Please forgive me if something along these lines has already been answered…

On June 14, I started my NBA blog on WordPress. I know that “sports” is a pretty hard niche to break into, but I’ve been covering the league for several seasons now, racking up millions of views on other websites. This summer, I decided to go independent. I have 159 posts published on my site so far, and have been linked/referenced on sites like Yahoo, Sporting News, and Sports Illustrated. Through Twitter, I’ve been able to amass 167 subscribers to my newsletter.

However, Google isn’t indexing me. I’ve submitted a sitemap, manually submitted each post’s URL, and nothing. 64 pages are “Crawled - currently not indexed.” More are “Discovered - currently not indexed.” Before you ask, the box that says “discourage search engines from seeing my content” has been unchecked in the WordPress dash.

I also link to between three and six posts in every new article I write, so my internal linking should be solid. Again, I’ve been cited by other sites, which should help speak to “quality” and “authority,” right?

Is there something I’m missing? Why am I not showing up in search? When I do a “site:EnterNameHere” search in Google, only my home page shows up.

Worth noting that most of my views on past sites were from organic search/Google Discover, so I was hoping to find similar (although smaller) success.

The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a site clean. The malware was installed as a must-use plugin with several self-healing mechanisms in place in order to survive removal. It also makes use of Etherhiding, a technique that hides the location of the attacker’s servers behind a smart contract on the Ethereum blockchain, making the command channel resilient to takedown..

Hi,

I’m using Voxel and have a hierarchical Coverage Areas taxonomy:

UK → England → North East → Northumberland

On my single listing template, I’m displaying the selected Coverage Areas dynamically, but it currently outputs the full hierarchy (see image):

UK, England, North East, Northumberland

I’d like it to display only:

North East, Northumberland

Is there a way to achieve this using Voxel dynamic data, without changing how the taxonomy is structured?

Thanks

Thank you to everyone here who gave feedback on PluginScore previously. We listened, shortened things down, cleaned up the interface and have continued building it out.

Alongside the plugin scoring system, we’ve now added:

• WordPress Theme Detector: detects themes, plugins, versions and supporting evidence
• Domain Scanner: checks security, SSL, DNS, email security and more
• Improved vulnerability reporting
• Cleaner plugin reports and exports

Everything is available at PluginScore.Kitgenix.com.

Would love some feedback on the new version, particularly what you’d change or add next.

I manage around 20 web sites for various clients that are hosted on WP Engine. I frequently find (today for example) that there is a security release available for a plugin , or in this case Wordpress version 7.1.2 that does not show in the usual dashboard view. Sites I’ve checked show far running 7.1 show no update available. The happened a week ar so ago when there was a Gravity Forms update available, but not showing in the dash.

This is mildly infuriating. Support says its because the updates have not been approved or tested for the server environments yet... But the real reason has to be because WP Engine started using a clone of the Wordpress plugin repository back when Matt M. was feuding with them.

There was some controversy yesterday when I shared news of a recent vulnerability with Gravity Forms, so I thought this was relevent. Under 13% of WordPress sites have been updated within the past month.

We just cleaned a self-healing infection on a couple of WordPress sites. A manual file cleanup was not enough: it came back within 24 hours because the malware’s source of truth was in the database and in wp-config.php.

Posting this so others can hunt the same traces. I’m not dropping payloads or backdoor keys.

What visitors saw

A fake Cloudflare “Verify you are human” overlay (ClickFix). Interaction tried to get people to paste PowerShell from the clipboard.

How it persisted (this is why it returned)

Three layers restored each other:

1. Database — base64 payloads in wp_options as transients named like _site_transient_health_*
2. Files — fake plugins, MU-plugins, copies in wp-includes/assets/ and sometimes uploads/
3. Boot code — restore logic in wp-config.php and/or wp-content/object-cache.php that rewrote the plugin from the DB on every request, plus hourly cron hooks

If you only delete the PHP files, the next page load recreates them.

