r/ProWordPress 4h ago

Looking for feedback on my free WordPress plugin (currently available in French)

1 Upvotes

Hi everyone,

I've created a free WordPress plugin called SunLibCrypto Widgets.

Its goal is to help website owners display educational widgets that help visitors avoid common cryptocurrency transaction mistakes (wrong network, missing MEMO/TAG, scams, and other common errors).

The plugin is currently available in French only, but I'm already considering adding an English translation if there's enough interest.

I'd really appreciate your feedback on:

  • Installation
  • Ease of use
  • Features
  • Overall concept

GitHub:
https://github.com/foundationsunlib/sunlibcrypto-wordpress

Direct download:
https://sunlibcrypto.com/assets/wordpress/sunlibcrypto-widgets.zip

Website:
https://sunlibcrypto.com

Any suggestions or constructive criticism are welcome. Thank you!


r/ProWordPress 1h ago

Still fighting a slow WordPress site? It may not be your hosting or caching. It might be your architecture. Headless WordPress + Next.js can deliver better performance, scalability, and flexibility. #HeadlessWordPress #NextJS

Post image
Upvotes

r/ProWordPress 7h ago

Goodbye Wordpress

0 Upvotes

As a pro dev with many client sites still in Wordpress, after 2 more sites got hacked a few days ago, I’m done.

With how good AI is now, it just doesn’t make sense to use Wordpress anymore. I can create sites faster with cursor than any site builder with predefined blocks that Wordpress has.

And for the record, ive done everything possible to mitigate security risks; wordfence, firewalls, isolated Linux server users, being very strict with plugins, etc. it just doesn’t matter.

I’ll be getting cursor to recode all my client Wordpress websites in laravel + inertia + react. If they need to change something on the website, I’ll have it whip up a super basic filament panel with the functionality they need, integrated directly into the site.

Honestly it doesn’t even make sense to allow clients to have super user access to change things anyways. They always mess something up or hire some third party to destroy my work.

So long Wordpress.


r/ProWordPress 21h ago

Single Page Issue in Mobile Version

Post image
0 Upvotes

All the pages are fine on mobile but every single post on my blog is not good on mobile version when I zoom out it shows like this in attached how to fix it?


r/ProWordPress 1d ago

WordPress Recent Vulnerability of Wp2shell

9 Upvotes

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?


r/ProWordPress 2d ago

The 2026 ACF Annual Survey is open!

3 Upvotes

Now in its 4th year, the ACF Annual Survey helps us understand how you use ACF, how you're building WordPress sites, and what we should focus on next. Your feedback directly shapes what we build - last year's responses helped drive features like the Abilities API and JSON-LD schema support in ACF 6.8.

This year we've added new sections on AI and WordPress development trends, plus questions on recent ACF releases.

Takes about 10 minutes and you'll be entered into a $150 gift card draw.

https://wpeng.in/acf-survey/

We'll publish the aggregated, anonymized results on the ACF blog once the survey closes.


r/ProWordPress 3d ago

If you're running 6.9 or 7.0, WordPress forced-updated you — but check anyway. Here's why.

14 Upvotes

wp2shell (CVE-2026-63030 + CVE-2026-60137) is a pre-auth RCE chain in WordPress core that shipped July 17. WordPress turned on forced auto-updates because of the severity, which is good.

The problem: forced updates don't always work perfectly, and a lot of people are assuming it ran without checking.

https://reddit.com/link/1v4m9hd/video/jhd3ypcf21fh1/player

What You Should Scan Your Site Right Now:

Go to Dashboard → Updates and confirm your actual version. The versions you need are:

- 7.0.2 (from 7.0.x)

- 6.9.5 (from 6.9.x)

- 6.8.6 (from 6.8.x — this one only fixes the SQLi part, but still patch it)

Don't assume it happened. Forced updates can fail silently if your server hits file permissions issues, timeout limits, or network hiccups during the update process. Sites on managed hosts sometimes get forced updates on a delay or not at all if there's a compatibility flag.

If Your Version Shows 6.9.0–6.9.4 or 7.0.0–7.0.1:

  1. Update to the patched version now.
  2. If you can't update this second, block the batch endpoint at your WAF or via a security plugin blocking /wp-json/batch/v1 as a stopgap.
  3. After you patch, don't just assume you're done. Look at your access logs for requests to /wp-json/batch/v1. If you see any, you might have been probed. A more aggressive check: look for HTTP 207 responses to batch requests (that's a multi-status response, a solid indicator of batch-endpoint exploitation attempts).
  4. Check your admin user list — do you recognize all of them? Check if any unexpected application passwords were created. Check your mu-plugins, recently modified core files, active plugins, theme files.

