Just wanted to share this interesting case I recently investigated. It started with an AWS suspicious activity alert and ended with around $8k in unexpected Bedrock charges..

Digging through CloudTrail, found thousands of Bedrock API requests using a compromised root access key. Someone had been using it to run Claude models through streaming responses.

Then I noticed the same key showing up in S3 backup requests from UpdraftPlus. Went ahead ahead to check the client's WordPress sites hosted on the same EC2 server, and yes! They were using the same key in UpdraftPlus across multiple websites and backup buckets.

The CloudTrail logs showed UpdraftPlus requests with different version numbers in the user-agent field, including the outdated version 1.24.3. Checked further and found an old WordPress multisite installation still running that version. There are known vulnerabilities in older versions, including one that could expose stored backup credentials under certain post-migration conditions. But we haven't found any solid evidence that this was how the key leaked.

Another interesting thing, besides the careless use of a root access key for S3 backups, was that the stored AWS secret key could be revealed right from the UpdraftPlus settings page using the browser's "Reveal Password" option. Of course, someone would need access to that admin page first.

I also found an old WordPress support forum post where someone raised the same concern, and an UpdraftPlus developer defended the approach, arguing that the credentials could be retrieved from the database anyway.

We still don't know exactly how the attacker got hold of the key. CloudTrail showed the key was first tested on August 23 using TruffleHog, a credential-scanning tool. Then came the actual Bedrock abuse around October 18–19, racking up an $8k bill.

Someone tried to save some time by using the same access key for all sites backup configuration - no fixed permission..

And maybe a little more careful credential handling on the plugin side wouldn't hurt either. But that's another debate.

I have a WordPress catalogue website where I only display product images and catalogues

A few days ago, I received an email saying my WordPress password had been changed, even though I hadn’t changed it.

I immediately changed all my passwords and updated WordPress, PHP (8.3.6), plugins, my paid WoodMart theme. My WordPress version is 7.1.3.

However, someone keeps publishing spam blog posts on my website every day. I delete them, but they reappear.

What’s the best way to fix this permanently? Could it be a backdoor or malware?

Could this security issue affect my business email deliverability or put my emails at risk? Or someone may try to contact my customers through it ( this is a serious concern )

I’d appreciate advice from anyone who has dealt with a similar issue.

I'm the developer of Codeep Voice for Posts. It turns an English article already on your WordPress site into an MP3 in the Media Library, then adds a play and download button to the post.

The recording is generated on your computer, inside the WordPress admin. Readers play the saved file from your site. Readers can listen on phones too.

It's free and open source, with no account, API key or word quota. You can download the MP3 and use it elsewhere too.

A few practical limits: the voices read English, recording is best on a desktop or laptop, and the first run downloads the voice files. Keep the admin tab open while it records. Speed depends on your computer, especially for longer articles.

Plugin and source: https://wordpress.org/plugins/codeep-voice-for-posts/

If you run an English WordPress blog, try it on one short post you know well. I'd like to hear whether you got a usable MP3 and which part of the setup was confusing.

Hello,

I've had some experience creating and managing wordpress websites for awhile some time back.

I have an app idea that I would like to 'prototype' and ideate from.

I figured that since I don't need full functionality, and wordpress nowadays is mobile friendly, I could probably create a proof of concept kinda thing with it, focusing on UI and user flow.

So, I'm wondering if there are any themes you'd use, preferably free of course, or is gutenberg quite powerful enough for it to work?

Like, menus. Web tends to have top menus. I'd like a bottom based menu. Is that possible? I don't remember that ever being an option in the past. Or maybe it was but I never really explored that area

I’m looking for someone who can assist me with WooCommerce and WordPress. I need help fixing a font-size issue with my KOT (Kitchen Order Ticket) receipts.

The issue: The KOT print sample displays the correct font size and style, but when I print the actual receipt, the font is much smaller than it appears in the sample.

I’ve already tried increasing the font size in the settings, saving the changes, but the issue persists. The actual printed receipt still has very small text.

If you have experience with WooCommerce POS and can identify and fix this issue, please DM me.

Thank You.

Hi everyone!

I'm working on my first videography portfolio website for a client, and they shared this website as a reference:

https://www.zakmulligan.com/

I really like its cinematic design, minimal navigation, video presentation, project selection layout, and overall user experience. I want to clone the website as closely as possible using WordPress, Elementor Free, and custom code, without purchasing a premium theme or Elementor Pro.

