I’ve started to notice that some of the biggest WordPress headaches usually come from small things that were ignored earlier.

For me, keeping plugins/themes updated, removing things that aren’t actually being used, and having regular backups has prevented a few problems from becoming much bigger ones.

I’m curious what it’s been for other WordPress users and developers.

What’s one WordPress habit or practice that has saved you from a major issue later on?

With AI tools like Claude, Codex, Cursor, etc. becoming so common, I’m curious what actual WP developers are doing these days.

Are you still using Elementor/Bricks/Divi, or moving toward custom themes, templates, Gutenberg blocks + ACF?

And how much has AI changed your workflow?

Would love to hear your actual stack and type of projects you work on.

With all the recent security issues stemming from ai and whatever else in the WordPress environment, and so many threads in this group being security focused, I wonder if a dedicated WordPress security group is in order.

No, I'm not suited to create it, but would be willing to be involved in moderation.

I've had an old website running on Wordpress for years, and I'm finally building a new small site from scratch, but things have changed a lot from when I initially learned the system. I'm trying to do what I thought would be the very simple task of adjusting the size and height of an HTML block I dropped in the editor, but despite searching, I haven't been able to find a way to do this. The block seems to have a fixed, very short height, and a width constrained to a block container I can't identify.

Could anyone point me in the right direction for how to manually set the height and width for an HTML block containing an iframe element?

What is everyone using for documentation? I’m talking about like to document custom functions or features you’ve added that you (or someone else later on) would benefit from. I use external documentation in a CRM for my own knowledge base, but if seems like there should be some sort of developer’s guide we can leave in WP for future reference.

Wordfence isn’t working properly on my shared hosting. The scan gets stuck and doesn’t complete. What should I do? Is there a good alternative security plugin that works better on shared hosting?

When you're looking to purchase a Pro plugin for its paid features, how do you know it works for you?

Do you go by the feature list and docs, contact support with questions, buy it and refund it if it doesn't fit, or look for a way to test-drive the Pro version first? And if there's no way to try it, does that ever stop you from buying?

Esta es mi tercera publicación. Mi proyecto va bien, pero esto me ha resultado frustrante (además de haberme adentrado en el desarrollo de WordPress sin tener mucha experiencia).

Mi cliente no tenía imágenes ni texto, así que primero busqué una plantilla. Pero luego me di cuenta de que sería mejor crear el diseño yo mismo por lo "sencillo" que era, y porque buscar plantillas y luego adaptarlas supone un trabajo extra.

El problema es que tuve que empezar a diseñar sin los recursos del cliente, mientras que él esperaba una plantilla para saber qué debía enviarme. Al final, le pedí a la IA que generara una imagen y empecé a desarrollar algo muy parecido. Pero aunque ya he añadido el texto y las imágenes del cliente, de repente siento que, con mi próximo proyecto, no empezaré hasta que el cliente me haya dado todo.

¿Cómo sueles empezar?

Me encantaría saber tu opinión.

EDIT: I should mention that they gave me a couple of website examples, which made finding a template that matched them quite difficult. And filling in a site like the ones they showed me would still have required their content and resources.

Hi everyone,

I’m currently setting up a site and I'm looking for recommendations, plugins, or tutorials to get a landing page builder experience similar to MailerLite inside WordPress.

I've tried a few traditional page builders and tools, but most of them either feel too bloated, overly complex for simple sales/opt-in pages, or lock essential landing features behind expensive paywalls.

What I need is a builder is that it's clean, intuitive, fast, and completely focused on high-converting landing pages rather than heavy corporate websites.

Does anyone know of a plugin combination, a specific block-based workflow, or tutorials that can help replicate this minimalist, streamlined landing page experience in WordPress?

Any suggestions or setups you use for this would be greatly appreciated!

So exploring the new 7.1 stuff, and while more direct access to the patterns and such is nice, the confusing and concerning part is this new "design" option on the right when you first click the "edit site" and get options to move your template blocks around.

That design section seems to have some default new patterns that aren't part of the theme I'm testing with, and it's unclear if these would edit the core theme templates, or just provide another option?

I can't find any documentation on these, on either how to add to them or remove this entirely so some user doesn't torch the theme for all other uses on our multi-site instance.

