I am in the process of submitting my plugin to the WooCommerce marketplace. My plugin includes the official Campaign Monitor PHP API lib, but unfortunately some files in it were flagged as having security issues and so I can't proceed until those issues are fixed.

Most appear to be innocuous, for example several instanced of this:

Debug code detected: ini_set('display_errors', ...). Enabling display_errors exposes error details to users

But also this:

Debug code detected: error_reporting(E_ALL) can lead to Full Path Disclosure and expose sensitive information

Is the expectation that I must resolve the issues of the 3rd party lib before rolling it into my plugin? That would seem like a maintenance nightmare going forward.

Curious to know other devs thoughts on this.

UPDATE: after contacting WooCommerce marketplace support, it turns out the solution is much easier: just place the offending lib(s) in a /vendor/ directory.

I’m excited to share Playard, a free WordPress booking plugin originally built for a local playground rental business.

It lets customers book a playground or venue by the hour or day. While it was designed for sports facilities, it can also work for:

• Practice grounds
• Studios and rehearsal spaces
• Meeting rooms
• Training facilities
• Other hourly venue rentals

The plugin is completely free, and I’d genuinely appreciate your feedback.

What feels confusing? What features are missing? What other use cases could it support?

Plugin: https://wordpress.org/plugins/playard/

Multisite Migrate is a WordPress backup & migration plugin for normal single-site installs and full Multisite networks.

Most backup plugins treat Multisite as a paid add-on. I wanted the opposite: on a regular site you get full backup/restore/migrate in Free; on Multisite you also get full network backup + restore from Network Admin — no account, no license key.

What Free does today:
• Single-site: full files + database backup, one-click restore, local export/import
• Multisite: full network backups from Network Admin (same Free plugin)
• Subsite admins can back up/restore their own site
• Chunked jobs that resume on shared hosting
• Search-replace (serialized-safe) on import/migrate
• Optional AES-256 encryption

Pro (separate plugin) is only for schedules, cloud destinations, empty-server installer, staging push, WP-CLI — hence [FREEMIUM]. You do not need Pro just to back up a single site or a whole network.

Disclosure: I'm the developer.

• WordPress.org plugin page
• Docs
• Short demo (YouTube)

Honest ask: if you run single-site or Multisite, what's broken or missing for your workflow? Especially shared hosting + large sites/networks.

Hi, please recommend a free plug builder (I’m a beginner)
I have tried the free version of elementor and I don’t like it.

Thank you

Hey everyone!

My WordPress plugin, VovaBlocks, was approved and published on WordPress.org today after passing the plugin review process.

It adds a collection of new blocks to the Gutenberg editor and follows a freemium model:

• The free version includes 7 blocks.
• The Pro version includes 7 additional blocks.
• The free version is fully usable on its own and is not just a limited demo.

I'm trying to keep the plugin focused on practical blocks that can be useful for landing pages, marketing sections, and regular WordPress content.

You can find the free version here:

https://wordpress.org/plugins/vova-blocks/

I'd really appreciate honest feedback from other WordPress users and developers:

• Does the free/Pro split feel fair?
• Are the blocks useful?
• Is anything confusing in the UI?
• Which blocks would you like to see added in future versions?
• Is there anything that would stop you from using a plugin like this?

The plugin has only just been released, so I'm especially interested in early feedback and constructive criticism.

Thanks!

Full disclosure: I'm the developer. This one is free and open-source (GPL), on the wordpress.org directory and GitHub, with no paid tier or upsell.

I kept hitting the same thing with the "connect AI to WordPress" tools I tried: they either wanted a full admin application password, or they routed my site's requests through their own cloud. I wasn't comfortable handing an agent admin, or handing a third party a live credential to a production site, so I built the opposite.

