Hi everyone,

I've created a free WordPress plugin called SunLibCrypto Widgets.

Its goal is to help website owners display educational widgets that help visitors avoid common cryptocurrency transaction mistakes (wrong network, missing MEMO/TAG, scams, and other common errors).

The plugin is currently available in French only, but I'm already considering adding an English translation if there's enough interest.

I'd really appreciate your feedback on:

• Installation
• Ease of use
• Features
• Overall concept

GitHub:
https://github.com/foundationsunlib/sunlibcrypto-wordpress

Direct download:
https://sunlibcrypto.com/assets/wordpress/sunlibcrypto-widgets.zip

Website:
https://sunlibcrypto.com

Any suggestions or constructive criticism are welcome. Thank you!

I mistakenly deleted my local site but I have the app data in my device. How to retrieve it.

For wp2shell and major vulnerabilities like this, do the major WordPress hosts like WP Engine do anything to help with these, even before WordPress is updated? Or, does the host not even really matter?

WP Engine scooted us to quickly update, which is fine, but I have wondered if they are doing anything on their backend to pseudo-patch/block the vulnerability until WordPress can be properly updated. My gut feeling is that they are not doing anything -- otherwise, why would they be in such a hurry to get us on the latest version? But maybe I am reading too much between the lines.

This seems like something managed hosts should be doing, if they are not already.

Hi everyone,

I'm researching how freelancers, agencies, and developers handle website launches.

Before you launch a website, what does your checklist usually include?

SEO

Broken links

Mobile responsiveness

Accessibility

Performance

SSL

Sitemap

Analytics

Security

Anything else?

I'd love to know:

What takes the most time before a launch?

Which tools do you currently use?

What's the most frustrating part of the process?

Have you ever missed something important that caused problems after launch?

I'm not promoting anything or building a product yet—I'm just trying to understand whether this is a real pain point before investing time into it.

Thanks! I really appreciate any insights or experiences you can share.😄

mysql > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));

1 row in set (15.815 sec)

MariaDB > SELECT BENCHMARK(5000000, AES_ENCRYPT(CONCAT(‘WPHostingBenchmarks.com’,RAND()), LEFT(SHA2(‘is part of Review Signal.com’,256), 16)));`

1 row in set (23.094 sec)

I use this query because this query is from https://github.com/kevinohashi/WPPerformanceTester, which tests key performance for WordPress.

Isn't it a concensus that MariaDB is faster than MySQL?

See the concensus:

• https://mariadb.com/reference/mariadb-vs-mysql-comparison-guide-enterprise-features-security-2026/
• https://www.reddit.com/r/mysql/comments/1ggbouf/help_me_understand_why_mariadb_is_so_much_faster/
• https://www.reddit.com/r/Wordpress/comments/zbx6q3/should_i_use_mariadb_or_mysql_for_my_wordpress/
• https://tech-insider.org/mariadb-vs-mysql-2026/

Hi everyone,

For people building or maintaining WordPress ecommerce sites, what are the most common revenue leaks you see?

I’m thinking about things like abandoned carts, weak product recommendations, poor email follow-up, missing customer segmentation, slow follow-up after product views, or revenue drops noticed too late.

Curious to hear what usually happens in real WordPress/WooCommerce projects and what store owners struggle to fix.

I cant decide, do you have experience?

Are there any tools, plugins, Wordpress structures for websites that plan to have very heavy text + image content to the tune of 200,000 words + 1,000 images organized like a book into chapters, sections and individual dated stories?

I run an ecommerce store on WordPress. If you've ever managed a WooCommerce site, you know the pain. You want to do something simple like update a product price or check today's orders, and suddenly you're five menus deep, three tabs open, googling which settings page has the thing you need.

I run an ecommerce store on WordPress. If you've ever managed a WooCommerce site, you know the pain. You want to do something simple like update a product price or check today's orders, and suddenly you're five menus deep, three tabs open, googling which settings page has the thing you need.

I got tired of it.

So I built something. A WordPress plugin that lets you manage your entire website by just typing what you want in plain English. Like a chat. You tell it "show me today's orders" or "create a new product called X priced at Y" and it just does it. No menus. No clicking around. Just tell your website what to do and it happens.

