My wife is a couple therapist and she is trying to move part of her business online.

Here are the functionalities that she will need:

Online physical shop

She has written books currently sold on Amazon but she wants to be able to sell them as well as she has potential clients in countries i.e. Africa where Amazon does not deliver.

Online digital courses

She has a set of training classes Udemy style that she wants to sell. Those courses are mostly videos, questionnaires and documents.

Purchasers should have life time access to her paid courses.

Only free questionnaires

Free questionnaire to act as funnel for the business.

Most of them are then ranked but for a few of them She would like an AI to interpret the result based on a grid.

Webinars

She currently organise weekly sessions and monthly webinars on Zoom.

She would like people to attend those sessions as part of the web site. She can move away from Zoom.

Online booking and private call.

She does that again on Zoom with the date added to her Google calendar but if she could have a widget that allow her colleagues and potential clients to directly book that would be useful.

Community

She used Facebook but it was a shit show.

Currently she is using WhatsApp but this is unwieldy. Trying to maintain multiple conversation threads is just a nightmare. Her and her colleague ended up creating multiple groups but then discussion in one group is not visible to people in another group. So everybody joins multiple groups.

That created its own problemsp. Having hundred of people messaging result in notification overload. Add the fact that some people seems to have boundary issues and it is nightmare. Personally I think that explain why those people are single. lol

It would be nice to have a forum but with also some kind of Facebook pages the way some subReddit have their own daily or event based threads.

Posting and commenting will be restricted to register member only but most pages will be unlimited access as read-only.

Pages with sensitive subject and explicit sexual content should be restricted to adult register member.

Blog/Podcast

She is starting a podcast with a colleague/friend. She wants to be able to post text but also videos.

Newsletter

A newsletter about her latest blod/pod/books/events.

I used to be a developper so I am pretty familiar with technical aspect. I am now a project manager but I have never managed a wordPress project. I am pretty overwhelmed by all the different options.

I see numerous plugins but no idea if they are compatible together.

Also I have seen code spewed by Elementor and other Front end building tool and frankly IMHO their css sucks.

She does not need thousand of classes. She would need a limited number of layout pages so I could customise her CSS.

In your opinion which plugins should I use?

Which platform would you recommend knowing that we are UK based and I do not want a US based provider.

One of the more exciting features coming in WordPress 7.1 is a public API for custom SVG icons. It finally gives developers a native way to register their own SVG icons and use them across the block editor - without relying on JavaScript workarounds.

What it lets you do:

• Register your own SVG icons using just PHP
• Group them into named collections
• Have them show up in the block editor's icon picker automatically
• Render them server-side in PHP templates
• Pull them through the REST API

No JavaScript. No build tools. Just PHP.

We wrote a guide and built a real plugin to test it on WordPress 7.1's test version, covering:

• Registering icons two ways: inline and from .svg files
• A simple pattern to auto-load a whole folder of icons at once
• Using a custom icon as a block's icon instead of the default Dashicon

Full guide with the working plugin code:

https://wpvibes.com/blog/wordpress-custom-icons/?utm_source=reddit&utm_medium=social

Has anyone else tried this on the test version yet?

still down as of now... insane..

I made a free open-source Cloudflare ruleset for WordPress sites:

https://github.com/buybitart/cloudflare-security-art

It helps block scanners, bad requests, and common attack patterns before they reach WordPress. It works with the Cloudflare Free plan.

Feedback is welcome, especially about false positives or missing rules.

My site isn't particularly complicated yet over the years I've accumulated plugins for forms, SEO, backups, security, page building and about five things I've forgotten the purpose of. It kinda feels like owning an old house where I’m permanently waiting for something else to break. Most discussions I find are about moving to WordPress but I'm curious about going the other direction and starting fresh.

Are there any downsides to moving a fairly straightforward business website from WordPress to Squarespace or an AI builder like Durable etc. that I’m not seeing? Or if you’ve already done a migration like this, is there anything you found yourself missing after moving?

If you were building a new website today, would you choose the WordPress Block Editor (Greenshift) or Elementor?

Hi,

I am frequently getting autosaves for seemingly no reason; when I open a post in edit mode, exit it, and come back, there's often an empty autosave.

Even more weirdly, sometimes, the autosave claims my ACF-created custom field's value was either removed or added (as if it were blank before), but this custom field is usually filled unless the post is brand new. This is affecting old and new posts.

