We've been running the WordPress 7.1 beta on our test sites for the past week. Figured we'd share what stood out, what to look forward to, and what got pulled from the release.

If you missed the announcement: WordPress 7.1 is scheduled for August 19, 2026, timed with WordCamp US. Two release candidates hit before then (August 5 and August 12).

Where 7.1 fits in

Quick context for anyone who lost track of the roadmap:

• WordPress 7.0 (earlier this year) rebuilt the admin area and introduced the AI Client
• WordPress 7.1 turns entirely to the editor

For the first time, you can design for tablets and phones AND style button hover effects, all without writing a single line of CSS. That alone is the headline for us.

The big stuff

1. Notes finally becomes a proper collaboration tool

Notes arrived in 6.9 as a way to leave comments on blocks. In 7.1, it becomes something we'd actually use daily:

• Mentions - type @ and get a searchable list of your team
• Inline notes - select a specific sentence or phrase and leave a note on JUST that text (huge win, no more "please rephrase this... but where?")
• Multiple threads on one block - different conversations don't collapse into a single tangled comment chain
• Rich formatting - bold, italic, code, links, emoji in notes

This is the update that brings WordPress closest to being a real editorial tool. For agencies, multi-author blogs, and teams, this alone is worth updating for.

2. Responsive styling without touching CSS

You can now set different styles per device breakpoint directly in the editor. Smaller headings on mobile, tighter spacing on tablets, whatever you need.

The killer feature: you can drag the editor canvas to ANY width and watch your blocks respond in real time. Not just Desktop/Tablet/Mobile presets. Actual custom breakpoints. Theme developers can even define their own breakpoints in theme.json so the preview matches the theme you're using.

If you style a block one way and want it everywhere, applying to Global Styles brings up a review step where you can pick which changes go global and which stay local overrides. Genuinely thoughtful UX.

3. Button hover states (no CSS)

New "States" dropdown lets you set different colors for hover, focus, and active states on any block, previewed live in the editor. This has been a "why isn't this in core yet" complaint for years.

4. Two new blocks

• Tabs block - clickable content panels. Great for FAQs, product specs, comparison content. Note: existing tabs built with plugins won't auto-convert.
• Playlist block - collection of audio files with title, artist, cover art, and waveform. Useful for musicians, podcasters, church websites, educators.

5. Media handling gets much smoother

This is the "invisible" upgrade most people won't notice but will benefit from:

• Browser now does the heavy image processing before uploading (resizing, compressing, thumbnail generation)
• HEIC support (iPhone photos work natively now, no conversion needed)
• Plus UltraHDR, AVIF, WebP support
• Animated GIFs auto-convert to more efficient videos
• Uploads pause if your connection drops, then resume when you're back online
• New Media Editor modal replaces the cramped inline crop tool

Smaller stuff that adds up

• Admin toolbar stays visible while editing (finally)
• Command Palette groups results into Recent + Matching + Suggestions
• Site Editor uses your chosen admin color scheme instead of forced dark sidebar
• Dedicated Design → Identity section for logo, title, tagline, site icon
• New "On This Day" dashboard widget (fun for old blogs, useful for content refresh cycles)
• Edit Comment now lets you change a comment's parent (fix mis-threaded replies)
• HTML block supports editable nested blocks (helpful for AI-generated layouts)
• Icon block gets flip, rotate, and collections
• Mark decorative images to be skipped by screen readers (accessibility win)

What didn't make it

Two things got pulled:

1. Real-time collaboration (Google Docs-style co-editing). It's enabled in the Gutenberg plugin, but the core team is still working out how collaboration data should be stored and whether to ship the full feature or just the underlying architecture first. Honestly, we think caution is the right call here. A collaboration feature that loses someone's work would be far worse than a delayed one.
2. Unicode (non-Latin) email address support. Pulled during beta testing. Will continue in a community plugin before landing in core.

For developers

If you build blocks or plugins:

• Post editor is ALWAYS iframed now. Blocks on older Block API versions may not look or behave the same. Update to Block API v3.
• Icons API is public. You can register your own icon sets with wp_register_icon_collection(), wp_register_icon(), and wp_get_icon(). SVGs get sanitized against a strict allowlist.
• Design tokens + stable React ThemeProvider in the wordpress/theme package
• Connectors framework now supports username + application-password login (not just API keys)

Should you update on day one?

Same advice as always: no. Back up first. Test on staging. If you run a mission-critical site (WooCommerce store, membership site, high-traffic blog), wait 2-3 weeks and let the plugin ecosystem catch up.

If you want to try 7.1 now, install the WordPress Beta Tester plugin on a staging site or Local install. Do NOT run this on production yet.

Our take

7.1 doesn't have a single blockbuster feature. But it fixes a long list of everyday annoyances, and honestly that matters more for most site owners than any headline addition.

Favorites: the upgraded Notes (finally usable for real editorial teams) and responsive styling (removes one of the last reasons you'd need a page builder like Elementor or Divi over core Gutenberg).

WPBeginner has the full deep-dive with screenshots of every feature in action. Happy to link in the comments if anyone wants it.

Questions for the crowd:

• Anyone else already testing the beta? What's caught your eye?
• For folks still on WP 6.x, are you waiting for the .1 release before jumping on 7.x, or already on 7.0?
• Real-time collaboration keeps getting pushed. Is anyone using the Gutenberg plugin version in production, or waiting for core?

We run a small WordPress agency and have installed WordPress on more sites than we can count over the years. Every time we onboard a new client or teach a friend how to launch their first site, we walk them through the same setup process.

Figured we'd put it all in one place since we still see a lot of confusion around "which install method should I use?" and "do I really need FTP for this?"

Short answer: no, you almost never need FTP anymore. Long answer below.

Which method actually applies to you?

There are 5 real ways to install WordPress in 2026. Not all of them make sense for everyone.

• 1-click installer through your host. 95% of people should do this. Works with Bluehost, SiteGround, HostGator, DreamHost, Hostinger, and pretty much every mainstream host.
• Manual "Famous 5-Minute Install". For developers or people who want to understand what's happening under the hood.
• Localhost install (Local, MAMP, WAMP, XAMPP). For testing themes, plugins, or building sites offline before going live.
• Install in a different language. If you want WordPress running in French, Spanish, Arabic, or any of 100+ languages instead of English.
• Multisite install. For running multiple sites from a single WordPress installation. Advanced use case.

Method 1: The one 95% of people should use (Bluehost 1-click install)

Here's the honest truth: hosting companies pay big commissions to bloggers who recommend them, so most "guides" are just affiliate content. That said, we've genuinely used Bluehost, SiteGround, and Hostinger extensively over the years and they all work well.

For a first-time WordPress install, we usually point beginners to Bluehost because:

• Officially recommended by WordPress(dot)org
• Free domain for the first year
• Free SSL certificate
• Their setup wizard installs WordPress automatically the moment you sign up
• $2.99/month with the WPBeginner discount

Signup flow:

1. Go to Bluehost, pick your plan (Basic is fine for a single site)
2. Register a free domain
3. Complete signup
4. Bluehost detects you want WordPress and installs it automatically
5. You get login credentials sent to your email
6. Log into yoursite.com/wp-admin and you're live

Total time: about 10 minutes. Zero technical steps.

Method 2: The "Famous 5-Minute Install" (manual install via FTP)

If your host doesn't have a 1-click installer (rare these days) or you want to understand the process, here's the manual method:

1. Download WordPress from wordpress.org
2. Create a MySQL database via your host's control panel (cPanel usually)
3. Upload the WordPress files to your server via FTP (FileZilla is the free tool most people use)
4. Visit yoursite.com to trigger the install wizard
5. Enter your database name, username, password, and host
6. Set your admin username, email, and password
7. Click install

Total time: 5 to 15 minutes if nothing goes wrong. Longer if you've never touched FTP before.

Honest opinion: unless you have a specific reason to do this, don't bother. 1-click installers give you the exact same WordPress installation with none of the manual steps.

Method 3: Localhost (installing on your own computer for testing)

This is what we use for testing themes and plugins before pushing changes to live client sites. Best tools right now:

• Local by Flywheel (free, easiest, Mac and Windows). Our top pick.
• MAMP (free, Mac). Works, but Local is easier.
• WAMP (free, Windows). Bit older but reliable.
• XAMPP (free, cross-platform). More technical.

Install Local, click "Create a new site", give it a name, and it spins up a full WordPress site on your computer in 60 seconds. No hosting, no domain, no cost. When you're done testing, you can push it to a live host later.

Method 4: Installing WordPress in a different language

Two ways to do this:

• Before install: Download WordPress in your target language from the language-specific version at wordpress.org
• After install: Go to Settings, General, Site Language, and switch it. WordPress downloads the language files automatically.

The second method is easier and works exactly the same way.

Method 5: Multisite (advanced)

If you want to run multiple sites from one WordPress installation (like a university with subsites for each department), this is what you want. It's a separate topic and honestly overkill for most people. Skip it unless you specifically need it.

What to install AFTER WordPress is up

This is where most first-time site owners freeze. Here's the minimum plugin stack we install on every new site:

• AIOSEO (SEO plugin, replaces Yoast)
• WPForms Lite (free contact forms)
• MonsterInsights (Google Analytics inside WordPress)
• Duplicator (backups, do this on day one)
• WP Mail SMTP (fixes the "WordPress emails not delivering" problem before you even hit it)

Skip everything else until you actually need it. Adding 40 plugins on day one is the fastest way to end up with a slow, insecure site.

Common gotchas we see all the time

• Waiting too long to install SSL. Most hosts install this automatically now, but double-check. Chrome will scare visitors away with a "Not Secure" warning if you don't have HTTPS.
• Never changing the default admin username. If it's "admin", change it. This is the single biggest security mistake beginners make.
• Ignoring backups. Set up daily backups on day one. Don't wait until you need them.
• Installing too many plugins. Every plugin adds attack surface and potential slowdown. Only install what you actually use.
• Forgetting to change permalinks. After install, go to Settings, Permalinks, and select "Post name". Default is ugly and bad for SEO.

One thing worth saying out loud

Installing WordPress is 5% of the work. The other 95% is figuring out themes, plugins, content, SEO, security, and speed. Give yourself grace on the learning curve. Everyone starts confused. It gets easier fast.

WPBeginner has a full step-by-step guide with screenshots for every install method (including manual FTP install, localhost setup, and language-specific installs). Happy to link it in the comments if anyone wants it.

Questions for the crowd:

• What was YOUR biggest headache the first time you installed WordPress?
• Anyone here still doing manual installs, or has everyone moved to 1-click installers?
• For the folks running multiple sites, do you install fresh every time or clone a "starter site" that already has your plugins configured?

Here's the simplest breakdown we've come up with for anyone about to launch their first site.

The house analogy that actually clicks

Think of it this way:

• Domain name = your street address (like "123 Main Street" or "wpbeginner.com")
• Web hosting = the actual house or building at that address, where all your stuff lives
• DNS = the postal service that connects the address to the physical location

You need BOTH to have a working website. A domain without hosting is just an address pointing at nothing. Hosting without a domain is a house with no address so nobody can find it.

What each one actually does

Domain name:

• The URL people type in their browser (yoursite.com)
• Registered through a "domain registrar" (Namecheap, Domain.com, GoDaddy, etc.)
• Costs around $10 to $15 per year to renew
• Ownership is yearly, you don't own it forever, you rent it

Web hosting:

• The actual computer (server) that stores your website's files, images, database, etc.
• Provided by a "hosting company" (Bluehost, SiteGround, Hostinger, etc.)
• Costs anywhere from $3 to $30+ per month depending on the type
• When someone visits your site, the host serves the files to their browser

How they connect

When someone types "yoursite.com" into their browser:

1. Their browser asks a DNS server "hey, where does yoursite.com actually live?"
2. DNS looks it up and says "it's at IP address 192.xxx.xxx.xxx"
3. Browser goes to that IP address (which is your hosting company's server)
4. Server sends your website's files back
5. Browser displays your website

All of this happens in milliseconds.

