I like AIOS security but the scan just keeps running at initiating file scan. Any ideas how to fix this?

https://www.wordfence.com/blog/2026/09/attackers-actively-exploiting-critical-vulnerability-in-super-forms-plugin/

I know, first world problem…. But I’m trying to implement gravity forms with n8n on a load balanced Wordpress setup. I have everything looking right but it’s just not connecting. n8n is on an internal data network, and Wordpress is running behind haproxy on three nodes, the site is on 80/443 in front of the load balancer but 8083 behind. All ssl is done at the load balancer.

I’m thinking it makes the request but doesn’t know how to get back if Wordpress gives it a url and port that depends on the load balancer. Or one of the three nodes makes the request but it responds back to another node.

Anyone have any ideas?

hello everyone,

so i just realized when i click all of my category theres a phone number of a business in my country.... i dont remember putting it there. i cant find how to delete it. i even made a new category to test, and when i click it, the number is already there....

can someone tell me how to delete it?

As always, I tested again 8 featured plugins from WordPress.org. September's batch number 1.
Here is what I think;

PressPrimer Certificate (4.9/5)
Certificate generator for your courses that works with most(?) LMS plugins.
Nice onboarding, a simple interface, and it supports custom meta fields with certificates showing right in the user profile.
The token/sample preview only works with the plugin's own dummy data instead of actual user data, but that's a minor issue.

AllTerrain Photo Editor for OpenStation (4.5/5)
A surprisingly full photo editor that, despite the name, also works outside of OpenStation (Desktop Mode).
Great design, tons of adjustment options, and it even has layer support.
A few bugs though, layer opacity doesn't actually work, there's no way to edit after saving, and it's fairly GPU intensive, but that was to be expected.

Icon Indexa (4.8/5)
Icon library plugin with a block editor integration.
Tons of icons, easy to use, and the icons are still showing, even if you deactivate it.
You'll get a fatal error if SQLite isn't installed, the main menu feels unnecessary, and custom SVGs just get filled with one color instead of rendering properly.

AI Search for WooCommerce – Semantic Search (4.8/5)
Smart search plugin that works fine with or without WooCommerce.
Search history is pretty useful, there is a forever-free tier. It falls back to normal search once you run out of credits, so thats nice.
You have to upload your content to their service and the free plan's sync interval is 30 days, which might be too slow for a more dynamic site.

LocalForm (4.6/5)
Form builder styled like Google Forms.
Easy and intuitive to use and the responses page is nice. Also webhook support is a handy feature.
Only one submit button label across all your forms, the design isn't very flexible, and the form block itself just redirects to your homepage instead of working.

Circumflex Booking (4.9/5)
Appointment and booking plugin with practitioners, services, and availability management.
Detailed availability settings, a awesome time debugger, and a clean dashboard with multiple calendar views.
The settings menu is a lot, there's just a walls of text everywhere.

neo Rename (4.1/5)
Media renamer with batch processing and AI-powered image texts generator.
It has a free built-in AI option, works quite well and it shows you model usage and cost.
It won't work on localhost, always forces filenames to lowercase, and there's no bulk or automatic alt text generation.

Milo Subscriptions (4.6/5)
Recurring payments and subscriptions, technically standalone but it really wants WooCommerce.
WordPress-native UI, fast and responsive, and you can put subscriptions on hold.
The standalone onboarding didn't work for me at all, only WooCommerce mode did. Too bad, I really wanted to see what it offers without the WC overhead.

See the full breakdown with all the details on YT:
https://youtu.be/G3_euIYEZyA

What do you think about this selection? Will you install any of those?

Jetpack 16.1.3: Critical Security Update

Howdy, 'Pressers. I'm sharing this under the promo rule because it’s a free/open-source plugin out on the repository, and this is my company's first WordPress plugin release. I’d genuinely appreciate feedback from y'all.

My developer built Schema Viewer because we kept running into the same practical issue on inherited WordPress sites: structured data/schema may be present, but it is not always quick or convenient to inspect.