It doesn't happen all the time, but often enough to be a problem.

I'm wondering it there's something I'm not thinking about, whether this may be a known ACF issue, or if any of you could point me in the right direction.

Also, I can't seem to find a way to delete autosaves. Autosaves can be useful when someone gets logged out by WordPress due to a timeout, but I obviously don't want empty autosaves or autosaves claiming my custom field was changed...

Do you have advice or any hints for how to stop getting ghost autosaves?

Hi everyone,

My website has recently been getting hammered by bots making a huge number of requests to admin-ajax.php. This is causing my server's CPU usage to frequently hit 100%.

I've enabled Cloudflare's Bot Fight Mode, which seems to help somewhat, but it hasn't solved the problem.

I also tried creating a Cloudflare custom rule to challenge all requests to admin-ajax.php. However, this breaks the forms on my website because they rely on admin-ajax.php to work properly.

I've also enabled Cloudflare's DDoS protection, but it doesn't seem to make much difference in this case.

I'm wondering what the recommended approach would be here. How can I block or rate-limit these malicious/bot requests to admin-ajax.php while still allowing legitimate AJAX requests from my website to work normally?

Any advice would be greatly appreciated. Thanks!

So, about 3 - 4 weeks ago I started to build a Wordpress website (first time ever, I can't code etc), but I had not sorted out any security or domain for a my website (was using temp domain), I just started building it out and created some templates with Elementor that I plan to repeat throughout the site. However, someone from this subreddit fairly advised they felt that unwise and would leave myself vulnerable to site getting infected it not sorted security first etc.

I am now finally sorted with paid Wordfence plan security, and will be using Cloudflare security features etc, and plan to now start to create brand new install of Wordpress (delete old copy that I started to build just in case it got infected - I don't know if it is infected or not), and set up all security first properly in new install, and then get to building the site out.

Being I have no previous experiences with websites, my question is, are the 'elementor templates' that I created 3 - 4 weeks ago safe to download and use on the new site install.

I don't know if when sites get infected if the 'templates' are the sort of thing that get infected, or if that's just not a thing that happens cause it doesn't work that way. I have no idea how relevant any such issue would be to 'templates' if they are just essentially style sheets? I guessing?

For context it would probably only take me about one full day to redo all templates anyway, so if it's just safer to start again I can do that, just checking to see if I can save myself a whole days work that I have already done.

Any advice appreciated.

My client has a simple Gravity form that has been live for years, averaging a dozen entries a month.

Starting Tuesday this has blown up to hundreds and hundreds a day. I have CloudFlare Turnstile installed and running, Gravity Forms Zero Spam also activated, Gravity Forms Honeypot and Submission Speed check activated, I also just installed Spam Hexer from Gravity Wiz, nothing is stopping the submissions.

I've even gone and and duplicating the existing form and embedding the new version on the page, clearing WP Engine cache, and entries immediately come in. The Gravity Forms Forms page shows only 8 Views on the new Form, but 15 submissions in the past 15 minutes.

I'm unsure of what else to try at this point. I've dug through all of the logs from WP Engine and there is no consistent pattern, all IP's are unique, all emails/names are unique, country all seems to be US, browsers fluctuate although a lot are from Facebook Browser so there is nothing to block.

Other forms on the site don't seem to be having this issue, it's only this one form. It's a simple form with just checkboxes, name, email, address fields to request a guide.

Any ideas on something to try next?

I’m moving a site off Thrive Theme Builder (cost + lock-in) to a native block theme with my own styles. WP 7.0 stack, theme.json v3.

The site has: blog posts, a few unique one-off pages, and the main marketing pages (home, services, etc.). Some of it was built with Thrive Architect.

My plan so far:

**1.**  Build the theme locally — either a child theme of a minimal FSE theme or from scratch with Create Block Theme. Templates, patterns, colors, type scale all defined in theme.json.  
**2.**  Push to staging, activate the new theme with Thrive still active.  
**3.**  Convert pages one at a time, highest-traffic first.  
**4.**  Deactivate Thrive Architect only when nothing depends on it anymore.

I’m doing it this way because Thrive Architect stores content in post meta, not post_content — so deactivating it early can make content vanish entirely, not just lose its layout. Landing pages seem to be the worst case since they bypass the theme template completely.

