Every migration I have scoped ends up taking longer once I actually get into the site. Looks straightforward from the outside, then I find sections the scraper does not detect properly, or content that got duplicated somewhere, and the timeline slides. Curious if that has been everyone's experience or if I am just bad at estimating.

Hi just wanna know if any of you here have found success as freelancers creating high-end premium ecommerce stores that convert. I would like to start doing it. Do you suggest it? Do you have any advices? Thank you!

Hi WP community is there a way to check number of subsites in a multi site network on a Vps server ? I have SSH connection

I'm doing some research into how people actually use CRMs day-to-day, and I'd love to hear from people who work with them regularly.

I'm especially interested in the gap between what a CRM can do and what people actually end up doing manually.

For those of you using a CRM:

• What's the most frustrating part of your current workflow?
• Do you frequently have to jump between multiple tools to complete one task?
• What customer information is hardest to get a complete picture of?
• What's one thing you wish your CRM could just handle automatically?
• If your CRM had an AI assistant, what would you actually trust it to do?

I'm trying to understand real workflows rather than just compare CRM feature lists.

If you're willing to share your experience, I'd really appreciate it. I also have a short research survey for anyone who'd prefer to answer anonymously.

"...We spent three weeks trying to fix a problem with the checkout process.

An online store. Payments were failing on the first attempt. Credit card fields weren't displaying correctly on mobile devices. The client was losing sales daily, and no one knew why.

So, we did what everyone does: we swapped out the payment plugin. Then we swapped it again. We ran a full security scan with Wordfence Premium—nothing detected. We tweaked the reCAPTCHA. We cleared the cache, tested across different browsers, disabled features one by one, and combed through the payment gateway logs line by line.

Each fix worked for a moment. Then, the problem would return.

Three weeks. Neither the client nor we had the slightest clue what was going on.

Only then did we hear about Site Doctor and decide to give it a try.

It turned out to be a credit card-stealing script. It was injected into the checkout process, hidden inside a legitimate snippet of code the team had written weeks earlier. The payload was Base64-encoded and stored in a variable named to mimic a reCAPTCHA license key—with a typo so subtle that it looked like "recaptcha" and was simply overlooked. It only executed on the checkout page, so all the tests we ran elsewhere came back clean.

It had been stealing data from that store the whole time we were blaming the payment gateway, the cache, and the browser.

From the moment we ran the scan to the moment the site was fixed: about an hour.

Three weeks of guesswork. One hour once we could see what was happening under the hood. ... So thanks SYSWP and thanks Site Doctor... we use it on all our projects now...."

That’s why this tool exists.

Site Doctor monitors all the WordPress sites we manage… (continue with what it does / doesn't do / beta / DM — the rest is the same as before)

https://sitedoctor.syswp.pro is currently in beta; fill out the form if you’d like to try it. We are not selling nothing is just a Tool MCP that you can use for free

#WordPress #WebAgency #WordPressSecurity #WooCommerce

https://preview.redd.it/krk2vsiajzih1.png?width=1762&format=png&auto=webp&s=379a2494f2b3d48cad954ad9e1b770de023c1f6e

The 7.0.x releases have restarted the oldest argument in this sub. Auto-updates on, because a patched hole beats a broken layout. Auto-updates off, because you don't push untested code to production at 4am. Both camps have been making the same case for a decade, and both are working from an assumption I think is the actual problem.

Both assume the update itself is safe.

The case for patching fast is strong and I'm not arguing against it. Patchstack's State of WordPress Security in 2026 puts the weighted median time from disclosure to first exploitation at five hours, across 11,334 vulnerabilities disclosed in 2025, 91% of them in plugins. If you're patching on a weekly review cycle you are losing that race, every time, and the 4am-broken-layout crowd is trading a rare outage for a common breach.

Here's the number from that same report that nobody quotes though. 46% of those vulnerabilities had no patch available at the moment they were disclosed. Patchstack's own conclusion is that this "shows why website owners can't rely on plugin updates as a security measure." Their words, not mine.

