These SQL injections have been coming in daily to this site which has still seemingly managed to avoid infection simply because of the changed database prefix. This one uses the “author not in” query bug inside some crazy nested query to place the payload in the database.

This is all related to the WP2Shell bug which was reported over a month ago. The site had auto updates disabled and still managed to avoid getting infected because of some seemingly silly security practices like changing table names and database prefixes. As far as I can tell all of these failed. I was alerted to the issue because the site got locked in a loop of timeouts, perhaps related to these malformed queries. Unfortunately I’m going to have to do some kind of a forensic workup even though there were no clear indicators of compromise because requests to the batch endpoint resulted in many 207 codes which means they may have succeeded.

But when I saw the giant block of 0s and 1s and hex codes in the logs, my heart dropped into my stomach. Stay safe out there people and leave auto updates on. It’s worth the chance of breaking your site every once in a while.

I'm looking for a WordPress plugin for a tour company's shuttle/transfer bookings. We have fixed routes and need pickup → destination selection, specific dates/times, fixed pricing, passenger counts. Does anybody have any suggestions

These SQL injections have been coming in daily to this site which has still seemingly managed to avoid infection simply because of the changed database prefix. This one uses the “author not in” query bug inside some crazy nested query to place the payload in the database.

This is all related to the WP2Shell bug which was reported over a month ago. The site had auto updates disabled and still managed to avoid getting infected because of some seemingly silly security practices like changing table names and database prefixes. As far as I can tell all of these failed. I was alerted to the issue because the site got locked in a loop of timeouts, perhaps related to these malformed queries. Unfortunately I’m going to have to do some kind of a forensic workup even though there were no clear indicators of compromise because requests to the batch endpoint resulted in many 207 codes which means they may have succeeded.

But when I saw the giant block of 0s and 1s and hex codes in the logs, my heart dropped into my stomach. Stay safe out there people and leave auto updates on. It’s worth the chance of breaking your site every once in a while.

I want to display our pdf newsletter on a page, with our normal header and footer. What hind of block or plugin would make this look good?

The File block isn't it.

I've recently switched from Windows to Mac while continuing to prepare my texts in Word (now under MacOS) and copying them to WordPress.com website. While there was no issues with this workflow under Windows, now I get a heavy mess.

Sometimes spaces are missing, and words are glued together. Sometimes lots of "nbsp" are added. Footnotes get pasted but hyperlinks don't work as planned (links now lead to something called applewebdata).

I thought I'd switch from Word to Pages. Now, it's better with the text but the footnotes are missing altogether when the text in pasted into WordPress.

Did anyone have same problems? How would I solve them?

Thank you.

Currently running a b2b site built on Astra theme. We have sales reps on the road using mobiles and tablets that complain about slow admin processes such as searching for products, adding admin orders and all general back end admin processes.

- 1600 products with png images
- 100-200 active users
- 28 plugins, all kept up to date
- 0 php snippets
- HPOS enabled
- Regularly maintained and kept updated
- Caching enabled and regularly purged but my hosting doesn’t support Memcached or Redis

Plugins list:
Admin Columns, Astra Pro, B2BKing Core and Pro, Complianz, Cost of Goods, Elementor, Email Templates, Fibosearch, Fluent forms, Global Payments, Max Mega Menu, Members , PiWeb disable payment method, Webtoffee invoices/packing list templates, Woocommerce update manager, Woopayments, WP Mail Logging, WP Mail smtp, WP Rollback, Zapier for woo and Zapier for wordpress plus four custom built plugins designed for admin processes such as stock inventory control, profit reports and projections , UI improvements etc.

Any ideas that I can look into to improve loading speed and improve ajax lookup speed

Currently running a b2b site built on Astra theme. We have sales reps on the road using mobiles and tablets that complain about slow admin processes such as searching for products, adding admin orders and all general back end admin processes.

- 1600 products with png images
- 100-200 active users
- 28 plugins, all kept up to date
- 0 php snippets
- HPOS enabled
- Regularly maintained and kept updated
- Caching enabled and regularly purged but my hosting doesn’t support Memcached or Redis

Plugins list:
Admin Columns, Astra Pro, B2BKing Core and Pro, Complianz, Cost of Goods, Elementor, Email Templates, Fibosearch, Fluent forms, Global Payments, Max Mega Menu, Members , PiWeb disable payment method, Webtoffee invoices/packing list templates, Woocommerce update manager, Woopayments, WP Mail Logging, WP Mail smtp, WP Rollback, Zapier for woo and Zapier for wordpress plus four custom built plugins designed for admin processes such as stock inventory control, profit reports and projections , UI improvements etc.

