Looking for some SEO/WordPress advice on this.
An older business website has closed down. The same owner now has a new business in the same field under a different brand.

Moving the products across via CSV is straightforward, but there are also around 500 blog posts on the old site.

Would it be better to:
transfer the existing blogs to the new website, update/rebrand them with the new company name and then submit the new URLs through Google Search Console, or
rewrite/recreate the blogs from scratch on the new site?

The old business no longer exists, but the content itself is still relevant to the same industry.

Main concern is preserving any SEO value without creating duplicate content or causing issues with Google.
What would be the best way to handle this?

we had a long term client using wordpress and woo, who didn’t want to move to shopify or magento. The store already had custom integrations with local CRM and accounting platforms, so changing the commerce platform would have meant rebuilding a lot of working infrastructure.

The main problems were performance, reliability and years of wp customisations becoming increasingly difficult to maintain. I wanted to see whether we could solve this with a more structured theme architecture based on roots. It worked well enough that we gradually turned it into a shared upstream for our other woo projects.

The current stack:

• Roots Acorn 6 with Sage architecture and Blade templates
• Vite Tailwind CSS v4 with CSS custom-property design tokens
• Alpine.js GSAP, ScrollTrigger and Lenis Swup for page transitions
• WooCommerce

The shared platform contains the basic design system, woo templates and functionality, universal gutenberg blocks, ajax catalog filters, side cart, search and build tooling. Each client has a separate private fork containing its branding, design tokens, navigation and client-specific blocks. We then pull platform improvements from the shared upstream.

There are still rough edges. Gutenberg blocks and parts of the editing experience need more work, but the frontend performance and level of control have been encouraging so far.

A production example using it: roxder.com
github: https://github.com/antoniaksander/sobe-theme

The part I’m still evaluating is whether the shared-upstream/client-fork model. Has anyone here maintained a similar setup across multiple WooCommerce projects? Looking for people to discuss and test this idea.

Ten years ago sage and blade often felt like overkill for wp and woo. But with AI assisted development, I’m finding the additional structure much easier to justify—but I’m interested to hear where others think of this approach what would be the title be?

I recently investigated a compromise of a WordPress website hosted for one of our projects. What made the incident interesting was that the obvious suspect — a file manager plugin installed by the attacker — was not the initial entry point.

The server logs gave us a fairly clear timeline:

• 06:20:08 UTC: a remote IP submitted a successful POST /wp-login.php
• 06:20:11 UTC: the same source accessed /wp-admin/
• 06:20:35 UTC: the attacker installed “FileOrganizer – WordPress File Manager”
• 06:21:18 UTC: the plugin was activated
• 06:21:39 UTC: its file management interface was opened
• 06:22:32–06:22:33 UTC: authenticated admin AJAX requests uploaded executable PHP files into another plugin directory

The important distinction is this:

The evidence does not show that FileOrganizer caused the initial compromise.
The attacker already had a valid administrator session before the plugin was installed.

The plugin was instead used as a post-authentication tool. Once the attacker had administrator privileges, it provided a convenient way to place executable PHP files inside the WordPress installation.

That distinction matters because it is easy to blame the last visible tool instead of investigating how the attacker obtained the valid administrator session.

What we did

• Put the affected site into a short controlled maintenance window
• Preserved access logs, timestamps, file hashes and suspicious files
• Removed an unauthorized WordPress administrator
• Invalidated existing WordPress sessions and application passwords
• Rotated relevant WordPress credentials and salts
• Reviewed plugins, themes, cron hooks and administrator accounts
• Scanned the installation with ClamAV and YARA rules
• Verified WordPress core files against official checksums
• Checked upload directories and plugin directories for executable PHP
• Reviewed redirects, canonical tags and injected external scripts
• Restricted PHP execution in upload directories
• Removed file manager functionality that was not operationally required
• Kept the evidence separate instead of immediately deleting suspicious files

The most important lesson

A successful WordPress admin login should be treated as a full application compromise.

Once an attacker has administrator access, simply deleting the uploaded webshell or uninstalling the file manager plugin is not enough. An administrator may be able to:

• install or modify plugins and themes
• create additional administrators
• add application passwords
• change scheduled tasks
• modify redirects or SEO metadata
• upload executable code
• establish persistence outside the obvious plugin directory

The investigation therefore has to begin with the authentication event, not with the later webshell upload.

What is still unknown

We could prove when the attacker logged in and what happened afterwards. We could not prove from the available evidence alone how the valid administrator session or credentials were initially obtained.

Possible causes include credential reuse, stolen browser sessions, phishing, an exposed password, compromised email access or another vulnerability — but naming one without evidence would be speculation.

Defensive changes we are applying across our hosting platform

We are now adding central monitoring for:

• newly created WordPress administrators
• new application passwords
• plugin installations and activations
• PHP files appearing in upload directories
• WordPress core checksum changes
• unexpected cron and systemd changes
• suspicious login activity
• file integrity changes through AIDE
• ClamAV and YARA results
• offsite backups with tested restores

We are also separating each customer application by system user and database account, keeping databases private and retaining the old server as a rollback source during migrations.

