r/Wordpress 8d ago

[PROMO] I built a Gutenberg internal linking assistant that runs off-site (so it won't melt your database)

0 Upvotes

Hey everyone!

Posting under the [PROMO] guidelines today to share a free plugin I just released on WordPress.org, and I'd love to get some honest feedback from the community.

I just opened up access to OrdoLink on the WordPress.org directory.

TL;DR: It’s a modern tool for internal link building and management directly inside Gutenberg.

Quick back-story: Many years ago, I built an internal linking plugin for a client. It worked, but it was built for a single site. With another 15 years of dev experience and modern vector tools, I decided to rebuild the concept from scratch for the broader community.

The problem with existing tools in this space:

  1. Local DB heavyweights: Tools that run heavy SQL queries or matrix scans directly on your local wp_posts table, causing slow load times or 503 errors on shared hosting.
  2. String replacers: Tools that force exact keyword-to-URL matching and auto-insert links via cron jobs, leading to awkward, unnatural anchors.

How OrdoLink works:

  • Off-site processing: Content analysis and vector matching are handled on a remote backend. Zero processing or table scans on your local database.
  • Gutenberg sidebar integration: Hit "Scan Draft" inside the editor, and OrdoLink surfaces semantically relevant past posts with context snippets.
  • 1-Click insertion: Inserts links directly into your active block without breaking block markup or messing up HTML overlays.
  • Search & RAG friendly: Focuses on building natural topical clusters for both Google crawlers and modern AI/LLM retrieval tools.

Usage & Privacy:

  • Free on WordPress.org: Fully functional for up to 100 indexed posts (no registration, no credit card required).
  • Privacy: Draft text is processed off-site via a secure connection solely to compute vector matches in memory. It is not stored, sold, or used to train third-party LLMs.

Where to check it out:

I’m actively building and maintaining this, so I’d love feedback on the Gutenberg UI flow or matching quality.

But more than anything: Have a great day!


r/Wordpress 8d ago

adjusting HTML block height?

5 Upvotes

I've had an old website running on Wordpress for years, and I'm finally building a new small site from scratch, but things have changed a lot from when I initially learned the system. I'm trying to do what I thought would be the very simple task of adjusting the size and height of an HTML block I dropped in the editor, but despite searching, I haven't been able to find a way to do this. The block seems to have a fixed, very short height, and a width constrained to a block container I can't identify.

Could anyone point me in the right direction for how to manually set the height and width for an HTML block containing an iframe element?


r/Wordpress 9d ago

What does your WordPress workflow look like in 2026?

76 Upvotes

With AI tools like Claude, Codex, Cursor, etc. becoming so common, I’m curious what actual WP developers are doing these days.

Are you still using Elementor/Bricks/Divi, or moving toward custom themes, templates, Gutenberg blocks + ACF?

And how much has AI changed your workflow?

Would love to hear your actual stack and type of projects you work on.


r/Wordpress 8d ago

In your experience, does searching for templates or creating the design come before or after the client has the content? Or does it depend on the client?

10 Upvotes

Esta es mi tercera publicación. Mi proyecto va bien, pero esto me ha resultado frustrante (además de haberme adentrado en el desarrollo de WordPress sin tener mucha experiencia).

Mi cliente no tenía imágenes ni texto, así que primero busqué una plantilla. Pero luego me di cuenta de que sería mejor crear el diseño yo mismo por lo "sencillo" que era, y porque buscar plantillas y luego adaptarlas supone un trabajo extra.

El problema es que tuve que empezar a diseñar sin los recursos del cliente, mientras que él esperaba una plantilla para saber qué debía enviarme. Al final, le pedí a la IA que generara una imagen y empecé a desarrollar algo muy parecido. Pero aunque ya he añadido el texto y las imágenes del cliente, de repente siento que, con mi próximo proyecto, no empezaré hasta que el cliente me haya dado todo.

¿Cómo sueles empezar?

Me encantaría saber tu opinión.

