u/ZGeekie

I'm not a fan of vibe coding, especially with WordPress, but I think it may have an advantage in terms of security.

Unlike public WordPress plugins, the source code of vibe coded plugins remains private and only to the website owner can see it.

Hackers find vulnerabilities in plugins by scanning their source code, but that's not possible with vibe coded plugins unless the hacker gets access to the PHP files on the server.

That solves like 90% of the WordPress security problem, then creates different problems of its own!

Spaceship has just hit 10 million domain registrations in about 3 years. It really took off!

They promised promos and giveaways in the coming days...

>Published this month, the survey, now in its fifth year, drew 319 responses from agencies, developers, designers, site owners and administrators between March and July. Respondents rated their concern about WordPress security at an average of 7.85 out of 10, close to the 7.8 recorded in 2025.

>But only 27.9% said they had a breach recovery plan, virtually unchanged from 27% last year, and 26% reported team security training, unchanged from 2025. Even among respondents who rated their concern at 7 or higher, just 32.5% had a recovery plan.

Shopify has just set a record for the most expensive domain purchase ever: they bought Shop.com for $100 million.

The news was shared by domain broker Andrew Rosener, although he wasn't involved in this deal.

About two years ago, Shopify bought Shop.us and Shop.ca for $375,000.

They also own Shop.app.

GoDaddy customers usually complain about pricing, but on the technical side, there are a couple of issues I noticed about their managed WordPress hosting...

Their servers still run Apache and MySQL. I found this info in their docs -- it's not mentioned on the product page.

That's way behind their competitors that use LiteSpeed/Nginx and MariaDB, both of which are faster than Apache and MySQL. That makes a significant difference in performance for dynamic WordPress sites.

MySQL is tolerable, but I don't know many managed WordPress providers that still use Apache.

Just 2 more reasons to think again before picking GoDaddy as your WordPress host.

I have been using Hostinger for close to a decade and have purchased and operated 8 hosting/server services qnd several domain registered with them over the years. Until now, I considered them a dependable hosting provider.

Unfortunately, my recent experience has seriously changed that opinion.

My main business website, xxxxxx-xx.com, along with its email service, was suspended following an abuse complaint. The website is a press release publishing and distribution platform where clients submit content for publication. Instead of first contacting us and giving us an opportunity to investigate or remove the reported content, the website was taken offline.

Since then, I have submitted the requested company documents, ID and other verification information. I have also clearly agreed to remove the reported content and not republish it. Yet the website and email have remained unavailable while the same “1–3 days” response keeps being repeated.

The most frustrating part has been trying to get meaningful human support. Most interactions go through an AI support agent that repeatedly gives the same responses, asks questions that have already been answered, and makes it unnecessarily difficult to reach someone who can actually review or escalate the case.

For a personal website, several days of downtime is frustrating. For a business website, it means lost enquiries, lost customers, disrupted email communication, revenue loss and potentially damage to search rankings built over years.

I fully understand that hosting companies need abuse and fraud-prevention systems. I am not asking Hostinger to ignore legitimate complaints. What I expect as a long-term paying customer is reasonable communication, proper human review, a clear escalation process and a realistic timeframe.

If a customer has submitted every requested document and even agreed to remove the disputed content, keeping an entire business website and its email offline without a clear resolution becomes extremely difficult to justify from a customer-support perspective.

After almost ten years as a customer, I genuinely did not expect to be in a position where I am considering moving my websites and servers elsewhere simply because I cannot get a timely human resolution when something serious happens.

I hope Hostinger improves this process, especially for established business customers. AI support is useful for basic issues, but when a live business has been completely taken offline, there needs to be a much faster route to a real person with the authority to resolve the issue.

>Cloudflare recently documented the migration of its main blog from WordPress to EmDash, the open source content management system developed internally. The new platform is designed to improve performance and caching, and it was tested to handle traffic of up to 7000 requests per second.

>In this work, we present THEMIS, a context-aware grey-box fuzzing framework specifically designed for WordPress plugins. We built THEMIS on top of the ATROPOS testing infrastructure and extended it with a domain-specific instrumentation layer, an adaptive test harness, and a custom bug oracle. Together, these components enable targeted vulnerability detection by guiding the fuzzer toward semantically meaningful and security-relevant code paths.

I've seen some posts from owners of small web hosting companies looking to exist the game. It's an exhausting job and it's become much harder lately due to search engines switching to AI mode.

I know a few companies that are actively seeking out new acquisitions:

If you have a small company with a few hundred customers or so, you can try offering it to KnownHost. I think they prefer US-based companies/customers, but they are global.