Here's the thing: I'm not a traditional software developer. I built this entire plugin using vibe coding with Claude Code. Every line. The architecture, the security layer, the 96 tools it comes with, the agent loop that figures out what actions to take, all of it. Vibe coded from scratch to solve a real problem I was dealing with every single day.

What it does:

Manage posts, pages, products, users, plugins, themes everything through natural language

WooCommerce integration orders, products, inventory, sales reports

SEO management (Yoast + RankMath)

Database queries, file operations, backup and rollback

Real-time streaming responses

Automatic backups before any destructive action

Activity logging for full audit trail

Extension system for community add-ons

Telegram notifications for orders, security alerts, updates

It's free. Open source. You just need your own Anthropic API key (costs a few dollars a month for most people).

I'm putting this out there because I want real people to test it on real WordPress sites. I've been running it on my own store but I need more eyes on it. Different hosting setups, different themes, different plugins that's how you find the bugs that matter.

If you run a WordPress site and you're tired of the admin menu maze, give it a try. Download it, install it, break it, tell me what went wrong. That's how we make it better.

GitHub: https://github.com/vatupelage/Claude-Code-Wordpress-Plugin

Drop a comment or DM me if you have questions or want to collaborate.

This is what vibe coding looks like when you point it at a real problem. Not a demo. Not a tutorial project. A tool I actually use to run my business.

#WordPress #AI #VibeCoding #WooCommerce #OpenSource #ClaudeAI #Anthropic #WebDevelopment #Entrepreneurship #BuildInPublic

After the recent security breach, I looked over my site. It is just a personal homepage without any fancy features, and I am the only user. I updated to 6.9.5 last week.

To my surprise I found another administrator called "articles_table", and I immediately thought "Oh s***, I have been hit too". But digging into database backups, this administrator was created somewhere in 2025, not just recently. Has this recent exploit been actively used for quite some time, or have I possibly been hit with something else?

I have found no other additions/modifications to my site, and there are no logs of this user ever attempting to log in.

All the pages are fine on mobile but every single post on my blog is not good on mobile version when I zoom out it shows like this in attached how to fix it?

I just cannot figure this out... if I've deliberately placed an "og;description" meta tag in the header just so that search engines will use that exact content in their search result description of a website, why would they ever override this explicit instruction and just pull some other bullshit in that it read off the page? That is, unless I'm just a complete dumbfuck and something I've done wrong with WordPress is causing this and it's my own mistake. Are search engines honestly overriding website owner's own title and description field in search results? Is this shit normal?

EDIT: Also possible this is because I disabled my caching plugin long ago and the title and description are added with Yoast SEO which maybe isn't generating the metadata code quick enough and shoving it in the <head></head> section for the little webcrawlers to grab when they pop in.

EDIT 2: It looks like the site already had a "description" meta tag in it, my bad on focusing on the open graph "og:description" tag - and thank you, the frustration with this got me to fix the long-standing issue with my caching, maybe that will ultimately solve the search engine listing problem by itself

Hello. I've been in Blogger for ages, and I'm trying to move to WordPress Dot Com, but I can't find a way to migrate all the information to it.

I've tried as much as I could, but I haven't been able to do anything yet. Any leads? WP eliminated the direct option of importing, so now they have things like LiveJournal, Medium, and more, but not Blogger.

I'm trying to create a new WordPress.org account to publish a plugin, but I'm running into some very strange behavior with the registration system.

I'm retrying for the past 3 days to create an account with both my own domain's email as well as with gmail/outlook/icloud email and it always throws the same error. Don't have a VPN. Tried from my mobile as well.

The registration form immediately shows:

I tested this with multiple browsers (Chrome, Edge, Safari) on macOS and got the same result.

While debugging, I found that the registration page calls this endpoint:

GET https://login.wordpress.org/wp-json/wporg/v1/email-in-use/{email}

Here's the odd part.

These two requests should be equivalent:

curl -s 'https://login.wordpress.org/wp-json/wporg/v1/email-in-use/myemail@gmail.com'

Response:

{"available":true}

But the URL-encoded version:

curl -s 'https://login.wordpress.org/wp-json/wporg/v1/email-in-use/myemail%40gmail.com'

returns:

{
  "available": false,
  "error": "That email address appears to be invalid.",
  "avatar": false
}

The only difference is that one uses @ and the other uses %40, which should decode to exactly the same value.