Anyone found info on this?

Hi Reddit Community, I'm in the blogging field from 2007 and you may be laughing that I joined reddit today, the main purpose to join reddit is that I want to explore new ways of blogging, I have done many type of blogging, like event blogging, pSEO Blogging, I have purchased many books and methods and create my own methods, mostly my income is through google adsense, from last 4 months I'm focusing on creating content through AI and using my google sheet+apps script+wordpress rest api for content scheduling, I think recent time is game changing time for bloggers, if they spend some budget on AI Agents for research and content scraping, they can change their life in online field, how many of you agree and please also share if you are working on google sheet + apps script

Hey, I’m very new to Wordpress and not very tech savvy. I have been trying to upload a pdf to my website without having this toolbar (in the red circle) visible. Been trying to find answers online to no avail. I don’t have Adobe which a lot of guides seemed to have.

Is this possible without plugins?

Thank you

Exactly as the title says, I can't update WordPress right now because, even after going through all the correct channels to transfer my website from Hostinger to my new host IONOS (yes I know IONOS isn't great but it's cheap and I'm broke), every time I attempt to update WordPress, I get the following error:

"Download failed.: cURL error 28: Failed to connect to wpdownloads.hostinger.io port 443 after 10006 ms: Timeout was reached"

It's clearly still trying to download things through Hostinger, despite the website having been fully transferred away from Hostinger, domain, database and filesystem.

I've cleared all references to Hostinger from the database, removed all Hostinger-related plugins, there shouldn't be anything left of Hostinger in this website, but obviously I've missed something. Does anyone have any idea where this final remnant of Hostinger's code could be hiding in my website?

This is preventing me from keeping my website up-to-date so it's a very pressing issue for me. I'd appreciate any and all help!

Im doing an article that i want to have detail drop downs so readers can click on it if they want to see the deails of something.

When i use only words and preview the detail drop downs show.

When i add in an HTML so i can add in a coded table and preview the detail stuff disappears.

I used to add tables from excel in the details drop down but i was trying to make the teams look nicer with HTML.

Any reason they disappear on the preview page?

The Above is what it looks like when i edit but nothing shows after i save draft and then preview.

I maintain the documentation site for a small tool I build, and about a year ago I put an illustrated guide character on every tutorial page, because the audience is not technical and a wall of text was losing them somewhere around step four. Forty one tutorial pages, a hundred and sixty eight illustrations, roughly four per page. This is what that did to the site and what actually fixed it, because most of what I tried first was the wrong lever.

The starting position was bad in a boring way. For the first thirty pages I uploaded whatever came out of the image generator. PNG, about fifteen hundred pixels wide, roughly 1.35 MB each. WordPress then did what WordPress does. Thumbnail, medium, medium_large, large, the 1536 variant, the 2048 variant, three more sizes the theme registers, plus a scaled copy for anything over the big image threshold with the original kept alongside it. Ten files on disk for every one picture on screen. The uploads folder was about 560 MB and roughly sixteen hundred files for what a reader would describe as a hundred and sixty eight pictures. The media library grid took several seconds to paint and every file was called some variant of guide_final.

Page weight was the visible symptom. A typical tutorial page carries four illustrations, so four times 1.35 MB is 5.4 MB, and the theme, fonts, CSS and markup were another 500 KB on top. Call it 5.9 MB for a page whose actual content is six hundred words and two code blocks. Largest contentful paint on a throttled mobile profile was 4.8 seconds. Time to first byte on the shared host it lives on was around 480 milliseconds cold.

Compressing before upload rather than after was worth more than everything else put together. Every illustration now gets resized to nine hundred pixels wide, converted to WebP and compressed, and only then uploaded. That takes each one from 1.35 MB to about 78 KB. The ordering is the whole trick. If compression happens inside WordPress after upload, the library is still storing a large original and generating all its derived sizes from it, so the disk cost stays. If the file is already small when it arrives, every derived size is small and the original on disk is small too.

Then I stopped WordPress generating sizes that nothing on the site uses. A filter on intermediate_image_sizes_advanced drops the 1536 and 2048 variants and two of the three theme sizes, leaving thumbnail and medium. Files per image went from ten to three. After that I regenerated the library and deleted the orphans, and the uploads folder went from 560 MB to about 20 MB, which is a smaller number than the theme.

