From an agency owner who's been using WP since 2013 and now also quickly becoming a Claude expert, here's a few truth bombs. I'm offering all of my clients a choice between WP or a site built with Claude code, not holding back on any positives or negatives. Just over 70% are picking WP.

The main reason? The total inability for them to update anything or log into a CMS. They feel they have more control and more ownership of a WordPress site. It starts to fall apart when I tell them that every change with Claude built sites would require my team. Yes, that's included in our monthly package but savvy owners are asking "so if I need to charge or update anything outside of your business hours....." then yep, they have to wait.

This is not an issue for the 30% who choose a Claude built site where they don't anticipate any changes, or very few. Also AI has an very negative stimaga, especially to the slightly older business owners; "you're gonna build my site using what?"

Other huge AI issues? Backend functionality. Setting up a database using Supabse, definitely a learning curve. Plugins? Obviously non-existent which means coding one or duct taping a third party solution onto the site.

Been going back and forth on this one. My logs fill up with failed logins on the default /wp-login.php every day, as far as I can tell it's just bots hitting the same path they hit on every WordPress site, nothing targeted at me. Limiting attempts and adding a challenge to the form quieted most of it, but I keep wondering whether moving the login off the default path is genuinely worth it or just security-through-obscurity that breaks more than it fixes.

For those of you who've hidden the login URL: did it actually cut the noise in your logs, or did it mostly create headaches with things that expect wp-login.php (mobile app, integrations, the odd plugin)? And if you deliberately don't hide it, what's your reasoning, rate-limiting at the edge and calling it done? Trying to figure out where the real payoff is before I fiddle with it further.

Hellooo, I’ve worked with Elementor and Elementor Pro for over 2 years. It’s not bad, but honestly, I’m not a big fan of it.

I’ve had sites where the design took way too long to load, even with caching properly configured, decent server and etc. Sometimes I suspect Litespeed server cache configuration, but still, it’s frustrating.

I’m thinking about switching to another builder, but I’m on a limited budget, so I’d really like to hear from people who have actually used different builders in real projects, not just tested them for a few days. 😀

I’ve heard about so many alternatives, including Bricks, Breakdance, Divi and even some cheaper options with lifetime licenses.

What’s your favorite WordPress builder, and why? What has your experience been with it in real-world projects?

Hey everyone, I’m curious that what plugin or tool are you using to handle form submissions on your WordPress websites?

Fairly new to running my own WordPress site and I got a fright the first time I opened the login logs, dozens of failed attempts a day from IPs all over the place. From what I've read since, this is mostly background noise: automated bots spraying credentials at the default login on basically every install, and unless the numbers are huge or paired with other symptoms it isn't a targeted attack. I tightened the obvious things, a strong unique password, a second factor on the admin account, and capping how many tries an IP gets before it's locked out, and the volume dropped noticeably.

Two things I'd love a reality check on from people who've run sites longer: at what point should a spike in failed logins actually worry me versus just being noise, and is limiting attempts + 2FA genuinely enough on its own, or is there one more thing you'd treat as non-negotiable? Don't want to bolt on five plugins for a problem that's already handled.

Hey guys, I use Envira Gallery to make video galleries for most of the posts on my website.

Since the latest updates to Envira all my video galleries old and new are broken - the video player does not show in the lightbox when you click the thumbnail, and the play button does not appear on top of the thumbnails either.

It is happening for both YouTube and VideoPress videos that I have embedded in my galleries.

VideoPress support confirmed that they believe it was an issue with the latest Envira update.

Trying to get support from Envira but all I have got so far is a generic AI reply. It's very frustrating because Envira is by far the most expensive thing I pay for on my website.

Hopefully they fix it soon as my site is broken at the moment because of this. Anyone else having issues?

ive been making contact forms with WPforms but after having to go through WordPress → WPForms → Gmail OAuth → Google Cloud → Client ID → and much more, it is almost impossible to make a working contact form for my clients

I recently investigated a hacked WordPress installation and wanted to document the indicators because they are very easy to mistake for something related to Google Analytics.

If you find this in a theme functions.php:

/* __GA_INJ_START__ */

it is not normal Google Analytics code.

In the site I investigated, the compromise was associated with hidden administrator accounts using names like:

sync_agentXXXXXXXX
cdn_workerXXXXXXXX
seo_serviceXXXXXXXX

The WordPress database also contained:

__ga_hidden_users
_theme_inject_status
__ga_r_cache

The malicious code maintained a list of administrator accounts that should be hidden.

What was particularly interesting

At first I thought the infection started when:

hello-elementor/functions.php

was modified.

It didn't.

By correlating the database with Apache logs I found that the attacker already had a hidden administrator nine days earlier.

The sequence looked like:

successful login using legitimate WP admin
→ Code Snippets / WP File Manager activity
→ access to theme functions.php
→ malicious administrator created
→ persistent access
→ more hidden administrators
→ final GA_INJ theme injection

So if you find this malware, don't just replace functions.php.

Check:

wp_users
wp_usermeta
wp_options
active plugins
administrator session tokens
access logs

and look several days/weeks backwards.