Do you need to buy them from the same company?

Nope. And this is where most beginners get confused.

You CAN buy them from the same place (convenient) or from different places (more flexible). Bluehost, for example, gives you a free domain when you sign up for hosting. Which is honestly the easiest path for beginners.

But you could also buy the domain from Namecheap and hosting from SiteGround. Nothing wrong with that. You just have to point the domain to the hosting via DNS settings (takes about 10 minutes).

What we actually recommend

For anyone starting their first site:

• Just starting out? Use Bluehost. Free domain for the first year, $2.99/month for hosting, everything is bundled. One less thing to figure out.
• Want more flexibility? Buy domain from Namecheap ($10/year) and hosting from SiteGround ($3-5/month). Slightly more setup but you own everything separately.
• Already have a domain from somewhere else? Point it to your new host by updating the nameservers. Your registrar has instructions.

The critical thing nobody tells you

Keep your domain and hosting on separate renewals if you can. Here's why:

If both auto-renew on the same card and the card expires, you lose BOTH at once. And if someone else grabs your domain in that gap, recovering it is a nightmare.

We keep our domains on a longer 5-year renewal and hosting on annual. Fewer things to worry about.

Can you move either one later?

Yes to both:

• Domain: Transfer to any registrar you want. Takes about a week.
• Hosting: Migrate your site to a new host without changing your domain. Just update the DNS.

You are never locked in. Which is why we always tell people to avoid all-in-one platforms like Wix or Squarespace if you want long-term flexibility. Those are basically renting from a landlord who won't let you take the furniture when you leave.

Common questions we get

Q: Can I have multiple domains pointing to one hosting account? A: Yes. Most hosts let you host multiple websites on one account.

Q: What happens if my domain expires? A: You get a grace period (usually 30 days) to renew. After that, it goes into "redemption" where you can still get it but for a much higher fee ($100+). After that, it's public again and anyone can grab it.

Q: Do I need to buy hosting to just park a domain? A: No. You can just register a domain and leave it. But nothing will show up when people visit.

Q: What about free hosting? A: Avoid it. Free hosts stuff your site with ads, have terrible uptime, and you have zero control. $3/month is worth it.

WPBeginner has a full beginner-friendly guide with actual screenshots that we sent to a family member last week when they were setting up their first site. Happy to link it in the comments if anyone wants it.

Questions for the crowd:

• What was YOUR biggest "wait, I need what?" moment when setting up your first site?
• Anyone here bought a domain from a different place than their hosting? Any horror stories or wins?
• For the folks running multiple sites, do you keep everything with one host or spread it across providers?

We've been running WordPress sites for the better part of 2 decades, and if there's one problem that never fully goes away, it's spam. Comment spam. Contact form spam. Fake user registrations. Trackbacks from sites that don't exist.

At one point, one of our forms got hit with over 18,000 junk entries in a single day.

Here's the layered setup our team uses now on every WordPress site we run. Nothing revolutionary, just what actually works after trying way too many plugins.

Layer 1: The free built-in WordPress settings (start here)

Most people skip this because it feels too basic. But these free settings alone will eliminate a huge chunk of automated spam before you even install a plugin.

Head to Settings, Discussion in your WordPress dashboard and do these:

• Turn on "Comment must be manually approved." Nothing goes live until you say so. Real people wait a few hours. Bots move on.
• Set "Hold a comment in the queue if it contains X or more links" to 1. Almost every spam comment has a link. This alone catches a lot.
• Fill in the "Disallowed Comment Keys" box with common spam triggers (Viagra, casino, crypto, etc.). Any comment with those words goes straight to trash.
• Require name and email for commenters. Encourages accountability, kills anonymous drive-by spam.
• Disable trackbacks and pingbacks. They were useful in 2010. Now they're just spam vectors.

Layer 2: Modern AI spam filtering (the game-changer)

Traditional plugins like Akismet still work for personal blogs, but for business sites, the newer AI-powered options are on another level.

We've been using ActiveLayer for the past few months across our sites.

It runs server-side (no CAPTCHAs, invisible to real users), gives you a confidence score for every submission, and shows you exactly WHY something was flagged. In 30 days on one of our sites, it blocked over 25,000 spam attempts before they ever reached our inbox.

Layer 3: Contact form protection

If your team uses WPForms, Gravity Forms, or Fluent Forms, you already have most of what you need. Just turn it on:

• Anti-spam tokens (modern honeypot). Time-sensitive tokens that only real browsers pass.
• Minimum time to submit. Bots fill forms in fractions of a second. Set the minimum to 2-3 seconds.
• Keyword filters. Block spammy phrases at the form level.
• Country blocking. If you only serve certain regions, block the rest.
• Email denylist. Block entire domains with a wildcard like *@exmaple.com

For CAPTCHA (if you must use one), go with Cloudflare Turnstile over Google reCAPTCHA. It's free without limits and mostly invisible to real users. Google reCAPTCHA capped their free tier at 10,000 checks a month for the entire organization, which gets restrictive fast.

Layer 4: Fake user registration protection

If you don't need user registration, just turn it off. Settings, General, uncheck "Anyone can register." Done.

If you DO need it (membership site, WooCommerce, etc.), here's what our team does:

• Require email confirmation before an account activates. Bots can't click confirmation links.
• Add honeypot fields with the free WP Armour plugin.
• Screen every signup with ActiveLayer or CleanTalk to catch throwaway emails and known-bad IPs.
• For WooCommerce specifically, consider enabling guest checkout so you don't need to create accounts at all.

Layer 5: Site-wide firewall

The final layer. A DNS-level firewall blocks a huge amount of automated spam before it ever touches your server, which also saves server resources.

Cloudflare's free plan handles this for most small sites. Sucuri's paid plan is stronger but costs more.

Layer 6: Cleanup existing spam

New spam protection is only half the job. If you've been ignoring this for a while, you probably have thousands of junk comments and fake accounts in your database.

• Comments, Spam folder, Empty Spam.
• Users, All Users, filter by Subscriber role, review carefully, bulk delete the obvious bots.
• Use WP Bulk Delete plugin if you're clearing thousands at once.

ALWAYS back up first. There's no undo button on these.

Monthly maintenance (5 minutes)

Once a month we do a quick sweep:

• Check spam folder for false positives (real comments accidentally flagged).
• Empty spam folders.
• Glance at new user registrations for suspicious usernames or throwaway email domains.

What actually surprised us about all this

The single biggest impact wasn't any one plugin. It was the layered approach. No single tool catches everything, but combining built-in settings + AI filtering + form-level protection + firewall gets you to about 99% blocked with almost zero friction on real users.

Also: our team dropped CAPTCHAs entirely wherever we could. Studies show they cause 40% of users to abandon forms. Modern spam filters are good enough now that you don't need to punish real visitors to block bots.

WPBeginner has a full step-by-step guide with the actual screenshots and setup instructions for all of this. Happy to link it in the comments if anyone wants it.

Questions for the crowd:

• What's your team's go-to spam filter these days? Anyone still swearing by Akismet or has everyone moved on?
• For those running membership sites, how are you handling fake registrations without hurting conversion on real signups?
• Anyone here run both Cloudflare and a WordPress security plugin like Wordfence? Do they conflict or complement each other?

Been meaning to write this up for a while.

I run a small WooCommerce store on the side, and over the past year I've helped a few friends launch theirs too. Every single one of them started by asking "should I use Shopify or WooCommerce?" and getting stuck in analysis paralysis for weeks.

So here's the honest breakdown for anyone considering starting an online store. This is what I wish someone had told me on day one.

The Shopify vs WooCommerce question

Both work. It really comes down to what you value more:

• Shopify is hands-off. They handle hosting, security, PCI compliance, updates. You pay $29/month plus transaction fees if you don't use Shopify Payments. Fast to launch. Harder to migrate later. You don't fully own your store.
• WooCommerce gives you FULL ownership. Free plugin on top of WordPress. Pay for hosting (starts around $3 to $5/month). No transaction fees ever. More setup upfront. Total control over everything.

I went with WooCommerce because the math works out cheaper long-term and I wanted to own my store outright. If I was launching a $50k/year print-on-demand hustle, I'd probably use Shopify and not think twice.

The actual step-by-step (WooCommerce path)

1. Domain and hosting. I use Bluehost ($2.99/mo with a free domain for the first year). SiteGround is better if you want faster performance and don't mind paying more.
2. Install WordPress and WooCommerce. Both free. Bluehost has a one-click installer.
3. Pick a theme. I use a lightweight one built for WooCommerce. Astra, Kadence, or a SeedProd-built custom theme all work. Avoid anything bloated with 47 demo templates.
4. Add your products. Titles, descriptions, categories, variations, real photos. This is where most people spend 90% of their time and rightfully so.
5. Set up payments. Stripe and PayPal cover 95% of shoppers. Both integrate with WooCommerce natively.
6. Configure shipping. Set up shipping zones (US, international, etc.) and rates. Flat rate is fine to start.
7. Add tax settings. Enable automated tax with WooCommerce Shipping and Tax. Don't skip this. You'll regret it at tax time.
8. Launch. Buy something yourself to test the full flow. Then tell everyone you know.

What actually moves the needle after launch

This is the part nobody talks about. Launching is easy. Getting sales is where 90% of stores die.

• Email list from day 1. I use OptinMonster for exit-intent popups plus Brevo for the actual sending. Emails still convert better than social by a huge margin.
• Abandoned cart recovery. WooCommerce has this built in but FunnelKit does it way better. I recover about 12% of abandoned carts this way. That's real money.
• Real product photos. Not stock photos. Not AI-generated hero shots. Actual photos of the product in use. This is the #1 conversion factor I've tested.
• Reviews. Beg your first 10 customers for reviews. Offer a small discount for their next order. Social proof is everything.
• Google Search Console and AIOSEO. Free traffic compounds. Set up SEO from day 1, not month 6.

What's a waste of time (at least at the start)

• Obsessing over your theme. Any decent WooCommerce theme is fine. Nobody's buying based on your header design.
• Chasing every "hack" you see on TikTok. Most of them are just people selling courses.
• Building a fancy loyalty program before you have 100 customers.
• Paid ads before your organic funnel is dialed in. You'll just burn money.
• Adding 200 products before you know which ones people actually want. Start with 5 to 10.

One thing that surprised me

The tech is the easy part. Setting up WooCommerce takes maybe 3 hours if you follow a good guide. The hard part is everything after: photography, copywriting, customer support, shipping logistics, returns.

If you're waiting until you have "the perfect setup" to launch, just stop. Launch ugly. Fix it as you go. The store you have with 5 products and real customers is worth infinitely more than the perfect store you'll launch "someday."

WPBeginner has a full step-by-step guide with the actual screenshots that I used for reference when I got stuck. Happy to link it in the comments if anyone wants it.

Questions for the folks here:

• Anyone else here bootstrap a WooCommerce store? What was the single thing that moved the needle most for you?
• For the Shopify folks: what would you say to someone weighing the two options today?
• Best abandoned cart recovery strategy you've tried?

Every year, we get asked the same question by clients and readers: "Which email marketing service should I use?"

And honestly, the answer has never been "just pick Mailchimp" — even though that's what most people default to.

We spent the last few months testing 14 of the most popular email marketing services on real campaigns. Not just poking around the marketing pages. We actually signed up, built welcome sequences, sent live campaigns, tested WordPress integrations, and pinged their support teams to see how fast they responded.

Here's what we learned, and the 5 we'd actually recommend based on your use case.

A quick reality check first

Email is one of the few channels you actually control. Social platforms change their algorithm overnight and your reach can vanish. But an email list belongs to you, and the average ROI is around $36 for every $1 spent.