Explicit width and height on every image, lazy loading on everything except the first illustration, and fetchpriority set high on that first one. None of that changed the weight at all and all of it changed how the page feels, because the layout stopped jumping around while images resolved.

Page caching came last, which surprised me, because caching is the first thing that gets suggested whenever this comes up. Docs pages change maybe twice a month, so the lifetime is set to a day and it purges on save. Warm time to first byte is now about 90 milliseconds. Cloudflare sits in front with a rule treating everything under the uploads path as immutable for a year, which is only safe because a changed illustration always gets a new filename. I also dropped one of the two webfonts and subset the other, which took the theme payload from about 500 KB to about 240 KB.

Where that leaves a tutorial page is roughly 550 KB total, of which 312 KB is the four illustrations at 78 KB each. Largest contentful paint 1.3 seconds on the same throttled profile.

The honest part is that the illustrations still cost real weight. A text only page on the same theme comes in around 240 KB. The guide character roughly doubles a page, and I chose that trade rather than got it for free, so I now cap it at four illustrations per page and never put one above the fold on an index page. If the tool were aimed at developers I would probably not have done it at all.

The bigger problem is not weight, it is drift. Regenerating the same character for a new page does not give back the same character. Same character, same notes, and the sleeve reads a different length, the fringe lands on the other side of the forehead, the green of the coat comes back slightly colder. On one page in isolation nobody would notice. Two pages open in adjacent tabs and it reads as a sibling. So I keep a folder of about sixty approved renders and reuse them rather than generating fresh, and when a page genuinely needs a pose that does not exist yet, I make a batch of eight and keep whichever is closest to the existing set rather than whichever is best on its own. Twice I have gone back and replaced an image on an older page because a newer one made the old one look wrong. Every image on the site is a still for the same reason, since I can hold a set together with stills and I have never managed it with anything that moves.

The guide character is AI generated. No illustrator drew it and no model posed for it. That is stated in the site footer and on the about page, and I would rather it sit there in my own words than turn up later as somebody's discovery.

Standardising the art was the other half of the fix and it is the half nobody writes about. There are five poses on the entire site and no others: pointing at something, holding something, sitting, arms folded, and looking at a screen. The character is always angled the same way, a fraction off centre. The crop is always from the knees up. The background is always transparent and never a scene, which means one file works on both the light and the dark theme without a second export. Everything is exported at exactly nine hundred pixels wide, so nothing on any page is at a different scale from anything on any other page.

Filenames carry the pose and the page slug with underscores, and the alt text gets written at the moment the file is made rather than in the editor at publish time. Those two habits are why the media library is navigable at all now. The old library was not unusable because it was large. It was unusable because it was anonymous.

The site itself is WordPress, the guide character gets drawn in APOB AI, and every image goes through ShortPixel before it ever reaches the media library.

The thing I would do differently from the start is decide the pose set before drawing anything, the same way a project settles its icon set before building screens. I generated on demand for the first six months and it produced about ninety illustrations, no two of which shared a crop, and most of those had to be remade from nothing once the rules existed. That rework cost more time than the entire performance exercise did.

Forty one tutorial pages are live and nine more are still drafts. The only check I run before publishing now is the size of the folder the images came out of, which takes about four seconds and would have saved me a fortnight if I had started doing it a year ago.

TL;DR: A WordPress site I run was attacked on Aug 26 by an automated bot exploiting an unauthenticated arbitrary file upload in "WPLP Cookie Consent" (gdpr-cookie-consent 4.4.1 - the latest version at the time, ~10,000+ active installs). The attack succeeded in writing a PHP dropper into my uploads folder in under 20 seconds. The only thing that stopped full site takeover: a server-level rule returned 403 on executing PHP inside wp-content/uploads. I found the file the next day via the server's malware scanner, spent a day on forensics, filed 5 coordinated disclosures, and the vendor shipped a proper fix (4.4.2) within 5 days of my report - verified in source. This is the story, with the full timeline and IoCs, because the campaign is real and other sites were not as lucky as mine.

