Hi, I recently made a website in Claude. It looks good but I can't find a way to import to Wordpress. I've tried Youtube but it didn't help. Every time I try to put the code into Wordpress, it becomes one full section. Please help and thank you in advance.

Hi

Would you start a store using NodeJs at front end or the default from wordpress?

A nice video on some of the new features in 7.1 for those that weren't paying attention (like myself) and I have to say, some of the new feature look promising.

https://www.youtube.com/watch?v=xoffY_YYhlo

Gravity Forms newest update changes the submit button from an input field to a button. If you were targeting the input[type="submit"] in your styling in any way, you will want to update to button[type="submit"]. I am partway through updating this on a whole bunch of sites at the moment.

These two sections of the website I'm building, a header and a footer, are not visible at all in the code editor. I do not know where they came from or how to remove them. They are not visible in the visual block editor either.

Wanted to move back to wordpress from wix because the wix site editor was pmo. But now wordpress, which I used to think was easy to use, is now betraying me. Please advise kindly. I am not generally a computer person but I built a working blog website with wordpress years ago. Trying to replicate that success now but it's really confusing me.

I am managing a network of 50 WordPress sites. I need a single management platform that allows me to post content to all sites and includes AI-powered features for content creation

Hey everyone,

Recently I was troubleshooting a WordPress site where the mobile version was breaking completely — elements overlapping, images loading slowly, and layout shifts causing a terrible user experience.

Since this is a super common issue for business site owners, I wanted to share the step-by-step fix that resolved it:

1. Mobile Layout Shift (CLS): The main banner was jumping around because fixed heights weren't defined for image containers in the mobile CSS breakpoints. Always set explicit aspect ratios for mobile wrappers.
2. Unoptimized Assets: Converting background images to .webp and enforcing lazy loading reduced page payload by over 60% without losing quality.
3. Plugin Overlap: Two conflicting optimization plugins were trying to minify the same scripts, creating layout rendering delays. Keeping just one properly configured caching tool fixed the script execution order.

After these tweaks, the mobile load time dropped from 4.8s to 1.1s, and the visual glitches vanished completely.

If you're running a WP site and noticing layout bugs on mobile, check your CSS containers and caching setup first. Hope this helps someone out there!

I'm trying to access my WordPress platform today to write a new post and this is what I get. I can't access my website or WordPress and the host platform isn't showing any issues or getting me anywhere. I have no emails to refer to and I don't even know where to start. So sick of WordPress. What do I do?

I'm interested in updating enfold theme, because it is pretty old and this theme was bought by a person who did my site and to update it I don't have a key to update enfold theme. What should I do in this situation?Can I find a key in files of my site(I haven't tried it yet)?

Normally a drop in unique visitors would make me frown at the screen and start second-guessing every life choice.

This one made me smile.

Solid line is the last 28 days. Dashed line is the previous period. Those big spikes were mostly bots hammering the contact forms, comments, and registration pages. Once I locked those down, a big chunk of the overall bot traffic just stopped. The flat line underneath is closer to real humans.

The free plugin (reCAPTCHA V3 for Jetpack) scores submissions with Google’s invisible reCAPTCHA v3 and sends the low-score junk to spam before it counts as a visitor. The Pro version adds temporary 72-hour IP bans on top of that.

Result: the stats finally stopped lying to me. I’m proud I built this thing. Sometimes the best traffic report is the one that finally tells the truth.

Hi everyone,

I have a ton of WebP images in my WordPress media library that I’d like to compress to reduce file sizes, but I want to minimize the risk of breaking anything on the site.

Ideally, I’m looking for a plugin that can compress my existing WebP images while:

• Keeping them as WebP
• Keeping the same filenames and URLs
• Replacing the existing files rather than creating new ones
• Preserving image quality as much as possible

Has anyone used a plugin that handles this reliably? I’d appreciate any recommendations or experiences with bulk-compressing existing WebP images.

Thanks!

Hello!

I'm building out a bare-bones block theme to try and learn what's going on under the hood.

First I've got to say I'm running into difficulty. Any tutorials/guides including the official theme handbook seem to be slightly out of date using theme.json v2. Finding a logical resource walking from step A to B seems to be an impossibility.