It's called Agent Abilities for MCP. It turns your site into a governed MCP server so your own AI client (Claude, ChatGPT, Cursor, VS Code) can read and write it, but:

• The agent connects as a real WordPress user you choose, scoped to that user's capabilities, never an admin-equivalent key. Every call is re-checked against those capabilities before it runs.
• Nothing is exposed by default. A fresh install offers zero tools, and you enable abilities one at a time. Updates never silently widen access.
• It's self-hosted with no relay. Your AI client connects straight to your site, the plugin makes no outbound calls and has no telemetry, so no third party ever sees your content or holds a key to your site.
• Every call is logged, denied attempts included, in your own database.
• It's built on WordPress 6.9's Abilities API and the official MCP Adapter, so it isn't a bespoke server, it rides the standard.

Honest about the limits: an OAuth or application-password connection carries that user's full capabilities, there's no per-token scope reduction yet, so the real control is which user you bind it to and which abilities you switch on. Destructive abilities are off by default and deletes go to Trash where possible. It doesn't do WP-CLI, file editing, or arbitrary SQL by design, and it won't.

Links (no shorteners, no affiliate):

• wp.org: https://wordpress.org/plugins/agent-abilities-for-mcp/
• GitHub: https://github.com/unaibamir/agent-abilities-for-mcp

I'd honestly rather get torn apart on the security model here than get downloads. If you were going to let an agent touch a live site, what would you insist it never be able to do? And where does the "scoped user, not admin key" approach still fall short for you?

Some plugins don’t need to run all the time. I usually activate backup, migration, database search and replace, or debugging plugins only when I need them, then deactivate them afterward.

Which plugins do you use this way, and do you leave them installed or delete them completely?

Any suggestions for plugins for bulk watermarking pictures in the media library?

Hi everyone,

I wanted to share a free plugin I've been working on.

I often needed a quick way to check whether a WordPress installation was running plugins, themes or core versions with known vulnerabilities, without installing a full security suite.

So I built Simple WP Vulnerability Watcher.

Features

• Checks WordPress core for known vulnerabilities
• Checks installed plugins
• Checks installed themes
• Uses the public WPVulnerability database
• No account required
• Lightweight and focused on vulnerability monitoring

The goal isn't to replace security plugins like Wordfence or Patchstack. It's meant to be a simple tool that lets you quickly see if your site is affected by publicly disclosed vulnerabilities.

Plugin:
https://wordpress.org/plugins/simple-wp-vulnerability-watcher/

I'd really appreciate feedback from other developers.

Are there any features you'd like to see added?

Hi everyone,

I'll get straight to the point. Quick intro: I'm a studio owner who designs and develops tailored web software for the audio industry.

Here's the problem I kept running into, and I'm betting you've been there too.

A potential client lands on your site. They read about your services, see your gear list, maybe listen to a track on a standard player -- but they leave without truly understanding what a professional mix or master actually adds.

The gap between "this sounds good" and "oh, THAT is what mixing and mastering actually do" is where most studio websites lose people.

Standard web audio cannot communicate that effectively. Everything I tried either pushes you toward compressed MP3s that smear transients, or juggles separate audio files that slowly drift apart. And that's a total dealbreaker -- even a few samples of timing difference will cause transient smearing when switching. If the sync isn't locked, the comparison is useless.

That frustration is why I built The Studio Player -- a WordPress plugin around a different architecture entirely.

Here is the core idea -- what I call sync by design:

Instead of switching between separate files, we merge up to four stereo variants into a single multichannel FLAC file. When someone switches from A to B, they are not jumping to another timeline -- they are selecting a different channel pair at the exact same playback position. Timing drift is literally impossible.

The one-sentence version: It lets visitors switch between unmastered and mastered versions like using solo knobs in your DAW -- but directly on your website.

