Every migration I have scoped ends up taking longer once I actually get into the site. Looks straightforward from the outside, then I find sections the scraper does not detect properly, or content that got duplicated somewhere, and the timeline slides. Curious if that has been everyone's experience or if I am just bad at estimating.

Hi just wanna know if any of you here have found success as freelancers creating high-end premium ecommerce stores that convert. I would like to start doing it. Do you suggest it? Do you have any advices? Thank you!

Hi WP community is there a way to check number of subsites in a multi site network on a Vps server ? I have SSH connection

"...We spent three weeks trying to fix a problem with the checkout process.

An online store. Payments were failing on the first attempt. Credit card fields weren't displaying correctly on mobile devices. The client was losing sales daily, and no one knew why.

So, we did what everyone does: we swapped out the payment plugin. Then we swapped it again. We ran a full security scan with Wordfence Premium—nothing detected. We tweaked the reCAPTCHA. We cleared the cache, tested across different browsers, disabled features one by one, and combed through the payment gateway logs line by line.

Each fix worked for a moment. Then, the problem would return.

Three weeks. Neither the client nor we had the slightest clue what was going on.

Only then did we hear about Site Doctor and decide to give it a try.

It turned out to be a credit card-stealing script. It was injected into the checkout process, hidden inside a legitimate snippet of code the team had written weeks earlier. The payload was Base64-encoded and stored in a variable named to mimic a reCAPTCHA license key—with a typo so subtle that it looked like "recaptcha" and was simply overlooked. It only executed on the checkout page, so all the tests we ran elsewhere came back clean.

It had been stealing data from that store the whole time we were blaming the payment gateway, the cache, and the browser.

From the moment we ran the scan to the moment the site was fixed: about an hour.

Three weeks of guesswork. One hour once we could see what was happening under the hood. ... So thanks SYSWP and thanks Site Doctor... we use it on all our projects now...."

That’s why this tool exists.

Site Doctor monitors all the WordPress sites we manage… (continue with what it does / doesn't do / beta / DM — the rest is the same as before)

https://sitedoctor.syswp.pro is currently in beta; fill out the form if you’d like to try it. We are not selling nothing is just a Tool MCP that you can use for free

#WordPress #WebAgency #WordPressSecurity #WooCommerce

https://preview.redd.it/krk2vsiajzih1.png?width=1762&format=png&auto=webp&s=379a2494f2b3d48cad954ad9e1b770de023c1f6e

The 7.0.x releases have restarted the oldest argument in this sub. Auto-updates on, because a patched hole beats a broken layout. Auto-updates off, because you don't push untested code to production at 4am. Both camps have been making the same case for a decade, and both are working from an assumption I think is the actual problem.

Both assume the update itself is safe.

The case for patching fast is strong and I'm not arguing against it. Patchstack's State of WordPress Security in 2026 puts the weighted median time from disclosure to first exploitation at five hours, across 11,334 vulnerabilities disclosed in 2025, 91% of them in plugins. If you're patching on a weekly review cycle you are losing that race, every time, and the 4am-broken-layout crowd is trading a rare outage for a common breach.

Here's the number from that same report that nobody quotes though. 46% of those vulnerabilities had no patch available at the moment they were disclosed. Patchstack's own conclusion is that this "shows why website owners can't rely on plugin updates as a security measure." Their words, not mine.

But look at what the update actually is. Your site fetches a package from a vendor's server, unpacks it, and executes it. That's a write path the site trusts by design. There's no authentication event anywhere in that chain to harden and no second opinion on what arrived. 2FA, lockouts, a firewall sitting in front of the login page, none of them are in that request path at all.

That's not hypothetical this month. An agency posted a writeup here on the 3rd describing their plugin vendor's update server being compromised and a backdoor landing on client sites through a routine update. Someone in another thread described a window in early August where pressing update in wp-admin could hand you a tampered package. Both are those posters' accounts and neither is independently verified, so treat the specifics as claims. The shape is what I'm interested in.

So my position is that both sides of the argument are defending the wrong door. The useful question isn't auto or manual. It's how you'd know.

There is a partial answer built into WP-CLI that hardly anyone runs. wp plugin verify-checksums compares the plugin files on your site against the checksums wordpress org publishes for that version. If a file changed after install, it says so.

Then you hit the part that matters here. It only works for plugins from the repo. Point it at a premium plugin and you get "could not retrieve the checksums, skipping," because there is no published source of truth to compare against. The vendor ships the package themselves.

So the one integrity check built into the tooling covers everything except the category where vendor-delivered tampering actually happens. In the ShapedPlugin case reported in June, the backdoor went into the Pro builds on 21 May and the first customer reports landed on 10 June. Twenty days, three paid plugins, delivered through the vendor's own update system. That timeline is from Wordfence's data as reported at the time, not something I measured.

Which brings me to the part I don't have a good answer for, and the reason I'm posting.

If a plugin update you installed last month had been tampered with in transit, how would you find out? Not in theory. What in your current setup would actually tell you?

This comes up every few weeks, and the answer never seems to be wherever people go looking for it. So, here.

You open your firewall summary and find something like:

Blocked for [Plugin Name] <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API in query string: rest_route = /[plugin-slug]/v1/tests/mock-data 

You have never installed that plugin. It isn't in your plugins folder, it isn't sitting there deactivated, it was never there at all. Two things are getting confused here, and separating them makes the whole thing boring, which is the correct outcome.

