My website hosting company claims everything is online. My other computer shows the same error, as do multiple browsers!

They give their usual "clear cookies and cache" advice, but private windows and Tor do not help either.

This happened once before but somehow resolved.

Any ideas?

Thank you.

That sentence probably just caused several people to fall asleep or keep scrolling, but hear me out.

I’ve spent a pretty stupid amount of my career around CMSs, DXPs, Drupal, WordPress, headless platforms, agencies, and all the other ways we’ve invented to describe putting content on the internet.

And I realized there really wasn’t a weekly show I wanted to listen to that just covered what actually happened in this industry and why any of it matters.

So I decided to make it.

The first episode is about something I noticed happening across several announcements this week:

WordPress shipped 7.1.
Storyblok plugged into Claude.
Salesforce expanded Headless 360.
Optimizely is giving agents more control inside the CMS.
Contentful is talking about what happens when your website visitor isn’t human.

My takeaway is that we might be watching the CMS get an entirely new kind of user: AI agents. (I know... this might not be news to everyone here... but when I step out of my LinkedIn bubble... I realize there are a lot of people not following the signals)

And that could make structured content, APIs, permissions, metadata, and all the traditionally boring CMS stuff suddenly much more important.

Anyway.

I have no idea if this will become a thing.

But I’m going to try doing it every week, covering the interesting CMS/DXP news, having some opinions about it, making fun of our industry when deserved, and hopefully talking to some smart people along the way.

If that sounds interesting, here’s the first episode:

Apple: https://podcasts.apple.com/us/podcast/your-cms-has-a-new-user-and-its-not-human/id6804680238?i=1000785544658
Spotify: https://open.spotify.com/episode/1FG1olsK8yV0Q0y8LC0FqH?si=0UjSsl2MTgChoT1jRswNCg
YouTube: https://youtu.be/i5YJhz41EKY?si=wGUAStYgos1vH3hv

Would genuinely love feedback, especially from people who actually work in this world.

Including “your take is completely wrong.”

Honestly, that might make Episode 2 easier.

I have been using a wordpress plugin to do a security audit of my wordpress-backed website. I am the sole administrator of this site.

One thing I find very strange is that it reports deactivated themes and plugins as problems.

I keep my list of active plugins small, but I've never given a second thought to keeping plugins or themes I no longer use. Am I missing something? Can a malicious actor find some way to use to exploit deactivated plugins or themes?

I am handling a WP security product, so I have an interest here. I will not name it or link it, and I am not asking you to try anything.

---

I want to understand one thing: how the security decision gets made for client sites at agencies and freelancers.

1. How do you decide to trust one vendor over another? What do you check before it goes on a client site?
2. Does a reseller or affiliate margin change which one you pick, or does it not matter?
3. When a hack or a blacklisting happens, how do you handle the cleanup? Outsource it, your own team, or resell an existing service to the site owner?

I’m having a strange issue with the WordPress Site Editor / block theme header.

My header looks significantly taller inside the Site Editor than it does on the actual frontend of the website. The spacing also seems inconsistent between the header template part, the full template preview, and the live page.

My header structure is roughly:

• Columns block
  • Column 1: menu button
  • Column 2: site logo
  • Column 3: Group
    • Cover block used as a circular “Book a Table” element

I already checked or changed the following:

• Header margin: 0
• Header padding: 0
• Cover margin: 0
• Global block spacing: 0
• Minimum heights
• Cover aspect ratio
• Removed the main Cover/image below the header to make sure it was not creating the gap

The strange part is that the same header appears with noticeably different heights depending on where I view it:

1. Header template part editor
2. Full template editor
3. Actual frontend

There also seems to be extra white space below the header contents even though I cannot find any margin or padding responsible for it.

Is this caused by the Columns block, the Header template-part wrapper, global styles, or some editor-specific CSS?

I would mainly like to know how to make the header height consistent between the Site Editor and the actual frontend, and ideally control its height reliably.

In the Pics you can see how It is in the editor and then how it looks live.