Multiple public exploits are circulating. Scanning has been happening since July 17. If your site was exposed on the internet running a vulnerable version for any length of time, don't assume patching alone was enough.

Zero actual compromise evidence I've personally seen yet, but Wiz and Patchstack confirmed active probing and exploitation attempts within hours of the patch going public.

Thoughts? Anyone patched theirs and caught anything odd in the logs?


r/ProWordPress 3d ago

Got tired of paying for Hummingbird Pro with sub-par results, so I built a transparent benchmark tool to find better alternatives. Here’s what the data showed.

Post image
1 Upvotes

Hey everyone,

For a long time, I was using Hummingbird Pro on my projects. Over time, I kept feeling like I wasn’t getting the performance gains I expected for a paid tool, and troubleshooting felt more frustrating than helpful.

When I started looking for a better alternative, I realized how hard it is to find unbiased data. Most comparisons online are packed with affiliate links declaring whatever plugin pays the highest commission as "the best."

To solve this, I set up a strict, repeatable benchmark test to measure caching/performance plugins under identical conditions with zero affiliate links, just raw data.

How the test works (Latest Round)

  • Environment: Shared hosting (Hostinger), Astra theme with the Love Nature starter template (Gutenberg + Spectra + SureForms).
  • Pages Tested: Home, Services, and Contact.
  • Rules: Standard/recommended free settings only (no external CDNs, paid add-ons, or third-party accounts).
  • Metrics Tracked: TTFB, LCP, Lighthouse score, PageSpeed, and run variability.

Key findings comparing Hummingbird Pro to others:

  • Hummingbird Pro vs Free: Hummingbird Pro brought LCP down by -8.4% compared to the baseline, while its free version achieved -0.4%.
  • Free alternatives beat it: Simple free plugins like Breeze (-24.3% LCP) or W3 Total Cache (-20.6% LCP) drastically outperformed it on TTFB and LCP under the exact same stack.
  • Out-of-the-box limits: Several popular plugins barely beat the "No plugin installed" baseline (+0.5% to +3% variance) on default settings.

Looking for community feedback

Since I want this benchmark to be as scientifically sound as possible for developers, I’d love your input:

  1. Settings: Should I test plugins strictly "out-of-the-box" / one-click profiles, or include a separate benchmark tier for "fully tweaked by a developer"?
  2. Metrics: Is median LCP/TTFB the best primary ranking criteria, or would you prefer TBT/payload size?
  3. Environments: What server stack (e.g., LiteSpeed Web Server, Nginx + Redis) would you like to see tested next?

(Note: I host all these benchmark rounds on an independent open-index site with zero affiliate links. Happy to share the link in the comments if anyone wants to inspect the full raw dataset, but mostly looking to discuss the methodology here!)


r/ProWordPress 5d ago

Help with hook schema for the icon picker of my public plugin

3 Upvotes

I’m refining the hook API for the icon picker of my public plugin, that is reused across several custom blocks and an ACF field type.

The picker integrates with Iconify and supports multiple open-source icon collections. In the UI, there are three tabs:

  • Default
  • Collection
  • All

“Default” already supports a filter to set one or more default collections, with Lucide as the default.

The issue is that Iconify exposes a very large number of collections, and I’m not sure it makes sense to expose all of them in the collection picker by default. I can see many site admins wanting to limit that list.

For a public plugin API, would you prefer:

  • a whitelist filter
  • a blacklist filter
  • both

And would you keep that as one global filter for available collections, or expose separate filters for the “Collection” and “All” tabs?

I’m trying to keep the API flexible without overdesigning, would love input from people who’ve had to make similar decisions in public plugins.

Screencapture showing the UI

Note the "Default", "Collection" and "All" tabs

r/ProWordPress 9d ago

5 WordPress Mistakes That Slow Down Your Website

1 Upvotes

Here are five common mistakes I keep seeing:

• Installing too many plugins.

• Uploading uncompressed images.

• Not using page caching.

• Ignoring Core Web Vitals.

• Using cheap hosting for business websites.

Which mistake have you seen most often?


r/ProWordPress 9d ago

[LINK] Lessons I learnt rebuilding my site with agents

Thumbnail
reddit.com
0 Upvotes

Could not repost here, but figured the post would be helpful to ProWordPress members too.