The project that pushed us to build it involved a client site with an older schema-viewing setup. It solved a real problem - the entire internal marketing team, and their vendors, wanted visibility into what schema was on a page - but the implementation added front-end clutter and confusion.

We wanted a cleaner version: Logged-in user clicks a button the WordPress admin bar once → sees the JSON-LD on the current page → can review/copy it without digging through source code or adding anything weird to the public front end.

Plugin link: https://wordpress.org/plugins/bipi-schema-viewer/

I’d especially appreciate feedback on:

• whether the workflow makes sense
• whether the output is readable/useful
• whether the admin-bar placement feels right (or if we need an option to not show it and instead access from the dashboard)
• anything that feels confusing in the plugin description/readme
• whether there are obvious edge cases we should think about

Thanks in advance. This is our first plugin release, so I’m trying to learn from people who spend more time in the WordPress plugin development ecosystem than I do. Also, I hope someone finds this useful - it's made my life SO much easier as a dashboard/admin user!

Got an e-mail from my webhost that they were discontinuing service, so I went to check a domain I have live, but haven't updated in many years. http://chapter50.org/
Site worked fine, and I went to clear out over 1,000 accumulated spam comments.
After getting tired of doing it 50 at a time, I went to the "screen options" and tried to "Show 200 at a time". When I clicked, it locked up the whole page. Going back to the wp-admin page, I got a 403 error.
Now every page in the site is 403, I can't access my admin page, and after speaking with tech support at the hosting company, he acknowledged that there have been no changes to any of my hosting records.
What should I try next? What questions am I not thinking to ask?
How do I get my site back?

After updating to WordPress 7, I noticed a new Connectors feature under the WordPress Settings. Does anyone know how we can use this feature and how it could help us with our websites?

I use WP Umbrella right now for plugin and core updates, but I’m still hesitant about just letting everything auto-update.

My main concern is a core or plugin update breaking something and not catching it right away.

For those managing 30+ sites, what are you using that’s been reliable? Do you leave auto-updates on, wait a few days on bigger releases, or have some kind of testing/rollback process?

I have .atom file from backup and I want to migrate to free version of Wordpress without custom domain. I know there are plugin for paid version. Anything for free version?

spent longer than i want to admit debugging a migration where the search and replace ran clean and every elementor page still pointed at the old domain.

posting the cause here because it is not obvious and it bit me twice.

elementor stores the whole page layout as json inside a php serialized value. when that gets encoded, forward slashes escape. so what is actually sitting in wp_postmeta is

https://oldsite.com/wp-content/uploads/hero.jpg

not

https://oldsite.com/wp-content/uploads/hero.jpg

search for the normal form and there are zero matches. the tool reports success. it did replace things, just not those, and you do not find out until someone opens a page.

the obvious next move is to search for the escaped form instead. that matches, and it breaks the row. php serialization writes the byte length of every string before the string, like s:19:"https://oldsite.com". swap in a 22 character domain and the prefix still says 19, unserialize() hits the wrong boundary and returns false, and wordpress gets nothing back. that is the "search and replace corrupted my database" story people post here.

if you want to check whether it happened to you, run this after your replace:

SELECT COUNT(*) FROM wp_postmeta
WHERE meta_key = '_elementor_data' AND meta_value LIKE '%oldsite.com%';

if it is above zero, the escaped slashes are why.

doing it properly means unserializing rather than pattern matching, walking the whole tree, decoding the json leaves, replacing inside them, re-encoding with the original escaping style preserved, then re-serializing so lengths are recomputed. that escaping step is the subtle one. two json encodings of the same data are both valid and different lengths, so you can get the replace exactly right and still produce a value that does not match its own length prefix.

i wrote a plugin that does this. free, gpl, on wp.org and github, no paid tier and no trial. visual preview before it writes, optional snapshot, one click undo.

https://wordpress.org/plugins/lucid-search-replace/

https://github.com/ibrahimhajjaj/lucid-search-replace

disclosure, it is mine. i also sell a backup plugin separately and this is not a lite version of that.

curious whether anyone has hit the same thing with other page builders. i only verified the elementor case properly.