Any ideas that I can look into to improve loading speed and improve ajax lookup speed

After WCUS I wrote a blog post about one of the main issues I kept hearing with block themes: it's really hard for agencies to just write and deploy code for design elements without losing control once it was deployed. Basically components. We have patterns and parts and blocks and a few things, but no easy way to do what we used to do with classic themes.

I'm curious how others are solving this or if it's just a non-issue for the majority of WordPress developers.

https://www.briancoords.com/agency-workflows-components-and-highlights-from-wcus/

After WCUS I wrote a blog post about one of the main issues I kept hearing with block themes: it's really hard for agencies to just write and deploy code for design elements without losing control once it was deployed. Basically components. We have patterns and parts and blocks and a few things, but no easy way to do what we used to do with classic themes.

I'm curious how others are solving this or if it's just a non-issue for the majority of WordPress developers.

https://www.briancoords.com/agency-workflows-components-and-highlights-from-wcus/

Hi everyone,

I’m currently trying to improve my workflow for building WordPress websites for clients, and I’m curious how professionals and agencies actually handle this.

I mainly use WordPress and I’m currently looking at Kadence Blocks.

What I’m struggling with is the actual workflow.

Let’s say I have a custom design for a client. Do you really build every section manually in Gutenberg/Kadence, adjusting containers, columns, spacing, padding, typography, responsive settings, etc.?

That feels like a lot of clicking, especially when AI can generate HTML and CSS for an entire design very quickly.

At the same time, I don’t want to build the whole website as one huge custom HTML block, because I want the WordPress backend to stay clean and maintainable. Ideally, the client or another developer should still be able to edit content later without digging through HTML.

So I’m wondering how experienced WordPress developers handle this:

Do you build everything with blocks?
Do you have your own library of reusable sections and patterns?
Do you combine Gutenberg/Kadence with custom CSS and code?
Do you let AI/Codex generate parts of the site?
And how do you handle more complex sections, like event listings, custom cards, filters, etc. without spending hours recreating everything manually with blocks?

I’m basically trying to find a good workflow that is fast for me as the developer, but still results in a clean and maintainable WordPress site for the client.

Would love to hear how agencies and freelancers actually do this in practice.

Hi everyone,

I’m currently trying to improve my workflow for building WordPress websites for clients, and I’m curious how professionals and agencies actually handle this.

I mainly use WordPress and I’m currently looking at Kadence Blocks.

What I’m struggling with is the actual workflow.

Let’s say I have a custom design for a client. Do you really build every section manually in Gutenberg/Kadence, adjusting containers, columns, spacing, padding, typography, responsive settings, etc.?

That feels like a lot of clicking, especially when AI can generate HTML and CSS for an entire design very quickly.

At the same time, I don’t want to build the whole website as one huge custom HTML block, because I want the WordPress backend to stay clean and maintainable. Ideally, the client or another developer should still be able to edit content later without digging through HTML.

So I’m wondering how experienced WordPress developers handle this:

Do you build everything with blocks?
Do you have your own library of reusable sections and patterns?
Do you combine Gutenberg/Kadence with custom CSS and code?
Do you let AI/Codex generate parts of the site?
And how do you handle more complex sections, like event listings, custom cards, filters, etc. without spending hours recreating everything manually with blocks?

I’m basically trying to find a good workflow that is fast for me as the developer, but still results in a clean and maintainable WordPress site for the client.

Would love to hear how agencies and freelancers actually do this in practice.

I know, first world problem…. But I’m trying to implement gravity forms with n8n on a load balanced Wordpress setup. I have everything looking right but it’s just not connecting. n8n is on an internal data network, and Wordpress is running behind haproxy on three nodes, the site is on 80/443 in front of the load balancer but 8083 behind. All ssl is done at the load balancer.

I’m thinking it makes the request but doesn’t know how to get back if Wordpress gives it a url and port that depends on the load balancer. Or one of the three nodes makes the request but it responds back to another node.

Anyone have any ideas?

Most AI writing plugins call an AI API with a generic prompt and hand you filler that reads like every other AI-generated post. I kept running into that on my own sites, so I built Versoo Content Ops to fix it — it's free, on wp.org, GPL: https://wordpress.org/plugins/versoo-content-ops/

The core idea: you set your brand context once — audience, tone, topics, a writing sample — and every draft gets generated against that specific context instead of a generic "write a blog post about X" prompt. It runs on WordPress 7.0's built-in AI client (Settings → Connectors), so it uses whatever AI provider you've already got configured there. You still need a real provider key set up—the plugin just doesn't need a separate one.

Past the draft generation, it also runs a 13-check SEO pass automatically, rotates generated titles across 15 headline formulas so they don't all end up sounding the same, and includes a free tag-cleanup tool for orphaned/duplicate taxonomy terms. Everything is currently free — no paid tier exists yet.

Curious whether other people building on WP 7.0's Abilities API have run into the same generic-output problem, or found different ways around it. Feedback (including "this doesn't actually solve it, here's why") is genuinely welcome.

