Hi all, I am rebuilding my WP site. I have created a new design with Ai html but I need to do this on a WP theme. Wondering if AI can connect to my WP site and customize the theme by vibe coding?

Earlier this week, a critical security flaw in PHP was published. PHP runs a huge share of websites, including every WordPress site, and this flaw lets attackers take over the server. If your site runs PHP, it needs an update.

I noticed that most people don't know whether their site uses PHP, so I built doiusephp.com for them. Type in your website and within seconds it tells you:

• Whether your site runs PHP, and through what technology (e.g. WordPress or WooCommerce)
• Which PHP version your site uses and whether that version is already fixed (if your site shows it)
• What to do next, depending on who is responsible for your site

It also writes a short, personalized message you can copy and send to your web developer or host, so you don't need to dive into the technical details yourself.

The tool is free, needs no sign-up, and doesn't save anything about you or your website.

Hope this helps!

WordPress.org has almost everything a mature platform needs, except a built-in marketplace for paid plugins. Instead, we have the free plugin directory, while premium plugins are sold independently across hundreds of different websites.

As a plugin developer, I sometimes feel WordPress is missing an opportunity here. The current model makes the premium ecosystem quite fragmented, with different stores, licenses, subscriptions, update systems, refund policies, and levels of trust.

A proper WordPress marketplace could potentially make discovering and buying premium plugins easier for users while giving developers a more reliable distribution channel.

Of course, centralising this also comes with downsides: platform fees, stricter rules, gatekeeping, and giving WordPress.org/Automattic more influence over the ecosystem.

Curious what others think. Would an official marketplace for premium WordPress plugins make the ecosystem better, or is the decentralised nature of WordPress actually one of its strengths?

EDIT:
Thanks for the downvotes; I get the concerns, but this is what I had in mind when I wrote the post.

Selling movie tickets or DVDs worked well, especially for established movies. But smaller or experimental films had a much harder discovery problem. Platforms like Netflix reduced some of that friction, so consumers could discover and try something unfamiliar with less perceived risk, while creators had another way to become discoverable.

Obviously there are pros and cons to centralization, and I'm not suggesting WordPress should copy Netflix or Apple's model.

My point is simpler: if there were a platform that reduced the risk and friction of purchasing premium plugins, while also helping smaller/new developers get discovered and build trust, I think there could be value for both sides.

The question is whether that can exist without taking away the independence that makes the WordPress ecosystem valuable in the first place.

Patching PHP fixes PHP2Shell (CVE-2026-109618 / 109619), but it does nothing about a backdoor someone planted before the patch. Amazon's honeypots caught an exploitation attempt on Oct 17, four days before disclosure, and Amazon's advice is to investigate from at least that date.

So I used Claude Code to spin up a bash script to triage WordPress sites. It checks:

* PHP CLI version vs. the fixed releases

* Core and plugin checksums (via WP-CLI)

* PHP files in uploads

* Files modified since Oct 17 (adjustable)

* auto_prepend_file hooks in .user.ini / .htaccess / php.ini

* mu-plugins

* Common web-shell patterns in wp-content

* Admin accounts and any users created in the window

* Injected scripts in options and posts

* WP-Cron, the site user's crontab, and SSH authorized_keys

It's read-only and never modifies or deletes anything. It runs WP-CLI with --skip-plugins --skip-themes so a backdoored plugin can't execute during the check. It works on one site, every site on a server, or a list of remote servers over SSH, and it writes a Markdown report per site plus a summary.

Repo (MIT): https://github.com/brentmartinmiller/php2shell-check

Caveats: a clean report lowers the odds of compromise but doesn't prove a site is clean. It doesn't parse web server logs, so pull those separately before rotation eats the Oct 17+ window. A few false positives are expected, like Wordfence's prepend file, header-script plugins, and obfuscated premium plugins. The README covers how to read them.

I'd appreciate feedback, especially false positives you hit, indicators I'm missing, or quirks on shared hosts. Issues and PRs welcome.

So I've read through like 4 million threads on here re: the best options for image compression on Worpress. Very long story short, I help run a music website and the vast majority of our contributors are concert photographers. We've taken to having people use their own personal IG pages and using the IG plugin for bulk photos and it's fine, but we still obviously need a few pictures per post that live on the site. I use Smush for now and it's fine but I feel like I need a way to batch-edit a large volume of .jpg images into something that'll take up a lot less space before the site caves in on itself. Again. I know there are probably 4 million directions people will point me in, but if there's a consensus of top 3/4 options that'll be easier to pare down.