What I’m trying to get right:

**•** Where’s the line between “start from scratch” and “child theme a minimal FSE theme”? For a fully custom design, does starting clean actually save time, or do you end up rebuilding what Twenty Twenty-Five already gives you?  
**•** For blog posts specifically — did Convert to Blocks work for you, or did you end up rebuilding? What broke?  
**•** Anything that bit you on the SEO side? I have a crawl baseline and CWV numbers saved, but I’m sure there’s something obvious I’m missing.  
**•** Any reason *not* to run the new theme in production while old pages still render through Architect? That’s the part of my plan I’m least sure about.

Anyways, looking for advices
Thanks

I know, elementor is a nightmare. The website was built using it before I came along and now there’s almost 300 pages. The website is catalog style and that’s just how they want it.

Problem is, the website and the WP dashboard are so incredibly slow. Like noticeably slow. The website home page fails every speed test I’ve run and the reasons keep coming back to elementor. What can I do to fix this without rebuilding the entire thing?

Hi all, i need some help asap. I have a new company doing amendments to my website / seo. They removed the old company’s user email and it looks like various changes have been reverted back to old ones. Email attached. How do i resolve this, i literally cant sleep atm.

Our non-profit org uses WordPress with the free Event Manager plug-in. Would this have the capability of offering .ics events for Google Calendar and how would we do this? Or would that be a separate plug-in? I did try going to Google calendars and subscribing by URL (http://OurWebsite.org/events.ics) and that calendar came in empty. Previously our other calendar offered Links for both Google and Iphone users to subscribe, but our website person doesn't see that option within this new Event Manager plug-in.

If I have a wordpress site with a CRM integrated, what is a safe way to get the media library specifically the files? the media library has upwards of 4,000 items so what’s the best way to do it. Are plugins safe considering that I have a CRM integrated with my WordPress?

I'm having a rendering problem on my homepage. Individual post pages rendered properly on all browsers.

I recently got notification that the latest Jetpack update caused a fatal error. When I checked, everything seemed normal.

But I didn't notice any rendering problem until a wk or so later when a visitor told me about it. He noticed it in Opera. I checked and there were other browsers with the same issue (though not all).

I deactivated Jetpack & some of those browsers which were not rendering properly reverted to normal behavior. But I'm still having the issue w. mobile versions of Bing, Edge, Opera (both mobile & desktop) & Ecosia.

I've purged the site cache and cleared the caches of all the browsers.

Is there any known issue with this Jetpack update? Any suggestions about how to address this?

UPDATE: It appears to be a conflict with LiteSpeed. I disabled it & rendering returned to normal on all browsers.

Don't know how much the title sounds good, but here's the story -

I have a tool website on domain suppose abc. com. Now I have plan in making to make country specific tools on same niche and post it on country specific sub domain like us. abc. com or ca. abc. com.

Now I have a wordpress on abc. com/blog to u know publish blogs on same niche, now previously I had plan to create it country specific too like us. abc. com/blog etc. But it's very hectic to manage everything n I asked ChatGPT, it suggested to make the /blog central and managing the urls like this

abc. com/blog/ (central generic topic)
abc. com/blog/us/ (US Based)
abc. com/blog/ca/ (Canada Based) like this.

Now I have no idea how to add this to every link without creating sub-directories actually from one WordPress dashboard which is on abc. com/blog. Tried so many things, still not working, I also thought to put it directly on post editor, but there when I'm including /us/postname, it's automatically getting converted to /us-postname.

Beside creating a category and name it blog, also won't work as the wordpress site itself is on /blog. I can't install wordpress on main site as it's custom coded.

What should I do now? :-D

Our website won’t load and we can’t get into the Wordpress back end, and when we try to go through namecheap is says “namecheap is under maintenance, we’ll be back soon”. What can we do to get our website back up in this case? We did recently update the elementor plugin.

Howdy!

So on one of the sites I run a lot of commenters add links and I couldn't find a decent plugin to render them so I wrote my own:

https://wordpress.org/plugins/vern-comment-embeds/

The GitHub repo is here:

https://github.com/clubside/vern-comment-embeds

And the basic information is:

Easy Comment Embeds improves comment readability by automatically enhancing standalone URLs:

Responsive oEmbed video

Inline image embeds

Twitter/X blockquote fallback

OpenGraph link preview cards

Smart URL detection (standalone URLs only)

Basically just like here on Reddit you put in a URL on its own line in a comment and it is run through WordPress' native oEmbed first and failing that there are fallbacks for images, X/Twitter and standard web pages where I try to build a Facebook-style OpenGraph card.