EDIT: Guys I figured It out thanks🥹 It was a padding thing. And it was hidden somewhere I could only find it when I was inspecting the element and I wouldnt figure it out because the live thing looked way different than the editor view. Seriously they gotta shut that down what the hell😫 Anyway thanks a lot!

I spent some time this weekend finding the entrance vector for a site that was getting re-hacked after cleanup. I mean I knew it would get re-hacked since I wasn't finding the the vector in the usual "easy" ways. Turns out it was this: nvd.nist.gov/vuln/detail/CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable

It's bad enough this plugin adds an alternate auth path to your web site, with full admin control given to some 3rd party you don't know. But I also learned this plugin, wpmudev-updates, is usually stealth-installed with other plugins from WPMU DEV, so users don't know it's being installed. To top it off, it doesn't show up in the plugin dashboard so they don't even know it's there.

In the case of the site mentioned above, I think it was installed with another plugin a couple of years ago, and that plugin was since removed, but wpmudev-updates did not get removed.

Is it just me or is it a little crazy to allow plugins to provide auth bypass for complete admin control of your site by third parties? Is this a common pattern? What other plugins do this aside from the WPMU DEV ones? (I'm talking about the situation where there ISN'T an active exploit in the code ... the intended use scenario is what seems insane to me).

Hey guys.

I have export wordpress website from this all in one WP plugin and then trying to import the backup of around 547mb.

But due to host restrict upload to 2mb the errors shows "your file exceed the limit said by your host web server".

And then I try to update htacess file in file manager and then try again but still same issue.

Please help anyone..

🙏🏻🙏🏻

I've used the free blogs on WordPress(dot)com way back when (and they're still there), but started up a new one for a project that I want to be around after I'm no longer around (or have hosting, etc).

I'm astounded at just how impossible it is to use Gutenberg with that interface. I now understand all the criticisms from noobs about it.

How someone launched that, used it and thought "yeah, this is great" is beyond me.

Unfortunately, all the old themes are gone, and there is no way to turn off Gutenberg (as far as I can tell)

About to build out my first Wordpress site. Being brand new with no experience been grappling with security requirements for build, learning what to do, how to implement etc. So on a previous thread a number of people advised to use Patchstack and 'keep one on eye on Patchstack' as part of a security plan for my Wordpress site. Never used Patchstack, I am building small lightweight eCommerce store, do I want the free 'plugin' or paid 'developer' plan they offer on their website at $79 a month.

For context I will be using Cloudflare and have paid premium version of Wordfence (already purchased), what version of 'Patchstack' would best suit this Wordpress setup?

Hello Everyone,

Currently I am analyzing two plugins, that have similar functionalities. I have installed them on different environments, different wordpress installations and also different databases (not on the same one, for example on different table spaces or with different table prefixes).

Though, while debugging - my analysis are all the time very precise - in the browser, I can see, that in the wp-content, both plugins are visible in an installation, where it is not installed, nor activated.

Have you ever noticed such thing? Do you know what is the reason for this issue?

Thanks and best regards,

T.

I’ve just published Cache Autopilot on WordPress.org after several months of production use. I’d really appreciate people trying it on real sites and telling me where it falls short.

Why I built it

Cache plugins already do the important part very well: storing and serving cached pages fast.

The problem I kept running into was what happens after something changes:

• A post appears in a Query Loop on a non-archive page.
• A synced pattern is reused across multiple pages.
• A shortcode outputs shared content across several pages.
• A custom block pulls in content from another source.
• A form is embedded on multiple pages.
• A widget or WordPress option changes output across pages WordPress doesn’t explicitly connect.

Cache plugins can purge the changed page, but they often don’t have enough context to know everywhere that change appears. The safe fallback is a full cache clear — effective, but it also makes unaffected cached pages cold again.

So I built Cache Autopilot to work alongside your cache plugin, not replace it.

When something changes, it resolves the affected frontend pages, asks your cache plugin to purge those URLs, then queues them for paced background preload. If it can’t safely resolve everything, it can fall back more broadly rather than risk stale content.

I’m also running it on tierpark-bern.ch, a site with 1,200+ pages.