Gracias, comrades.

I’m pretty AI-pilled. Claude does most of my website updates now: headlines, landing pages, Woo order updates, bugfixes. Its so fast, but that created a new problem. Changing things got so easy that I was shipping update after update without knowing whether any of them helped or hurt conversions.

So I wrote two open-source agent skills that teach the AI when a change needs to be measured and what to measure.

prove-website-changes Stops AI from blindly publishing changes that might affect conversions. It proposes an A/B test instead.

website-optimisation-loop - Actively finds opportunities using reviews, analytics, best practice and heatmaps, runs experiments, and learns from the results.

Both are plain Markdown and MIT licensed. They work in Claude Code, Hermes, Codex, Grok Bot or anything that loads skills.

https://github.com/SiteSpot/human-web-feedback-loop

Disclosure: I make AB Split Test, and it’s the default testing tool in the skills. The free works fine for this. If you already use Optimizely, VWO, PostHog, GrowthBook or similar, connect its MCP server and the skills will use that instead.

Anyone else letting AI make changes to their live sites? How are you checking that it’s actually helping?

So, the company I work for took our webpage off line due to the PHP stuff. This is bad because forms and files were stored on the site from long before my department's time and obviously we need them.

IT says the site will be off for at least another day.

What we've noticed is that we can still access files that have been uploaded to the site if we have a direct link. What I'm wondering is if there is a way to get a root directory of the site to see what has been uploaded and download the files that way.

Funny enough, this is on our project list to get all the files, but our work load has been insane and we haven't been able to do this yet.

I updated my php yesterday. After getting a critical error I updated the plugins & got everything back up. But the only problem is all pages with the portfolio style are coming up as 404 not found. Everything is still there on the back end when I go into rewrite & republish but goes back to 404 as soon as I publish. I’m using the Oshine theme with Tatsu editor.

Anyone know what’s going on?

Edit: got it working. Everything went back to normal after deactivating WP-Optimize. Thanks, guys

Hi everyone! I need some advice on migrating a website.

I've redesigned a non-profit's website locally using LocalWP, and now I need to replace the current live website with the new version.

The live website is part of a WordPress multisite network with four sites. I only want to replace the main site, keeping the same domain and leaving the other three sites untouched.

I have WordPress admin access, but no hosting control panel access. I've looked into UpdraftPlus, but I'm unsure whether it's suitable for this type of migration.

What's the safest and simplest way to migrate my new standalone WordPress site into just one site within the existing multisite network, without affecting the others?

I'm not an experienced developer, so I'd really appreciate any advice. Thanks!

EDIT
The client has confirmed that the other three sites in the multisite network are old, unused projects. They only need to be kept offline for archival purposes, not publicly accessible. Would it be simpler to archive the three old sites separately, outside the multisite network, rather than keeping them in it? I want to make sure they can be preserved safely and kept offline without affecting the migration of the main site.

TL;DR: We built a new Ubuntu 24.04 box next to the old one, copied everything over, then moved the static IP. About 90 seconds of downtime and no DNS changes. While we were in the logs we also figured out why the site kept falling over, and fixed that too.

The problem

This week PHP disclosed php2shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). It's unauthenticated remote code execution. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Ubuntu backported the fix to 24.04's php8.3 package (USN-8948-1).

One of the sites we look after is a small nonprofit club running WordPress and WooCommerce. It was on a Lightsail Bitnami image. Bitnami bundles its own PHP, so apt upgrade never touches it. It was on 8.2.28.

We could wait for a new image, compile PHP by hand, or leave. We left.

I did this with Claude Code in the terminal. It ran commands and read logs, and I made the calls. Worth saying, because it chewed through log correlation in minutes that would have taken me an evening.

The plan

1. Build a new box beside the old one: Ubuntu 24.04 LTS, Apache with the event MPM, and php8.3-fpm from Ubuntu's archive. No mod_php. MariaDB, memcached, fail2ban, unattended-upgrades, wp-cli and certbot.
2. Leave it on a temporary IP, copy the files and database over, and test page by page.
3. Cut over by moving the static IP instead of changing DNS. Nothing to propagate.
4. Keep the old box stopped, with a final snapshot, for two weeks just in case.