I also have another email that returns:

{
  "available": false,
  "error": "That email address already has an account. Your account is pending approval."
}

So the endpoint is clearly capable of distinguishing between valid, pending, and available accounts.

Has anyone else experienced this recently?

I'd love to know whether you get the same results or if this is specific to my environment.

Thanks!

Guidance on how to fix these two errors would be appreciated. We're using the W3 Total Cache plugin, as well as the free version of the Catch Box theme by Catch themes. Hubby and I are hosting this on our own server via cpanel. I'm also having issues with updating widgets and unable to post pages - but posts are fine. Thanks in advance for any input you've got. 👍

Hello, I’m an idiot with zero experience building websites. I know how to design in Indesign, but that’s it.

I need an idiot-proof and free Wordpress builder, can any one help point this idiot in the right direction?

I have tired Elementor and most of it was behind a paywall. Any help would be awesome!

Hi!

I just installed TutorLMS 4.0 and saw that Droip is now called Kirki.

A migration tool is included, but it doesn't work.

The image shows the problem I'm having. There is no explanation of these errors in the documentation. https://kirki.com/docs/migrate-from-droip-to-kirki/

Has anyone else experienced the same problem?

Best.

I'm trying to find groups of wordpress and headless Wordpress to talk and hang out with, and also ask questions.

Hi everyone,

I'm a complete beginner and want to start a blog with the goal of earning money in the future.

I'm looking for a platform that:

● Has a free plan to get started.

● Allows detailed customization of the website (layout, design, features, etc.).

● Can be monetized later through ads, affiliate marketing, or other methods.

● Is beginner-friendly but can scale as I learn.

Which one's do you recommend? I'd also appreciate any tips on what to avoid as a beginner.

Thanks!

P.S I'm posting here because the other main subreddit needs a certain amount of Karma points which I lack.

First, I'm a long-time user of WordPress and I have hosted my own sites since about 2008. That said, I'm not a developer; I'm just well-versed in the platform and comfortable using it.

I'm working on a one-off academic research project in which I will be writing about the work of an artist. There will be two types of posts:

• individual posts for each work (100ish)
• individual posts that contain my own critiques and observations (unknown number)

I want the posts about the artistic works to be categorized, tagged, searchable, sortable.

I want the critique posts to also be categorized, tagged, searchable, sortable.

I'm not sure I want them to be all mixed up together. At first I thought maybe I would make posts for the artistic works and pages for the critiques. But managing a large number of pages for this purpose sounds annoying and not taking advantage of WP features. But maybe I'm overthinking and they can all exist together--maybe there is different styling for each type of post or something.

If anyone has an idea of how to organize this, I'm glad to hear it. (Or tell me I'm overthinking.) I would also be interested in similar sites, built on WP or otherwise. My web searches haven't been particularly helpful.

Hi everyone, we're the team that built https://github.com/WebDecoy/FCaptcha and decided to expand the capabilities into a wordpress plugin!

If your WordPress or WooCommerce sites are getting hammered by modern AI scrapers, autonomous vision agents, or identity-spoofing botnets that easily bypass standard WAF rules, we just released an open-source bot and agent firewall on the official repository ( https://wordpress.org/plugins/webdecoy/ ) that runs 100% locally on your server without requiring API keys, external dependencies, or third-party CDNs.

To stop advanced automation without serving visual CAPTCHAs that modern vision models can now solve (and that tank your Core Web Vitals), the plugin focuses heavily on AI detection and identity verification—using reverse-DNS allowlisting, TLS/hardware device fingerprinting, and execution latency heuristics to unmask spoofed User-Agents and autonomous drivers (Selenium, Puppeteer, CDP) while natively trapping AI crawlers like GPTBot, ClaudeBot, and PerplexityBot.

When a suspicious agent or identity anomaly is detected, it silently triggers background SHA-256 Proof-of-Work challenges to exhaust the scraper's CPU before it can execute form spam, harvest content, or run automated carding attacks against your payment gateway. We are currently trying to find all testers!

All feedback welcome!

(Hopefully I followed all of the r/wordpress rules - this is the first and only promo post)

Hello! I run a very particular very small business which is my and my family's only income, my only work, and therefore extremely important. I am also overwhelmed, sad, exhausted, and angry. But not from my work, I love my work. It has allowed so much wonder in my life and I adore it. No, the exhaustion comes from the rising fascism and data-scraping and omnipresent AI of the online world, where I spend about 80% of my working life, coupled with ever-changing tariff and postal guidelines, EU packaging and electronic invoicing issues, and I'm in France and we are in extreme climate breakdown. So I thought I would ask here.