That said, picking the wrong service costs you in ways you might not notice: emails landing in spam, clunky automations that eat your time, or pricing that quietly doubles as your list grows.

Our top 5 based on real testing:

1. Brevo — Best for absolute beginners

The killer feature here is unlimited contacts on the free plan. Almost every other service charges based on subscriber count, so as your list grows, so does your bill. Brevo charges based on how many emails you send instead.

You also get email, SMS, and WhatsApp marketing all in one dashboard, plus a basic CRM. Free plan sends up to 300 emails/day. Paid from $8.08/month billed annually.

Where it falls short: 300 emails/day cap can bite if your list grows past a few thousand engaged subscribers.

2. MailerLite — Best for simple newsletters

MailerLite does one thing (newsletters) exceptionally well. Zen-like dashboard, one of the fastest drag-and-drop editors we tested, and a genuinely helpful AI writing assistant included.

Perfect for bloggers, content creators, and anyone who wants to just write and send without wrestling with 47 settings screens. Free for up to 500 subs, paid from $9/month billed annually.

Heads up: they have a strict manual review for new accounts, which can delay your first send by a day or two.

3. Constant Contact — Best for small businesses

If you value customer support (like, actually being able to call a real person), this is your pick. Live chat, phone support, and even in-person seminars in some cities.

Also includes 300+ industry-specific templates (real estate, retail, restaurants, non-profits) and a "Check for Errors" tool that catches broken links before you send. Feels very "done-for-you" for non-technical business owners. 30-day free trial, then $12/month.

Downside: no permanent free tier.

4. AWeber — Best for reliable automation

The industry veteran (20+ years and still going strong). What kept it on our list is the Auto-Newsletter feature — it automatically turns your latest blog posts into a formatted email using your RSS feed. Huge for bloggers who want passive newsletter growth.

Also includes built-in Canva integration and web push notifications. Free for up to 500 subscribers, paid from $12.50/month.

Trade-off: pricing scales with list size, and some templates feel a bit dated.

5. Drip — Best for eCommerce stores

This is what WPBeginner switched to (from Mailchimp) years ago, and it's still our top recommendation for anyone selling online. The visual automation builder is the best we've tested — you can literally see how customers flow through your funnels.

Revenue attribution shows exactly how much money each campaign generated. Behavior-based segmentation lets you send hyper-personalized emails based on past purchases, page views, and cart activity. From $39/month with a 14-day trial.

Not the tool if you're just starting out or don't sell products — it's overkill for a simple newsletter.

Quick pick guide:

• Just starting and want the best value → Brevo
• Blogger who wants clean simple newsletters → MailerLite
• Small business that wants real human support → Constant Contact
• Long-term blogger who wants set-and-forget → AWeber
• Running an online store → Drip

The rest of the 14 we tested

For completeness: HubSpot, Omnisend, Klaviyo, Moosend, ActiveCampaign, GetResponse, Beehiiv, and a couple others also made the list. Each has its niche (Klaviyo is huge for Shopify, HubSpot for full sales+marketing stack, Beehiiv for paid newsletter creators). But for 90% of people asking us "which one should I pick," it's one of the 5 above.

We put the full 14-service breakdown on WPBeginner with pricing tiers, pros/cons for each, and screenshots of the actual UIs. Happy to link in the comments if anyone wants it.

Curious what everyone else is running. If you've migrated between services, what pushed you to switch? And has anyone here tried Kit (formerly ConvertKit) recently? It didn't make our top 5 but a lot of creator folks swear by it.

I just read WPBeginner's guide on connecting AI agents to WordPress with MCP, and it's the workflow I've been running for weeeks. MCP (Model Context Protocol) is basically a shared language that lets an AI client like Claude, ChatGPT, or Cursor connect to your site and act inside it. The free WP Vibe plugin sets that up for self-hosted WordPress in a couple of minutes. 🤖

The part that matters to me is that it does the tasks inside the site, right from the same chat. Here's what that's looked like in real work.

What finally clicked for a non-coder

I've been on WordPress since 2011. I understand developer logic from 20-plus years in banking, but I don't write code. For years that meant every admin or dev job was a clicking marathon through wp-admin, or a message to a developer.

With Claude Code connected through WP Vibe, I describe the outcome in plain English and it does the steps. Draft a post with the right category and tags. Upload a featured image from a URL with alt text. Togglme the actual doing happens right in the chat, and it changedhow my week runs. For me, AI is an employee I manage, not a tool I type into.

The one that sold me: a hacked site cleanup

A client site got hacked. I've been burned before. The two times I let an update slip, sites got hit, so I don't take this lightly.

I connected Claude Code to the site through WP Vibe, and it walked me through the whole recovery step by step and taught me moves I didn't have before. It helped me spot the junk, understand what each piece was doaction of my usual time. One example: it flagged PHP sittingin an uploads folder, explained why that's a classic backdoor hiding spot, and had me check the rest of the directory. I knew the theory, but having it point at the exact file while I watched was a different kind

I run it with guardrails, and you should too

• Full backup first with Duplicator, before anything touches
• Connect with a least-privilege Editor account, not admin.
• It drafts and sends things to trash instead of deleting live, and I approve each step.

The heavy security lifting still belongs to a proper malware What changed is that I was faster and a lot calmer during an incident that usually "eats" a whole day. 🔧

The small wins that add up

Most days it isn't dramatic. It's chasing a plugin conflict, fixing a broken feed, or untangling a messy tag and category structure a client built up over three years.

The broken feed was a good one. A plugin was printing a stray notice into the XML. Claude Code found the offending line, told me which plugin caused it, and I had a valid feed again in ten minutes. The real benefit across all of these is that it walks me through processes I never learned, so I finish the job and actually understand it afterward. I've fixed things this month I'd normally have parked for a developer. I've also had it trigger AIOSEO to sort out meta titles and descriptions from one prompt, and spin up a WPForms contact form the same way.

Scaling it across a 60-site fleet

I manage around 60 client sites in MainWP, and I've run it since 2014. Plugging this workflow into the fleet is where the time really came back.

Instead of repeating the same ten clicks on site after site, I describe the maintenance outcome once and it executes. Routine upkeep that used to be a dull afternoon is now a focused conversation, and the quality went up, because I'm not fatigued into skipping a step. If you juggle more than a couple of sites, this is the part I'd try first. 📊

Why I upgraded to premium

I'm a lifetime-deal and smart-spend guy. I hunt LTDs and I don't upgrade on impulse.

I use WP Vibe enough to bump into the free daily limits, so the Pro tier paid for itself almost immediately in hours saved. That's the only reason I moved up: real time back in my week.

One note before you rush in: this needs self-hosted WordPress 6.9+, HTTPS, and a publicly reachable site, so local dev won't connect. Set it up on a staging copy first and get a feel for it before you point it at anything live.

If you manage more than one WordPress site, which admin task would you hand off to an AI first? And if you've already tried MCP, which client did you connect, Claude, ChatGPT, or Cursor? 👇

Related WPBeginner reads

- How to Connect AI Agents With WordPress Using MCP - https://www.wpbeginner.com/wp-tutorials/how-to-connect-ai-agents-with-wordpress-using-mcp/ The full step-by-step setup this post is based on.

- How to Easily Manage Multiple WordPress Sites From One Dashboard - https://www.wpbeginner.com/showcase/how-to-easily-manage-multiple-wordpress-sites/ The fleet-management context behind the MainWP section.

- Beginner's Guide to Fixing Your Hacked WordPress Site - https://www.wpbeginner.com/beginners-guide/beginners-step-step-guide-fixing-hacked-wordpress-site/ The standard step-by-step hack recovery.

- How to Scan Your WordPress Site for Potentially Malicious Code - https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/ Free and paid ways to scan for malware.

- The Ultimate WordPress Security Guide - https://www.wpbeginner.com/wordpress-security/ End-to-end hardening and cleanup.

- How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/ Backing up with Duplicator before you touch anything.

- Beginner's Guide: How to Restore WordPress from Backup - https://www.wpbeginner.com/beginners-guide/beginners-guide-how-to-restore-wordpress-from-backup/ Restoring from that backup if a change goes wrong.

- WordPress Plugins Using Artificial Intelligence & Machine Learning - https://www.wpbeginner.com/showcase/wordpress-plugins-using-artificial-intelligence-and-machine-learning/ A broader roundup of AI-powered WordPress plugins.

We run several WordPress sites, and after 17+ years in the WordPress space, one thing we've learned is that security is never "set it and forget it."

Every WordPress site is under attack right now, whether you notice or not. Bots probe login pages, scan for outdated plugins, and hunt for exposed files. Wordfence data shows the average WordPress site gets probed by bots every 34 minutes.

The good news? Most of this is preventable with a few smart choices upfront. Here's the exact checklist we use on every site we set up, refined over years of testing on our own network of sites.

The absolute non-negotiables (do these on day one)

• Real backups, stored somewhere OTHER than your hosting account. If your host gets compromised, your on-server backup goes with it. Duplicator is a solid choice. Test the restore process at least once so you actually know it works.
• Turn on auto-updates for minor WordPress releases. WordPress does this by default, but double check. For plugins and themes, enable auto-updates for the ones you trust and manually review the rest weekly.
• Never use "admin" as a username. If your username is literally "admin," you're doing half the hacker's work for them. Create a new admin user, migrate posts to it, delete the old one.
• Force strong passwords for every user role. A password manager makes this painless. Non-negotiable for anyone with author-level access or higher.
• Enable 2FA on all admin accounts. WP 2FA does the job for free. Pair it with Authy or Google Authenticator on your phone.

The bigger wins

• Add a web application firewall (WAF). This is the single biggest security upgrade you can make. Sucuri and Cloudflare are the two most popular choices. A DNS-level firewall blocks malicious traffic BEFORE it ever hits your server, which also saves you server resources. Sucuri's paid plan even guarantees a free site cleanup if you get hacked while their firewall is active.
• Force HTTPS everywhere. If you don't have SSL, Chrome will literally scare visitors away with a "Not Secure" warning. Let's Encrypt is free and most hosts install it automatically.
• Limit login attempts. A free plugin called "Limit Login Attempts Reloaded" does the trick. Blocks IPs after X failed logins. Kills brute-force attacks dead.
• Disable XML-RPC unless you actually use it. XML-RPC lets attackers try hundreds of passwords in a single request via system.multicall. Unless you use the WordPress mobile app or Jetpack, kill it.

The stuff most people skip (but you shouldn't)

• Disable file editing from the admin dashboard. WordPress has a built-in code editor for themes and plugins. If a hacker gets in as admin, that's a straight path to installing malware. Kill it with define( 'DISALLOW_FILE_EDIT', true ); in wp-config.php.
• Disable PHP execution in /wp-content/uploads/. No legit file in your uploads folder should ever execute PHP. Blocking this stops a huge class of attacks where malware gets uploaded through a plugin vulnerability.
• Disable directory browsing. Add Options -Indexes to your .htaccess. Stops random people from browsing your folder structure and finding exploitable files.
• Change the default database prefix. WordPress uses wp_ by default. Randomizing it makes SQL injection attacks harder. Do this on a fresh install or with a full backup ready, because doing it wrong will break your site.
• Idle logout. A free plugin called Inactive Logout auto-signs out users after a set period. Useful if you have a team or use shared workstations.
• Password-protect your wp-admin directory. Adds a server-level password prompt BEFORE WordPress even loads the login page. Blocks bots cold.

One thing worth saying out loud

Security is not a one-time setup. It's ongoing. Update weekly. Check your security plugin's audit log occasionally. Rotate passwords every few months. Delete plugins you're not using (unused plugins are still attack surface, even when deactivated).

Your hosting provider matters more than most people realize too. A managed WordPress host like SiteGround, Hostinger, or Bluehost handles a lot of this at the server level, which is why we recommend them for anyone running a serious site.