THE TIMELINE (all within 20 seconds, from access logs)

05:06:50 GET /wp-json/wp/v2/users?per_page=100 -> 200 (user enumeration)

05:07:02 POST /wp-json/wplp-react-gdpr/v1/store-auth -> 200 (option poisoning)

05:07:06 POST /wp-json/wplp-react-gdpr/v1/upload-logo -> 200 (arbitrary file write)

05:07:10 GET /wp-content/uploads/2026/08/uxq9KacU_400x400.jpg.php -> 403 x3 (blocked)

Attacker: AWS IPv6, User-Agent "Python-urllib/3.12". Fully automated, mass campaign.

THE EXPLOIT CHAIN (no programming required)

1. Enumerate users - a standard WordPress REST endpoint revealed my admin username.

2. Poison a setting - the plugin had an unauthenticated REST route ("store-auth") whose only real check was a JWT from the vendor's own SaaS platform plus "a username that belongs to an admin". It wrote attacker-controlled JSON into a WordPress option - including the plugin's internal "master key".

3. Arbitrary file upload - a second route ("upload-logo") checked the request's key against the value just planted in step 2, then wrote attacker-supplied base64 content to uploads/<attacker-controlled-filename> with zero extension/MIME validation. Result: "uxq9KacU_400x400.jpg.php" - a PHP webshell disguised with a Twitter-avatar filename.

4. Execute - three GET requests. All answered 403 by a server-level WAF rule. The payload never ran.

The part I found most sobering: the plugin version (4.4.1) had been released 7 days before the attack. Whatever window we imagine exists between a release and its exploitation - it was 7 days here, and this bot needed 20 seconds per site.

WHAT ACTUALLY SAVED THE SITE

Not a security plugin. Not a scanner. Not even a firewall rule I configured. The platform's rule "no PHP execution inside uploads" returned 403, the dropper's self-delete never fired (it only deletes itself after successfully running), and the file just sat there until the server's malware scanner flagged it the next morning. Defense in depth worked at exactly one layer - and that was enough.

THE MALWARE (for those interested)

The dropper boots WordPress, creates a hidden administrator with a randomized username, suppresses every notification email so nobody gets alerted, backdates the account's registration date to match the previous user (so "sort users by creation date" finds nothing), scans the whole volume for OTHER WordPress installs and reads their database credentials from wp-config.php, returns the generated password as JSON to the attacker, and deletes itself.

SHA256: E3DA2973957017A72403531D5475BD95189DFF1C70B23E4657D0D5F23955575E

Size: 15,187 bytes. On VirusTotal (0/70 at upload - normal for a PHP dropper).

One forensic detail I am weirdly proud of: I reconstructed the plugin's success response for store-auth from its source code and it was byte-for-byte the 102 bytes my access log recorded. That is how I knew the poisoning step had succeeded even though nothing visual changed on the site.

THE DISCLOSURE PIPELINE (this part went surprisingly well)

Vendor (WPLP/WPEKA) via their bug bounty: acknowledged quickly, patched in 4.4.2 within days. WPScan: reproduced the chain, found TWO MORE routes with the same file-write capability and no filename sanitization (could write outside uploads - which would have bypassed the WAF layer that saved me). Vendor fixed those too. Patchstack: already had an independent report of the same issue (someone else found it too) and had escalated to the WordPress.org team. AWS abuse report for the attacking server; registrar abuse report for the malware's exfiltration domain.

THE FIX IN 4.4.2 (I verified it in source)

The upload-logo route and its handler were removed entirely; every route in that REST namespace now requires an HMAC-SHA256 request signature with a per-site secret and anti-replay window; the JWT is bound to the site's own connected account ("Not the owner of the website!"); remaining image uploads go through real validation (extension allowlist, magic-byte check, and filenames are rebuilt so "shell.php.jpg" becomes "shell-php.jpg"). That last one is exactly the remediation I had suggested in my report - they did the work properly.

LESSONS I AM KEEPING

1. The layer that saves you may be one you never configured. Check whether PHP execution is blocked inside wp-content/uploads on your server - if you don't control the server, ask your provider. If you do, enforce it.

