at the top of the screen its super annoying

My site recently had a failed hacking attempt but I don't understand why someone would try this way. In the space of 1 min, thirty or so log in attempts were made using mostly nonsensical usernames.

Normally I see one or two attempts with names like admin, or wphiddenbot (not sure why that) and then they stop.

But this was one was repeated numerous times, every time with a new username and one that is unlikely to be used such as 'guflhane'.

What is the logic in trying such attempts? The usernames seem so unlikely to be used anywhere, one or two were more realistic such as 'pv_admin', but none were the usualy suspects like admin.

Anyone else seen this?

EDIT: I think the point of my questions is getting lost. To clarify, I know it's bots, I also see lots of login attempts all the time. Most of the them are usually trying common usernames or names that might be associated with my site, or as I said I see some ones repeated like 'wphiddenbot'.

But my question was trying to understand what's the point in trying so many weird usernames, the usernames they tried were mostly very odd 8 to 10 letter strings

I've been using WPBakery for years and have bought 21 "lifetime" licenses over time. I regret every single one of them at this point.

The update process is a fucking nightmare. It's been bad for years. As a "lifetime" licensed user you can't just update from the WP dashboard if you don't have a support license. I don't need support. I just need to update the plugin. But to do that simple task, you have to log in to the WPBakery site, find your version/license and then download a ZIP. This ZIP has to be unpacked and transferred to your site. And ofcourse the site breaks for a few seconds in the process

How can this be right? In Denmark we have this saying: "May your ass itch and your arms be too short to scratch it." – The late stage capitalist scumbag at WPBakery that came up with this should have the biggest itch and the smallest arms IMO.

I've been using WPBakery for years and have bought 21 "lifetime" licenses over time. I regret every single one of them at this point.

The update process is a fucking nightmare. It's been bad for years. As a "lifetime" licensed user you can't just update from the WP dashboard if you don't have a support license. I don't need support. I just need to update the plugin. But to do that simple task, you have to log in to the WPBakery site, find your version/license and then download a ZIP. This ZIP has to be unpacked and transferred to your site. And ofcourse the site breaks for a few seconds in the process

How can this be right? In Denmark we have this saying: "May your ass itch and your arms be too short to scratch it." – The late stage capitalist scumbag at WPBakery that came up with this should have the biggest itch and the smallest arms IMO.

Hi everyone!
I’d really appreciate some advice from people with experience building corporate websites with WordPress.
I recently joined a company in a digital marketing role, and the company is currently going through a rebranding process. I’ve been given the opportunity to take ownership of the new corporate website, and I’ve already created the design myself.
Now I want to move on to the development and implementation phase using WordPress.
I have some previous experience with WordPress. I’ve built a few websites and worked with themes and plugins, but I’ve never developed a website for a company of this size or within a corporate environment.
I’m considering using WordPress Studio together with Claude (Claude Code) to help me build the website and potentially develop a custom theme. However, I’m not sure whether this is a good approach or whether I might end up overcomplicating things, especially when it comes to long-term maintenance and handing the project over to an external agency.
Here are some things I’d particularly appreciate your advice on:
Would you recommend starting with an existing theme (Astra, GeneratePress, etc.), using a Full Site Editing/block theme, or building a completely custom theme with Claude Code?
Is using Claude Code to develop a custom WordPress theme a good idea for this type of project, or could it introduce unnecessary complexity?
Would WordPress Studio be a good development environment, especially if I want to work with a cloud-based workflow?
How can I make sure the website is properly structured and easy for an external agency to take over and maintain?
What should I consider from the beginning regarding reusable blocks, plugins, SEO, performance, responsiveness and compatibility?
What would be the best workflow for development, staging and production?
My intention is to handle the design implementation, website structure, content, reusable blocks and on-page SEO. Later on, an external agency will most likely take over the more advanced technical aspects, such as security, hosting infrastructure, maintenance and further optimisations.
I want to make sure I build something professional, scalable and easy to maintain, rather than creating technical debt that someone else will have to deal with later.
There is also a personal motivation behind this project. I’m still relatively new to the company, and my current salary is quite modest. I see this as an opportunity to demonstrate my skills, take on more responsibility and deliver something tangible that I can use to support a salary review at the beginning of next year.
If you’ve worked on similar corporate WordPress projects, especially using AI coding tools such as Claude Code, I’d love to hear about your experience.
Would you use Claude Code for this project? Would you build everything from scratch or take a more conventional approach?
Any recommendations, resources or lessons learned would be greatly appreciated.
Thanks in advance!