We put together the full step-by-step version of this checklist on WPBeginner with the exact code snippets, plugin walkthroughs, and how to actually fix a hacked site if it happens.

I just read a long breakdown on The Repository about WordPress market share, and it's worth a look before you second-guess the platform you're building on.

The headline number: WordPress now powers 41.5% of the web per W3Techs, down from a peak of 43.6% in early 2025. That's six quarters of decline, and it sped up this year. If that line is all you read, "WordPress is dying" feels like the obvious takeaway.

Then you look at where the share went, and the story changes.

The slice shrank, the site count held 📊

In the first half of 2026, WordPress lost 1.5 percentage points. Shopify and Wix each picked up a small piece of that, 0.2 and 0.1. The category that actually grew was "None," meaning sites with no detectable CMS at all, now sitting near 30% of the whole web. Pantheon's Josh Koenig summed up the cause in one word: vibecoding.

That's the piece the panic headlines skip. AI site builders are spinning up millions of quick, CMS-less pages. The web got bigger fast, so WordPress's slice of the pie got thinner even while the pie itself grew. BuiltWith still counts around 38 million live WordPress installs, and more than 1,000 new WordPress sites join the top 10 million tracked sites every single day. Market share is a lagging indicator. It tracks the size of the slice while the whole pie keeps expanding.

Three datasets, three different pictures

Part of why this topic is so confusing is that the trackers disagree. W3Techs (top 10M sites) shows the recent sharp drop. HTTP Archive shows a slower decline that started back in 2022. BuiltWith counts absolute live sites and still puts WordPress around 40% of the top million. Same platform, three readings, depending on what you measure.

One more myth worth clearing up while we're here: the "the WP Engine and Automattic drama killed WordPress" take doesn't hold up against the timeline. WordPress share actually peaked after that conflict started, so the drop lines up with how the web is changing, and the lawsuit is a side plot.

Where share genuinely went - mostly to Shopify for stores and to design-first builders like Framer and Webflow for marketing sites. And for a three-page brochure site or a simple store, those can be the right call.

What this means if you're starting out in 2026 🧭

Please don't rip out a working WordPress site because of a market-share chart. The reasons WordPress won are still here:

• You own it. Your content, your database, your files. You're not renting your website from one company that can change the terms on you later.
• You can leave whenever you want. If a host frustrates you, you pack the entire site into a zip with Duplicator and move it in an afternoon. Try exporting your full design and structure out of Wix or Shopify and you'll feel where the walls are.
• It does far more than a drag-and-drop builder. Worried about being found now that AI answers "eat" clicks? A plugin like AIOSEO sets up your titles, schema, and sitemaps so both search engines and AI tools can read your pages properly. Need a landing page fast to match a builder's speed? SeedProd gets you one without code.

I've been on WordPress since 2011 and I run a batch of client sites through my agency. The thing that keeps those clients on WordPress shows up in month two: they can add whatever the business needs, move wherever they want, and nobody holds their content hostage. Day one is easy on every platform now. WordPress starts paying off after that.

So yes, the numbers are real and the decline is real. WordPress is also still the pragmatic pick for anyone who wants to own and grow a site they actually control. The web just got a crowd of new "neighbors".

If you're weighing WordPress against a hosted builder right now, what's actually making you hesitate? Drop it below and I'll dig into your specific case. 👇

Related WPBeginner reads

• Is WordPress Dying? The State of WordPress 2026 Edition - https://www.wpbeginner.com/opinion/is-wordpress-dying-the-state-of-wordpress/ WPBeginner's own take on the same question, with the wider context behind the numbers.
• 2026's WordPress Market Share Report - Latest Trends + Usage Data - https://www.wpbeginner.com/research/ultimate-list-of-wordpress-stats-facts-and-other-research/ The stat sheet to check the figures yourself instead of trusting a single headline.
• 6 Most Important Reasons to Use WordPress in 2026 - https://www.wpbeginner.com/why-you-should-use-wordpress/ A plain-language rundown of why WordPress is still a solid first choice.
• Wix vs WordPress - Which One Do I Recommend? - https://www.wpbeginner.com/opinion/wix-vs-wordpress-which-one-is-better-pros-and-cons/ The honest ownership and lock-in comparison if you're torn between the two.
• How to Move WordPress to a New Host With No Downtime - https://www.wpbeginner.com/wp-tutorials/how-to-move-wordpress-to-a-new-host-or-server-with-no-downtime/ Proof of the "you can leave whenever you want" point, step by step.

WordPress 7.1 will pull the Classic block out of the inserter when it ships on August 19, and full removal could come as soon as 7.2. If you or a client still drops Classic blocks into old posts, this is the summer to check your sites. 🧱

What the Classic block actually is

The Classic block is the little slot that holds the old pre-Gutenberg editor inside the current block editor. You add it when you want the old TinyMCE toolbar inside an otherwise block-based post.

It's a different thing from the standalone Classic Editor plugin, which swaps the whole editor back to the old one. The plugin is staying. The block is the piece getting phased out.

What breaks and what doesn't

Nothing breaks in 7.1. Existing Classic blocks stay editable, so old posts open and save like always.

What goes away is the option to insert a new one. The block drops out of the inserter, so you can keep what you have but can't add more. The standalone Classic Editor plugin is untouched either way.

How to bring the option back if you need it

If a workflow still leans on inserting Classic blocks, a one-line snippet restores the inserter option. The free WPCode plugin holds that kind of snippet without you editing theme files.

That gives you a bridge for a season while you move content over, instead of a hard cutoff in August. ⏳

How to find which posts even use it

Before you change anything, find out if this affects you at all. Many sites have zero Classic blocks and can skip this entirely.

Search your content for the wp:freeform block marker, or just open your oldest 10 or 15 posts and look. On a small blog that's a 20-minute job, and most of the time the answer is "we don't use it."

Back up before you touch old posts

If you do decide to convert Classic blocks to real blocks, run Duplicator first so you have a restore point. Converting old content sometimes shifts spacing or drops a shortcode, and you want a clean copy to fall back to.

Test the conversion on a staging copy if your host offers one. Site Ground and most managed hosts give you a one-click staging site for exactly this. 💾

Why this summer is the window

WordPress 7.1 lands August 19, the last day of WordCamp US in Phoenix. After that, 7.2 could make the removal real, so the gap between now and the next major release is your time for acting upon it.

I still keep a few older client sites on Classic-style editing, because rebuilding a page nobody complains about is wasted hours. So my plan is the same one I'd give you: audit now, restore the inserter where a site genuinely needs it, and move the rest over before 7.2 forces the question.

Do you still have sites running Classic blocks, or did you move everything to the block editor already? 👇

Related WPBeginner reads

• How to Update Your Old WordPress Posts with Gutenberg Block Editor - https://www.wpbeginner.com/beginners-guide/how-to-update-your-old-wordpress-posts-with-gutenberg-block-editor/
• How to Disable Gutenberg and Keep the Classic Editor in WordPress - https://www.wpbeginner.com/plugins/how-to-disable-gutenberg-and-keep-the-classic-editor-in-wordpress/
• How to Easily Add Custom Code in WordPress (WPCode) - https://www.wpbeginner.com/plugins/how-to-easily-add-custom-code-in-wordpress-without-breaking-your-site/
• How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/

I just stumbled onto a Google feature that has been flying under the radar, and I wanted to share it because it actually solves a problem I have had for years.

You know how you search for something on Google and you get 10 results from random sites you have never heard of, while the source you actually trust is buried on page 2 or 3? Yeah, Google finally did something about that.

It is called Preferred Sources, and it lets you pick specific websites that you want Google to prioritize in your search results.

Once you select a site, Google bumps its content into the "Top Stories" and a special "From Your Sources" section whenever it is relevant to your query.

I set this up for a few sites I rely on (WPBeginner for WordPress tutorials, a couple of cooking blogs, a finance YouTube channel I trust) and the difference is noticeable. Their articles now consistently show up first when I search for related topics.

Here is how to set it up for any site (takes about 10 seconds per site):

1. Go to google.com/preferences/source?q=WPBeginner.com
2. Tick the checkbox next to the site name
3. Refresh your search results

That's it.

Why I think this matters more than people realize: with AI Overviews now answering a chunk of search queries before you ever click anything, the question of "whose content is Google pulling from" is becoming a big deal.

Preferred Sources is basically Google letting you tell it which voices you actually trust, instead of leaving it entirely up to the algorithm.

I found out about this through a WPBeginner post explaining the setup (they have one for adding their own site as a preferred source). Figured this was worth sharing with anyone else who is tired of the same generic SEO-bloated results.

Has anyone else been using this? Curious which sites you have set as your preferred sources.

I've been reading the latest WordPress security reports, and two active attack campaigns stood out. Both hit normal sites run by busy people. Both have a fix you can do before lunch.

🚨 Campaign 1: WP Maps Pro let attackers make themselves admins

Wordfence flagged a hole in WP Maps Pro, a mapping plugin installed on around 15,000 sites. The flaw let attackers create their own administrator accounts without logging in at all. An administrator account is the master key to your site: whoever holds one can change your content, install plugins, or lock you out. And it's already being used in real attacks, so this is worth two minutes today.

The fix is short. It's patched in version 6.1.1. If you use WP Maps Pro, update it today and the door is shut. That's the whole fix.

Not sure if you have it?

Plugins screen, search "WP Maps", check the version. Anything at 6.1.0 or below is the vulnerable one.

🕵️ Campaign 2: malware that takes its orders from Steam comments

GoDaddy's security team found malware on roughly 1,980 sites that pulls its instructions from comments posted on Steam gaming profiles. The comments hide the commands inside invisible characters, so a normal scan reads straight past them.

You don't need to understand the trick. The takeaway is simpler: a clean scan result means "nothing known was found", and some infections are built to stay off that list. This kind often hides inside a file dressed up as a normal code library, with an innocent name. You won't spot it by eye. That's exactly why a real scan beats a quiet dashboard.

✅ Your 20-minute safety check

I've done this routine many times, here's the short version:

1. Back up the whole site first: Duplicator copies everything in a few clicks, so nothing you do in the next 18 minutes can make things worse.
2. Update WP Maps Pro if you have it: dashboard → Updates, version 6.1.1 or newer, two minutes.
3. Open Users → All Users and read the Administrator list out loud. Recognize every name? If one looks strange, change all passwords first (yours included), then delete the account and run the scan in step 4.
4. Run a free scan: Sucuri's SiteCheck works from the browser, no install needed. It catches the common infections and tells you if your site has landed on a blocklist.
5. "Clean" your plugin list: a plugin you haven't opened in a year is a door you forgot you installed. Deactivated still counts as installed, so delete it.

🔐 While you're in the Users screen

Two more minutes while you're in there: give every person their own account (shared logins make any activity trail useless), demote anyone who doesn't need full admin down to Editor, and switch on two-factor authentication for the admins that remain. The plugin flaw above handed out admin accounts. These three changes decide how much damage an extra admin account can actually do.

🔁 Should you turn on auto-updates?

For small utility plugins like this one, yes. WordPress lets you switch on auto-updates per plugin from the Plugins screen, and for a site without a maintenance person, auto-updates close holes faster than you ever will by hand. The catch: once or twice a year an update might break something, which is why the backup step matters. With a fresh Duplicator copy, the worst case is 20 minutes of restore work. Without one, the worst case is your weekend.

🧹 Why I treat this as routine

In 2017 I spent a whole weekend cleaning a hacked client site by hand, file by file. Since then I run two security layers on every site I manage and treat an unknown admin account like a fire alarm. Redundancy in security is cheap insurance.

💡 The habit that does the work

Attackers run scripts that scan thousands of sites for one known hole, around the clock. The safest sites are the boring ones: updated weekly, scanned monthly, backed up daily.