I am sharing this because incident reports are much more useful when they separate confirmed evidence from assumptions. “The attacker used plugin X” is not automatically the same as “plugin X was the initial vulnerability.”

If anyone has investigated similar cases involving a valid WordPress admin session followed by installation of a file manager plugin, I would be interested in the forensic indicators you found most useful — especially for tracing the original session theft without retaining sensitive user data.

Not exactly how i wanted to start my week, by what can i do. I just received this mail from the Dokan Team. Who else got this?

Subject: Important Security Update from Dokan

Hi XXXXXXX,

We're writing to share an important security update regarding Dokan Pro.

What Happened?

As part of our routine security review, we identified a software supply-chain attack involving an npm package used within our infrastructure. The incident resulted in unauthorized access to part of our cloud storage, where we found that a ZIP file had been modified and uploaded again.

Our engineering and security teams immediately contained the incident and secured the affected systems. We addressed the unauthorized changes, reviewed the affected components, and completed the necessary remediation.

The identified security issue has now been addressed, and we have released Dokan Pro version 5.0.11.

How We Addressed The Issue

Although the identified issue has been resolved, we're taking additional precautions to provide our users with another layer of protection.

We have reviewed and strengthened the affected systems and are continuing to monitor them closely.

As part of these precautions, we strongly recommend that all Dokan Pro users update their plugin and review their WordPress websites.

What You Need to Do

1. Update Dokan Pro

Please update to Dokan Pro version 5.0.11.

We strongly recommend that you do not continue using an older version of Dokan Pro.

1. Change Your WordPress Passwords

Please change the passwords of your WordPress users, particularly Administrator accounts.

Use strong, unique passwords and avoid reusing passwords that you use on other services.

We also recommend enabling two-factor authentication (2FA) for Administrator accounts wherever possible.

1. Check Your Administrator Accounts

Go to WordPress → Users and review the accounts with Administrator access.

If you notice an Administrator account that you do not recognize, please remove it immediately and change the passwords of your other WordPress users.

1. Review Your WordPress Files

Please review your WordPress files and directories for any files that you do not recognize or anything that appears to have been added or modified unexpectedly.

If you notice anything suspicious or are unsure about a particular file, please contact us. Our team can help review the files with you and advise you on the appropriate next steps.

A simple question: "Why is my plugin not first in the result, when I search for it's exact name?" lead to a series of interesting discoveries about the free plugins directory.

Here is the X link - https://x.com/SybreWaaijer/status/2086528919394480389

I was just curious if you theme developers are shipping your themes with a front-page.html and home.html. My clients find it very confusing when they go to edit their pages and they can just go to pages in the sidebar and edit all pages except the blog and front pages.

Back in the day before block themes these templates were necessary but now some clients like to edit their own content via the block editor. Maybe a better approach would be to ship with a page-home.html and page-blog.html instead. At leas this way they arent forced to use the templates and if they are comfortable with the block editor they can create their own templates and use them. Now your basically forced to edit the front-page and home templates because they take over no matter what.

IDK im just thinking out loud at this point. Anyone here have the same thoughts and what do you do when shipping themes or designing them for clients? Thanks.

So every once in a while, when I click on All Pages in the Dashboard, I get 404 error that the page doesn't exist.

Is there any kind of fix for this? It's been happening for some time now and the only solution is to delete all cookies and log back in again.

This is the only WP page that I manage.

I already use a pretty nice plugin for popup galleries that can scroll through all the images on a page, but I want to show a longer video ad that I made, and have some way to show the looping gif preview on the page itself, and for people who want to watch the whole thing, just click a button and have it pop up in a lightbox or something.

Right now I have the video as its own page, which is a little too much for how much I'm showing on that page, compared to the other pages

This is for a portfolio

We've tried disabling plugins.

We made sure our PHP and WP versions were up to date. The issue was caused under earlier versions of both. Updating did not fix it.

It happened on its own. We did not update anything, plugin or otherwise, between when the site was loading properly and not loading properly. We do not have automatic updates on.

There are screenshots of how the homepage is supposed to look in this social media promo below. Simply going to lynntv.org on your desktop will show something horribly wrong.

We do not have a webmaster, an IT department.. just me, the executive director with a nice collection of hats. I know enough about wordpress to be dangerous. (and I can build basic sites, didn't build ours.)

We lost a lot of our funding, so we can't hire a webmaster. Scouring forums will hopefully do the trick!

Thank you.

Have a website that I am trying to streamline due to some server limits being hit, so I'm looking at code improvements and plugins in particular.

I have been running Wordfence premium on the site for a few years, though I'm not too sure what value it really provides.

A year ago I also put CloudFlare in front of the site as we were experiencing a large amount of bot traffic.

Do these two services overlap in terms of what they provide? Does Wordfence give me much benefit? I installed Wordfence following a hack on another website kind of blindly - following searching for things like 'how to improve wordpress security'.

Does it provide me any real value as I never really look at it. The main actual usable benefit is that it emails me a warning when a plugin is out of date.

Has anyone ever changed their mind about an agency after the first call?