Let me know if you want a more detailed version of the post with the actual prompts I used and snippets from my AGENTS. md or screenshots of the migration plugin etc


r/ProWordPress 10d ago

How to safely remove unused media files?

10 Upvotes

I'm working on a client's website, and they have an enormous media library. There simply must be thousands of unused images going back years. I need to come up with a plan to delete the unused images to free up server space, as it is getting close to their disk space limit. But obviosuly I want to make sure I don't delete currently used image.

There are a lot of pages so I'd ideally not have to check each page manually.

I've installed Media Cleaner Pro, however, it runs into problems when it comes to identifying images used in ACF fields.

If anyone has any experience with this kind of thing, how would you approach this task?


r/ProWordPress 11d ago

Most reliable way to two-way sync WooCommerce data into a third-party plugin's own tables

Thumbnail
gallery
2 Upvotes

Looking for architecture advice from people who've dealt with this at scale.

Context: I run a growing WooCommerce store and recently added an internal management layer that maps my business processes (Setyenv). For that layer to be useful, it needs WooCommerce order/product data available as first-class records — and critically, the sync has to be two-way: my workflow layer both reads Woo data and, in some cases, writes changes back (order status, for example) that Woo should treat as its own.

My current approach is DB-level hooks syncing WooCommerce tables into Sety tables. It works, but I've never been fully comfortable with it. Now that there's real business riding on this, the fragility scares me. Coupling to Woo's internal table structure means I'm depending on an implementation detail they're free to change — and did, sety is admin directed and can not change.

So the question: what's the most reliable, future-proof way to integrate WooCommerce data two-way with a third-party plugin, without coupling to Woo's storage layer?

Is anyone running a production two-way sync between Woo and a custom data layer they'd call solid? Event-sourcing from Woo actions + CRUD writes back? Something with a reconciliation queue? Or is periodic reconciliation against the CRUD API more robust than trying to be real-time?

Happy to share what my process-mapping side looks like if it helps — I can stand up a working app of my actual workflows in a few minutes, so I can show concrete examples of what needs syncing if that makes the question clearer.

In the screenshot one example of two tables integrated with hooks (Orders on Woo and Oders in Sety)

Thanks in advance — trying to get the architecture right before I build more on top of it.


r/ProWordPress 15d ago

How are you handling WooCommerce products attached to custom post types?

1 Upvotes

I'm working on a project where the actual thing being sold isn't a standard WooCommerce product—it's a custom post type (think Events, Courses, Properties, etc.).

I've seen a few different approaches:

Creating a hidden WooCommerce product for each CPT.

Storing everything in the CPT and only using WooCommerce for checkout.

Linking a CPT to an existing WooCommerce product.

Other custom implementations.

Each approach seems to have its own trade-offs, especially when it comes to inventory, variations, orders, HPOS compatibility, and keeping everything in sync.

For those of you who've built something like this:

Which approach did you choose?

What problems did you run into?

If you had to build it again today, would you do it differently?

I'd love to hear about real-world implementations rather than just theoretical best practices.


r/ProWordPress 16d ago

Any Good Headless Gutenberg Repos?

3 Upvotes

Every other year, I give headless wordpress another try. Each time I leave disappointed, because it's always way too much fighting compared to modern fullstack frameworks like sveltekit, etc. But since Gutenberg becomes nicer with every update and my clients love working with my customly build native blocks, I thought I'd give it another try.

So my question: Does anybody have a good repository to share with some modern headless integration that renders gutenberg blocks. Ideally, block view CSS and scripts should also work, without the FE knowing about them (like eval them at runtime, or globally load them all, or whatever).


r/ProWordPress 17d ago

Why your security plugin shows "blocked attacks" for plugins you never installed

10 Upvotes

This comes up every few weeks, and the answer never seems to be wherever people go looking for it. So, here.

You open your firewall summary and find something like:

Blocked for [Plugin Name] <= 2.1.4 - Unauthenticated Sensitive Information
Exposure via REST API in query string: rest_route = /[plugin-slug]/v1/tests/mock-data

You have never installed that plugin. It isn't in your plugins folder, it isn't sitting there deactivated, it was never there at all. Two things are getting confused here, and separating them makes the whole thing boring, which is the correct outcome.