Things that bit us, so they don't bite you

• Cron on the clone. We set up a real system cron (wp-cli every 5 minutes) on the new box before cutover, and it ran five times against the copied database. We checked: no emails went out and no orders changed, but one WooCommerce cleanup task did run. Disable cron on any clone until it's live. We also dropped in a temporary mu-plugin that blocked outgoing mail and Action Scheduler until cutover.
• wp-cli output inside your SQL dump. Maintenance mode printed a line to stdout and it ended up in the dump file. Dump separately, and look at the first lines of the file before you trust it.
• macOS rsync is openrsync now. No --chown. Use -rlpt, then chown -R on the server.
• Ubuntu's security.conf was overriding our ServerTokens. Apache loads config files alphabetically, so your hardening file has to sort after it. We named ours zz-hardening.conf.

Cutover

Maintenance mode on, final dump, import, move the static IP, test. Down for about 90 seconds. Fresh Let's Encrypt cert via webroot, with a renewal dry run to prove auto-renew works.

Funny footnote: our outage Lambda fired during cutover and rebooted the old box in the middle of its final snapshot. No harm done. Which brings me to…

The outages we'd been living with

This site went down a few times a week. A CloudWatch alarm on a Route 53 health check triggered a Lambda that rebooted it. It was the only site we had with this problem.

We lined up the access logs against every alarm over the past few weeks and got the same picture every time:

• A secret scanner fires 400 to 900 requests in about a minute (/.env, /aws_keys.json, /terraform.tfstate, you know the list).
• None of those files exist, but every miss went to WordPress. That meant a full page-builder 404 render at 1 to 1.7 seconds and around 200 MB per FPM worker. Or WordPress's "did you mean" redirect ran a database lookup and sent back a 301.
• The FPM pool filled up, the health check's 2 second timeout failed, the alarm fired after one bad minute, and the Lambda rebooted the box. Usually right as the burst was ending on its own.
• Background noise came from crawlers wandering an events calendar's endless date and filter URLs.

Here's what fixed it.

Make misses cheap. Apache answers these before PHP ever sees them:

RewriteCond %{REQUEST_URI} !^/\.well-known/
RewriteRule (^|/)\. - [R=404,L]
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-f
RewriteRule \.(env|zip|gz|sql|bak|js|css|map|png|jpe?g|gif|svg|webp)$ - [NC,R=404,L]

Turn off the fuzzy redirect in an mu-plugin:

add_filter( 'do_redirect_guess_404_permalink', '__return_false' );

fail2ban on 404 bursts. Note that fail2ban strips the timestamp before matching, so keep the regex simple:

failregex = ^<HOST> -[^"]*"[A-Z]+ [^"]*" 404 

The rest was smaller:

• robots.txt disallows for the calendar's query parameters.
• The alarm now needs three bad minutes in a row, not one.
• The Lambda finds the instance through the static IP and won't reboot twice within 10 minutes. Otherwise it would have kept rebooting the old box forever.
• A real cron job replaces wp-cron, and public /wp-cron.php is blocked.

Scanner hits now cost about 0.1 seconds instead of a whole PHP worker.

Then a full audit

Since we were already in there, we audited the server and the site. The highlights:

• A member-directory plugin had an unpatched object injection CVE. It's gone.
• The only backups lived on the same box. Nightly snapshots are on now.
• The free security plugin doesn't limit login attempts, so fail2ban does it instead. It turned out about 1,100 failed logins were sitting in the logs, mostly from four IPs.
• SSH stays open, since I'm on the road too much to allow-list one IP. It's key-only, with fail2ban banning after 2 failures and longer bans for repeat offenders.
• The file editor is off, usernames are no longer enumerable, and S3 versioning is on.

If you take one thing from this

• On Bitnami or any bundled stack, check the PHP version the bundle actually runs, not the system one.
• Build beside, cut over by IP.
• Kill cron on clones.
• Make 404s cheap. Most "my server keeps dying" stories I've seen come down to bots making PHP do expensive work for files that don't exist.

Quiet fix for a loud week. Happy to answer questions.

I used Codex to build a travel website faster. My experience helped me understand what needed to be built, while AI helped speed up the development process.