The request is generic. WordPress serves REST routes at /wp-json/..., and it also accepts ?rest_route=... as a query-string fallback so the API still works when pretty permalinks are off. That fallback resolves on every WordPress install. So a bot needs to know nothing about your site to try it. It takes a list of recently disclosed plugin vulnerabilities, builds the request for each one, and fires the whole list at every WordPress site it can find. The sites running that plugin answer with something useful. The rest return nothing, because the route was never registered.

The block is a pattern match, not a detection. Your firewall recognized the shape of the request and stopped it before WordPress got a chance to shrug at it. That's why the log names a plugin and a version range: it's describing the exploit the request was written for, not something it found on your site. The phrasing makes it read like you were targeted and narrowly got away with it. You weren't, and there was nothing to get away from.

So: nothing is installed that shouldn't be, there's nothing to clean up, and it isn't related to some other plugin of yours with a similar name.

What the alert does tell you is that your site is on somebody's list. About 91% of last year's disclosed WordPress vulnerabilities were in plugins rather than core, per Patchstack's 2026 report, so those lists are long and they get worked constantly. Being on one only means your site answered a WordPress fingerprint check at some point.

If you'd rather be on fewer of them, look at what an anonymous request can learn about your install. Version strings hanging off your CSS and JS URLs. Readme files sitting under plugin directories. Directory listings nobody turned off. None of that is secret and none of it is why anyone gets hacked. It's just what makes a site cheap to sort into "worth coming back to" rather than "no idea what this is."

I'm a plugin dev and a few months back I built a way to collect feature voting from my users right inside wp admin, on my plugins' dashboard screen. The results have been pretty interesting!

So now I'm looking for other people who want to test it too (free account). If you're down, just hit me up here or DM me.

On the site you can try it easily through WP Playground and see it running live on one of my plugins: https://wpfeatureloop.com/

Thanks!

Need help troubleshooting.

A few weeks ago things changed on the backend of WP. File names showed up over the images in the media selection making it nearly impossible to see the images. And our post thumbnail editor options turned white making the checkmarks and 'crop' button basically invisible. Trying to figure out what caused this so I can get it fixed. Was it an update? is it user error (I am the content manager and we have a web guy who was making some site design refreshes recently).

side question: does anyone know how to set the image view when selecting images to their actual orientation and not the square thumbnail?

We are building Sales CRM plugin. Glad to share today it released in WordPress org. This CRM plugin help manage Leads, Contacts, Deals, Products, Invoice, Client Portal, Companies, Activities, team members and more.

This CRM plugin deeply synced with WooCommerce. Like:

• WooCommerce Customer convert to Contacts or Leads
• Woo Products add in Deals
• Woo Products add in invoice
• Woo Sync with CRM Currency
• Collect Payment via WooCommerce (add Woo payment link in invoice)

Note: Also sync with WordPress users and overall ecosystem.

Bit CRM plugin is available in WordPress org: https://wordpress.org/plugins/bit-crm-sales-marketing-automation/

Feel free to contribute here: https://github.com/bit-Apps-Pro/bit-crm-sales-marketing-automation

Can you please take look this CRM plugin and share your feedback like

• Which feature must need for WordPress users
• Which WooCommerce part need to integrate
• This way is not working, that way will be work better
• share anything

Our aim is building effective and usable CRM for WordPress and WooCommerce users.

Thank you so much for your time.

Invoice module (payment collected vai WooCommerce)

Workflow

Deals

Companies

Contact

Leads

Dashboard

Sorry if I’m being a total boomer here, but I want to ask this once and for all: Is there a solid way to export a Lovable design to WordPress, and if so, what’s the best way to do it?

My goal is to build the whole site in Lovable and then move it over to WordPress. I know Lovable outputs React and WordPress is rooted in PHP, but surely there has to be a smooth workflow or reliable bridge for this by now? Or is trying to mix the two just a bad idea altogether?

Appreciate any advice or reality checks!

Hello community,
Hope you are all doing well. WordPress beginner here, and I need help and suggestions.

I created a blogging website for my friend to polish up my skills but I realise every WordPress website has the same URL for admin page. And I would like to change it for security reasons.

So need some help, is there any good free plugin i can use?
or
Is there any other way which i can change the url.?
And what are the things that can happen if I change the URL? like pros and cons?

I spent a couple of months on X following the WP space and honestly, I started feeling like there's an inner circle. I see the same group of people everywhere, sharing each others tweets, podcasts, product launches, it's like there is no space for new things to come and establish themselves. But if you are outside that circle, you get very little exposure. Maybe I'm completely wrong and this is how online communities work

Hi, I recently made a website in Claude. It looks good but I can't find a way to import to Wordpress. I've tried Youtube but it didn't help. Every time I try to put the code into Wordpress, it becomes one full section. Please help and thank you in advance.

Hi

Would you start a store using NodeJs at front end or the default from wordpress?

A nice video on some of the new features in 7.1 for those that weren't paying attention (like myself) and I have to say, some of the new feature look promising.

https://www.youtube.com/watch?v=xoffY_YYhlo

Gravity Forms newest update changes the submit button from an input field to a button. If you were targeting the input[type="submit"] in your styling in any way, you will want to update to button[type="submit"]. I am partway through updating this on a whole bunch of sites at the moment.

These two sections of the website I'm building, a header and a footer, are not visible at all in the code editor. I do not know where they came from or how to remove them. They are not visible in the visual block editor either.

Wanted to move back to wordpress from wix because the wix site editor was pmo. But now wordpress, which I used to think was easy to use, is now betraying me. Please advise kindly. I am not generally a computer person but I built a working blog website with wordpress years ago. Trying to replicate that success now but it's really confusing me.

I am managing a network of 50 WordPress sites. I need a single management platform that allows me to post content to all sites and includes AI-powered features for content creation