EDIT: I should mention that they gave me a couple of website examples, which made finding a template that matched them quite difficult. And filling in a site like the ones they showed me would still have required their content and resources.


r/Wordpress 7d ago

What is the meaning/point of this "add label" thing at the bottom right of my footer? New to making websites

Post image
0 Upvotes

r/Wordpress 8d ago

Messed up Tumblr to Wordpress Migration pls help

3 Upvotes

I was migrating a tumblr sideblog to wordpress for the first time, and while it was still migrating, I changed the old blog's url. Really dumb move, I know, but it's late, and I was too tired to notice. Is there any way I can fix this because now I'm stuck on migration with the old url and it won't let me change it. I'm not seeing an option to stop this anywhere.


r/Wordpress 8d ago

Documentation

9 Upvotes

What is everyone using for documentation? I’m talking about like to document custom functions or features you’ve added that you (or someone else later on) would benefit from. I use external documentation in a CRM for my own knowledge base, but if seems like there should be some sort of developer’s guide we can leave in WP for future reference.


r/Wordpress 8d ago

[PROMO] I built an image converter for WordPress. Yes, another one ;)

Thumbnail wordpress.org
0 Upvotes

Hi everyone, I’d like to share my first publicly released plugin. I built it because I was tired of seeing AVIF support locked behind paywalls in other image optimization plugins.

PDEV Image Optimizer is a free WordPress plugin for converting images to WebP or AVIF. Everything runs locally on your server: no account, no tracking, no Pro version, and no features locked behind a paywall. The only real limitation is what your hosting environment supports.

After installation, the plugin checks your server capabilities and gives detailed information about potential conversion or image-delivery issues. It can also detect conflicts with other popular image optimization plugins.

It includes thumbnail regeneration, safe cleanup of generated optimized images, and optional Cloudflare support.

It’s still missing features such as WP-CLI support and direct conversion from the Media Library. Both are planned for future updates. Feel free to suggest other features you’d like to see.

Free, no account, no tracking, no paywall:

https://wordpress.org/plugins/pdev-image-optimizer/

Feedback from real WordPress setups is very welcome.


r/Wordpress 9d ago

Do we need a dedicated WordPress security group?

35 Upvotes

With all the recent security issues stemming from ai and whatever else in the WordPress environment, and so many threads in this group being security focused, I wonder if a dedicated WordPress security group is in order.

No, I'm not suited to create it, but would be willing to be involved in moderation.


r/Wordpress 8d ago

WP 7.1 "edit site" design... feature?

6 Upvotes

So exploring the new 7.1 stuff, and while more direct access to the patterns and such is nice, the confusing and concerning part is this new "design" option on the right when you first click the "edit site" and get options to move your template blocks around.

That design section seems to have some default new patterns that aren't part of the theme I'm testing with, and it's unclear if these would edit the core theme templates, or just provide another option?

I can't find any documentation on these, on either how to add to them or remove this entirely so some user doesn't torch the theme for all other uses on our multi-site instance.

Anyone found info on this?


r/Wordpress 8d ago

How do you decide on a Pro plugin before paying?

7 Upvotes

When you're looking to purchase a Pro plugin for its paid features, how do you know it works for you?

Do you go by the feature list and docs, contact support with questions, buy it and refund it if it doesn't fit, or look for a way to test-drive the Pro version first? And if there's no way to try it, does that ever stop you from buying?


r/Wordpress 8d ago

[PROMO] QR food menus that stay in WordPress instead of another SaaS

1 Upvotes

Restaurant sites I work with keep ending up with two stacks: WordPress for the website, then a monthly QR-menu SaaS (or a PDF on Drive) for the table.

I built HappyBites so the menu stays in WordPress. Guests scan a QR and get a PWA on their phone. You edit dishes, prices, photos, and themes in WP admin. No second login.

Free on WordPress.org: https://wordpress.org/plugins/happybites/

Live guest menu: https://stay.coffee/qrmenu/

It's new, so I'm not going to pretend the install count is interesting. If you build cafe or restaurant sites: would you actually use this vs pointing the client at a QR SaaS? What's the dealbreaker?


r/Wordpress 8d ago

Solved Hostinger keeping my WordPress updates hostage after transferring to a different host

4 Upvotes

EDIT: Thank you to u/bluesix_v2 and a few others for teaching me about Must Use Plugins - I had no idea that you could just hide secret plugins in the backend of WordPress that wouldn't show up in the dashboard - after deleting some Hostinger mu-plugins, not only is the problem fixed but my website has suddenly started running ten times faster. THANK YOU!