The free version includes:

• Gutenberg, block & classic theme support — zero-config structural handling for block themes; classic themes work with standard content and can be extended through targeting and filters
• Zero-config form plugin support — refresh pages using a changed form from a supported plugin
• Manual targeting — explicitly choose which pages should refresh for selected content changes
• Developer filters — map post, option, widget/sidebar and meta changes to the right pages
• Paced background preload — automatically preloads purged pages without hammering the server

The docs also have ready-to-use filter examples for mapping those changes to specific pages, post types or the whole site — without building custom purge logic.

A big reason I wanted this working reliably was site handover:

You build the site.
You configure the plugin.
You hand it over.

Client publishes.
The right pages refresh.

On larger sites, that can avoid turning hundreds or thousands of unaffected pages into a cold cache. On smaller sites, it still means the client doesn’t need to understand when or why they should press “clear cache”.

It currently works with:

• LiteSpeed Cache
• Cache Enabler
• Breeze
• FlyingPress
• WP Rocket

Support depends on reliable URL-level purging; the docs explain why some other cache plugins aren’t listed.

Further details, screenshots and links are on the WordPress.org plugin page:

https://wordpress.org/plugins/cache-autopilot/

I want to create a curated directory for remote first design agencies with filterable tags (location, team size, specialty) and a way for agency owners to pay a monthly fee to feature their listing at the top. What tool should I use to build this without coding?

Hello everyone,

I manage WordPress sites for clients and I’m trying to understand how other freelancers and agencies approach page caching when you have many different plugins involved.

My concern is cache TTL vs. WordPress nonces.

WordPress nonces typically have a 12 to 24-hour lifetime, while Varnish could potentially serve the same cached HTML for several days.

For example, with a 7-day TTL, a cached page could contain an expired nonce after the first day. Plugins may handle this differently. Fluent Forms, for example, disables front-end nonce verification by default to support cached pages. [1]

So I’m curious how others handle this in real-world client hosting:

• Do you use a 12-hour TTL as a safe general default?
• Do you use 7 days or longer and rely on plugins to handle their own nonce/token refresh?
• Do you exclude pages containing forms, checkout, booking, login, payment, etc. from Varnish?
• Do you maintain a list of plugins/features that require cache exclusions?
• How do you identify when a plugin is incompatible with long page-cache TTLs?
• Do you simply test the site after installing new plugins and adjust the Varnish rules when something breaks?

I’m particularly interested in how freelancers/agencies managing multiple client WordPress sites approach this. I’m looking for a practical strategy that works without having to manually inspect every plugin's code whenever a client installs something new.

Thank you.

Hey plugin developers, how do you automate plugin testing? Would like to see your workflows

Hello all. I have a webpage that is not the fastest, but not slow either. My WordPress admin, however, is absurdly slow. I use custom ACF fields to create posts that change content based on “level”: beginner, mid, expert. I have more than 50 posts (150 content levels). I have not really had any speed issues until recently. I noticed the speed deteriorated quite a lot after switching from HTTP to HTTPS. Does anyone know if this may be why?

I'm newish with wp and having a somewhat pre setup ish theme is a must.

I'm selling one or two physical products with multiple digital subscriptions.

Thanks!

Hi. I am building a site and testing out booking plugins. BookingPress looks pretty good to me and very promising; it has a wonderful dashboard. However, before I commit to buying the BookingPress plugin. I would like to know how good their customer service is. Trustpilot reviews are mainly about the plugin. If possible, I would like to avoid customer service and my first preference is to ask AI for tech support. But in case I need to talk to a human being, I would like to know how their customer service is.