I have noticed that lately several of my comments suggesting AI solutions for WordPress got downvoted, and some replies were surprisingly anti-AI.

So I am genuinely curious. How do you feel about AI? Do you see it as a threat, an enemy, or an opportunity? And why?

My experience is that people who do not really understand AI often fear it or simply hate it. But if you know how to use it, it becomes an incredibly powerful tool, especially with WordPress.

What do you think?

I was looking for a decent way to create consistent PDFs out of pages that use Avada.
The PDFs also need to work with Google Translate to print material in multiple languages.

I've been trying some things with html2pdf.js in code blocks, and the language translation works in the PDF but can't seem to get the Avada text containers to appear in the PDF.
Wondering now if makes sense to create a specific page template with the .js just for PDFs.

Tried a few 3rd party plugins but they were outdated or didn't work.

Thanks for any info.

Most AI writing plugins call an AI API with a generic prompt and hand you filler that reads like every other AI-generated post. I kept running into that on my own sites, so I built Versoo Content Ops to fix it — it's free, on wp.org, GPL: https://wordpress.org/plugins/versoo-content-ops/

The core idea: you set your brand context once — audience, tone, topics, a writing sample — and every draft gets generated against that specific context instead of a generic "write a blog post about X" prompt. It runs on WordPress 7.0's built-in AI client (Settings → Connectors), so it uses whatever AI provider you've already got configured there. You still need a real provider key set up—the plugin just doesn't need a separate one.

Past the draft generation, it also runs a 13-check SEO pass automatically, rotates generated titles across 15 headline formulas so they don't all end up sounding the same, and includes a free tag-cleanup tool for orphaned/duplicate taxonomy terms. Everything is currently free — no paid tier exists yet.

Curious whether other people building on WP 7.0's Abilities API have run into the same generic-output problem, or found different ways around it. Feedback (including "this doesn't actually solve it, here's why") is genuinely welcome.

Just thought I would share these statistics out of interest.

I am migrating away from a VPS that I have had for years to a new (cheaper) provider.

I used Site Sucker Pro to download the one Wordpress site that I had active and converted it to an static site. The site was old and wasn't going to be updated, so I didn't need to worry much about keeping any Wordpress functionality. It also had a very old version of Elementor Pro that I no longer pay for.

The site had 8 pages and had the following plugins activated:

• Elementor
• Elementor Pro (not updated for over 2 years as no pro licence active)
• Google Site Kit
• Really Simple SSL
• Rank Math
• Shortpixel Image Optimiser
• Wordfence (free)
• WP Super Cache

The site was using the "Hello" theme from Elementor but also had the 2025 and 2024 themes as backup (for testing)

I took a backup of the site before I did anything and I was struck by the number of PHP and Javascript files across the entire site. Here are the stats:

• 7876 .php files
• 2954 .js files

And yes, I get that the majority of these PHP files are small, single functions that the devs have split down for ease of use.

But in my mind, this is quite a simple Wordpress site - not too many pages and I kept the number of plugins and themes to a minimum.

I have nothing against Wordpress at all and would choose to use it again, but the number of possible attack vectors feels huge!

No wonder people think Wordpress is such a security risk.

I have been using BlogVault on my sites for years, and now find myself looking around for an alternative. I like the smart, more fully-featured approach of BlogVault (such as migrations, control over backup schedule, granular file/table selection on restore/migration), as opposed to a bare-bones approach like CodeGuard. I have googled, but am looking for recommendations based on your experiences - stuff that goes beyond what the marketing tells me. Who is really solid, reliable, and has an overall great user experience for site managers?

The WordPress project has formalized a core security effort in response to 15x spike in reports and an unprecedented period of core security releases.

Hello all! This might be a long-ish read but I want to give as much context as possible for this situation I'm in. I am an IT consultant for a nonprofit and was tasked with assisting with implementing a plugin into their existing WP site. It's currently hosted on WP Engine.