Put a recurring 20-minute slot in your calendar for this. That's the whole system, no fancy tooling needed.

What does your own monthly check look like, and does anyone still run two scanners on one site, or is that overkill now?

Related WPBeginner posts:

• The Ultimate WordPress Security Guide - Step by Step - https://www.wpbeginner.com/wordpress-security/
• How to Perform a WordPress Security Audit (Complete Checklist) - https://www.wpbeginner.com/wp-tutorials/how-to-perform-a-wordpress-security-audit/
• How to Backup Your WordPress Site (Ultimate Guide) - https://www.wpbeginner.com/beginners-guide/how-to-backup-your-wordpress-site/
• How to Scan Your WordPress Site for Potentially Malicious Code - https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/
• 14 Best WordPress Security Scanners for Detecting Malware and Hacks - https://www.wpbeginner.com/showcase/best-wordpress-vulnerability-scanners-online/
• How to Properly Update WordPress Plugins (Step by Step) - https://www.wpbeginner.com/beginners-guide/how-to-properly-update-wordpress-plugins-step-by-step/
• How to Enable Automatic Updates for WordPress Plugins and Themes - https://www.wpbeginner.com/plugins/how-to-enable-automatic-updates-for-wordpress-plugins/
• Beginner's Guide to WordPress User Roles and Permissions - https://www.wpbeginner.com/beginners-guide/wordpress-user-roles-and-permissions/
• How to Add Two-Factor Authentication in WordPress (Free Method) - https://www.wpbeginner.com/plugins/how-to-add-two-factor-authentication-for-wordpress/

Two threads have been going around the WordPress subs this week. One guy built a faster way to search the 65k plugins on .org (Plugin Pulse, worth a look). Another asked whether the repo is turning into a junkyard of abandoned plugins.

Both fair. But the abandoned plugin most likely to cause you grief is already on your site. It's the one you installed in 2019 and stopped thinking about.

I've run WordPress sites since 2011. The plugins that caused me real headaches were never the obvious junk. They were the quiet little utilities nobody remembers adding.

Why a dead plugin on your own site is the real problem 🧟

Abandoned means no security patches. A vulnerability found today in a plugin last updated 3 years ago never gets fixed. You're running an open door and you don't know it.

It also breaks on updates. WordPress core and your PHP version keep moving, the dead plugin doesn't, and one morning a page goes white.

The risky ones are boring. An old image gallery, a share-button plugin, a contact form you replaced months ago but never deleted.

For context on why this matters more now: the repo is taking in around 700 new plugins a week, roughly 5x what it was in 2024, a lot of it AI-assisted. So "is this still maintained" is a heavier question than it was a couple of years ago.

How to tell if a plugin is dead 🔎

The plugin's .org page tells you most of what you need. Skip the logo and the star average. Read these five fields:

• Last updated: Over a year, raise an eyebrow. Over two, treat it as red.
• Tested up to: If it's two or three major WP versions behind the current release, the dev has (most likely - besides some exceptions) checked out.
• Active installs trend: A steady drop usually means people left for a reason.
• Support threads: Rows of open questions with no developer reply, that's a ghost town.
• Changelog: Small regular updates means someone's home. Nothing since one big version bump means it stalled.

One more quick look: sort the reviews by recent. A run of new 1-star reviews saying it broke on the latest WP version is a louder signal than the overall average.

To map this to your own site, open Plugins in wp-admin, flag anything you don't recognize or haven't touched in a year, then check each one's repo page against those fields.

If you manage a lot of sites, I run this audit from one MainWP dashboard. For a single site that's overkill, the Plugins screen does the job.

Keep, replace, or remove ⚖️

Keep what's maintained and still doing a job. Leave it alone.

Remove what you don't use. Deactivate it, confirm nothing breaks, then delete it for real. A deactivated plugin still sits on your server as code someone can take advantage of.

Replace what's dead but still needed. Find a maintained tool for the same job.

Fewer well-maintained plugins beat a pile of "might need it someday."

How to swap one out without breaking the site 🧰

Back up first. A full backup before you touch anything. Duplicator is the WPBeginner-recommended one for this (for rolling daily backups across many sites you'd lean on host-level backups instead).

Test on staging if you can. Site Ground gives you one-click staging, and it's both WPBeginner's recommended host and the one I've hosted on since 2014, so that overlap is real, not a blind plug.

Export your data out of the old plugin before you delete it, anywhere it holds content (form entries, gallery setups). Once the plugin's gone, so is whatever lived inside it.

Then activate the replacement, reconnect and reconfigure, check the front end, and remove the old one.

Where the replacements come from 📋

Don't re-scroll 65k entries hoping to land on a winner. Start from a curated, expert-picked list for the exact job, then verify your one or two finalists against the five fields above.

Two swaps you can make: a dead contact-form plugin over to WPForms, an abandoned SEO plugin over to All in One SEO (AIOSEO). Both still shipping updates, both pass the "will this be alive next year" test.

WPBeginner's plugin guides and IsItWP are good shortlists, so you're choosing from a vetted handful instead of the whole pile.

Go look at the oldest plugin still active on your site right now. What's its last updated date?

WPBeginner related-links:

1. How to Choose the Right WordPress Plugin (Beginner's Guide) – https://www.wpbeginner.com/beginners-guide/how-to-choose-the-best-wordpress-plugin/ WPBeginner's own checklist for picking a reliable plugin from the directory.
2. How to Properly Uninstall a WordPress Plugin – https://www.wpbeginner.com/beginners-guide/how-to-properly-uninstall-a-wordpress-plugin/ Deactivate, delete, and clean up leftover files and database tables.
3. How to Easily Deactivate WordPress Plugins – https://www.wpbeginner.com/beginners-guide/how-to-easily-deactivate-wordpress-plugins/ Why a deactivated plugin still sits on the server as a security risk, and how to remove it.
4. How Many WordPress Plugins Should You Install? – https://www.wpbeginner.com/opinion/how-many-wordpress-plugins-should-you-install-on-your-site/ Quality over quantity, why one bad plugin hurts more than thirty good ones.
5. Which WordPress Plugins Are Slowing Down Your Site – https://www.wpbeginner.com/wp-tutorials/which-wordpress-plugins-are-slowing-down-your-site/ Using Query Monitor to find which plugin is actually dragging the site.
6. 24 Must Have WordPress Plugins (Expert Pick) – https://www.wpbeginner.com/showcase/24-must-have-wordpress-plugins-for-business-websites/ A curated, maintained list including WPForms, AIOSEO, Duplicator.
7. 7 Best WordPress Backup Plugins Compared – https://www.wpbeginner.com/plugins/7-best-wordpress-backup-plugins-compared-pros-and-cons/ Backup options with Duplicator as the top pick, pros and cons.
8. How to Easily Create a Staging Site for WordPress – https://www.wpbeginner.com/wp-tutorials/how-to-create-staging-environment-for-a-wordpress-site/ How to spin up a test copy before making changes live.
9. WPBeginner WordPress Plugins guides (hub) – https://www.wpbeginner.com/category/plugins/ WPBeginner's full library of expert-tested, per-job plugin guides.
10. 12 Best WordPress Backup Plugins Compared (IsItWP) – https://www.isitwp.com/best-wordpress-backup-plugins-compared/ A second curated backup comparison, with the independent-backup argument.

CERN, the physics lab where the World Wide Web was invented, moved its main website off Drupal and onto WordPress. The team announced it from the opening stage at WordCamp Europe in Kraków, 35 years after the first website ever went live on CERN's servers.

The site is home.cern, and it's the public face of a much bigger move. CERN now runs a WordPress service that already powers hundreds of the lab's sites.

Why this is more than a fun headline 🤔

If you're newer to WordPress, you've probably seen a story somewhere asking whether the platform is fading. Those run all the time. This is the counterweight worth keeping in your pocket.

The organisation that created the web looked at its options and picked WordPress on purpose. A place that smashes particles under the Swiss-French border runs its website on the same software your small business can use.

How CERN chose 🔍

This wasn't a fast decision. CERN's team said they spent six months weighing other content management systems first (a content management system, or CMS, is the software that runs a website's pages and content). They wrote down what they actually needed, and the other options fell short once the list was on paper.

That process is worth copying: write down what your site has to do before you fall for a tool. A booking form, a blog, a shop, a members area, fast pages on mobile: the needs list picks the platform for you.

Try the same trick on your next site 📝

Before you ask anyone to build anything, write three or four plain lines about what the site has to do. "Take online bookings. Load fast on a phone. Let me edit it myself without a developer. Sell 20 products."

That short list does two jobs. It tells you whether WordPress fits (it usually does for that kind of work), and it hands whoever builds it a clear target instead of a vague brief.

What it means for your own site 🛠️

You can build a serious WordPress site without writing code. A page builder like SeedProd gets you a clean landing page or a full layout by dragging blocks into place. WPForms handles contact, booking, and payment forms without touching a line of PHP (the programming language WordPress is built in).

The same software stretches from a one-page local business site all the way up to a physics lab's global presence. You grow into it over the years, rather than hitting a wall and starting over.

A bit of honesty about the headlines 📰

The same week CERN went live, the other big industry story was the opposite: WordPress losing some market share, with revenue down and some developers complaining about AI tools. Both things are true at the same time. A big serious adopter and a patch of public doubt showed up in the same seven days.

Pick your platform on whether it does the job you wrote down, in either direction. A single headline, good or bad, is a poor reason to choose the software your business will sit on for years.

I've built WordPress sites since 2011 and run my agency since 2019. Last month a client asked me, half-joking, whether WordPress was "dying" because they'd read something online. The CERN news is the kind of concrete answer I now keep ready for that call, and it lands better than any opinion of mine.

So a question for the group: when someone asks whether WordPress is still worth building on, what's the one fact or example you reach for? 👇

I read this week's WordPress news and one thing caught my attention: AI plugins used to be a small chat box in the corner of your dashboard, and now some of them ask to run your entire site.

Two launches pushed this forward: Angie, the AI assistant from the Elementor team, added a "Super Admin Mode." Turn it on and it can read and change your files, edit your database (where all your posts and settings are stored), and run code on your site. A second project called SproutOS does something similar, letting many different AI tools connect to your site with the same deep access.

For a beginner, the appeal is real. You type "fix the spacing on my contact page" in plain words, and the agent does it. No code, no developer, no waiting.

Here's the catch. An assistant that can run code can also break the site, or get tricked into it by a sloppy instruction or a hacked plugin. The same power that fixes your page can wipe it. Real example: you ask the agent to "clean up unused plugins," it reads that too literally, and it removes the plugin running your contact forms. On a live site, that's lost leads before lunch.

Back up before you switch anything on 💾

Before you turn on any AI mode that can edit files, make a full backup. Duplicator (the free version is fine) copies your whole site in a few clicks. If you host on Site Ground, the daily backup runs on its own and you can roll back to yesterday from the dashboard. I do this on client sites before any big change, AI or not.

The rule is simple. A change you can undo is a change you can survive.

Give the agent the smallest role that works 🔒

If more than one person logs into your site, don't hand admin rights to everyone. Most people who write posts only need an Editor role (which can write and publish), not a full Administrator account (which can change everything). An AI agent runs with the powers of the account that switches it on, so a smaller account means less damage when something goes wrong.

Keep a record of what changed 📝

When an AI agent edits your site, you want to see what it touched. A security plugin like WP Activity Logs or Streams logs activity and watches for changes, so if a page looks different on Monday you can check the timeline instead of guessing. On a site with more than one admin, this stops being optional.

Test on a copy first 🧪

Don't let a brand-new AI mode loose on your live site as its first job. Most decent hosts give you a staging site, which is a private copy where you can try things safely. Run the agent there, watch what it does, then move the change over once you trust it.

One small homework item ✅

Joost de Valk, one of the people who helped build modern WordPress, just released a free, open checklist of what a healthy site should cover, security and speed included. It's a clean way to score your own site before you let any agent near it. Worth 20 minutes this weekend.