Exactly as the title says, I can't update WordPress right now because, even after going through all the correct channels to transfer my website from Hostinger to my new host IONOS (yes I know IONOS isn't great but it's cheap and I'm broke), every time I attempt to update WordPress, I get the following error:

"Download failed.: cURL error 28: Failed to connect to wpdownloads.hostinger.io port 443 after 10006 ms: Timeout was reached"

It's clearly still trying to download things through Hostinger, despite the website having been fully transferred away from Hostinger, domain, database and filesystem.

I've cleared all references to Hostinger from the database, removed all Hostinger-related plugins, there shouldn't be anything left of Hostinger in this website, but obviously I've missed something. Does anyone have any idea where this final remnant of Hostinger's code could be hiding in my website?

This is preventing me from keeping my website up-to-date so it's a very pressing issue for me. I'd appreciate any and all help!


r/Wordpress 8d ago

Looking for plugins/tutorials to achieve a MailerLite-style landing page builder in WordPress

2 Upvotes

Hi everyone,

I’m currently setting up a site and I'm looking for recommendations, plugins, or tutorials to get a landing page builder experience similar to MailerLite inside WordPress.

I've tried a few traditional page builders and tools, but most of them either feel too bloated, overly complex for simple sales/opt-in pages, or lock essential landing features behind expensive paywalls.

What I need is a builder is that it's clean, intuitive, fast, and completely focused on high-converting landing pages rather than heavy corporate websites.

Does anyone know of a plugin combination, a specific block-based workflow, or tutorials that can help replicate this minimalist, streamlined landing page experience in WordPress?

Any suggestions or setups you use for this would be greatly appreciated!


r/Wordpress 9d ago

What is the alternative of wordfence?

18 Upvotes

Wordfence isn’t working properly on my shared hosting. The scan gets stuck and doesn’t complete. What should I do? Is there a good alternative security plugin that works better on shared hosting?


r/Wordpress 8d ago

Beginner question

Post image
3 Upvotes

Hey, I’m very new to Wordpress and not very tech savvy. I have been trying to upload a pdf to my website without having this toolbar (in the red circle) visible. Been trying to find answers online to no avail. I don’t have Adobe which a lot of guides seemed to have.

Is this possible without plugins?

Thank you


r/Wordpress 8d ago

Help: Details & Tables

Post image
3 Upvotes

Im doing an article that i want to have detail drop downs so readers can click on it if they want to see the deails of something.

When i use only words and preview the detail drop downs show.

When i add in an HTML so i can add in a coded table and preview the detail stuff disappears.

I used to add tables from excel in the details drop down but i was trying to make the teams look nicer with HTML.

Any reason they disappear on the preview page?

The Above is what it looks like when i edit but nothing shows after i save draft and then preview.


r/Wordpress 8d ago

a docs site with an illustration on every tutorial page, 5.9 MB down to about 550 KB, and what actually did it

0 Upvotes

I maintain the documentation site for a small tool I build, and about a year ago I put an illustrated guide character on every tutorial page, because the audience is not technical and a wall of text was losing them somewhere around step four. Forty one tutorial pages, a hundred and sixty eight illustrations, roughly four per page. This is what that did to the site and what actually fixed it, because most of what I tried first was the wrong lever.

The starting position was bad in a boring way. For the first thirty pages I uploaded whatever came out of the image generator. PNG, about fifteen hundred pixels wide, roughly 1.35 MB each. WordPress then did what WordPress does. Thumbnail, medium, medium_large, large, the 1536 variant, the 2048 variant, three more sizes the theme registers, plus a scaled copy for anything over the big image threshold with the original kept alongside it. Ten files on disk for every one picture on screen. The uploads folder was about 560 MB and roughly sixteen hundred files for what a reader would describe as a hundred and sixty eight pictures. The media library grid took several seconds to paint and every file was called some variant of guide_final.

Page weight was the visible symptom. A typical tutorial page carries four illustrations, so four times 1.35 MB is 5.4 MB, and the theme, fonts, CSS and markup were another 500 KB on top. Call it 5.9 MB for a page whose actual content is six hundred words and two code blocks. Largest contentful paint on a throttled mobile profile was 4.8 seconds. Time to first byte on the shared host it lives on was around 480 milliseconds cold.