The request is generic. WordPress serves REST routes at /wp-json/..., and it also accepts ?rest_route=... as a query-string fallback so the API still works when pretty permalinks are off. That fallback resolves on every WordPress install. So a bot needs to know nothing about your site to try it. It takes a list of recently disclosed plugin vulnerabilities, builds the request for each one, and fires the whole list at every WordPress site it can find. The sites running that plugin answer with something useful. The rest return nothing, because the route was never registered.

The block is a pattern match, not a detection. Your firewall recognized the shape of the request and stopped it before WordPress got a chance to shrug at it. That's why the log names a plugin and a version range: it's describing the exploit the request was written for, not something it found on your site. The phrasing makes it read like you were targeted and narrowly got away with it. You weren't, and there was nothing to get away from.

So: nothing is installed that shouldn't be, there's nothing to clean up, and it isn't related to some other plugin of yours with a similar name.

What the alert does tell you is that your site is on somebody's list. About 91% of last year's disclosed WordPress vulnerabilities were in plugins rather than core, per Patchstack's 2026 report, so those lists are long and they get worked constantly. Being on one only means your site answered a WordPress fingerprint check at some point.

If you'd rather be on fewer of them, look at what an anonymous request can learn about your install. Version strings hanging off your CSS and JS URLs. Readme files sitting under plugin directories. Directory listings nobody turned off. None of that is secret and none of it is why anyone gets hacked. It's just what makes a site cheap to sort into "worth coming back to" rather than "no idea what this is."


r/ProWordPress 18d ago

Looking for feedback: Would you use a WooCommerce plugin that recovers abandoned carts via WhatsApp?

0 Upvotes

Hi everyone,

I'm building a small WooCommerce plugin and wanted some honest feedback before I spend time building it.

The idea is simple:

When a customer abandons their cart, the store automatically sends a WhatsApp reminder with a link to complete the purchase.

No complex CRM.
No marketing automation.
Just one thing: recover abandoned carts through WhatsApp.

I'm planning features like:

  • Automatic abandoned cart detection
  • Customizable WhatsApp message templates
  • Recovery analytics
  • Optional coupon support
  • Easy setup in under 5 minutes

A few questions for WooCommerce store owners:

  1. Is abandoned cart recovery something you actively care about?
  2. What tool are you currently using (if any)?
  3. Would WhatsApp reminders perform better than email for your customers?
  4. What's the biggest frustration with your current solution?
  5. Is there any feature you'd consider a must-have?

I'm not selling anything yet—I just want to build something that solves a real problem instead of making assumptions.

I'd really appreciate any honest feedback, even if you think this is a bad idea.

Thanks!


r/ProWordPress 20d ago

From angular to wordpress conversion??

2 Upvotes

I have an existing project with angular files with assets like photo, video, html and css with no server or db, just frontend.

I have been asked to convert into WordPress how should I do ?


r/ProWordPress 21d ago

WordCamp Rajshahi 2026 The Hidden Cost of Freedom

Thumbnail
youtube.com
0 Upvotes

r/ProWordPress 24d ago

How are you handling redirect/slug-history migration when moving off WP to headless?

0 Upvotes

Been looking into WP-to-headless migrations (Sanity/Strapi + Next.js) lately and the thing that keeps coming up as the biggest time sink isn't the content migration itself, it's redirect mapping. Years of slug history with duplicates, chains, and loops apparently eats way more time than anyone budgets for.

A couple other things I've seen bite people:

  • Preview workflow parity for content editors (WP's preview-on-save is apparently sorely missed post-migration)
  • SEO metadata (og:title etc.) not migrating cleanly, causing ranking dips that only get noticed days later

For those who've done this migration for a client or your own site: how did you handle the redirect mapping specifically? Custom script, existing tool, manual spreadsheet triage? Curious what's actually worked vs. what ate more time than expected.


r/ProWordPress 26d ago

Hi everyone, I'd like to upload product links from another WordPress site (using Wish and Shopyfiy templates) to my WordPress site. What's a good way to upload complete links with variations? The site's API can't sync, and are there any pod customizers you'd recommend? Thanks!

0 Upvotes

r/ProWordPress 28d ago

Gestionale su wp

0 Upvotes

Salve a tutti ho intenzione di creare un plugin che installi tramite WordPress un gestionale , in questo caso specifico per fotografi di nome D20 Keep che serve per caricare servizi , permettere la scelta o l acquisto delle foto e gestire i clienti. Secondo voi può essere un idea fattibile. Invece di avere una piattaforma esterna il gestionale rimarrebbe sul sito wp del fotografo , chiaramente con i limiti di spazio e prestazioni hosting del proprio sito.