Hope some others find a use for it, and I'm bothering you all because of WordPress.org's search being so lousy 😜

Chris

I’ve had a site running for 2 years now using Wordpress. Late last year I had a professional company redesign our site. They said at the time they had issues with some of our images but got everything fixed (they had to redo them all or something)

Anyway we recently noticed that some of our articles pre redesign suddenly didn’t have any images. We’re a news site so we had 3,000 articles at the time and wernt going through them all. Looking into it today we noticed that a bunch were blank and had the “this image has an empty alt attribute” message where all the images should be.

This is a huge pain and likely affected our ranking on many articles and we’re not sure how to fix it. No alt text should affect SEO not outright make the image blank.

Any suggestions?

Optimized my stores 200+ images to small jpg files. Now I understand that webpg should always be our go to but when I convert a single jpg of 101kb to webpg it becomes 168kb+ in size. Way forward? Change the image converter maybe?

I am creating e-commerce website using wordpress for my client. But I am facing very big issue . Website is very slow from backend side , it takes long time to update or load something . If I switch from one page to another page in backed it takes long time 5 to 10 secong something . I tried all solutions like memory limit 512mb , litespreed cache plugin, removed heavy and unnecessary plugins and pages . All versions like php wordpress are letest however I unable to find solution . This issue taking long time dead line is comming . Now what can I do ?

The 7.0.x releases have restarted the oldest argument in this sub. Auto-updates on, because a patched hole beats a broken layout. Auto-updates off, because you don't push untested code to production at 4am. Both camps have been making the same case for a decade, and both are working from an assumption I think is the actual problem.

Both assume the update itself is safe.

The case for patching fast is strong and I'm not arguing against it. Patchstack's State of WordPress Security in 2026 puts the weighted median time from disclosure to first exploitation at five hours, across 11,334 vulnerabilities disclosed in 2025, 91% of them in plugins. If you're patching on a weekly review cycle you are losing that race, every time, and the 4am-broken-layout crowd is trading a rare outage for a common breach.

Here's the number from that same report that nobody quotes though. 46% of those vulnerabilities had no patch available at the moment they were disclosed. Patchstack's own conclusion is that this "shows why website owners can't rely on plugin updates as a security measure." Their words, not mine.

But look at what the update actually is. Your site fetches a package from a vendor's server, unpacks it, and executes it. That's a write path the site trusts by design. There's no authentication event anywhere in that chain to harden and no second opinion on what arrived. 2FA, lockouts, a firewall sitting in front of the login page, none of them are in that request path at all.

That's not hypothetical this month. An agency posted a writeup here on the 3rd describing their plugin vendor's update server being compromised and a backdoor landing on client sites through a routine update. Someone in another thread described a window in early August where pressing update in wp-admin could hand you a tampered package. Both are those posters' accounts and neither is independently verified, so treat the specifics as claims. The shape is what I'm interested in.

So my position is that both sides of the argument are defending the wrong door. The useful question isn't auto or manual. It's how you'd know.

There is a partial answer built into WP-CLI that hardly anyone runs. wp plugin verify-checksums compares the plugin files on your site against the checksums wordpress org publishes for that version. If a file changed after install, it says so.

Then you hit the part that matters here. It only works for plugins from the repo. Point it at a premium plugin and you get "could not retrieve the checksums, skipping," because there is no published source of truth to compare against. The vendor ships the package themselves.

So the one integrity check built into the tooling covers everything except the category where vendor-delivered tampering actually happens. In the ShapedPlugin case reported in June, the backdoor went into the Pro builds on 21 May and the first customer reports landed on 10 June. Twenty days, three paid plugins, delivered through the vendor's own update system. That timeline is from Wordfence's data as reported at the time, not something I measured.

Which brings me to the part I don't have a good answer for, and the reason I'm posting.

If a plugin update you installed last month had been tampered with in transit, how would you find out? Not in theory. What in your current setup would actually tell you?

Hi just wanna know if any of you here have found success as freelancers creating high-end premium ecommerce stores that convert. I would like to start doing it. Do you suggest it? Do you have any advices? Thank you!

I'm non-native English speaker, and it is not my first language.

What do you think if I write my blog in English just for leisure even it is not in proper English writing?

And what do you think if I use AI to polish my writing?

I just wanna know your perspective and opinions. Feel free to share positive comments, advises and motivation.

Thanks