Hunt these filenames / folders

wp-content/mu-plugins/wp-own-assets.php wp-content/mu-plugins/wp-feed-normalize-*.php wp-content/mu-plugins/wp-rest-cache-*.php wp-content/mu-plugins/wp-rest-hardening-*.php wp-content/mu-plugins/wp-rest-optimizer-*.php wp-content/plugins/wp-cache-*/ wp-content/plugins/security-headers-manager-*/ wp-content/plugins/site-performance-toolkit-*/ wp-content/object-cache.php (only if you did not install an object cache yourself) wp-includes/assets/class-walker_*.php (hex suffix, NOT core Walker files) .own-releases/ (hidden folder inside the fake plugin) own-stego.php / own-stg.php / qtt-own-core.php.obf pc_pack.py _w10_up.php (often dropped in a theme js/ folder) 

Also search wp-config.php for a block around WP_Core_Integrity or a function named _wp_cuh_restore / _wp_cuh_sql. That block is the self-heal. Remove it.

.htaccess

Look for:

# own-stego-v4 

and lots of:

# BEGIN wp_compat_* <FilesMatch ...> 

The stego block silently rewrites a normal image URL (featured-default.jpg, slide-01.jpg, etc.) to own-stego.php.

Database / cron

In phpMyAdmin or WP-CLI:

SELECT option_name, LENGTH(option_value) FROM wp_options WHERE option_name LIKE '%\_site\_transient\_health\_%'; 

Use your real table prefix instead of wp_.

Cron hooks to remove (inside the cron option, or via a cron plugin):

wp_cache_health_* wp_compat_heal_* 

On our sites the transients were ~125–225 KB of base64. Legitimate site-health transients are not that size.

Hidden admins

Check wp_users / Users in wp-admin for recent administrators with names like:

wpsvc_* *_infra* *_dev* emails on u/wordpress-svc.internal 

Do not assume every wpsvc_* account is Plesk/Toolkit. Ours were created the same day as the webshell plugin.

REST backdoors

Malicious MU-plugins registered extra routes under the core namespace:

/wp-json/wp-site-health/v1/check-* 

Core WordPress uses /tests/... under that namespace. Random check-<hex> POST routes with permission_callback wide open are not core. After cleanup those URLs should 404.

Cleanup order (important)

1. Put the site in maintenance / take it off the public internet if you can.
2. Break self-heal first: remove the wp-config.php injection and object-cache.php drop-in (if it is not yours).
3. Delete the fake MU-plugins and fake plugins (including hidden .own-releases).
4. Delete class-walker_<hex>.php copies in wp-includes/assets/ (keep the real script-loader-packages.php / icon-library-manifest.php).
5. Delete the _site_transient_health_* rows and the unknown cron hooks.
6. Rotate all salts in wp-config.php (not only AUTH_KEY).
7. Reset every remaining admin password. Rotate FTP/SFTP and DB passwords too. Attackers with RCE can steal those.
8. Update WordPress, themes, and plugins from clean sources. Reinstall anything you cannot verify.
9. Re-enable security plugins if they were renamed (wordfence.disabled_* etc.).
10. Watch 24 hours: if wp-cache-* or those MU-plugins come back, a copy is still on disk or in the DB.

Initial access note

Our copy was attributed to Thrive Architect. CVE-2026-66694 is public as unauthenticated XSS in Thrive Architect <= 10.9.3.1, patched in 10.9.3.2. Our sites were already on 11.x; the reinfection was the leftover self-heal, not that CVE still being open. Still: update Thrive (and everything else). An older Thrive file-write bug has existed in the past, so don’t treat “we patched XSS” as a full incident review.

If you find wp-own-assets.php loading a script from another vhost on the same server, clean that vhost too. In our case production was being reinfected from a sibling site.

If you are not sure

Do not “edit the malware until it looks clean.” Remove the listed files, the wp-config block, and the transients. If the site is a mess, restore WordPress core + themes + plugins from vendor copies and keep only wp-content/uploads after scanning it for .php files.