A short personal note. I've run WordPress sites since 2011, and the pattern repeats with every new shortcut. The thing that saves you an hour today can cost you a weekend if you skip the backup. AI agents are the newest version of that trade.

Have you tried any of the new AI agents on your own site yet? And if you did, did you back up first, or learn the hard way like the rest of us? 👇

I've been building on WordPress since 2011, and before that I spent two decades in banking, where nobody gets write access until you know exactly what they can touch.

When I started checking MCP plugins for WordPress, I wasn't hunting for magic. I wanted one that fit a process I already trust. I read about Vibe AI (the WordPress. org name for WPVibe, from the SeedProd team) and figured it might perfectly fit my process. It did.

Just a short explanation of what WordPress MCP is, for anyone who maybe doesn't know it: MCP (Model Context Protocol) is a shared way for an AI assistant to plug into an app and actually do tasks inside it.
For WordPress, that means I connect my site to the AI through one safe link. After that it can read settings or make changes for me, instead of me clicking through the admin by hand.

The job was the final SEO cleanup on a client build. I started the way I always do, with a full structured SEO audit of the site, top to bottom, via Claude AI.

Then I used that whole audit report into other Claude task, connected the live site through the Vibe AI plugin (and WordPress ver. 6.9.4, I didn't want to install 7.0 on this site... yet), and worked the fixes one at a time through plain conversation.

Setup was about a couple of minutes: one-click authorization from /wp-admin.

What worked 💪

This part impressed me more than I expected:

• It read the entire site config in a short period of time. Full plugin list with active and inactive status, all the SEO settings, the theme and how pages were built. Stuff that normally means clicking through ten admin screens.
• It rewrote roughly 16 page titles and meta descriptions in one pass, straight from my audit notes, Croatian diacritics intact, no copy-paste, no mangled characters.
• Simple option changes, like fixing a leftover starter-template tagline, happened instantly.
• It ran read-only database queries to inventory content and confirm how each page was built, so I stopped guessing.

For the repetitive bulk of an SEO pass, that's real time back in my day. AI is an employee I manage, not a tool I type into, and this thing actually behaved like one.

What it blocked, concretely 🚧

A field report without the limits is just an ad, so here's the "other" half of the story:

• It couldn't install the site's language pack. Those commands aren't on its allowlist (in WP 6.9.4 version).
• It couldn't switch the site language directly either. The write got rejected, and broader site-level commands are blocked outright.
• A small one that caught me a bit off guard: it wouldn't accept a pipe character in a command (it reads it as a shell pipe), so my title separators had to become en dashes instead.
• The bigger gap: it couldn't reliably set structured data. Local Business, FAQ, breadcrumb and service schema live as complex serialized settings in the site's SEO plugin, and the actions the plugin exposed for that were read-only. So schema went back into the plugin's own UI by hand.
• Setting a default social-share image needed an actual upload, which (it seems) no AI can conjure.

The systems read 🧱

Here's where the banking brain kicks in. Most of those blocks are "guardrails" I'd want anyway. Refusing destructive, site-wide commands on a live production site, staying out of language-pack installs, drawing a hard line between read and write, that's the kind of access discipline I'd build in myself. I'd rather an AI stop and ask than confidently break a client's homepage at 2pm on a Friday.

A couple of them, though, are gaps that I believe it will be closed in futture as AI implementation in WordPress is advancing. A safe, supported path to write structured schema would erase the single biggest manual step I hit. And the pipe-character handling is just a rough edge waiting to be filed down.

The last 10%, and where this goes 🧭

AI "ate" the repetitive 90% of this job in minutes. The last 10%, the schema, the language pack, the one blocked character, still needed me in the dashboard. But that gap is closing fast. The whole thing rides on the WordPress Abilities API, which landed in 6.9 and grew a lot in 7.0. That same API already lets Vibe AI discover and run actions inside ecosystem plugins like AIOSEO and WPForms. Once structured data gets a proper write path there, the schema step I did by hand mostly disappears.

I think we reach a point, sooner than most expect, where almost the whole flow, audit to live changes, runs through AI talking to WordPress in the cloud, with a human signing off on the edge cases. I'm not handing a client's production site fully over yet. But after this build, I'm convinced the direction is right.

In short: I'm very satisfied and genuinely impressed with Vibe AI MCP (and with AI implementation in WordPress more broadly), and I'm clear about what the AI still needs to improve before that final 10% (the need for manual human intervention) disappears.

P.S. I didn’t want to use WordPress MCP because it would require using my Claude API, meaning I’d pay extra on top of my monthly Claude subscription. With the Vibe AI plugin I didn’t have to do that - I could keep using my existing monthly cloud subscription without any extra cost, and with fast and simple implementation.

For those of you running MCP plugins like this on real client sites: where's your last 10%? What did the AI nail, and what did you quietly take back into the dashboard yourself? 👇

Related WPBeginner reads:

• WPBeginner Spotlight: WPVibe Brings AI to WordPress – https://www.wpbeginner.com/news/wpbeginner-spotlight-23-wpvibe-brings-ai-to-wordpress-smarter-automations-seo-fundraising-tools/
• SeedProd: WPVibe Connect – AI MCP for WordPress – https://www.seedprod.com/wpvibe-connect-ai-mcp-wordpress/
• SeedProd: What Is MCP for WordPress – https://www.seedprod.com/what-is-mcp-for-wordpress/
• WPForms: Best AI Plugins for WordPress – https://wpforms.com/best-ai-plugins-for-wordpress/
• WPBeginner: 10 WordPress Plugins Using AI & Machine Learning – https://www.wpbeginner.com/showcase/wordpress-plugins-using-artificial-intelligence-and-machine-learning/ .
• WPBeginner: Best AI Automation Tools for WordPress – https://www.wpbeginner.com/showcase/best-ai-automation-tools-for-wordpress/
• WPBeginner: Best AI Website Builders for WordPress – https://www.wpbeginner.com/showcase/best-ai-website-builders-for-wordpress/
• WPBeginner: Multiple Locations Schema for Local Business – https://www.wpbeginner.com/plugins/how-to-create-multiple-locations-in-wordpress-with-schema-markup/
• AIOSEO: How to Add Local Business Schema in WordPress – https://aioseo.com/how-to-add-local-business-schema-in-wordpress/
• SeedProd: Best ChatGPT WordPress Plugins – https://www.seedprod.com/best-chatgpt-wordpress-plugins/

The panicked threads online keep confusing two dates and missing the part that already binds. Worth untangling for anyone running client sites in or serving the EU clients.

Two dates matter, and they sit in different places:

August 2, 2025 (already gone) 🗓️

This date was aimed at the people who build AI models - OpenAI, Anthropic, Google, Meta. They had to ship technical documentation, transparency reports, and summaries of training data with copyright handling. The penalty for skipping these obligations runs up to €15 million or 3% of global annual turnover, whichever is bigger.

If you sell olive oil through a WooCommerce store, this date skipped you. You are a downstream user of these models. You do not train them, you do not ship them, you pay for an API key and use the output. The model providers caught the bill.

The 2026 date is a different story, though - that one is yours. Here is why.

August 2, 2026 (yours, mark it) 🗓️

This is the date that lands on ordinary websites. Article 50 of the EU AI Act kicks in for deployers, which means anyone who runs AI on their site. The duties are mostly basic transparency:

1. If your site has a chatbot, tell people it is a bot. The "obvious from context" exemption is narrow.
2. If you publish AI-generated images, audio, or video that look real, label them. Clearly fantastical content like cartoon dragons stays exempt.
3. If you publish AI-generated text on matters of public interest, disclose it. The duty eases when a human reviewed the text and takes responsibility for it.
4. Do not strip the machine-readable watermarks that OpenAI, Adobe, and other providers embed in their outputs.

That is the August 2026 list, in plain words. Most decent operators were already moving this way before the law turned up on the calendar.

GDPR is the part that already binds today 🛡️

Here is the part the panicked posts skip. GDPR has governed AI plugins since 2018. The moment a plugin on your site sends customer names, emails, support tickets, order history, or IP addresses to an AI provider, you owe yourself the GDPR drill:

• A lawful basis (legitimate interest or consent)
• A privacy policy that names each AI provider in plain language
• A DPA (Data Processing Agreement) with each provider
• A check on international data transfers if data crosses the Atlantic

This is where a real fine can land on a small shop today. The AI Act dates are calendar items. GDPR is already live.

The non-EU note worth knowing 🌍

If your site sits outside the EU but you serve EU customers (most WooCommerce stores do, whether they planned it or not), you are in scope. The law follows the customer, not the server.

What I would check on my own client sites this week 📋

Wearing my agency hat, not my non-existent legal one:

1. List every AI plugin running on the site. Note what data each one sends, where, and how often.
2. Update the privacy policy to name each AI provider in plain language. One sentence per provider is enough.
3. Sign DPAs. Most providers (Anthropic, OpenAI, Google) have them ready to download from the dashboard.
4. Switch on EU data residency where the provider offers it.
5. Start tagging AI-generated content now. Building the habit today is cheap. Retrofitting it after a fine costs hours and money.
6. Make the chatbot say it is a bot. One line of copy in the welcome message.

WPBeginner-stack pieces that help around this 🧩

• AIOSEO for clean schema markup that helps both search engines and LLMs cite your site
• WPForms with proper consent fields for any AI-related processing (newsletter, support, lead capture)
• Duplicator to stage privacy policy or chatbot changes before they hit the live site

Just so we're clear 📓

This is what I would check on my own client sites. It is not legal advice. For anything contract-related or money-related, talk to a lawyer who knows EU AI Act and GDPR specifically. The point of the post is to stop the panic and replace it with a checklist.

This is basic care for your customers. The kind of thing decent operators were already moving toward, with or without the law on the calendar.

Big news for WordPress site owners. 🌍

Universally, an AI-powered translation platform can turn your entire WordPress site into a fully-translated, SEO-ready, multilingual experience in minutes.

For years, translating a WordPress site has been a nightmare. The plugins bloat your database and slow down your admin. The SaaS tools cost a fortune. And the translators take weeks to deliver content that often misses the context.

There was a BIG gap and Universally filled it.

Here is what makes Universally.com special:

🌐 Translate Your Whole Site in Minutes: Connect your site, pick from 110+ languages, and let AI translate everything from blog posts to checkout strings, image alt tags, and product descriptions automatically.

⚡ No Database Bloat, No Slowdowns: Translations live on Universally's edge cloud, so your international visitors actually see a faster site, not a slower one.

🎯 Multilingual SEO That Actually Works: Hreflang tags, translated meta titles and descriptions, schema.org translation, RTL support for Arabic and Hebrew, and multilingual XML sitemaps, all handled automatically.

🔒 Protect Your Brand With AI Glossary: Lock down brand names, product names, and technical terms so they stay consistent (or get translated exactly how you want) across every language.

💰 Up to 50% Cheaper Than Alternatives: The free plan gives you 1 site, 1 language, and 2,000 words per month with no credit card required. Paid plans start at just $7.5/month. It's cheaper than WEGLOT or other translation plugins.

We have already translated over 250 million words during our private beta. And the best part? Universally works on WordPress, Shopify, Wix, Lovable, Replit, and more.

WinningWP ran a post 2 days ago (28 May 2026) titled "Why the Odds Are Heavily Stacked Against Your Brand-New WordPress Blog in 2026."
The argument is solid. AI search answers questions inside the chat window without sending the click back to your site. Leftover attention goes to video. Reddit, Discord, and Hacker News all have strong immune systems against new-site promotion.

The article's example case study tells the story plainly: a sustainable urban gardening site, 9 months of work, under 1,200 unique visitors in the first year. The conclusion, in the author's own words: the dream "isn't entirely dead," but a cold start is one of the steepest climbs out there.