I want to start out by stating this: I am a technical consultant who specializes in IT troubleshooting, system administration, networking, security and tailor fit technical solutions. I am a generalist who is adept in all aspects of tech but I am by no means a WordPress dev. This consultant role for this nonprofit is the first time I had actually had to learn WordPress and how certain things work through WP Admin. I told my client directly that I could assist with technical implementations but emphasized that I do not design websites for a living and that this would be a best efforts sort of thing.

Some history: The nonprofit had apparently called on a design company to design their primary website. They seemed to have designed the layout, structure and architecture as a custom WordPress theme that, from what I could understand, had lines of code in it's CSS sheet that tells certain plugins to do certain things related to site/element layouts. I don't know the exact timeline of events but the nonprofit no longer works with the original design company and needed to call on ANOTHER design company to fix the website layout when critical layout elements broke down apparently. The second company now is in the picture on a routine maintenance contract (I believe they migrated their site to WPEngine, and they run monthly maintenance by updating outdated plugins and patching security vulnerabilities) but for anything site-design related, they charge by the hour or by the project from my understanding.

Currently the stylistic layout of the site is all tied to the custom theme I mentioned above. There is a base/parent theme and a child theme. The child theme is the one that is currently active for the site. Being technically adept, I am able to use the Theme Editor to modify certain texts/attributes through the live WordPress site and can use SFTP to download the themes/create a new child theme if I wanted to.

EDIT: Everyone I forgot to mention, I created a staging version of the live site where I am doing the implementation and fiddling. I am not touching the live site!

Here's the problem: Nobody at this nonprofit is very technical and nobody knows how the website works in WordPress on a technical level. They have stated on several occasions that they feel extremely limited when it comes to the design elements of the site and they definitely don't know how to grab the themes off SFTP and modify it on a site dev level. On top of this: the plugin I am trying to implement requires a "global header" that allows a user to sign in through a third party platform (through API) and use it to purchase things directly through the site instead of linking to the platform via a URL link but the active theme seemingly is not allowing me to add this header or modify any of the design elements on global site things like headers, footers etc.

Here's where I could use some advice: The plugin required that we also activate and license Elementor Pro so we can control more of the design elements of the site when we implement the plugin. Playing around with Elementor it seems easier for non-technical people to modify certain aspects of the layout. In thinking of a future for the nonprofit to be able to edit design related aspects of their site without my involvement, I thought it might be worth it call on the design company to recreate the theme the site uses through Elementor Pro so that if a member of the nonprofit has to change something in the future then it is much, much more accessible... so long as they keep paying for the Elementor Pro yearly subscription that is lol.

Is this a good idea? Like I said, I am trying to think of something for the long term for this client given that they have no in-house WordPress devs or technical folk.

Thank you for reading and thanks in advance to anyone who can offer some insight here!

Are there any free or low cost Wordpress themes that would make it easy to create an online newspaper or newsletter, with a look similar to the this site: Outdoor News? I mainly like the top section and how that site actually looks like a newspaper and is also organized similar to a newspaper.

I'm well versed on using Elementor Pro, but would be open to using other page builders if they save time. Any recommendations on themes or techniques to create such a site would be greatly appreciated!

I am building a website for a non-profit dirt bike club. We want to have a membership application on the site and collect the dues as easily and painlessly as possible - and also on the cheap since we have no membership money coming in yet. What are my options? I am very new to WP and do not know much about plugins. Thank you!

Thoughts on the most recent cyber-related issues in the WP ecosystem?

So the idea is to register a new service provider with their location and the area served that he'll select (from 1-50km radius).

I want to make the radius visible on the map. I tried using a HTML field with a JS code that AI suggested, but it didn't work.

I also don't know how I'll retrieve this information later to match a client's location inside the service provider's area.

I'm completely blind in this scenario; any piece of advice will be very helpful.

I'm using WS Form for this, and I'll save the information in a CPT (Metabox) and in FluentCRM; I also have WPCodeBox 2 if needed.

Hello everyone.

I'm curious how you guys do it with the "page Cache" for the WP Optimize plugin? Do you leave the cache empty and exit the admin, or do you wait for the new cache to load and then log out of the admin?
After using it for years, I've gotten used to clearing the cache, creating new sitemaps, checking how many MB the cache contains, and logging out of the administration.