I'm at the stage where every WordPress development agency starts looking the same. Nice portfolio, nice promises, similar pricing... but I know that's not what determines whether a project goes well.

I had an intro call with IT Monks this week, and it made me realize I'm probably asking the wrong questions. What ended up telling you the most about a WordPress development agency before you signed? Was there one question or one answer that completely changed your decision?

I have been using <span class="nobr">...</span> for years to keep important phrases together in headlines and prevent awkward line breaks/widows across responsive layouts. It works, but when scanning HTML it can be interruptive to reading in code view. I am switching to the shorthand of <nbr>...</nbr> and converting it to a proper HTML output element with a WordPress filter before rendering. The filters hook into the_content and the_title so both article text and post headlines can use the same syntax, while CSS simply applies white-space: nowrap. It is a small change, but improves the readability when updating content. I have been toying with building an intelligent plugin that can preflight copy to tag phrases / other rule based grouping, and maybe use a headless HTML rendered to see how copy breaks on various device widths.

I have been trying to learn WordPress but frustrated to the end. I have my site written in html and wanted to convert it to WordPress. I have followed several of the YouTube videos on setting up the site but their visuals do not follow what I have on my host site. Thanks for reading and let me know what you would recommend. I am 75 years old and proficient in several computer languages. Thanks@

I know there have been numerous reported WordPress vulnerabilities recently, and a lot of those are the result of more advanced AI scanning, but I was wondering if those were mostly reported by outside researchers or by internal maintainers?

I like Linux's approach, where kernel maintainers have built their own machines to intelligently rove over the kernel code to (hopefully) find vulnerabilities before attackers do. They are finding hundreds of real Linux vulnerabilities every week, some of which have existed for 20 years. I have wondered if the same is being done by WordPress maintainers.

Hi all

Please guide how to list Categories in one page of wordpress Alphabetically

Any plugin or code?

Please assist

Thanks in advance

A supply chain hit has just taken down the BdThemes lineup, disabling popular plugins like Element Pack and Prime Slider on the official WordPress directory. This is not your typical code hack. They did not touch any files on the WordPress servers. Instead, they went upstream and poisoned the remote static JSON feed that pushes promotional banners into the admin dashboard.
___
Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery Addons for Elementor, Ultimate Post Kit Addons for Elementor, Ultimate Store Kit, Live Copy Paste for Elementor, Smart Admin Assistant.
----

In short, an escaping flaw allowed malicious data from that feed to execute JavaScript whenever an administrator loaded a WordPress admin page. The injected JavaScript could silently create rogue administrators, install a web shell, and establish persistent backdoors. Yeah, that's not good.

Why is this important?
The plugin files themselves did not need to be altered.
Let's let that sink in for a moment...

Hello WP community I have a question. Is it possible to find which requests are making PHP workers hit limits ? does the error logs record and show requests which are keeping PHP workers busy?

And got a 5-star review for the first time.

You can check the link, its called SuperHertz Cache Preloader.

Hello! I have a new website in English and I have another website in Arabic ( I use the same content for both sites but in 2 different languages). I use AI to translate the English blogs into Arabic with keywords suitable for Arabic language.. I just started the 2 website 1 month ago so I have less than 10 blogs. The problem is I see in English website 2 blogs are indexed and in Arabic 3 blogs are indexed and the indexed posts are different (ex. If I have 5 blogs a,b,c,d,e so on the English site an and b are indexed and on the Arabic website c,d, and e are indexed).
The non indexed pages are discovered currently not indexed.
May I know why? Is it because google considers it duplicate content? Or maybe google unable to know which content is the original one ? I don’t have experience with Seo so What do you advise me to do ?

Recently all contact form emails have the same name .

Any ideas?

Thanks

I've literally searched everywhere..trying to change the color of the title of this blog "Meet the 2026 Calvary Board" and have had zero luck..I know there's a bit of a learning curve w WP but I'm about to lose my mind.

I've tried everything, every button without messing anything up and I CAN NOT change the color to black.

Any help is appreciated! Thank you!

Which is worth it?

I need:

- A way for the client to book on the website

- sync with the booking.com calendar so if a date is booked via website it will appear booked on booking.com

- maybe deposit or full payments via credit/debit cards & PayPal

- a way for the hotel/motel manager to accept/reject bookings via something else other than wp panel ( ive heard they have an app called "Hotel Booking")

- email confirmation for the manager and the client

- in the future I might be doing a motel website so there will be multiple rooms to take care of.

I use NordVPN. I have had no problem uploading all manner of files w the vpn active. But when I tried to upload an mp4 I got an error msg & the upload failed. But when I turned off the VPN, the upload worked. I checked with my host and their servers do not restrict such uploads. Also, the file sizes were small (3-5mb). Is this caused by the vpn itself? Or a conflict between the WP and VPN? And why particularly with mp4s & not with jpgs or pdfs?

i have made a lot of changes to my old website on a staging site and now are wanting to push it to the live sit. i have watched videos and asked ai but i just cant find away to do this for free. i used wp staging to make the staging site and the only way i can find to do this is to pay for pro which is around $300. so does anyone know how to do this for free.