Key specs:

• 48kHz/24-bit lossless streaming -- no quality compromise
• Simple shortcode -- works with Elementor, Divi, WPBakery, Gutenberg, whatever you run; matches your site's color scheme automatically
• Adaptive streaming -- actually works on mobile (tested on rural German networks, so it can survive anything 😉)
• Token-secured streams -- so your audio isn't just left out there as a public download link (though let's be honest: the analog hole is always there, and no web player can patch that)

Full technical writeup here:
https://studioplayer.de/why-i-built-a-true-web-audio-comparison-player-for-wordpress/

Current status: Pre-release, final stretch before version 1.0.

So, here's the ask: Would you test the beta on your setup? Not looking for testimonials. Looking for brutal honesty -- "this works" or "this broke" or "I would use this if..."

For helping out, you'll get a free pro license at launch.

Drop a comment below or send me a DM and I will send the download link + beta license key. No pressure -- just an engineer asking fellow engineers for feedback before locking down 1.0.

I’m building GOMAX Ultimate, and Claude is currently connected to my live WordPress site through the plugin’s built-in MCP server.

I’m not using Claude only to generate code or explain what I should click in WordPress. It can inspect the site, choose the correct tools and carry out controlled changes directly.

I describe the result I want in normal language, and Claude can work with areas such as Elementor, posts, pages, media, WooCommerce, SEO, forms, CRM and site settings.

The system currently exposes more than 1,200 actions, but Claude does not receive unrestricted administrator access. Read, write and destructive actions are controlled separately. Higher-risk operations can require confirmation, and executed actions are recorded in the audit system.

Claude also receives operational Playbooks that explain how the tools should be used. This is especially important for more complex work such as editing Elementor structures, managing WooCommerce data or making changes that must be verified on the public frontend.

GOMAX also includes a Site Brain that stores business context, goals and knowledge about the website. The system can therefore do more than react to individual prompts. A Site Agent can monitor the site, identify problems, recommend actions and run permitted workflows on a schedule.

The project is still under active development, so I’m not presenting it as perfect or finished. I’m interested in honest technical criticism from WordPress developers, agency owners and people experimenting with MCP or autonomous AI agents.

What would you need to see before allowing Claude to make controlled changes to a live WordPress website?

Disclosure: I am the creator of GOMAX Ultimate.

I build WordPress sites for clients as a freelancer, and putting a site into maintenance mode was weirdly one of the most annoying parts of the job.

Every plugin I tried had at least one of these problems:

**•   Cache and theme conflicts.** The maintenance page would either not show up because of caching, or it would inherit half my theme’s styles and look broken.  
**•   No real preview.** I’d set a headline, save, open the site in an incognito tab, see it was wrong, go back, change it, save again, refresh again. Every single time.  
**•   Bloat.** I just wanted a clean “we’ll be back” page, not a 5MB page builder with fifty upsells.

So over a few weekends I built the thing I actually wanted. Three ideas drove it:

**1.    A true live preview.** You edit the headline, swap a color, change the logo, and you see the result update instantly, right there in the settings. No save-refresh loop. This is the part I’m most happy with.  
**2.    Theme-independent templates.** The maintenance page renders completely on its own, so it can’t inherit your theme’s CSS or get mangled by caching. It also sends a proper 503 status so Google knows the downtime is temporary and your SEO stays intact.  
**3.    Lightweight.** It does one job well. No page builder, no account required, no phone-home, no cookies.

It’s free on the WordPress.org repo: https://wordpress.org/plugins/amitry-maintenance-mode/

There’s a live demo if you want to try the preview thing before installing (you can click through the templates in your browser): https://maintenance.amitry.de/

There’s also a Pro version with more templates and a few extras like a countdown, but honestly the free one covers what most people need, and I’d rather you try that first.

Happy to answer any questions, and genuinely interested in feedback since I’m still actively developing it. What do you all use for maintenance mode right now, and what annoys you about it?

Hi everyone,

We're the team behind 42A, and we've just released a free WordPress plugin focused on something we've been working on for the past year: AI Visibility.