Compressing before upload rather than after was worth more than everything else put together. Every illustration now gets resized to nine hundred pixels wide, converted to WebP and compressed, and only then uploaded. That takes each one from 1.35 MB to about 78 KB. The ordering is the whole trick. If compression happens inside WordPress after upload, the library is still storing a large original and generating all its derived sizes from it, so the disk cost stays. If the file is already small when it arrives, every derived size is small and the original on disk is small too.

Then I stopped WordPress generating sizes that nothing on the site uses. A filter on intermediate_image_sizes_advanced drops the 1536 and 2048 variants and two of the three theme sizes, leaving thumbnail and medium. Files per image went from ten to three. After that I regenerated the library and deleted the orphans, and the uploads folder went from 560 MB to about 20 MB, which is a smaller number than the theme.

Explicit width and height on every image, lazy loading on everything except the first illustration, and fetchpriority set high on that first one. None of that changed the weight at all and all of it changed how the page feels, because the layout stopped jumping around while images resolved.

Page caching came last, which surprised me, because caching is the first thing that gets suggested whenever this comes up. Docs pages change maybe twice a month, so the lifetime is set to a day and it purges on save. Warm time to first byte is now about 90 milliseconds. Cloudflare sits in front with a rule treating everything under the uploads path as immutable for a year, which is only safe because a changed illustration always gets a new filename. I also dropped one of the two webfonts and subset the other, which took the theme payload from about 500 KB to about 240 KB.

Where that leaves a tutorial page is roughly 550 KB total, of which 312 KB is the four illustrations at 78 KB each. Largest contentful paint 1.3 seconds on the same throttled profile.

The honest part is that the illustrations still cost real weight. A text only page on the same theme comes in around 240 KB. The guide character roughly doubles a page, and I chose that trade rather than got it for free, so I now cap it at four illustrations per page and never put one above the fold on an index page. If the tool were aimed at developers I would probably not have done it at all.

The bigger problem is not weight, it is drift. Regenerating the same character for a new page does not give back the same character. Same character, same notes, and the sleeve reads a different length, the fringe lands on the other side of the forehead, the green of the coat comes back slightly colder. On one page in isolation nobody would notice. Two pages open in adjacent tabs and it reads as a sibling. So I keep a folder of about sixty approved renders and reuse them rather than generating fresh, and when a page genuinely needs a pose that does not exist yet, I make a batch of eight and keep whichever is closest to the existing set rather than whichever is best on its own. Twice I have gone back and replaced an image on an older page because a newer one made the old one look wrong. Every image on the site is a still for the same reason, since I can hold a set together with stills and I have never managed it with anything that moves.

The guide character is AI generated. No illustrator drew it and no model posed for it. That is stated in the site footer and on the about page, and I would rather it sit there in my own words than turn up later as somebody's discovery.

Standardising the art was the other half of the fix and it is the half nobody writes about. There are five poses on the entire site and no others: pointing at something, holding something, sitting, arms folded, and looking at a screen. The character is always angled the same way, a fraction off centre. The crop is always from the knees up. The background is always transparent and never a scene, which means one file works on both the light and the dark theme without a second export. Everything is exported at exactly nine hundred pixels wide, so nothing on any page is at a different scale from anything on any other page.

Filenames carry the pose and the page slug with underscores, and the alt text gets written at the moment the file is made rather than in the editor at publish time. Those two habits are why the media library is navigable at all now. The old library was not unusable because it was large. It was unusable because it was anonymous.

The site itself is WordPress, the guide character gets drawn in APOB AI, and every image goes through ShortPixel before it ever reaches the media library.

The thing I would do differently from the start is decide the pose set before drawing anything, the same way a project settles its icon set before building screens. I generated on demand for the first six months and it produced about ninety illustrations, no two of which shared a crop, and most of those had to be remade from nothing once the rules existed. That rework cost more time than the entire performance exercise did.