Useful filesystem search:

grep -RniE '__GA_INJ|__ga_hidden_users|__ga_r_cache|_theme_inject_status|sync_agent|cdn_worker|seo_service' .

I wrote up the sanitized timeline, IOCs and an experimental YARA detection rule here:

[GitHub repository link]

I'm not selling anything — it's just an open incident report so these strings become searchable.

If anyone else has encountered __GA_INJ_START__ or administrator accounts named sync_agent, cdn_worker or seo_service, I'd be interested in comparing indicators.

Site's 9 years old and the marketing pages are the part that keeps breaking, plugin update, security patch, some builder conflict, and the homepage looks off til I go dig through it. The blog's fine, ranks well, I'm leaving it alone. Anyone split the marketing side off and keep the blog on WP, or was running two setups more hassle than it was worth?

I've been working on WordPress plugins for years, and recently decided to rebuild a PWA plugin from the ground up rather than keep adding to an old codebase.

The interesting part has been dealing with the real-world stuff:

• Service-worker caching and updates
• iOS vs Android PWA behavior
• Offline support
• Caching/CDN/plugin conflicts
• Push notification permissions and subscriptions
• Making the installation experience feel more like a real app

I've recently added push notifications for Android, desktop, and iOS, and I'm still improving the project based on real-world testing.

The project is Hyper PWA.

I'd love to hear from other WordPress developers:

What has been the biggest problem you've faced when implementing or maintaining a PWA on WordPress?

I'm especially interested in feedback about things that existing PWA plugins don't handle well.

Full disclosure: I'm the developer behind Hyper PWA. I'm sharing it here because I'd genuinely like technical feedback and ideas for improving it.

https://wordpress.org/plugins/hyper-pwa/

I've embedded Google Calendar into my site for client bookings. It works fine, but opens a new window whenever I click on a time slot. Apparently this some security feature. Asked Gemini and it suggested I add target="_self" to the code, but this didn't fix it. Is there something else I should add to the code to fix this or possibly a plugin that might function as a work around? My preference would be to stick to Google Calendars rather than a third-party app for ease of use.

Hi everyone,

My WordPress site was recently compromised. The attacker managed to create 3 admin accounts, and Wordfence caught two malicious PHP files in a fake theme folder (wp-content/themes/twk-dbbfd2bc/functions.php and fixer.php).

I deleted that theme, removed their admin account, deleted the admin accounts. Wordfence scans are coming back clean now, but I noticed two suspicious files sitting in my wp-content/mu-plugins/ and in www/mu-plugins directory:

firewall.php (Version 1.0)

wp2shell-batch-guard.php (Version 1.1.0 — description says "Blocks anonymous REST batch API (wp2shell mitigation)")

Their last modified dates match mid-August, right when the unauthorized admin accounts were created (while the site was running WordPress 6.9 (yes, i know...) and i was in vacations at that date so i don't insgall it)

This looks like an attempt by the attacker to disguise a backdoor as a security fix so I wouldn't delete it, but I want to double-check with the community before I purge the mu-plugins folder via FTP because i don't want to make a mistake...

Is there any chance these are legitimate, or should I delete them immediately (i think...) ? I since update to 7.0.4.

Thanks a lot for your help!

I'm looking for a way to allow visitors to view one post for free, and subsequent posts triggering a content wall requiring account registration.
All of the membership plugins I've found seem to want you to manually set which posts are public and which are gated, but I want whatever the first article someone visits to be free regardless, and then they need to make an account to view the rest.

Does this exist?

I work for an IT company as a WordPress web developer and we build and manage Texas counties government websites, like tax offices, central appraisal districts etc. and we pay top dollar for the most secure server and we have multiple other security softwares on top of that. Historically, we've never really seen many security issues. One off here there however in the past 30 days, we're not only experienced the WP2Shell attacks and the BD themes compromise but now we're also experiencing a slew of other random attacks, not related to third-party issues. I've never seen anything like this before.
Is anyone else experiencing this? What is everybody else using to combat cyber attacks?

I am trying to build a course for my website hosted on wordpress. I am very new to the whole thing and I cannot seem to get elementor to work when trying to edit my course layout/content. I have set up the sections and the lessons, but when trying to edit how it looks with elementor, nothing happens.

Normally when i edit pages with elementor i can click the "Edit with Elementor" as the cursor turns to a pointer, it doesnt do that when i am viewing the course page.

Does anyone know how to fix?
EDIT: I have checked off courses and lessons in elementors settings

As an agency with several hundred sites, we see vulnerabilities pop up all the time, and update them in a timely manner. We use automatic plugin updaters through Flywheel and WP Engine to do this, and generally there is no issue.

Today was different. We have the PODS plugin on about 80 of our sites, and at least 70 of them had fake administrator users added. The vulnerability patch came out on Friday and most of our sites were updated by Saturday / Sunday.

Needless to say, we've had to scramble big time to roll back sites and clean them up, removing all these users and running scans. If you use PODS, I suggest you update it as soon as you can.

This is outlined here: CVE-2026-19598

I figured people in this sub might appreciate the heads up, if they aren't already aware of this!