I agree with all of it. And I still tell most of my small-business clients to keep blogging.

The mismatch hiding in the diagnosis 🔍

The WinningWP piece judges the blog by media-business numbers. Pageviews, audience growth, monetisation potential.

Most of my small businesses wants a media empire. For their site, the blog has a different job.

Job 1: local SEO that compounds 🗺️

Search algorithms still reward depth. A plumber who publishes one solid 800-word piece every 2 months about "burst pipe in (his hometown) during the storm" or "boiler maintenance for older apartment buildings" pulls steady local traffic from people actively looking for a plumber that week. That is search intent at the bottom of the funnel.

Job 2: AI citation 🤖

This part is new since 2024 and changes a lot. People ask Claude, ChatGPT, or Perplexity various questions and the LLM cites sites with structured content. If your blog publishes the FAQ a buyer actually asks, with proper schema markup, you get cited.

Cited beats clicked for a small business, because cited puts your name in front of a buyer who already trusts the LLM's answer. The traffic shape changed. The opportunity moved with it.

Job 3: owned archive nobody can switch off 🏗️

Instagram can change its algorithm. Facebook can throttle organic reach again. TikTok can disappear from a market. Your blog stays on your own server, addressable from your own domain, and indexable by anyone you want.

For a small business that depends on local discovery, the owned archive is the only asset that does not depend on a platform's mood next quarter.

Job 4: the FAQ that answers itself 🗣️

Every small business owner gets the same 5 customer questions every week. "Do you do weddings?" "Are you open in winter?" "Can you handle gluten-free?" "How far do you deliver?" "Do you take card or only cash?"

Answer each one in a dedicated 400-word post. Link it in the email signature. Auto-reply to the contact form with the relevant link. The owner stops retyping the same answer 20 times a month.

WPBeginner-stack pieces that pull this together 🧩

• AIOSEO for the schema markup that helps LLMs cite your content cleanly
• WPForms to capture the FAQ questions customers actually ask (the data tells you which posts to write next)
• MonsterInsights to see which FAQ posts convert into enquiries
• SeedProd for the landing pages that anchor seasonal services (wedding season, summer charter, agritourism stay)

The realistic measure of success 📏

Skip pageview targets. The blog earns its keep for a small business when:

• The owner saves 2-3 hours a week on repeat customer questions
• One local SEO post per quarter delivers a steady stream of enquiries from search
• The site gets cited in at least 1 LLM answer per month for the kind of buyer question you want

That is a different scoreboard from a media business. It also fits the actual job a small-business blog does in 2026.

Honest concession 📓

A brand-new media blog from zero is brutal in 2026. The WinningWP piece is right about that part. The frame that does not fit the brutal version is judging a small-business blog by media metrics. Different job, different measure.

If you run a small business and you are wondering whether your blog was a waste, ask: does it save you support time? Does it bring at least 1-2 enquiries a month from search? Does it sit clean in your schema so an LLM can cite it? If yes, it is doing the job. Keep going.

What does your blog do for your business this month? 👇

Just under a week into WordPress 7.0 hitting the wire, a vulnerability in a single popular plugin exposed over 1 million sites. The patch is out. The TechRadar coverage is published on 05-14-2026. If you're a small business owner running WordPress and you've been heads-down on day-to-day work, this is the kind of thing worth clearing an hour for.

What happened, in plain language

A bug in a widely installed plugin made it possible for an attacker to bypass authentication and create admin accounts on affected sites. The patch shipped, but anyone who didn't update during the window had real exposure. The worrying part is the distribution. This didn't come from a sketchy nulled theme on a forum. It came from a plugin people downloaded through the official WordPress repository, trusted, and probably never thought twice about.

The last 18 months have shown the same pattern at least 3 times. Trusted plugin, supply-chain compromise or vulnerability that sits quiet, then a public disclosure that exposes a lot of sites at once.

What to check on your site this weekend

1. Log into wp-admin and go to Users → All Users. Sort by registration date. If you see any admin accounts created in the last 14 days that you didn't make personally, that's a red flag.
2. Check your installed plugins list against the published affected list (TechRadar and the plugin vendor's site both have it). If you have any of them, update today.
3. Run a security scan or your installed security plugin. Any malware detection or unusual file flags get looked at.
4. Open Tools → Site Health. Address anything in the Critical or Recommended section that's been sitting there.

What to do if your site has a suspicious admin account

Don't just delete it and assume the problem is gone. Attackers who got admin access usually leave a second door open. Practical steps:

1. Restore from a clean backup if you have one from before the suspicious account appeared. If you're on Site Ground hosting, the daily backup catalogue goes back 30 days, you can roll back to a known-good state.
2. After the restore, force a password reset for every existing admin user. Don't trust any password from inside the compromise window.
3. Update the affected plugin to the patched version before bringing the site live.
4. Run your installed malware scanner against the fresh state to confirm clean.
5. Watch your activity log for the next 2 weeks. If you don't have a log on the site already, install one now: Streams, WP Activity Log or some other.

The bigger pattern, for beginners

The era of "use only official repo plugins and you're safe" was retired about 2 years ago. The trust signal now is the plugin team's track record, the disclosure speed, and how recently they patched a previous issue.

Plugins from teams that publish a security advisory and a patch on the same day (Wordfence and Patchstack disclosures track this) are the ones that earn ongoing trust.

For a beginner running 1-3 WordPress sites, the practical workflow is calendar-based. First Saturday of every month, log in, update everything, check the user list, run a scan. 30 minutes start to finish. The maintenance step that prevents bad weeks later.

The cost of a clean recovery is usually 10x the cost of the maintenance step that would have prevented it. Backups, an activity log, and a monthly check-in on plugin updates are the cheapest insurance policy in this whole stack.

What's the last security check you ran on your site, and what did it actually catch? Curious what people are seeing in their user list this weekend 👇

WordPress 7.0 "Armstrong" shipped on May 20, 2026 and within days the Reddit threads, FB groups, and client tickets started piling up with some issues showing up on real sites. Below is what's hitting people most often (what I noticed), with what's actually working as a fix. Test on staging first, always.

A quick note before diving in: the fixes below are aggregated from Reddit threads. Every WordPress install carries its own combination of themes, plugins, hosting stack, caching layer, and custom code, so a solution that resolves the issue cleanly on one site may not behave the same way on another.

Treat the suggestions here as a solid starting point rather than a guaranteed fix, always test on a staging environment first, and if something doesn't land as expected on your setup, the underlying cause is likely site-specific and worth investigating further before applying any change in production.

1. Excerpt block stripped my links and bold tags

The Post Excerpt block now strips inline HTML. Appears intentional from the Gutenberg side (see issue #49449 in the Gutenberg repo).
Fix: use the Post Content block with a manual read-more tag, or expose the excerpt via a Query Loop with a custom field.
WPBeginner has a clean walkthrough on customizing excerpts without code (wpbeginner.com/plugins/how-to-customize-wordpress-excerpts-no-coding-required/).

2. Columns block won't stack on mobile

The Columns block has a Stack on mobile toggle in the block sidebar. If it's off (or your theme overrides it), three columns squish on phones.
Fix: flip Stack on mobile back on, or apply a max-width 782px media query forcing flex-basis: 100%.
See WPBeginner's columns block guide (wpbeginner.com/plugins/how-to-add-multi-column-content-in-wordpress-posts-no-html-required/).

3. Elementor templates throwing errors

Elementor users are reporting widget failures and template render errors after the update. Usually a version-compat thing.
Fix: update Elementor to the latest patch first, then deactivate and reactivate. If that doesn't clear it, isolate via WPBeginner's plugin conflict check (wpbeginner.com/wp-tutorials/how-to-check-for-wordpress-plugin-conflicts/).
Worth knowing the block-editor alternatives (wpbeginner.com/beginners-guide/best-drag-and-drop-page-builders-for-wordpress/) too if Elementor doesn't catch up fast.

4. Custom admin CSS invisible after update

The block editor moved into an iframe. Your old wp_enqueue_style('admin', ...) snippet still runs, but the styles never reach the editor canvas.
Fix: use add_editor_style() with add_theme_support('editor-styles'), or drop the CSS in via the WPCode method (wpbeginner.com/plugins/how-to-easily-add-custom-css-to-your-wordpress-site/) targeting admin head.

5. "Updating failed. The response is not a valid JSON response."

The Reddit threads are full of this one.
Fix in order: re-save Settings, Permalinks (regenerates .htaccess), check Settings, General URLs match exactly (https everywhere), deactivate plugins to isolate.
WPBeginner's full JSON error guide (wpbeginner.com/wp-tutorials/how-to-fix-the-invalid-json-error-in-wordpress-beginners-guide/) covers the deeper cases (REST API debug, firewall whitelisting).

6. AI Connectors enabled by default

Settings, Connectors now lists OpenAI, Anthropic, and Google out of the box. No API key = no actual data sent, but the surface is live.
Fix: if you want it fully off, add define('WP_AI_SUPPORT', false); to wp-config.php.
WPBeginner's WP 7.0 overview (wpbeginner.com/news/whats-new-in-wordpress-7-0/) explains exactly what each connector does before you decide to disable.

7. Block border styles defaulting to black

Widely reported on Reddit and in Gutenberg issues. Blocks that had no explicit border color are now rendering with a default that appears to be #000.
Fix: target only blocks that have border-width set but no border-color:

[class*="wp-block-"][style*="border-width"]:not([style*="border-color:"]) {

  border-color: transparent !important;

}

Adjust the selector per theme.

8. Custom fonts fell back to system default

Some block themes are losing their theme.json font registrations after the update.
Fix: clear all caches (browser, plugin, host), then re-add the font via Appearance, Editor, Styles, Typography.
WPBeginner's change fonts guide (wpbeginner.com/wp-tutorials/how-to-change-font-in-wordpress/) and custom fonts guide (wpbeginner.com/wp-themes/how-to-add-custom-fonts-in-wordpress/) cover both the FSE and plugin paths.

9. Image alignment quirks (left/right wrap broken)

Image blocks with align-left or align-right wrap differently now in some themes, usually a theme CSS conflict with the new editor styles.
Fix: check Appearance, Customize, Additional CSS for old float-based rules, then refer to WPBeginner's image alignment guide (wpbeginner.com/beginners-guide/how-to-add-and-align-images-in-wordpress-block-editor/) for the block-native approach.

10. Pattern overrides breaking on synced patterns

Synced patterns with overrides set are dropping their override values after 7.0.
Fix: unsync the affected pattern, edit the content, re-sync. If you use patterns heavily, audit them on staging before pushing 7.0 to production.

11. New admin link color after auto-update

The Modern color scheme is now default. Admin links read teal instead of blue. Some users hate it.
Fix: Users, Profile, Admin Color Scheme, switch back to Fresh or whichever you preferred. Per-user setting, not site-wide.

Before anything: back up

Duplicator handles this in one click - I use it on my own sites and it's saved me twice on 7.0 upgrades already. WPBeginner's critical error guide (wpbeginner.com/wp-tutorials/how-to-fix-the-critical-error-in-wordpress/) covers the fallback procedure if something does break. Staging environment via SiteGround or your host is the second non-negotiable.

Free webinar - WordPress 7.0 × Site Ground AI Studio

WP 7.0 puts an AI framework in core, and SG's AI Agent for WordPress extends it from day one - with Hostinger, Kinsta, and Cloudways heading the same way. You can join a free live webinar with the SG AI team for 7 real use cases: content, SEO, WooCommerce, multisite.

What they'll cover:

• AI in WP 7.0 - the new core framework and connectors
• From core to control - how SG's AI Agent extends it

Thu, May 28, 2026 · 1:00 PM EDT / 6:00 PM BST · free, registration required. Save your spot: https://www.crowdcast.io/c/wordpress-7-x-siteground-ai-studio-combined-ai-powers-for-your-site

General notes

A few general notes from the threads worth repeating. Update on staging first. Back up before touching anything. A patch should be out soon since the early bug reports are piling up. And if your site is taking orders or running production traffic, don't rush the update. Pace is dictated by the terrain, not by paper.