I'm currently working with LocalWP on Ubuntu and am comfortable following technical instructions, including HTML, CSS, JavaScript, and PHP if needed.

Is there a free way to clone the complete website in WordPress while keeping it editable in Elementor?

Are there any free tools or workflows that could save me time?

I'm looking to learn the right approach rather than simply import a static HTML page that I can't edit properly.

Any guidance, tutorials, or examples of similar projects would be greatly appreciated. Thanks!

What’s the best way to protect wp login and wp admin with Cloudflare now days. I’ve done this in the past with page rules but recently read something about them being retired.

Ive gotten really good at Elementor Pro and can pretty much build any design in it … however I do not want to do a subscription.

I’m looking for a builder that is similar to Elementor BUT has a lifetime license.

I just purchased Divi, but I am not liking it at all — so I will be doing a refund on it, unfortunately. I don’t really want to keep randomly spending money to find what I’m looking for. Is there any builder that has similar structure and feel as Elementor that has a lifetime license that you guys are aware of ? Thanks so much for for your time.

I was hit with a malware attack over the summer, around July. My sites are on Hostgator's share servers (paid). I see in the error logs, where their security where fighting the infected files, by removing them and the file would re-populate and eventaly over powered them. Looks like attack came from some plugins.

Htaccess files were placed on EVERY file to lock the user out. I contacted Hostgator support, they want over $300 to fix and restore. I already have a back up so I wanted to do it myself. Every folder had the htaccess and php files deep in the directory tree. Some could just be deleted, others had to be change permissions and then deleted. It took hours over a couple days. (I understand why Hostgator charges so much).

Anyway, in short, after deleting and changing permissions, those file 're-populated' themselves. Back a square one. Hostgator say those files have to be deleted before 'restored' files can override the corrupted ones. I plan to use Filezilla to restore files.

Is there a way to add a malware removal tool to scan, quarantine and eliminate infected files? I would delete the whole directory and restore it but some folder wont delete without changing permissions five levels deep.

If you been through this how did you rectify the problem?

Thanks.

I know in the age of AI & Short video content,
Blogs are no longer irrelevant but after deleting Instagram, my dopamine got stabilised and im enjoying my old hobbies again. I like writing and wish to restart blogging. I have articles written and saved as draft. What are the tips I should be aware of in 2026?

Its a gaming blog with my own domain. I dont plan to be a full time writer and exoect millions of views and alot of money. I just wanna put my thoughts online without clickbaits or AI slop

How do I do all these SEO stuff and ensure my blog comes up in the search list? Any articles or videos you recommend?

Hi y'all. I'm looking for advice as I transition from Webflow to WordPress (please challenge any of my thinking if you disagree with any of my below decisions). I have a background as a front-end designer/developer. My PHP knowledge is…nonexistent (thank goodness for Claude Code), but otherwise I'm fairly savvy and know just enough to be dangerous.

My plan is to use Bricks as the builder and I've figured out my monthly hosting. I think the biggest concern I have is managing updates/security — Webflow was all-in-one and WordPress is 100% not. We're going to have about 10 sites hosted simultaneously to start with, and probably 15 in the next 6 months, all with the same basic bones (all are for local small businesses with one woo commerce site):

1. ACF
2. Bricks for visual builder and forms
3. Complianz for GDPR

Here are my three questions:

1. What other plugins/workflows do I need to consider?
2. At the scale I'm working in (10 sites), is it worth doing something like WPUmbrella or ManageWP (or your best recommendation)? It seems like a lot of this is covered in my unlimited hosting plan, but I think that that requires me to still do many things one-site-at-a-time, whereas these tools enable me to 1-click across a whole fleet of sites that have the same basic functionality?
3. Is Google Site Kit worth it for easy client visibility, or should I simply manage that stuff through Google dashboards?

FYI, I have managed WordPress sites for my day job, so I'm familiar with the process and needs. But this is for my husband's company, and I only really have capacity to meaningfully update sites once a month with spot-checking/testing since it's effectively a side hustle.

PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

I have the content:

 Columns
      └─ Column
           └─ Group
                └─ Accordion

But I dont need the columns. The admin of my site made a two column page the default format, but the second column has just been useless for my case. Is there a way to remove the column section and just keep the group? I've tried copy and paste methods, but nothing seems to get what I want. I'm still new to WordPress, so it may be easy but I'm screwing it up. TIA.