The mixing of theme.json, inline styles, style.css and annotated html comments to define how the site looks has got me questioning my sanity.

The tutorial I've been following already seems to require fighting against the wordpress css by overriding just to get full width content to work. I'm at a loss for words, this is just basic html layout with some css.

Basically without going on too much it seems like all of this hoopla is to make the content editable to the lay-man. Otherwise things would be so much easier with a classic theme.

So the real roadbloack I've run into so far is with the navigation. Specifically, I don't see a way at all that it will be possible to add a mega-menu without simply hardcoding it in, or making use of a Mega Menus-type plugin, which seem to not make use of blocks anyway.

Creating a mega-menu that works with FSE seems like it will be far more work than creating a basic theme itself.

My current plan is to simply make a separate mega-menu plugin to hardcode the megamenu navigation for now to take care of mega-menu functionality while unfortunately going against the FSE ethos here.

I'm curious to know how block theme developers are handling FSE and Mega Menus?

was wondering if it is possible to swap the add-to-cart button to "request quote" button across all products in my woocommerce that then leads to a page with form which captures required info

Hej,

when i'm editing in colibri, i got kinda ghost/preview duplicated block.

It's basically a block i can't edit and a duplication of a block i can edit. When editing the "real" block, the ghostblock get's edited too - i'm stuck here.

The ghost block is not visible on the livepage.
Actually the ghostblock is the one visble at the livepage and at the correct position.

Thanks in advance

I recently investigated a compromise of a WordPress website hosted for one of our projects. What made the incident interesting was that the obvious suspect — a file manager plugin installed by the attacker — was not the initial entry point.

The server logs gave us a fairly clear timeline:

• 06:20:08 UTC: a remote IP submitted a successful POST /wp-login.php
• 06:20:11 UTC: the same source accessed /wp-admin/
• 06:20:35 UTC: the attacker installed “FileOrganizer – WordPress File Manager”
• 06:21:18 UTC: the plugin was activated
• 06:21:39 UTC: its file management interface was opened
• 06:22:32–06:22:33 UTC: authenticated admin AJAX requests uploaded executable PHP files into another plugin directory

The important distinction is this:

The evidence does not show that FileOrganizer caused the initial compromise.
The attacker already had a valid administrator session before the plugin was installed.

The plugin was instead used as a post-authentication tool. Once the attacker had administrator privileges, it provided a convenient way to place executable PHP files inside the WordPress installation.

That distinction matters because it is easy to blame the last visible tool instead of investigating how the attacker obtained the valid administrator session.

What we did

• Put the affected site into a short controlled maintenance window
• Preserved access logs, timestamps, file hashes and suspicious files
• Removed an unauthorized WordPress administrator
• Invalidated existing WordPress sessions and application passwords
• Rotated relevant WordPress credentials and salts
• Reviewed plugins, themes, cron hooks and administrator accounts
• Scanned the installation with ClamAV and YARA rules
• Verified WordPress core files against official checksums
• Checked upload directories and plugin directories for executable PHP
• Reviewed redirects, canonical tags and injected external scripts
• Restricted PHP execution in upload directories
• Removed file manager functionality that was not operationally required
• Kept the evidence separate instead of immediately deleting suspicious files

The most important lesson

A successful WordPress admin login should be treated as a full application compromise.

Once an attacker has administrator access, simply deleting the uploaded webshell or uninstalling the file manager plugin is not enough. An administrator may be able to:

• install or modify plugins and themes
• create additional administrators
• add application passwords
• change scheduled tasks
• modify redirects or SEO metadata
• upload executable code
• establish persistence outside the obvious plugin directory

The investigation therefore has to begin with the authentication event, not with the later webshell upload.

What is still unknown

We could prove when the attacker logged in and what happened afterwards. We could not prove from the available evidence alone how the valid administrator session or credentials were initially obtained.

Possible causes include credential reuse, stolen browser sessions, phishing, an exposed password, compromised email access or another vulnerability — but naming one without evidence would be speculation.