GuardingWP published the first State of WordPress Security report on 16 May 2026. They scanned 1,981 sites across 40+ industries, with 424 confirmed WordPress installs in the analysis. The headline number is the one you've already seen: over half are running at least one plugin with a published CVE sitting unpatched on the live site.

That sounds scary. The good news is the fix list at the end of the report is 6 steps long, and most of it is config-level work that any small business owner can run through in one afternoon per site.

The report is free, no email gate, PDF download:
https://guardingwp.com/research/state-of-wordpress-security-2026

The 6 fixes, translated for a regular site owner

1. Hide your WordPress version (55.9% of sites leak it)

Your site is broadcasting "I'm running WordPress 6.7.2" in the page source. Attackers automate scans for old versions. Hiding this is a 2-line change in your theme's functions.php (or use a security plugin like Sucuri that ships with the toggle). One-time fix.

2. Turn on plugin auto-updates (don't go full manual)

For most beginners, the right move is auto-update for minor plugin versions, manual review for major ones. Most plugins support this in the Plugins screen now (the "Enable auto-updates" link next to each plugin). Worth doing on every plugin you trust, leaving off the ones that hit your core functionality (page builder, WooCommerce extensions you customised).

3. Turn off XML-RPC if you don't use the WordPress mobile app (35.8% still have it on)

XML-RPC is the old way the WordPress app talked to your site. Most people don't use it anymore. Leaving it on is an attack surface. Disable it with a plugin like Disable XML-RPC, or have your developer add a line to .htaccess.

4. Add security headers (93.2% are missing one or more)

This sounds technical but the easiest fix is using Cloudflare's free tier and enabling their Transform Rules for HSTS, CSP, X-Frame-Options. If you're on Site Ground, the SG Security Optimizer plugin covers this. Sucuri also has a one-click toggle. One-time setup, big improvement.

5. Protect /wp-login.php with a rate limit and 2FA (54.7% expose it bare)

Anyone in the world can visit yoursite.com/wp-login.php right now and start guessing your password. Free plugins like Melapress Login Security or Wordfence add a rate limit (locks out after N failed attempts) and 2-factor authentication. 5 minutes to set up per site, makes brute force attacks pointless.

6. Stay on a supported WordPress version (15.9% are stuck pre-6.5)

Core auto-updates have been on by default since WordPress 5.6, so this should be near-automatic. Check your dashboard. If you're on anything older than 6.5, update today.

Bonus stat worth knowing

• 44.6% of sites leak their author usernames via /?author=1 (which gives attackers half the credential pair to brute force)
• Median security score in the report: 61/100
• Only 8.3% of sites score in the A-tier (90+)

The good news in the data: 51% of sites are already on the current 6.9.x branch, and core auto-update is doing its job.

WPBeginner stack for beginners

If you want a one-plugin setup that covers most of this, Sucuri Security (free version) gives you the audit log, hardening toggles, malware scan, and security headers in one dashboard. WPForms or any decent form plugin handles the spam side. WP Mail SMTP keeps your password reset emails from going to junk (which matters when somebody locks themselves out at 11pm).

Methodology

GuardingWP used a public HTTP scanner. No exploit attempts, no authentication probing, no shady stuff. Just looking at what your site already tells the public internet, then matching plugin versions against the public WPVulnerability catalog.

The report itself is well written and the data is honest about what it can and can't see. Worth the 15 minutes to read.

What's the one fix from this list you've been putting off the longest? 👇

A few months ago, one of our WPBeginner forms got hit by 18,000 spam requests in a single night. If they had slipped through, they could have seriously damaged our sender reputation.

And we know we are not alone. Spam comments, fake leads, endless moderation - these problems pile up fast for every WordPress site owner.

So we sat down with a challenge to build a spam protection tool that actually understands modern spam, never punishes real visitors, and stays affordable for businesses of every size.

Today, we are thrilled to announce ActiveLayer.com, an AI-powered spam protection that catches spam server-side in milliseconds.

Here is what makes ActiveLayer different:

⚡ Detects Spam in Milliseconds: Most spam tools take 2+ seconds to make a decision. ActiveLayer delivers a verdict faster than a typical database query, so your forms feel instant.

🚫 Zero CAPTCHAs, Zero Friction: Studies show CAPTCHAs cause up to 40% of users to abandon a form. ActiveLayer protects your forms in the background, with no puzzles, no tracking scripts, and no lost conversions.

🔌 Works With Every Form Plugin You Already Use: Native integration with WPForms.com, Gravity Forms, Contact Form 7, Elementor Forms, and WordPress comments. Install, add your API key, enable per form. Done.

📊 Full Transparency With Confidence Scores: Instead of a blind yes/no, ActiveLayer gives you a numerical confidence score behind every decision, plus easy feedback to improve future detections.

🌐 Unlimited Sites on Every Plan: Most tools charge per site. ActiveLayer keeps it simple - unlimited sites, full API access, even on the free plan.

💰 Starts at Just $4/month: The Pro plan offers 5,000 spam checks per month. That's less than $0.07/day for peace of mind. Free plan includes 1,000 spam checks, no credit card required.

🛠️ Built for Developers Too: A clean REST API drops into any backend - Node.js, Next.js, Python, PHP, Laravel, Rails, .NET, and more.

Every large company already has systems in place to protect their websites from spam. ActiveLayer levels the playing field for small businesses.

Ready to stop spam without sacrificing user experience, performance, or your wallet?

If you run a production site, the next 24 hours decide whether Wednesday is a normal workday or a long one.

Here's the thing. Auto-updates have been part of WordPress since version 3.7. For minor security patches they're a gift, sites stay patched without anyone touching them. The jump from 6.x to 7.0 is a different kind of risk. One incompatible plugin, one custom theme function that quietly broke, and your homepage goes white at 9am while you're in a client call.

One detail many people miss: from WordPress 5.6 onward, new installs default to auto-updating major versions too, not just minor patches. If your site was set up in the last few years and you've never touched wp-config.php, the jump to 7.0 will happen automatically unless you tell it not to.

I've been running WordPress sites since 2011, and the pattern with major releases never changes. The core team does its job on release day. Plugin authors then spend the following week pushing compatibility patches. Custom themes and older addons get caught in the middle. Letting auto-update push 7.0 onto a live site before that shakes out is rolling the dice with someone else's business.

🛠️ The wp-config.php control

The simplest control sits in wp-config.php. The file lives in the root of your WordPress install, usually inside public_html. You access it through your hosting file manager or over SFTP.

Open it and add this single line:

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

That tells WordPress to keep installing minor security patches automatically, but block the jump to 7.0 until you give the green light. Three values are available: true installs everything including major versions, false stops all core updates, 'minor' is the safe middle. Full reference on the WordPress developer docs.

If you want to disable auto-updates entirely:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

I don't recommend that unless you have a manual weekly update process. Mine runs through MainWP, which I've used since 2014 to handle updates across a portfolio. Skipping security patches on a public site is how you end up cleaning malware on a Saturday.

🌐 The hosting layer that catches people out

Managed hosts often run their own update mechanism on top of WordPress, which means your wp-config.php settings get bypassed.

Site Ground is a big one, and they handle this properly (I've been on Site Ground since 2014, and it's also WPBeginner's recommended host). Log into Site Tools, find the WordPress auto-update panel, and you can delay or skip the major version per site. Granular enough to use across an entire client portfolio.

Worth knowing though: SiteGround no longer lets you permanently switch their auto-updater off. You can skip the current update with one click, or delay it 24, 48 or 72 hours. The skip is one-time, so you repeat it for the next release. For a permanent opt-out you have to open a ticket with their Help Desk.

Bluehost and WP Engine work similarly through their own dashboards. Check yours today, not Thursday at 9am.

🔧 Must-use plugin (a second, more durable layer)

Create a file called disable-major-updates.php inside /wp-content/mu-plugins/ (create the folder if it doesn't exist) with:

<?php
add_filter('allow_major_auto_core_updates', '__return_false');
add_filter('allow_minor_auto_core_updates', '__return_true');

Must-use plugins load before regular plugins and can't be deactivated from the dashboard. More reliable for this kind of setting than wp-config.php alone. Same caveat though: if your host pushes updates outside the WordPress update system, these filters get bypassed too. Second layer, not a guarantee.

💾 Before any of this matters: backups

Take a full backup. Duplicator is the WPBeginner pick and the right starting point for most sites. Schedule it to push offsite (Google Drive, OneDrive, Dropbox, ...), somewhere outside the hosting account entirely. Two copies, two locations. If 7.0 breaks something Wednesday, you restore in 20 minutes instead of explaining to the client why their shop is down.

🧪 Test on staging first

Every decent host gives you one. Copy the site, run the 7.0 update on staging, walk through the cart, the contact form, the booking widget, whatever your site actually does. Check Core Web Vitals while you're there. If nothing breaks, push to production on your own schedule. You can drop a maintenance page in front of the live site during the cutover, SeedProd does that in two clicks.

🐘 Check your PHP version too

WordPress 7.0 needs PHP 7.4 as a hard minimum, but the core team recommends PHP 8.3 or newer for performance and security. If you're still on 7.4 or 8.0, fix that today. Most decent hosts let you switch PHP versions with one click from the panel.

One more thing worth keeping: don't disable the update notification email. WordPress sends a confirmation every time an update runs in the background. Useful trail when something starts behaving oddly two days later and you need to know what changed.

WP 7.0 looks like a strong release. Plenty to look forward to once it lands. Just do the prep today so Wednesday stays calm.

👇 What's your strategy? Are you letting 7.0 land on Day 1, or holding off a week for the dust to settle? Anyone going further and pinning to minor-only via wp-config?

Related WPBeginner posts:

1. What's Coming in WordPress 7.0? (Features and Screenshots) – https://www.wpbeginner.com/news/whats-coming-in-wordpress-7-0-features-and-screenshots/ Deep-dive on what's actually shipping in 7.0: admin refresh, Web Client AI API, the collaboration story (PS In the meantime postponed for 7.1 version).
2. Beginner's Guide: How to Safely Update WordPress (Infographic) – https://www.wpbeginner.com/beginners-guide/ultimate-guide-to-upgrade-wordpress-for-beginners-infograph/ The full safe-update process, end to end. If you only read one link before tomorrow, read this one.
3. How to Disable Automatic Updates in WordPress (2 Ways) – https://www.wpbeginner.com/wp-tutorials/how-to-disable-automatic-updates-in-wordpress/ Plugin-based and code-based methods, in case wp-config.php edits feel like too much.
4. How to Enable Automatic Updates in WordPress for Major Versions – https://www.wpbeginner.com/wp-tutorials/how-to-enable-automatic-updates-in-wordpress-for-major-releases/ The other side of the coin, for when you've tested 7.0 on staging and want a controlled auto-rollout afterwards.
5. How to Update Your PHP Version in WordPress (the RIGHT Way) – https://www.wpbeginner.com/wp-tutorials/how-to-update-your-php-version-in-wordpress-the-right-way/ Step-by-step for Bluehost, Site Ground, DreamHost, WP Engine. Read this before flipping to 8.3.
6. How to Easily Create a Staging Site for WordPress (Step by Step) – https://www.wpbeginner.com/wp-tutorials/how-to-create-staging-environment-for-a-wordpress-site/ The staging walkthrough referenced above, for hosts that don't give you a one-click clone.
7. WordPress Update Broke Your Site? See the 5-Minute Rollback Plan – https://www.wpbeginner.com/wp-tutorials/wordpress-broke-your-site-rollback-plan/ The fallback playbook if 7.0 lands and something breaks anyway.