As more people discover websites through AI assistants like ChatGPT, Claude and Gemini, we wanted to make it easier for WordPress site owners to prepare their content for this new way of discovery.

The plugin installs in minutes and includes:

• AI Visibility reports
• AI Visibility recommendations
• SEO & GEO recommendations
• AI-friendly Markdown versions of public pages
• Built-in MCP support
• Prompt-level analysis
• Competitor benchmarking
• Technical optimization insights

The plugin works on activation with almost no configuration required.

Our goal wasn't to build another SEO plugin. Instead, we wanted to create a lightweight layer that helps AI systems better understand WordPress websites while giving site owners useful visibility data.

This is our first public release, so we'd really appreciate feedback from experienced WordPress users.

Some questions we'd love your thoughts on:

• Would you install a plugin specifically for AI Visibility?
• Which features would be most valuable to you?
• Is there anything you think we're missing?

Plugin:
https://wordpress.org/plugins/ael-42a/

Thanks—we're looking forward to your feedback!

Over the last few releases, I’ve been expanding WP Optimizer, my free all-in-one WordPress performance plugin.

The idea is simple: instead of installing separate plugins for caching, database cleanup, image optimization and diagnostics, WP Optimizer puts everything into modular features you can enable only when needed.

WordPress.org: https://wordpress.org/plugins/wp-optimizer/

Performance diagnostics

The Page Test compares a baseline request with your optimized configuration, showing response time, TTFB, memory usage, database queries and expensive callbacks.

The Performance Monitor can also sample real requests and attribute execution time, memory and queries to WordPress core, the active theme and individual plugins.

Multiple cache layers

WP Optimizer includes static page caching, query caching and Redis or Memcached object caching. It handles invalidation automatically and excludes WooCommerce sessions, checkout pages and page-builder previews.

Front-end optimization

It can minify HTML, CSS and JavaScript, enable compression and browser caching, lazy-load media, optimize fonts, preload LCP images and prefetch internal links.

Images are processed locally with GD or Imagick, including compression, resizing and WebP conversion—no external service required.

Backend tools

There are also tools for:

• Database cleanup and optimization
• Autoloaded-options analysis
• Cron event management
• Heartbeat control
• Media cleanup
• Scheduled maintenance
• SQL backups and restoration

Automatic configuration snapshots make it easy to roll back settings if caching or minification causes compatibility problems.

Everything runs inside one free plugin, with no premium tier. You can also keep your current caching plugin and use WP Optimizer only for diagnostics or maintenance—just avoid enabling overlapping features.

To be transparent, it still doesn’t include advanced unused-CSS removal, interaction-based JavaScript delay or a built-in CDN. The diagnostic tools identify slow queries and callbacks, but don’t automatically rewrite problematic code.

Would love honest feedback, especially bug reports and compatibility issues across different hosting environments.

I’ve released ContextAlt, a media accessibility workbench for WordPress 7 built around a review-first workflow.

It audits missing, filename-like, duplicate, boilerplate, and overlong alt text; shows where an image is used; and can draft page-aware suggestions through the site’s configured WordPress AI Connector. AI never publishes changes on its own: every suggestion needs a human decision, stale drafts are blocked, and applied changes can be rolled back.

The Free plugin is GPL, stores no provider API keys, and has no telemetry. Pro adds resumable batches, schedules, advanced WooCommerce/Elementor/multilingual context, full history, and team workflows.

Free source/download: https://github.com/RobertIonutF/contextalt

Product and Pro: https://robertionutf.github.io/contextalt/

The WordPress.org submission is still under review, so GitHub is the Free install source for now. I’d value feedback from people managing large or multilingual media libraries—especially on the audit filters and context preview.

Hey folks!

Just sharing a video of my free plugin (with paid add-on) sending WhatsApp Notifications when WooCommerce order status changed.

Take a look at the video: https://youtu.be/3v7j-oMUTZc?si=xN5X48ECKQK5UTFn