Defensive changes we are applying across our hosting platform

We are now adding central monitoring for:

• newly created WordPress administrators
• new application passwords
• plugin installations and activations
• PHP files appearing in upload directories
• WordPress core checksum changes
• unexpected cron and systemd changes
• suspicious login activity
• file integrity changes through AIDE
• ClamAV and YARA results
• offsite backups with tested restores

We are also separating each customer application by system user and database account, keeping databases private and retaining the old server as a rollback source during migrations.

I am sharing this because incident reports are much more useful when they separate confirmed evidence from assumptions. “The attacker used plugin X” is not automatically the same as “plugin X was the initial vulnerability.”

If anyone has investigated similar cases involving a valid WordPress admin session followed by installation of a file manager plugin, I would be interested in the forensic indicators you found most useful — especially for tracing the original session theft without retaining sensitive user data.

Hello, I have a relatively old site and it has the php version 7.4.33 and the overall version 6.4.9 with Alpha Forte theme.
Now back to business, I am very scared to update it and I also don’t know how.
What should I do? If I contact the domain provider should they be able to provide me with the help i need?

i was using wp super cache by automattic and wordfence, thought it wouldnt hurt to put some clients with $5 web hosting behind cloudflares free tier.

Not because they are under too much attacks or need clients from the us, they only have clients in germany and the servers were in germany.
But when they start their ads or have multiple visitors at the same time these trash servers will crash and serve slow. I changed the nameserver and installed cloudflare plugin, created api token only for that domain, clicked on recommended settings, disabled email address obfuscation and selected

Use the Cloudflare HTTP header "CF-Connecting-IP" to get a visitor's IP address. Only use it if you're using Cloudflare.

under wp-admin/admin.php?page=WordfenceOptions, it warns me with a red box and tells me wrong settings etc. but i think it didnt understand my cloudflare is active so ive dismissed the error warning because cloudflare is definitely active and protecting.

Ive set Cloudflare via Plugin to "Auto Purge Content On Update", the question is now should i change my WordPress Caching Plugin itself or is WP Super Cache already the best free ones.
I do not want to convince clients to pay for any Plugins.

WP Fastest Cache could work too but it is always causing Layout Problems after 2-3 days or with Elementor Sites CSS/JS Problems, i have to set the CSS on inline instead of external.

With WP Super Cache i do not have to do that it can stay in the Elementor Settings "CSS External" plus i deactivate the Elementor Cache and can set compress in the advanced WP Super Cache Settings too. And it does not have any problems after 3-4 days and requires no clearing the cache manually. The problem was using elementor back then in the first place but i cannot check the sites constantly with WP Fastest Cache now,

WP Super Cache works better but ive wanted to ask if theres a better solution for free that works better with Cloudflare or is Automattic already doing us a favor for free.

Ive seen there is a Plugin called wp-cloudflare-page-cache by Optimole

is this better and legit as Automattic or a future security risk?

i actually have to create a site for my aunt's local business. By far, i realized wordpress is better than making an html+css site. However, I am concerned if it is a good decision or not, since AI is making wp sites vulnerable these days.

Yep AI made this tool so I can convert my WXR XMLs to Markdown

Source code: https://git.italiatroller.dpdns.org/italiatroller/WXR-to-MD

https://wxr-to-md.italiatroller.dpdns.org/

I've been working on content writing and SEO, and I realized that the biggest improvements often come from checking the boring little things before hitting publish.

Here's my basic pre-publishing checklist:

1. Search intent
Does the article actually answer what someone searching the target keyword wants to know?

2. Title
Is it clear, specific and interesting enough to make someone want to click?

3. Headings
Can someone skim the article and immediately understand how it's organized?

4. Keyword usage
Is the primary keyword used naturally, without turning every paragraph into keyword soup?

5. Internal links
Are there relevant pages or articles that the reader can go to next?

6. Images
Are images useful and do they have descriptive alt text where appropriate?

7. Meta title + description
Do they accurately explain what the page is about?

8. Actual usefulness
This is the big one. If I removed the keyword completely, would the article still be worth reading?

I'm trying to move away from the idea that SEO writing means "write for Google" and more toward "write something genuinely useful, then make it easy for Google to understand."

Curious what other bloggers check before publishing. What's on your checklist?