2. A malware scanner finding the file a day later was the difference between "incident" and "compromise". Zero-day exploits cannot be signature-matched on day one - detection speed after the fact is what you actually get from scanners. That is still valuable.

3. Keep access logs longer than you think you need. My whole reconstruction - attacker IP, sequence, byte-level responses - came from one log file.

4. Block username enumeration via REST (/wp-json/wp/v2/users). It was step 1 of this attack, which tells you how easy it is to defer the boring stuff. Do not defer it.

5. Coordinated disclosure works. Five reports, one week, patched plugin. The system is slow right up until it is not.

IOCs (the patch is public; share freely)

Payload SHA256: E3DA2973957017A72403531D5475BD95189DFF1C70B23E4657D0D5F23955575E

Payload filename pattern: *_400x400.jpg.php (mimics Twitter avatars)

Rogue admin indicators: username = {sitedomain}+3 random chars, display name "Lucas Hayes", email domain ifuqpatr.com

Attacker: AWS IPv6 2600:1f18:472b:900:f81d:f8eb:a12e:7fd3, UA Python-urllib/3.12

Attack pattern: GET /wp-json/wp/v2/users?per_page=100, then POST /wp-json/wplp-react-gdpr/v1/store-auth, then /upload-logo

If you run gdpr-cookie-consent: update to 4.4.2 now, and check wp_users for an admin you do not recognize (the dropper backdates its creation date - compare for identical timestamps between two users instead of just looking for "new" accounts).

Happy to answer anything in the comments.

Smart card button now shows an error and my clients can't pay (give donations) using card detail on my WP site.

scf_unhandled_error_on_submit_SHIPPING_ADDRESS_MISSING Object

This question is just semantics I think, but what is considered a "custom theme"? With classic theme, if I code the templates and such, I would think that is considered a custom theme. But with the Gutenberg editor, I'm a bit confused. For example if I modify the 2025 theme to fit my brand and save it as another theme, would that be considered a custom theme? Do I need to create the theme from scratch for it to be considered a "custom theme"? At which point or what action turn nothing/other theme into a "custom theme"?

Hey everyone,

I'm trying to set up a WordPress maintenance business and could really use some advice from you guys.

Right now, I only have a couple of clients on a yearly payment model, but I obviously want to expand my portfolio and start building some monthly recurring revenue.

The thing is, doing all the updates and tracking manually is already a pain, and it's just not going to scale.

I've been looking for a management dashboard and found a Spanish project called Modular DS a few months ago. I honestly loved it—the workflow is amazing and it feels super complete.

The problem is my trial is ending soon, and I really don't want to commit to a fixed monthly expense until I have enough steady clients to cover the platform's cost.

I also gave MainWP and InfiniteWP a try, but to be honest, their free versions feel pretty limited compared to Modular DS unless you start paying for the premium add-ons.

I'm basically looking for a free or very low-cost option to manage these first few clients while I grow. I'd be totally open to self-hosted tools, open-source software, or even a pay-as-you-go/micro-transaction model.

My main priority is being able to keep a solid log of all the updates and changes, and most importantly, being able to send out client reports.

What are you guys using for your maintenance clients? Does anyone know of any other platforms similar to Modular DS, or maybe an open-source hidden gem I haven't heard of?

I'm thinking of getting elementor one and using it across all my new site builds. Do any of you have this? Whats you're experience with it? Is the AI generated code good, jenky, doesnt work at all. From the video the ai powered widget creation looks amazing. Would love any thoughts here.

What is everyone using for cookie consent on WordPress sites nowadays?

A lot of the popular options seem to be freemium, where the basic banner is free but things like automatic scanning, blocking scripts, geo rules, consent logs or multiple sites are behind a paid plan.

Are there any genuinely free cookie consent plugins that are actually good enough for a normal WordPress/WooCommerce site?

Also curious:
what limitations have you run into on the free versions?
which paid ones are actually worth it?
do you use a plugin at all, or handle consent another way?
any that are lightweight and don’t noticeably affect page speed?

Trying to keep the plugin stack lean and avoid paying subscriptions for features that the client don’t really need.

I'm using use headless WordPress with Next.js.

Is there a way to keep track of the relationship between my custom fields data and my front-end components?

Is it just manual documentation, or is there a better way?