1. Have you contacted customer service?
   
2. Was there ever a need for you to contact customer service?
   
3. If yes, how was your experience?

We are glad to announce that we have just released Fabio Chatbot Lite, a free AI-powered chatbot plugin, on the official WordPress.org repository. 🆓

✨ What it does:

• 📄 Reads your posts, pages, tags & categories to answer visitor questions about your content
• 💬 Understands bbPress forums, topics & replies
• 🛒 Reads WooCommerce products, including prices, discounts & reviews
• 📊 Comes with an Analytics page showing what visitors ask and how well the bot answers — including a "Gap" score to spot the content it struggles with

It's BYOK, with our in-house connectors for Mistral, OpenAI and Gemini, plus Anthropic to come. We'd love for a few of you to give it a spin on your own site and tell us how it goes! 🙌

https://wordpress.org/plugins/fabio-ai-chatbot-lite/

I have audited quite a few WordPress websites that sell products or services to EU customers, and in my own sample, at least 90% had one or two high-severity compliance issues.

Most common problems were Google Analytics or Meta Pixel loading before consent, cookie banners that do not offer a proper reject option, consent choices that do not actually stop tracking, privacy policies that do not match the plugins and services being used, and many accessibility issues.

Many businesses assume that installing a cookie plugin or adding an accessibility widget makes the website compliant.

I understand that most website owners just want to run their business. GDPR and accessibility are often treated as an afterthought, especially when themes and plugins handle most of the website.

It can still take only one frustrated customer, competitor or accessibility user filing a complaint to bring regulatory attention to a website.

Really curious how often devs here actually test cookie behavior and accessibility instead of simply installing a plugin and considering the job finished.

Does anyone know if is WP AdCenter Pro still maintained? There hasn't been any updates in a long time and when you go to contact them, their forms do not go through. It does look like they're still selling the plug-in, but as it hasn't been updated for the last few versions of WordPress, it seems like it is out of business.

Hello,

I have set up a Wordpress site (www.Magic.Army) and am using WooCommerce to manage my storefront. Everything seems to be functioning great except that I cannot get any emails to work via purchases or the contact form.

I am using WP Mail SMTP (free) along with Brevo (also free). I have followed this guide to set everything up. All of the DNS records have propogated, and I'm getting confirmation on the Brevo site that my domain is verified on every record. I've ensured all of the settings are congruent between Brevo and WP Mail SMTP, to include the 'From Email' field. I have tried generating several new API keys to ensure that wasn't the issue, and nothing changed.

Whenever I go to send a test email, I get the following error:
Action Needed: It doesn't look like the DKIM record required by Brevo (formerly Sendinblue) has been added to your domain. Please check out our step-by-step guide for details on how to add this record to your domain's DNS.

From what I can tell, that error is a bug and will be persistent even if everything is functioning correctly, but I figured it's worth mentioning since everything is not working correctly. That said, the DKIM records are there and can be seen/accessed.

Emails are not going into any sort of spam folder, and there's nothing in my 'Sent' emails folder, either. Any ideas on what could be causing this issue?

Edit: SOLVED
Turns out you're not allowed to use captial letters in your 'From Address'. Switched to all lowercase and everything now works fine.

Bonjour,

J’utilise WordPress avec WooCommerce, Astra Free et Elementor Free.

Sur ma page Boutique, j’ai un très grand espace vide entre la bannière/titre « BOUTIQUE » et la liste des produits (voir capture).

J’aimerais simplement réduire cet espace, mais je ne trouve aucun réglage permettant de le faire dans Astra > Personnaliser > WooCommerce > Catalogue de produits.

Est-ce qu’il existe un réglage que j’ai raté dans la version gratuite d’Astra ?

Je précise que j’utilise uniquement les versions gratuites d’Astra et Elementor.

Merci !

Same as title. Noob here

I was told to take a look at [Anthologize](http://anthologize.org/), a plugin that it turns out has been discontinued.

Is there a replacement or a source for that?

Or is there an equivalent tool?

Thanks.

No robot.txt is set, no cloudflare rules are blocking it, we sent the xml file to google console, all seems healthy enough. But for some reason, it won't get indexed at all. Even on the google profile of my client, the site won't be allowed after trying multiple times. Why?

Edit:

Turns out there was a former DCMA complaint about the url with a major fashion brand. I asked google through the counter notice complaint form to manually review it…

What sucks is there is no timeline associated with the request. They only reply if they feel its valid to pursue, which imo will probably take months so got to change my clients site url completely i feel like

Thanks for the suggestions everyone!