabilities in the management plugins themselves. WPMU DEV recently had a pretty serious authentication vulnerability .... ManageWP and MainWP have had similar issues over the years. To WPMU DEV's credit, their response and patch turnaround seemed pretty quick.

I'm not necessarily looking for the cheapest solution. I'd rather pay a reasonable amount for something reliable that doesn't require constant babysitting.

A few things I'm particularly interested in:

• How reliable have the connections been between your dashboard and individual sites?
• What are you using for backups, and have you actually tested restores?
• Have you had any security concerns with the management plugins?
• How useful are the monitoring and reporting features?

I'm currently testing WPMU DEV on a couple of my own sites, and so far I'm fairly impressed. But I'm interested in hearing from people who have been using these platforms longer, especially those managing 15–30 sites or more.

What's working for you, and what drives you crazy?

So i've decided to build my own website for my business, since budget is short, and am doing this is Wordpress.

This is going to be a service based business, with both one-time paying customers, aswell as subscription based clients, this then entails that prices need to be shown different for both. And this goes for both my services and add-ons.

So i need a booking plugin that allows me to show different prices, depending on subscription type, and then also combine the available times, so i dont get double bookings.

Currently building with Astra and Elementor, with some help from a well-known friend (ChatGPT).

Any recommendations on plug-ins for; 1. Login, 2. Booking?

Any tips or tricks shared are more than appreciated :)

I've had a blog on Wordpress for years and I just noticed today that I'm getting an error when I'm trying to reach the site. I can't even log into Wordpress or edit in any kind of recovery mode like I have in the past. I'm going to be honest - I'm panicking because I haven't been able to get backups to work on my site and I have no idea how to read the error log. It looks like my last email from my website was about 2 days ago, so I feel like it has to be a recent error. Would anyone have any guidance for me to go about recovering or fixing this issue?

Hey r/Wordpress,

A couple of weeks ago I shared SlimPress here, and the feedback from this community was awesome. Today I’m back with another tool I built out of my own day-to-day frustration: Cron Monitor.

Every time a scheduled post missed its publish window, a backup silently failed, or a site slowed down because of background tasks, I ran into the same wall. Existing cron plugins are great at showing you what is scheduled to run, but unless you pay for a Pro tier or an external SaaS, you're mostly flying blind on what actually happened when the job executed.

I wanted full execution visibility without paywalls, so I built it myself. Just like my last plugin, it is 100% free. There is no pro tier, no locked features, no nag banners, and zero telemetry.

What it covers

• Execution History & Timing: See exactly when jobs ran, how long they took, and any recorded errors—including fatal crashes and timeouts.
• Instant Failure Alerts: Get notified via Email, Slack, or Discord when a background job crashes, runs late, or stops running altogether.
• Plugin & Theme Ownership: Automatically maps cryptic cron hooks back to the specific plugin or theme that owns them by inspecting their observed callbacks.
• Orphan & Duplicate Cleanup: Identifies duplicate events and leftover cron jobs from long-deleted plugins based on what actually happens when they run, with a safe preview before you remove anything.
• Full Job Management: Add, edit, run on-demand, pause, resume, or bulk-delete events and custom schedules straight from the admin.
• Cron Health & WooCommerce Support: Tracks cron jobs that are progressively getting slower, flags server config issues blocking wp-cron.php, and automatically logs failed Action Scheduler tasks (huge for debugging WooCommerce).
• Developer Tools: Includes native WP-CLI commands, CSV exports, and a REST API for connecting your own external monitoring tools.

How it behaves on your site

• Zero bloat or phoning home: All logs stay strictly inside your local WordPress database. The only outbound requests are the optional failure alerts if you explicitly configure an email address or Slack/Discord webhook.
• Works out of the box: Once activated, just head to Tools → Cron Monitor. Duplicate detection, ownership mapping, and health checks work immediately, and your execution history starts building as your background jobs run.
  

Quick transparency note on AI: All the core logic and architecture were written by hand - AI was only used to help with UI mockups, class scaffolding/boilerplate, testing, documentation, and a final code review pass.

👉 Cron Monitor on WordPress.org

I’d love to get some feedback from others maintaining WordPress sites—especially if there are specific edge cases, WP-CLI flags, or webhook payloads that would make debugging background tasks easier for your workflow!

Hi all, just wanted to get some traction, mainly for getting feedback for improvements, for a set of 8 LocalWP addons I created to make working with LocalWP better, especially on MacOS and/or with composer based websites. You can find it on my github;

• https://github.com/rmpel/rasql-database-manager - LocalWP oriented database manager (but supports ssh/other DB connections as well) with MCP support
• https://github.com/rmpel/Local-Site-Beam/ - LAN/WAN site transfer
• https://github.com/rmpel/Local-Auto-Start - Auto start on LocalWP launch
• https://github.com/rmpel/Local-Trust-SSL-MacOS - Fix SSL trusting on MacOS
• https://github.com/rmpel/Local-CLI-Bridge - Replacement for defunct local-cli with many improvements
• https://github.com/rmpel/Local-Composer - Fixes for working with composer bases sites
• https://github.com/rmpel/Local-Router-Doctor - Fix annoying router mishaps
• https://github.com/rmpel/Local-Apache-Modules - Allow selecting Apache modules
• https://github.com/rmpel/Local-MySQL-Fixes - Permissions fixing for external/older MySQL clients

Yes, these are ALL Claude co-authored, if you don't like AI software, that's fine, just don't use it.

It's all free of charge, and also at your own risk, if you have issues, comments, suggestions, praise, etc; for all projects the issues tracker is open.

J'essaie de mettre à jour une de mes extensions sur wordpress. Cependant je me retrouve à tourner en boucle là dessus :

https://preview.redd.it/27gamt3yrsvh1.png?width=1083&format=png&auto=webp&s=1ddadcc70a549dc76720435acd4f06640a80c868

Et lorsque je sélectionne "remplacer l'extension..." je dois entrer mes codes. Ce que je fais mais une fois validé, ça revient sur cette page et je peux recommencer indéfiniment. J'ai bien sûr vérifié et sans surprise, l'extension n'est pas à jour.

I use GeneratePress and GenerateBlocks on my WP website and I'm curious to hear what you think about the premium version. Do you like it? What are some downsides you think it has (if any)? What advantages does it have? Thanks to all answers in advance!