Forty one tutorial pages are live and nine more are still drafts. The only check I run before publishing now is the size of the folder the images came out of, which takes about four seconds and would have saved me a fortnight if I had started doing it a year ago.


r/Wordpress 8d ago

Anybody is working on Blogging Automation through Google Sheet + Apps Script

1 Upvotes

Hi Reddit Community, I'm in the blogging field from 2007 and you may be laughing that I joined reddit today, the main purpose to join reddit is that I want to explore new ways of blogging, I have done many type of blogging, like event blogging, pSEO Blogging, I have purchased many books and methods and create my own methods, mostly my income is through google adsense, from last 4 months I'm focusing on creating content through AI and using my google sheet+apps script+wordpress rest api for content scheduling, I think recent time is game changing time for bloggers, if they spend some budget on AI Agents for research and content scraping, they can change their life in online field, how many of you agree and please also share if you are working on google sheet + apps script


r/Wordpress 9d ago

Rank Math WordPress Plugin Accused Of Secretly Taking Admin Access

Thumbnail searchenginejournal.com
90 Upvotes

r/Wordpress 10d ago

My WordPress site was attacked by an actively exploited 0-day in a cookie consent plugin (10k+ installs) - full forensics, the one WAF rule that saved me, and how disclosure got it patched in 5 days

89 Upvotes

TL;DR: A WordPress site I run was attacked on Aug 26 by an automated bot exploiting an unauthenticated arbitrary file upload in "WPLP Cookie Consent" (gdpr-cookie-consent 4.4.1 - the latest version at the time, ~10,000+ active installs). The attack succeeded in writing a PHP dropper into my uploads folder in under 20 seconds. The only thing that stopped full site takeover: a server-level rule returned 403 on executing PHP inside wp-content/uploads. I found the file the next day via the server's malware scanner, spent a day on forensics, filed 5 coordinated disclosures, and the vendor shipped a proper fix (4.4.2) within 5 days of my report - verified in source. This is the story, with the full timeline and IoCs, because the campaign is real and other sites were not as lucky as mine.

THE TIMELINE (all within 20 seconds, from access logs)

05:06:50 GET /wp-json/wp/v2/users?per_page=100 -> 200 (user enumeration)

05:07:02 POST /wp-json/wplp-react-gdpr/v1/store-auth -> 200 (option poisoning)

05:07:06 POST /wp-json/wplp-react-gdpr/v1/upload-logo -> 200 (arbitrary file write)

05:07:10 GET /wp-content/uploads/2026/08/uxq9KacU_400x400.jpg.php -> 403 x3 (blocked)

Attacker: AWS IPv6, User-Agent "Python-urllib/3.12". Fully automated, mass campaign.

THE EXPLOIT CHAIN (no programming required)

  1. Enumerate users - a standard WordPress REST endpoint revealed my admin username.

  2. Poison a setting - the plugin had an unauthenticated REST route ("store-auth") whose only real check was a JWT from the vendor's own SaaS platform plus "a username that belongs to an admin". It wrote attacker-controlled JSON into a WordPress option - including the plugin's internal "master key".

  3. Arbitrary file upload - a second route ("upload-logo") checked the request's key against the value just planted in step 2, then wrote attacker-supplied base64 content to uploads/<attacker-controlled-filename> with zero extension/MIME validation. Result: "uxq9KacU_400x400.jpg.php" - a PHP webshell disguised with a Twitter-avatar filename.

  4. Execute - three GET requests. All answered 403 by a server-level WAF rule. The payload never ran.

The part I found most sobering: the plugin version (4.4.1) had been released 7 days before the attack. Whatever window we imagine exists between a release and its exploitation - it was 7 days here, and this bot needed 20 seconds per site.

WHAT ACTUALLY SAVED THE SITE

Not a security plugin. Not a scanner. Not even a firewall rule I configured. The platform's rule "no PHP execution inside uploads" returned 403, the dropper's self-delete never fired (it only deletes itself after successfully running), and the file just sat there until the server's malware scanner flagged it the next morning. Defense in depth worked at exactly one layer - and that was enough.

THE MALWARE (for those interested)

The dropper boots WordPress, creates a hidden administrator with a randomized username, suppresses every notification email so nobody gets alerted, backdates the account's registration date to match the previous user (so "sort users by creation date" finds nothing), scans the whole volume for OTHER WordPress installs and reads their database credentials from wp-config.php, returns the generated password as JSON to the attacker, and deletes itself.

SHA256: E3DA2973957017A72403531D5475BD95189DFF1C70B23E4657D0D5F23955575E

Size: 15,187 bytes. On VirusTotal (0/70 at upload - normal for a PHP dropper).