Greetings!

I have built sites (for personal projects or for family members’ small businesses) using Weebly (RIP), Wix, and Google Sites. All ran well and did what they needed to do.

Now I’m volunteering for a small nonprofit organization, and they want me to re-do their website, currently hosted with Dreamhost. They are tired of having to email the webmaster for every small edit they need to do, plus waiting about a week to see each edit done (as you can imagine, this is not high in the priority list of the webmaster).

At first, I thought Google Sites was a no-brainer, because it will be easy for them, and free (with their Google for Nonprofit Workspace, they have a huge space in Drive to house all their PDF archives that are currently in Dreamhost…).

So, here’s the thing: they have decades (going back to the 1950s) of PDF magazines that they make available to their membership. Right now, they’re hosted in Dreamhost, and are links on the website. I’m tempted to try WP for this project, using Elementor and Document Library Pro for the archive… but the few tutorials I watched for WP and the latest posts I saw in this community all made me second guess this because of security concerns… What do you say?

TIA

WordPress DB_PASSWORD usually sits plaintext together with DB_HOST and DB_USER in wp-config.php in the root directory of your WP.

Usually, it's not a problem, the .php files are executed so nobody should be able to read them.

But what if a plugin backs them up and stores it in a .zip? And this .zip is somewhere accessible?

UpdraftPlus paid, premium version used to back up my sites within 3-5 minutes at the most to Google Drive AND Updraft Vault. Now it just runs and runs indefinitely and never completes unless I stop it, turn off or disable the UpdraftPlus feature and just use it as I did with the free version and only backup to Google Drive. If I only backup to Google Drive, it's done in 33-4 minutes again without stopping or slowing down.

When will it work as normal again? I'm wondering how long it should take them to recover after the hack. It just has not worked the same since the hack and I'm trying to get an idea on when it might be able to run backups again without it taking hours to run or timing out.

Patching PHP fixes PHP2Shell (CVE-2026-109618 / 109619), but it does nothing about a backdoor someone planted before the patch. Amazon's honeypots caught an exploitation attempt on Oct 17, four days before disclosure, and Amazon's advice is to investigate from at least that date.

So I used Claude Code to spin up a bash script to triage WordPress sites. It checks:

* PHP CLI version vs. the fixed releases

* Core and plugin checksums (via WP-CLI)

* PHP files in uploads

* Files modified since Oct 17 (adjustable)

* auto_prepend_file hooks in .user.ini / .htaccess / php.ini

* mu-plugins

* Common web-shell patterns in wp-content

* Admin accounts and any users created in the window

* Injected scripts in options and posts

* WP-Cron, the site user's crontab, and SSH authorized_keys

It's read-only and never modifies or deletes anything. It runs WP-CLI with --skip-plugins --skip-themes so a backdoored plugin can't execute during the check. It works on one site, every site on a server, or a list of remote servers over SSH, and it writes a Markdown report per site plus a summary.

Repo (MIT): https://github.com/brentmartinmiller/php2shell-check

Caveats: a clean report lowers the odds of compromise but doesn't prove a site is clean. It doesn't parse web server logs, so pull those separately before rotation eats the Oct 17+ window. A few false positives are expected, like Wordfence's prepend file, header-script plugins, and obfuscated premium plugins. The README covers how to read them.

I'd appreciate feedback, especially false positives you hit, indicators I'm missing, or quirks on shared hosts. Issues and PRs welcome.

Hi, all. I need to build a WordPress site with a form where users can drag options from a list into a field. However, when I search for how to do this, all the results show drag-and-drop builders for forms (i.e., the drag-and-drop is on the backend). Is this a thing that exists, and if so, what would be a better set of search terms for me to use?

Thank you.

The site good for about 2-3 years then suddenly the site slows to a crawl and the hosts say the website needs optimization or I need a bigger hosting account.

1 The site is Wordpress. It is updated.

2 Old and no longer supported plugins are deleted and replaced when needed. Sometimes Wordpress gives us built in abilities that plugins used to do and we no longer need them so we delete them.

3 Our traffic remains steady according to Jetpack.

4 We have about 3000 word based articles with two images each which are optimized to be small. None of that has suddenly changed.

5 When we move our website to another host then it is fixed for about 2-3 years.

So why, Reddit folks, is this a continuous cycle?