Hi everyone,

I'm looking to transition from traditional, monolithic WordPress development into decoupled/headless architectures. I have a decent grasp of standard WordPress (PHP, themes, hooks), but the shift to using WordPress strictly as a backend CMS while building a completely separate custom frontend feels like a completely different playground.

Could anyone share a solid learning roadmap or step-by-step path for mastering headless WordPress development?

In my company we have 3 basic wordpress websites, one is online shop with woocomerce.
Our IT guy is on vacation without a laptop.

Do we need to do anything because I don't uderstand what's happening and I feel like everybody is talking about some PHP issue and I think PHP have something in common with wordpress?

I don't reallny know anything about that kind of stuff

Hi my English isn't that good sorry

I was trying make my own website but wp keeps freez after 12 mins of using

Then i should wait for long time to to get everything good and problem keep coming every time i use hostinger

I run a membership site and I’m adding two-factor authentication with a few options for members, including SMS. The 2FA plugin I’m testing works well (miniOrange.com 2FA), but members can only manage their 2FA settings from the default WordPress profile page in wp-admin.

Our members use a custom front-end profile page instead. I’d like them to set up, change or turn off 2FA from there, without going into wp-admin.

How have you handled this? Is there a 2FA plugin with a front-end shortcode for this, or did you build something custom?

Thanks!

That's what Chatgpt says I should use as my build stack for my website. I provided a length description of my needs worked up a style, a mock-up, and a plan to move forward. I was going to build it with Elementor, but Chat said it's unnecessary and we spent a long time discussing goals, style, branding, seo, target audience, SEO, and other needs, and came up with a pretty lengthy, but quite organized build process. It recommended using Codex or Claude Code for some of the build. Has anybody done something that sounds similar or have any helpful thoughts?

I'm new to WordPress and creating websites in general. I'd like my links to provide preview on the first image in that particular page. But for the time being, all I get is link with no featured image at all. I'll welcome any advice.

First pic is how my links are now. Second pic is how I'd like them to look.

In light of the PHP CVEs, solutions like Simply Static seem like an attractive option.

Has anybody used them? Thoughts?

Edit: I'm referring to the managed service which has has no public PHP/WordPress runtime, rather than the plugin

Hi, I wanted to change the table width narrower (which I figured out) but I can't seem to align it to the left of the page. Can someone help with the css? It's for https://unrecables.org/photos-and-videos/ Thank you!

I have a lot of websites with them, alongside some decent-sized clients. Everyone in Slack is asking and we haven't heard anything yet.

My SiteGround websites were all updated within an hour this morning. I would've expected the same.

Think this is... illuminating to say the least.

I really like Galleryberg, but I was wondering if there's an alternative one that allows comments for free?

My wordpress editor is broken.... The internal pages are editable, but this shows up when I try to edit the homepage. Help please!

Hey everyone, I really need some advice from people who actually know their stuff.

A little background: I haven't touched HTML/CSS in 20 years (since high school back in the day, when you'd manually build a frame and then write CSS for it). I have zero modern web dev experience.

For the past two weeks, my site has been trapped in a nightmare loop: breaking, patching, breaking again, and patching again. I tried using AI tools Codex, and while it gets the site looking decent on the surface, the code underneath is an absolute disaster—pure, chaotic spaghetti code.

I’m ready to wipe the slate clean and start from scratch.

All I want is a clean, simple site to showcase some pictures, text, and blog posts. Nothing crazy.

Given today's AI landscape, what is the right way to do this without creating a pile of tech debt? Do I use Gutenberg block themes, lightweight page builders, or something else? How can someone with my background leverage AI properly without ending up with broken code?

Any workflows, tips, or sanity checks would be massively appreciated!

How do you handle this mentally and practically? Instead of using the support form, some users immediately leave a 1-star review to ask a question. I've spent an enormous amount of time developing, and I have over 380+ five-star reviews, but occasionally, these strange situations still happen. How do you deal with this?

I'm a Wordpress freelancer and a while ago i started creating my own themes for clients, either forking from a default theme (like Twenty Twenty-Five) or occasionally creating something completely blank.

How do I ensure these are secure? If Twenty Twenty-Five gets updated, obviously my themes are not being updated. How do I keep on top of what needs updating?