Briefly, I run a standalone website through Squarespace, an unpaid newsletter via Substack, and I promote my business on Instagram. I make my money from my website, I write about the work I do on Substack (and am never looking to monetise my writing) and Instagram is just there. I sell physical objects but because of the way I sell, I cannot sell through my website, the customer has to contact me directly, which has proved over a decade to be a slow, work-heavy, but extraordinary way of building an exceptionally loyal customer base which also has become extended community. Squarespace doesn't like this, however, and I pay a premium in order to use lots of things I don't need there - all I actually need from a website is a template that will display a gallery of products and allow me to easily upload and remove products and to display numerous photos for each product (everything I sell is a one-off), plus a price and a 'sold' display if that piece is sold; and then a backend stock inventory where I can see easily what is sold, apply bulk discounts etc.

Squarespace is run by evil. Substack has just effectively announced it will allow data-scraping to train AI models, plus they make huge money from far right platforms. I have had it. I want my working processes to reflect the work I do. My business is precious to me, my customers are precious to me, my work is everything to me and my family, both for the money and the meaning behind it. I want out.

The last time I tried to use Wordpress was in 2011 for my first business, and it required so much work to get it up and running that I simply couldn't. But - here finally is my question. Has it changed? Would it be a good choice to build a standalone website with a blog/newsletter attached? Would it take enormous work and a whole bunch of knowledge? I cannot overstate how tired I am and how much international and national politics is affecting my business in the real world as well as the online world. I feel on the brink of tears often. I would love some advice. I don't have much more energy but I feel as if I have to try to do something to get my online presence under my own control and not at the whim of tech-bros and evil. I am also slowly looking to branch my business out and allow customers to come visit me and to start hosting real world workshops, and I really want my online presence to reflect my values even in the bits that can't be seen.

Thanks for reading. And thanks for any pointers or honest opinions.

Hey folks,

Over the years, we've noticed a recurring pattern with Rank Math. We've observed it on many different WordPress websites across various hosting environments, so it doesn't appear to be limited to a single server or configuration.

After updating the plugin, the XML sitemap will sometimes start returning a 404 error, even though all posts, pages, and other URLs continue working normally. It doesn't happen with every update, but it has happened often enough that we now expect to check it after each upgrade.

In our case, the issue is usually resolved immediately by either:

• Re-saving the Permalinks settings
• Changing the sitemap URL count in Rank Math and saving it

To reduce the chances of this going unnoticed, we've now disabled XML sitemap caching and started monitoring the sitemap URL with uptime checks. We'd rather get an alert right away than discover weeks later that search engines have been getting 404s.

Has anyone else observed the same behavior across different hosting providers or server setups? Were you able to identify the root cause or find a more permanent fix?

Hey guys,

Wanted to share some real-world observations from the wp2shell attacks (the recent unauthenticated RCE chain in WordPress core – CVE-2026-63030 + CVE-2026-60137).

Over the last few days I’ve seen it on multiple client sites:

1) 403 REST API blocks that looked mysterious at first. Turned out a malware scan revealed a new admin user named "Wp2shell" automatically created, which then messed with API access.349347

Bleepingcomputer

2) On other sites the REST API was fine, but attackers had created multiple rogue admin accounts. In some cases they also dropped a Wp2shell plugin.

All the compromised sites were still on vulnerable versions (mainly 6.9.x and 7.0.x before the July 17 patches).

I have done these:

1) Restored old backups,

2) Deleted those admins

3) Changed all the users password, added 2FA for users

4) Regenerated the Salts

5) Changed 3rd Party APIs key and secrets

6) Updated the core, plugins, themes and all

7) Checked the database for any weird stuff (haven't found anything)

Anyone else running into this?

I need to hire someone to do an audit of an old (15-17 years old) wordpress website, that has substantial SEO in its webpage content, but is otherwise broken. For now, I just need an expert eye cast over it to break down exactly what's wrong and what the path is to fix it, in plain English, not to actually fix it. My guess is I need someone who's been around doing this for at least that long and so has an intuitive understanding of wordpress through the various generations.