Happy to answer hunt questions. Don’t ask for a copy of the payload.

Make sure to press the update button: https://wordpress.org/documentation/wordpress-version/version-7-1-2/

- An unauthenticated path traversal issue in page-template resolution leading to conditional remote code execution reported by Robert Ressl 

I have a website that's getting a lot of traffic to URLs that aren't intended to be viewable pages, and having checked this on a couple of other wordpress sites I manage, it seems to be a default part of Wordpress.

The URLs in question are: https://mycustomdomain.com/page/N/

We're experiencing a lot of bot traffic going to those addresses and are not sure why.

To mitigate this I have:

- introducing a WAF rule in Cloudflare to block visits (http.request.uri.path wildcard r"/page/*")

- added nginx rules to return a 404 on those URLs

I'm also trying to look into where these are coming from and why the site in question is seeing so many visits to these URLs.

I put the Cloudflare rule in place this morning (2-3 hours before writing this) and according to Cloudflare the rule has been triggered 8,430 times since I created it!

AFTER MORE INVESTIGATION:

So I believe that the issue is being created somehow by pagination / query loop.

I have a query loop on the page which returns posts. The pagination block for this returns pages past the initial 10 with the following URL structure:

https://mycustomdomain.com?query-7-page=2

I don't know why this is the URL convention rather than:

https://mycustomdomain.com/page/2

I’m attempting to set up MemberPress on Wordpress to manage memberships for our association. I’m not a pro, but I have reasonable coding experience. Setting up MP with shortcodes, defining groups and rules, styling everything to look right, has all been straightforward.

Now I’m trying to do my research to avoid spam sign-ups and card testing attacks. I have no experience with this, and have no idea of the realistic threat.

What I’ve set up:
- in MP itself, enabled prevent card testing attacks
- minimum membership fee $40 (no free or low memberships)
- Cloudfare Turnstile on all form pages (login, registration)
- Math captcha (kind of simple)
- Using Stripe Checkout, so offsite to complete purchases

Am I missing anything? With Stripe there is a heft chargeback fee, so I really don’t want to face 1000s of fraudulent charges (using real cards). Any other advice? Thanks.

This is my first time building a directory AND using WordPress with hosting. I was using a really flexible theme, Voxel, together with using Elementor, and was working on a couple of new features when suddenly my website was full of bugs or something that was causing a lot of security issues on my host.

I am just good at editing some html, understanding basic coding, but full-on things like these are where I just couldn't deal with it.

I still have about half a year on my paid Voxel, so it would be a pity to not use such a good theme. I really love the flexibility of Voxel + Elementor; I managed to make some good-looking pages!

But I can no longer deal with the problems that come with using WordPress and am thinking of using an Saas. It's less flexible, but it gets the work done. I do need some minor customisation, but I believe the provider may be able to ship the customs?

I once tried DirectoryEasy before, but there was too much custom needed on my end.

I am thinking of using Directify. Been trying it out, and it seems promising, just need some simple customs.

Before using WordPress, I was just using a simple SpreadSimple but literally it was too simple plus the design is too old school.

Any gurus able to give advise before I throw in another 39 bucks monthly compared to the 7 bucks monthly for only hosting etc?

(I have spent an amount I don't really have trying out different providers just to either make my directory work or find something that's flexible enough.. Just for context, it's a local directory gathering general businesses for my area)

[Manual repost from r/directorymakers ]

How to replace the Hero image in Twenty Twenty-Four (TT4) – and the Cover Block bug that blocks it

Hi everyone,

I'm working on a new project using the default Twenty Twenty-Four (TT4) theme and I'm trying to replace the Hero image on the front page with one of my own images from the Media Library.

However, I've run into a problem that I can't seem to solve on my own.

What I tried:

I uploaded several images to the Media Library.

I opened the Site Editor (Design → Editor) and selected the Home template.

I clicked on the Cover block (Hero area) to select it.