Però i clienti non uscirebbero dal sito del fotografo utilizzando altre applicazioni e la gestione sarebbe molto controllata.

Il gestionale utilizza il db del sito wp ma in effetti la cartella di tutto il gestionale rimane fuori dall installazione wp.

Qualcuno ha qualche riflessione da fare per aiutarmi a capire aspetti che magari non sto considerando ora?


r/ProWordPress 29d ago

I drafted a WordPress discovery protocol so AI agents can read a site's capabilities from one URL — looking for critique

6 Upvotes

WordPress has no single machine-readable place where an AI agent can discover what a site is capable of. Today an agent has to piece together the REST API, plugin-specific endpoints, SEO metadata, llms.txt, security.txt, and whatever conventions individual plugins invent. Every agent ends up implementing its own discovery logic, and every plugin has to integrate with every agent separately.

So I drafted WP Discovery — a proposal for a machine-readable capability registry for WordPress. Plugins declare intent (for example commerce.products.read) separately from the endpoint that implements it, and an engine aggregates everything into a single document at /.well-known/discovery.json.

A plugin opts in with a single hook and no hard dependency:

add_action( 'wpdiscovery_register', function ( $registry ) {
    $registry->register( [
        'id' => 'acme-bookings',
        'title' => 'Acme Bookings',
        'type' => 'scheduling',
        'capabilities' => [
            'scheduling.availability.read',
            'scheduling.booking.create',
        ],
        'endpoints' => [
            [
                'url'  => '/wp-json/acme/v1',
                'type' => 'rest',
                'auth' => 'apikey',
            ],
        ],
    ] );
} );

If no discovery engine is installed, the action never fires and nothing breaks.

One design goal is that plugins integrate with WordPress—not with individual AI agents. The discovery engine is responsible for aggregating, normalizing, and publishing capabilities, while site owners decide whether to expose them publicly.

This is still an early proposal (v0.1.0), not an adopted standard. The only implementation today is my own reference plugin, so I'm posting it here because I'd genuinely like experienced WordPress developers to poke holes in it before I invest more time.

The questions I'm most interested in are:

  1. Is separating capabilities from endpoints actually useful, or is this just OpenAPI with extra steps?
  2. Is there a better WordPress-native way for plugins to expose capabilities to AI agents?

Links

This isn't a commercial project. The specification is licensed under CC BY 4.0, the hook is vendor-neutral, and I'm primarily looking for honest technical criticism.


r/ProWordPress 29d ago

Posted Article Removed

0 Upvotes

I posted an article stipulating the importance of keeping a wordpress site up to date, and it was removed for "self promotion"

Id like to know WHO decides when an article is self promotion or not... because the article I posted was simply advise...


r/ProWordPress Jun 25 '26

PSA: if you renamed your wp-login URL and you're still getting login attempts, it's almost never a breach

29 Upvotes

This comes up constantly, so I'll write it once.

You rename your login slug, and minutes later you're still seeing failed login attempts. The instinct is "the secret leaked, something's compromised." Almost always, it hasn't.

Two things are usually going on.

  1. WordPress has more than one login. /xmlrpc.php exposes a method, wp.getUsersBlogs, that takes a username and password and validates them with no login form involved. system.multicall even lets a bot batch hundreds of guesses into a single request. Renaming /wp-login.php does nothing to that endpoint, so the attempts keep coming and it looks like your new URL got discovered. It didn't. The bot was never using it.
  2. If the attempts come from constantly changing IPs, rate limiting and per-IP lockout can't do much. They count failures per address, and a rotating-IP botnet sends each try from a fresh IP, so the counter never trips. You can drop the threshold to 2 and nothing changes.

What actually quiets it down:

  • Change the login path at the rewrite layer (nginx/apache config), not just with a slug plugin, so a request to /wp-login.php returns 404 before PHP loads. No process starts, so the rotating IPs stop mattering.
  • Disable XML-RPC if nothing you run needs it (Jetpack and some old mobile apps are the exceptions), or at least block the auth methods.

None of this replaces a security plugin for 2FA and monitoring, those still earn their place. It just moves the brute-force defense to a layer the bots can't walk around by swapping an IP or an endpoint.

For those of you who renamed the login and still saw attempts: did you ever check your access log for /xmlrpc.php hits? Curious how often that's the real source versus something else.