I like AIOS security but the scan just keeps running at initiating file scan. Any ideas how to fix this?

weird

https://preview.redd.it/jd0bc36rkenh1.png?width=913&format=png&auto=webp&s=aac85bad4fdae6856cc41a400d06334d1ba04a6b

hello everyone,

so i just realized when i click all of my category theres a phone number of a business in my country.... i dont remember putting it there. i cant find how to delete it. i even made a new category to test, and when i click it, the number is already there....

https://preview.redd.it/6ni2s00nkenh1.png?width=1176&format=png&auto=webp&s=1df70e1f88ddd57d283323eb6b238af1d6103ea1

can someone tell me how to delete it?

I like AIOS security but the scan just keeps running at initiating file scan. Any ideas how to fix this?

Howdy, 'Pressers. I'm sharing this under the promo rule because it’s a free/open-source plugin out on the repository, and this is my company's first WordPress plugin release. I’d genuinely appreciate feedback from y'all.

My developer built Schema Viewer because we kept running into the same practical issue on inherited WordPress sites: structured data/schema may be present, but it is not always quick or convenient to inspect.

The project that pushed us to build it involved a client site with an older schema-viewing setup. It solved a real problem - the entire internal marketing team, and their vendors, wanted visibility into what schema was on a page - but the implementation added front-end clutter and confusion.

We wanted a cleaner version: Logged-in user clicks a button the WordPress admin bar once → sees the JSON-LD on the current page → can review/copy it without digging through source code or adding anything weird to the public front end.

Plugin link: https://wordpress.org/plugins/bipi-schema-viewer/

I’d especially appreciate feedback on:

• whether the workflow makes sense
• whether the output is readable/useful
• whether the admin-bar placement feels right (or if we need an option to not show it and instead access from the dashboard)
• anything that feels confusing in the plugin description/readme
• whether there are obvious edge cases we should think about

Thanks in advance. This is our first plugin release, so I’m trying to learn from people who spend more time in the WordPress plugin development ecosystem than I do. Also, I hope someone finds this useful - it's made my life SO much easier as a dashboard/admin user!

https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-super-forms-plugin/

Just thought I would share these statistics out of interest.

I am migrating away from a VPS that I have had for years to a new (cheaper) provider.

I used Site Sucker Pro to download the one Wordpress site that I had active and converted it to an static site. The site was old and wasn't going to be updated, so I didn't need to worry much about keeping any Wordpress functionality. It also had a very old version of Elementor Pro that I no longer pay for.

The site had 8 pages and had the following plugins activated:

• Elementor
• Elementor Pro (not updated for over 2 years as no pro licence active)
• Google Site Kit
• Really Simple SSL
• Rank Math
• Shortpixel Image Optimiser
• Wordfence (free)
• WP Super Cache

The site was using the "Hello" theme from Elementor but also had the 2025 and 2024 themes as backup (for testing)

I took a backup of the site before I did anything and I was struck by the number of PHP and Javascript files across the entire site. Here are the stats:

• 7876 .php files
• 2954 .js files

And yes, I get that the majority of these PHP files are small, single functions that the devs have split down for ease of use.

But in my mind, this is quite a simple Wordpress site - not too many pages and I kept the number of plugins and themes to a minimum.

I have nothing against Wordpress at all and would choose to use it again, but the number of possible attack vectors feels huge!

No wonder people think Wordpress is such a security risk.

Howdy, 'Pressers. I'm sharing this under the promo rule because it’s a free/open-source plugin out on the repository, and this is my company's first WordPress plugin release. I’d genuinely appreciate feedback from y'all.

My developer built Schema Viewer because we kept running into the same practical issue on inherited WordPress sites: structured data/schema may be present, but it is not always quick or convenient to inspect.

The project that pushed us to build it involved a client site with an older schema-viewing setup. It solved a real problem - the entire internal marketing team, and their vendors, wanted visibility into what schema was on a page - but the implementation added front-end clutter and confusion.

We wanted a cleaner version: Logged-in user clicks a button the WordPress admin bar once → sees the JSON-LD on the current page → can review/copy it without digging through source code or adding anything weird to the public front end.

Plugin link: https://wordpress.org/plugins/bipi-schema-viewer/

I’d especially appreciate feedback on:

• whether the workflow makes sense
• whether the output is readable/useful
• whether the admin-bar placement feels right (or if we need an option to not show it and instead access from the dashboard)
• anything that feels confusing in the plugin description/readme
• whether there are obvious edge cases we should think about

Thanks in advance. This is our first plugin release, so I’m trying to learn from people who spend more time in the WordPress plugin development ecosystem than I do. Also, I hope someone finds this useful - it's made my life SO much easier as a dashboard/admin user!