If your customers are mostly from the UK, Krystal might be interested in buying your business.

If you hate your customers, you can try to sell it to Hosting.com or HostPapa! They usually buy bigger hosts, but you can try reaching out to them.

Know any others?

Yoast SEO has just become the first WordPress plugin to surpass 1 billion all-time downloads. That is the total number of times the plugin has ever been downloaded, not the currently active installations.

These are the most downloaded WordPress plugins as of September 20, 2026:

Plugin	All-time downloads
Yoast SEO	1,001,817,212
Elementor	888,054,219
Jetpack	510,566,510
WooCommerce	463,537,891
Wordfence	427,252,149
Contact Form 7	424,276,019
Akismet	406,590,043
WPForms	356,170,910
Site Kit by Google	281,381,741
Really Simple Security	221,188,038
Rank Math SEO	196,881,603
All-in-One WP Migration and Backup	188,968,479
UpdraftPlus	164,861,523
LiteSpeed Cache	138,016,087
Classic Editor	93,028,223
WPCode	92,950,159

Which ones do you use?

I’m switching my website from squarespace to Wordpress & just learned that there’s a difference in Wordpress.com & wordpress.org. 🤯 which one should I use? It’s just a simple site to have an online presence, no selling involved.

Vibe coding is creating more demand for Node.js hosting. Many providers added Node.js hosting plans recently, and Cloudways has just joined the race with Cloudways Velocity: a managed Node.js hosting service.

Unlike serverless hosting, they offer always-warm servers with fixed resources. It may not be cheaper, but more predictable.

>Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress plugin active on more than 600,000 websites. Both chains begin in the plugin’s widget-rendering pipeline and can ultimately lead to Remote Code Execution without authentication through two separate methods.

Full details on Wordfence.

If you don't like cybersquatters, you'll like this story...

A domain investment company called Mira Holdings bought the domain NexusMutual.com for $53,499 through an expired domain auction on DropCatch back in 2023. Then they listed it for sale for $250,000.

NexusMutual.com doesn't sound bad as a domain name, but paying $53k for it and expecting to resell it for $250k doesn't make sense as an investment, unless they had a specific buyer in mind who's highly interested in that domain, and there is indeed one such buyer: a crypto insurance company called Nexus Mutual.

According to the investor, Nexus Mutual was the runner-up in the auction. They later offered to buy the domain for $25k but it wasn't accepted. Then they filed a UDRP complaint, and the decision came in last month:

>The Panel orders that the disputed domain name <nexusmutual.com> be transferred to the Complainant.

One of the three penalists disagreed, but the majority ruled in favor of the complainant (Nexus Mutual).

Read the full UDRP case here.

I agree with the decision. There is no way that investor didn't know about the Nexus Mutual company at the time of bidding like they claimed. They bid that high because they knew that specific company wanted the domain badly and they thought they could capitalize on it.

This is a clear cybersquatting case, and it's not the first one Mira Holdings was involved in. They've had multiple UDRP complaints against them before this one.

They filed a lawsuit to overturn the UDRP decision -- imagine if they end up losing even more money on a failed lawsuit!

>Matt Mullenweg has been removed from his role as CEO of Automattic and put on paid leave. The board of directors at the company have replaced him with the Chief Financial Officer Mark Davies. Mullenweg only had 50 minutes advance notice of the vote and his request to have the action reviewed by legal counsel was denied.

After getting rid of Horizons and replacing it with AI Builder, Hostinger has just retired its AI assistant/chatbot Kodee and replaced it with Hostinger Agent.

The new AI Agent has a dual role: it works as a support assistant and also as a virtual assistant for small businesses, which can help with content creation and marketing, SEO, planning, etc.

But there is a catch: it's not free. It requires a credit-based paid subscription.

This is a quote from Hostinger's blog:

>Support and account management remain available at no additional cost, while specialized agentic work is available through a tiered subscription.

Just another way to squeeze more dough out of small businesses!

Just had the worst hosting experience of my life and want to warn anyone considering xCloud.

Their server had some kind of failure and I lost every website on my account including a site that was actively in final prep for launch. I contacted support to ask about restoring from a backup. Their answer: no backup exists, no recovery is possible. That's it. No compensation offer, no real explanation of what caused it, just "it's gone."

For a hosting company, having zero backup infrastructure that can protect a customer from total data loss is not a minor bug it's a fundamental failure of what you're paying them for. I lost weeks of work and a launch date because of it.

If you're currently on xCloud: export/back up everything yourself immediately, don't trust their infrastructure to protect you. If you're considering signing up: I'd look elsewhere.

Happy to answer questions if anyone else has been burned by them too.