On a subdomain Multisite install, WordPress by default scopes its auth cookies to the network domain: ms_cookie_constants() sets COOKIE_DOMAIN to '.' plus the network's cookie_domain if one is set, otherwise the network domain. (ms_cookie_constants reference)

Why it matters: say old-staging.example.com was CNAMEd to a host or page builder, the account was closed, and the DNS record stayed. If that provider lets anyone claim an unclaimed hostname, someone else can serve content on your subdomain (OWASP calls this subdomain takeover).

The record itself leaks nothing. The risk is that when a logged-in admin's browser makes a request to that subdomain, it sends any cookie whose Domain, Path and Secure attributes match, including wordpresslogged_in*, to the server the other person now controls. (MDN on Set-Cookie)

To find candidates, start from your DNS zone. One useful cross-check is certificate transparency logs (crt.sh, query %.example.com), which often surface old hostnames that got their own certs. They won't list names covered only by a wildcard cert, so treat them as a supplement. Then for each name:

dig +short CNAME old-staging.example.com dig old-staging.example.com # NXDOMAIN vs NOERROR curl -sI https://old-staging.example.com

A CNAME whose target returns NXDOMAIN is the classic red flag. A provider's generic "no such site" page only matters if that provider actually lets a stranger claim the name, so check their docs.

When you decommission, remove the DNS record first, then delete the environment or cancel the service. The other order leaves a window where the name points at something nobody owns.

For those running subdomain networks or sharing COOKIE_DOMAIN: do you audit the zone when a site leaves the network, or does DNS just accumulate forever?

Earlier this year before I knew client-side image processing was coming to WordPress 7.1, I created a free and open source WordPress plugin called Menagerie. It originally converted any image upload to AVIF or WebP in the browser, then uploaded saving some server bandwidth. So, pretty much what WordPress core can do now. This is always painful when you make a plugin and months later it's in core. Oh well.

Not all is lost though! Menagerie is still very useful. I stripped out what Core now does and left/enhanced the parts that Core doesn't automatically do. Core doesn't automatically ensure every upload converts to AVIF or WebP. Menagerie steps in to make sure that happens, gives you a JPEG fallback image, ensures your images are wrapped in <picture>, and provides a bulk image converter for your existing images. Plus, has a nice little toast message to confirm if the conversion was successful or not.

Tools within Performance Lab are another option. But, those are all server side I believe? And, a lot... Look at all those plugins that the Performance Lab page lists. Is all of that necessary? Depends on the situation and who you ask I suppose.

TL;DR

• Not Menagerie: WordPress 7.1+ processes your images in the browser when possible and then uploads
• Menagerie forces AVIF or WebP conversions; Still WordPress 7.1+ doing it in the browser when possible, but Menagerie is telling it to go with AVIF or WebP based on settings
• Menagerie creates your JPEG fallback for when a WebP or AVIF image can't be displayed
• Menagerie wraps images where possible in <picture>
• Menagerie gives you Open Graph image settings
• Menagerie lets you quickly convert all existing images

See also: https://wilcosky.com/my-quest-for-image-sanity/

The form is a small thin strip 3 text lines in height tops. I'm struggling to find the best placement for it where it doesn't disrupt from the customers journey.

I had considered placing it at the top of all product pages but then felt since those are my landing pages from paid ads that's probably a poor choice because that page is at the customers buying decision point. I had considered very bottom of all pages but felt that might be too hidden as well...

I had also considered the top of collection pages but felt that might distract visitors exploring. Where can you place this where it feels appropriate in the customers journey and doesn't feel spammy to the customer?

I build a Gym Management System with QR Code scanning for check-in with points system. I did use crocoblock Jetengine & JetFormBuilder. Right now it is working and I will use it next week. What do you think of building web app using wordpress?

Small site on shared hosting, LiteSpeed Cache plugin with QUIC.cloud as the CDN (DNS on QUIC.cloud too).

Right now I hit "Purge All" after every content or theme change, otherwise visitors sometimes get the old version. It works, but it feels like a sledgehammer.

For those running LSCache + QUIC.cloud:

- Do you rely on the auto-purge rules, or purge manually?

- Any settings you changed that stopped stale pages from showing up?

Not having a problem exactly, just want to set it up the right way before the site grows.

On a subdomain Multisite install, WordPress by default scopes its auth cookies to the network domain: ms_cookie_constants() sets COOKIE_DOMAIN to '.' plus the network's cookie_domain if one is set, otherwise the network domain. (ms_cookie_constants reference)

Why it matters: say old-staging.example.com was CNAMEd to a host or page builder, the account was closed, and the DNS record stayed. If that provider lets anyone claim an unclaimed hostname, someone else can serve content on your subdomain (OWASP calls this subdomain takeover).