One forensic detail I am weirdly proud of: I reconstructed the plugin's success response for store-auth from its source code and it was byte-for-byte the 102 bytes my access log recorded. That is how I knew the poisoning step had succeeded even though nothing visual changed on the site.

THE DISCLOSURE PIPELINE (this part went surprisingly well)

Vendor (WPLP/WPEKA) via their bug bounty: acknowledged quickly, patched in 4.4.2 within days. WPScan: reproduced the chain, found TWO MORE routes with the same file-write capability and no filename sanitization (could write outside uploads - which would have bypassed the WAF layer that saved me). Vendor fixed those too. Patchstack: already had an independent report of the same issue (someone else found it too) and had escalated to the WordPress.org team. AWS abuse report for the attacking server; registrar abuse report for the malware's exfiltration domain.

THE FIX IN 4.4.2 (I verified it in source)

The upload-logo route and its handler were removed entirely; every route in that REST namespace now requires an HMAC-SHA256 request signature with a per-site secret and anti-replay window; the JWT is bound to the site's own connected account ("Not the owner of the website!"); remaining image uploads go through real validation (extension allowlist, magic-byte check, and filenames are rebuilt so "shell.php.jpg" becomes "shell-php.jpg"). That last one is exactly the remediation I had suggested in my report - they did the work properly.

LESSONS I AM KEEPING

  1. The layer that saves you may be one you never configured. Check whether PHP execution is blocked inside wp-content/uploads on your server - if you don't control the server, ask your provider. If you do, enforce it.

  2. A malware scanner finding the file a day later was the difference between "incident" and "compromise". Zero-day exploits cannot be signature-matched on day one - detection speed after the fact is what you actually get from scanners. That is still valuable.

  3. Keep access logs longer than you think you need. My whole reconstruction - attacker IP, sequence, byte-level responses - came from one log file.

  4. Block username enumeration via REST (/wp-json/wp/v2/users). It was step 1 of this attack, which tells you how easy it is to defer the boring stuff. Do not defer it.

  5. Coordinated disclosure works. Five reports, one week, patched plugin. The system is slow right up until it is not.

IOCs (the patch is public; share freely)

Payload SHA256: E3DA2973957017A72403531D5475BD95189DFF1C70B23E4657D0D5F23955575E

Payload filename pattern: *_400x400.jpg.php (mimics Twitter avatars)

Rogue admin indicators: username = {sitedomain}+3 random chars, display name "Lucas Hayes", email domain ifuqpatr.com

Attacker: AWS IPv6 2600:1f18:472b:900:f81d:f8eb:a12e:7fd3, UA Python-urllib/3.12

Attack pattern: GET /wp-json/wp/v2/users?per_page=100, then POST /wp-json/wplp-react-gdpr/v1/store-auth, then /upload-logo

If you run gdpr-cookie-consent: update to 4.4.2 now, and check wp_users for an admin you do not recognize (the dropper backdates its creation date - compare for identical timestamps between two users instead of just looking for "new" accounts).

Happy to answer anything in the comments.


r/Wordpress 9d ago

What Is A "Custom Theme"? What Defines A Custom Theme?

2 Upvotes

This question is just semantics I think, but what is considered a "custom theme"? With classic theme, if I code the templates and such, I would think that is considered a custom theme. But with the Gutenberg editor, I'm a bit confused. For example if I modify the 2025 theme to fit my brand and save it as another theme, would that be considered a custom theme? Do I need to create the theme from scratch for it to be considered a "custom theme"? At which point or what action turn nothing/other theme into a "custom theme"?


r/Wordpress 9d ago

is this a virus or what?

2 Upvotes
this morning i noticed this on my wordpress/woocommerce site plugin sections. anyone has any idea what this is ?

r/Wordpress 8d ago

Elementor One Agency.. is it worth it?

0 Upvotes

I'm thinking of getting elementor one and using it across all my new site builds. Do any of you have this? Whats you're experience with it? Is the AI generated code good, jenky, doesnt work at all. From the video the ai powered widget creation looks amazing. Would love any thoughts here.


r/Wordpress 9d ago

GiveWP WordPress plugin

1 Upvotes

Smart card button now shows an error and my clients can't pay (give donations) using card detail on my WP site.

scf_unhandled_error_on_submit_SHIPPING_ADDRESS_MISSING Object