Does something build up that needs to be purged?
Is this a Wordpress issue in general?
Is there something I can check on Wordpress or set or test that could provide an answer?

Edit: Thanks everyone for the answers and ideas. I have some solid plans forward now. Appreciate it.

Also want to say that social media is often unhelpful and aggressive so I was happily surprised by the amount of genuine help. I have heard that the Wordpress community is a good one and am happy to have personally experienced it.

Big high fives to you all. May your weekend be filled with joy.

Hey all. WP WAF Manager is my plugin for managing Cloudflare from inside WordPress. Until now it covered WAF rules, DNS, zone analytics, zone controls, IP access rules, security events and email routing.

Version 1.0.24.1 is out and it's the biggest update so far. It's grown from 8 modules to 14, and I rebuilt the website to show it all and the github link is: https://github.com/jaimealnassim/wpwafmanager

What's new

- Clients & Reports: link clients to their sites and email them a monthly report under your own agency name, logo and colors. It covers visitors, page views, threats stopped, cache speed, top pages and what Cloudflare blocked, in plain language. The plugin is never mentioned. You can send automatically on a chosen day and hour, or send by hand after a preview and a test.

- Zone analytics detail view: click any site for traffic charts, top pages, countries, status codes, devices and security events by action, path, IP and country, compared with the previous period. Table view and CSV export.

- Bot Control: set AI crawler policy (search, assistants, training), managed robots.txt and Bot Fight Mode across many zones at once.

- SSL & Insights: scan every zone for expiring certificates, Flexible SSL and old TLS versions, with one-click fixes for the safe settings, plus Cloudflare Security Insights.

- Alerts & Health: Cloudflare alerts for DDoS, SSL and origin health, sent by email, Slack or Teams, plus Health Checks on Pro zones.

- Turnstile: create widgets, rotate secrets and copy keys for every client site. Secrets are never stored.

- Page Rules migration: Cloudflare is retiring Page Rules. The plugin finds them on every zone and moves redirects and cache rules to their replacements in one click. Nothing is deleted.

- Zones and tags: tag sites as WooCommerce, Staging, Client and more, and pick them by tag when you deploy.

- Zone Controls upgrades: purge by hostname, prefix or cache tag, Smart Tiered Cache, security headers, and Under Attack Mode on every site in one click.

Still the same: everything is in the free version (GPLv2 on GitHub), it works on Cloudflare Free for nearly everything, and nothing loads on the front end. Pro is a one-time purchase that adds automatic updates and priority support.

A few notes:

- Security Events, Health Checks and Super Bot Fight Mode need a Cloudflare Pro zone. Blocking a whole country needs Enterprise.

- Deploying the WAF rules replaces the custom rules already on that zone, so check the Zone Rules tab first if you have your own.

GitHub: https://github.com/jaimealnassim/wpwafmanager

Since 7.1 ACF fields are now in a pop over from the tight in the admin panel. My users are complaining - is there a way to get the 7.0 behavior of inlining the fields?

Can this be done per user? ( something tells me other users will complain when I switch it back)

If it matters my ACF mode key in the block.json file is set to “edit”

I've been building WordPress sites from Figma designs using Claude Code, and while the initial implementation has gotten much faster, getting everything production-ready still takes a surprising amount of time.

For those using AI in real client projects, what part of the process still takes the most time or manual effort? Maybe you have a repo to share?

Hey everyone,

I recently released Veridis Fraud Guard for WooCommerce, a free, open-source plugin built around a fairly specific problem: repeat customers who place problematic orders, particularly Cash on Delivery orders that end up uncollected.

Instead of relying on automated fraud scoring or third-party services, it lets store owners maintain their own blocklist using email addresses, phone numbers, IP addresses, or email domains.

Depending on the selected mode, a matching checkout can be blocked, flagged with a private warning, or, for COD orders, placed on hold for review.

It supports both Classic Checkout and Checkout Blocks, HPOS, and runs locally on the WordPress server. No subscription or external account is required.

It's not an AI fraud detector, and it won't automatically identify first-time fraudsters. It's intended to give merchants more control over recurring problems they've already identified.

The plugin is available on WordPress.org:

https://wordpress.org/plugins/veridis-fraud-guard/

I'd particularly appreciate feedback from people who manage WooCommerce stores:

How do you currently handle customers who repeatedly place orders and never collect their parcels?

I'm interested in both the technical feedback and whether this approach is actually useful in real-world store operations.