The record itself leaks nothing. The risk is that when a logged-in admin's browser makes a request to that subdomain, it sends any cookie whose Domain, Path and Secure attributes match, including wordpresslogged_in*, to the server the other person now controls. (MDN on Set-Cookie)

To find candidates, start from your DNS zone. One useful cross-check is certificate transparency logs (crt.sh, query %.example.com), which often surface old hostnames that got their own certs. They won't list names covered only by a wildcard cert, so treat them as a supplement. Then for each name:

dig +short CNAME old-staging.example.com dig old-staging.example.com # NXDOMAIN vs NOERROR curl -sI https://old-staging.example.com

A CNAME whose target returns NXDOMAIN is the classic red flag. A provider's generic "no such site" page only matters if that provider actually lets a stranger claim the name, so check their docs.

When you decommission, remove the DNS record first, then delete the environment or cancel the service. The other order leaves a window where the name points at something nobody owns.

For those running subdomain networks or sharing COOKIE_DOMAIN: do you audit the zone when a site leaves the network, or does DNS just accumulate forever?

The form is a small thin strip 3 text lines in height tops. I'm struggling to find the best placement for it where it doesn't disrupt from the customers journey.

I had considered placing it at the top of all product pages but then felt since those are my landing pages from paid ads that's probably a poor choice because that page is at the customers buying decision point. I had considered very bottom of all pages but felt that might be too hidden as well...

I had also considered the top of collection pages but felt that might distract visitors exploring. Where can you place this where it feels appropriate in the customers journey and doesn't feel spammy to the customer?

I just came across this article: https://www.ultimatewb.com/blog/15203/etch-pre-sale-promises-whats-been-delivered-and-whats-still-missing/

Pretty brutal stuff

I just came across this article: https://www.ultimatewb.com/blog/15203/etch-pre-sale-promises-whats-been-delivered-and-whats-still-missing/

Pretty brutal stuff

Getting a Facebook 403 error when posts are shared, robots txt file is set to allow, works on my other sites, I’m perplexed!

This has been a fun side-project I've had since late 2021, created without AI. It uses WordPress in a pretty unique way to create a timeline. With colors for each category, it should be easy to browse.

I built it using as much of WordPress default features as possible. The "People" and "Websites" sections are separate post types, as they are hard to place in a timeline - but the rest of the filters/categories are just standard post archives.

The Full Timeline 2026-1561

Default posts categories:

• News
• Documentaries
• Famous Cases
• Sightings
• Books & Documents
• Spotlight
• Quotes

Custom post types:

• People
• Websites

Thought I'd share this site to show how flexible WordPress really is (<3), using default features!

Once I heard about AVIF I thought it was a miracle. Even smaller file sizes than WebP and still looks great? Are you kidding me? Heck yeah I'm switching. I saw most modern browsers support it. Not switching seemed stupid.

I even built a plugin to convert my images to AVIF because I didn't like existing options.

I don't share my blog posts on social media often. I'm trying to use social media less and less. But, I went to share a post and the platform generated the link preview. No image. I thought that was strange, I know I have Open Graph. Nothing was blocking the platform from my images. What gives?

Turns out, the major social platforms don't support AVIF. So, they generate a text only link preview.

On one hand, maybe that's okay to you. Who cares what your social media link previews look like. On the other hand, a link preview with an image is much more eye catching. Also, if this situation has a problem with AVIF who knows, there could be other little reasons to not switch yet.

So, I went back to WebP. Small enough. More widely supported.

Now in 20 years once social media platforms fix this, I'll switch to AVIF. You know they'll take their sweet time.

This has been a fun side-project I've had since late 2021, created without AI. It uses WordPress in a pretty unique way to create a timeline. With colors for each category, it should be easy to browse.

I built it using as much of WordPress default features as possible. The "People" and "Websites" sections are separate post types, as they are hard to place in a timeline - but the rest of the filters/categories are just standard post archives.

The Full Timeline 2026-1561

Default posts categories:

• News
• Documentaries
• Famous Cases
• Sightings
• Books & Documents
• Spotlight
• Quotes

Custom post types:

• People
• Websites

Thought I'd share this site to show how flexible WordPress really is (<3), using default features!

Hi friends, total noob here who needs your help.. I tried to add a contact form 7 to a page to my website but it somehow overwrote every other linked page as well. I tried to remove the contact form from the pages template but now its just empty and my pictures still wont show up. Would you help me out with this one please? I can post more scrennshots if needed.. Any advice is appreciated.

1. Page empty

2. Page revision still shows my pictures

3. Page template with removes contact form

4. Page Template revision

Hi Support Team,

I run a website for Apprise Cyber that has two branches, one in KSA and one in Pakistan. I created a separate header and footer for each region.

The problem: the footer on the KSA version displays incorrectly. The CSS isn’t applying properly, so the layout looks broken. The Pakistan footer works fine.

Could you please guide me on how to fix this?

Thank you. I need Help with URL https://apprise-cyber.com/en-sa/