But look at what the update actually is. Your site fetches a package from a vendor's server, unpacks it, and executes it. That's a write path the site trusts by design. There's no authentication event anywhere in that chain to harden and no second opinion on what arrived. 2FA, lockouts, a firewall sitting in front of the login page, none of them are in that request path at all.

That's not hypothetical this month. An agency posted a writeup here on the 3rd describing their plugin vendor's update server being compromised and a backdoor landing on client sites through a routine update. Someone in another thread described a window in early August where pressing update in wp-admin could hand you a tampered package. Both are those posters' accounts and neither is independently verified, so treat the specifics as claims. The shape is what I'm interested in.

So my position is that both sides of the argument are defending the wrong door. The useful question isn't auto or manual. It's how you'd know.

There is a partial answer built into WP-CLI that hardly anyone runs. wp plugin verify-checksums compares the plugin files on your site against the checksums wordpress org publishes for that version. If a file changed after install, it says so.

Then you hit the part that matters here. It only works for plugins from the repo. Point it at a premium plugin and you get "could not retrieve the checksums, skipping," because there is no published source of truth to compare against. The vendor ships the package themselves.

So the one integrity check built into the tooling covers everything except the category where vendor-delivered tampering actually happens. In the ShapedPlugin case reported in June, the backdoor went into the Pro builds on 21 May and the first customer reports landed on 10 June. Twenty days, three paid plugins, delivered through the vendor's own update system. That timeline is from Wordfence's data as reported at the time, not something I measured.

Which brings me to the part I don't have a good answer for, and the reason I'm posting.

If a plugin update you installed last month had been tampered with in transit, how would you find out? Not in theory. What in your current setup would actually tell you?

This comes up every few weeks, and the answer never seems to be wherever people go looking for it. So, here.

You open your firewall summary and find something like:

Blocked for [Plugin Name] <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API in query string: rest_route = /[plugin-slug]/v1/tests/mock-data 

You have never installed that plugin. It isn't in your plugins folder, it isn't sitting there deactivated, it was never there at all. Two things are getting confused here, and separating them makes the whole thing boring, which is the correct outcome.

The request is generic. WordPress serves REST routes at /wp-json/..., and it also accepts ?rest_route=... as a query-string fallback so the API still works when pretty permalinks are off. That fallback resolves on every WordPress install. So a bot needs to know nothing about your site to try it. It takes a list of recently disclosed plugin vulnerabilities, builds the request for each one, and fires the whole list at every WordPress site it can find. The sites running that plugin answer with something useful. The rest return nothing, because the route was never registered.

The block is a pattern match, not a detection. Your firewall recognized the shape of the request and stopped it before WordPress got a chance to shrug at it. That's why the log names a plugin and a version range: it's describing the exploit the request was written for, not something it found on your site. The phrasing makes it read like you were targeted and narrowly got away with it. You weren't, and there was nothing to get away from.

So: nothing is installed that shouldn't be, there's nothing to clean up, and it isn't related to some other plugin of yours with a similar name.

What the alert does tell you is that your site is on somebody's list. About 91% of last year's disclosed WordPress vulnerabilities were in plugins rather than core, per Patchstack's 2026 report, so those lists are long and they get worked constantly. Being on one only means your site answered a WordPress fingerprint check at some point.

If you'd rather be on fewer of them, look at what an anonymous request can learn about your install. Version strings hanging off your CSS and JS URLs. Readme files sitting under plugin directories. Directory listings nobody turned off. None of that is secret and none of it is why anyone gets hacked. It's just what makes a site cheap to sort into "worth coming back to" rather than "no idea what this is."

We have a content type with a multi-select field with (let's say) options A, B, C, D. A ton of nodes already have the field populated with content. We need to add an option E, and would like to have it selected if B is also already selected.

Is Views Bulk Operations with Views Bulk Edit our best (or only) option?