I tried to replace the image via the block toolbar – but instead of the expected "Replace" option, I only see "add-media".

When I click on the Media Library, nothing happens at all – it doesn't open. I also checked the three-dot menu in the block toolbar, but it only shows the standard options (copy, cut, duplicate, add before, add after, copy styles, paste styles, group, lock, rename) – no image-specific settings.

What I found out so far:

After some research, I came across a known bug in the Cover block of Twenty Twenty-Four. When the Cover block is set to use the Featured Image, critical settings – such as image resolution or "fixed background" – are hidden, and the block sometimes behaves as if no image were loaded at all. The official workaround is to:

Add a new Cover block.

Insert a temporary image (not the featured image).

Adjust the settings (e.g. resolution to "Full Size").

Save the block/template.

Then use "Replace" → "Use Featured Image".

My problem now:

I can't even get to step 2, because the Media Library doesn't open in the Site Editor when I click it. I suspect a plugin conflict (possibly LiteSpeed Cache or a security plugin blocking the JavaScript).

My questions:

Has anyone else experienced this with TT4 – the Media Library not opening in the Site Editor?

Is there another reliable way to insert a temporary image into a Cover block (e.g. drag & drop) without using the Media Library?

Which plugins are known to cause this kind of conflict in the block editor?

I'd really appreciate any hints. I'm very close to solving this, but I feel like I'm missing one final step.

Thanks a lot in advance!

I moved a site to a new VPS last month (both with WHM/cPanel), which included an update from PHP 7.4 to 8.4 and then updates to the WP core, theme, and plugins. I enabled Smart Update and auto updates.

Today I had an auto-email from the server saying:

Smart Update could not be completed automatically. Please try running the update manually. Details: Failed to clone the installation: 'Failed to set permissions for database user: The request failed. (Error ID: a2n3z3) 

Then I discovered that there were 4 new databases with 0 bytes and 4 new users added, so presumably this has failed 4 times (guessing once a week).

I deleted those stale DBs and users, then as a test tried to add a new user myself. I could add the user in cPanel, but when I tried to add it to the main DB nothing happened; I had the progress circle for a few seconds, then it went away without adding the user.

I added the user to the database manually in CLI then added it to wp-config.php and it worked, but cPanel doesn't show the username being added to the database.

cPanel's error_log shows 265 lines after running Smart Update. I don't want to post the whole thing unless you all say you need it, but what I thought was relevant were the first few:

[2026-09-22 00:09:06 -0400] warn [cpmysql] Error from MySQL query: Cpanel::Exception::Database::Error/(XID 4abqfx) The system received an error from the “MySQL” database “mysql”: ER_PASSWORD_NO_MATCH (Can't find any matching row in the user table) at /usr/local/cpanel/Cpanel/DBI.pm line 200. QUERY: ALTER USER IF EXISTS 'example'@'localhost' IDENTIFIED WITH 'mysql_native_password' AS '<foo>'; GRANT USAGE ON *.* TO 'example'@'localhost'; ALTER USER IF EXISTS 'example'@'my.server.net' IDENTIFIED WITH 'mysql_native_password' AS '<foo>'; GRANT USAGE ON *.* TO 'example'@'my.server.net' [2026-09-22 00:09:06 -0400] warn [cpmysql] Error from MySQL query: Cpanel::Exception::Database::Error/(XID 6qvnq4) The system received an error from the “MySQL” database “mysql”: ER_PASSWORD_NO_MATCH (Can't find any matching row in the user table) at /usr/local/cpanel/Cpanel/DBI.pm line 200. 

I confirmed that the password (authentication_string?) printed here (represented by <foo>) matches what's in mysql.user

Finally, I see that 'example'@'localhost' and 'example'@'123.45.67.89' show GRANT USAGE ON *.*, but 'example'@'my.server.net' says There is no such grant defined for user 'example' on host 'my.server.net'. I tried adding grants to that one, but SHOW GRANTS still says the same thing. Is that relevant?

If not then I'm out of ideas. Any suggestions?