PSA because this keeps showing up on hacked wordpress sites.

if your site gets hit with clickfix, visitors see a box that looks like a captcha. it says press windows + r, then ctrl + v, then enter to "verify". the site has already copied a command to their clipboard, so pasting it installs malware on their computer.

the nasty part is your site doesnt go down. hosting dashboard looks fine, uptime monitor looks fine. you usually find out when a customer complains or google flags you.

quick way to check yours: open it in a private window on desktop and on your phone and look for any verify box you didnt add. check search console under security issues. look through your theme files and recently changed plugins for script tags you dont recognise, and for redirects to domains you dont own.

if you find it, change every password (hosting, wp admins, ftp, database), update everything, delete admin users you dont know, then ask google for a review.

happy to help if anyone finds something weird.

Slider Carousel FREE (specific example)

Looking for a FREE Plugin (non Elementor depending) that can do something like the Character Slider on the bottom of this page:
https://www.otomate.jp/crazy_chain/chara/?page=7

I've found some that have this kind of functionality paywalled. I'd prefer not to have to make my own...
What do y'all use?

Hello Everyone,

Do you help your users with some features to write blogspot articles? If so, what are the methods you are using? Taking into account, that most probably you want, that the information you want to be posted, should be true, valid and valueable - not only safe and correct from many points of view.

Are you using some plugins and if so, what are these?

Thanks and wishing you a great day!

Feel free to point me to the right place.

My website has only a contact form that goes to my Gmail. I did set up my hosting account with the catch all email, so I get everything sent to @mydomain.com.

I have a link to my site at the bottom of my clients sites (with permission), so people can find the webmaster or hire me to make their own site.

I'm getting strange emails at my main domain, where I don't ever get email except for dmarc ones. It's sent to instructions@mydomain.com and it's asking if I want to buy a .com version of my clients domain.

I imagine they found me via the link on my clients site, but why not use the contact form on my site? And the emails started by assuming I own my clients domain and have continued checking in to see if I'm interested,and just today that the price is negotiable.

I've done internet searches, trying to see what's really going on, but not finding anything. I haven't responded, the big weirdness is the 'instructions' address, which has never existed and doesn't even seem like a reasonable address to send cold contacts to. Admin, contact, support, etc make much more sense.

Just looking for if other people have experienced this and perspective on what the point might be. I know it's some sort of scam, but I guess I'm curious about what kind.

This is a screenshot from an inactive MySpace. You can flip through these albums by hovering over them with the cursor. Is there a WordPress plugin that would allow me to do this or something similar?

I have a site on WPEngine (on the Advanced Network), running Wordfence Premium.

I'm keen on beefing up the edge security.

Is adding the Sucuri WAF going to improve this meaningfully, or am I better off just signing up to GES?

Basically, I want to embed something just for its audio. The accompanying video is either irrelevant or contains something like spoilers, and takes up more page space, besides.

Currently, I just shrink the embed's frame until only the play button is visible, but that looks sloppy. Is there simple code/a plugin that'll auto convert YouTube vids to just a play/pause button and a seek bar? Thank you for any help!

I’ve been having this problem with the page title for a day now, I know how to hide it from the setting of the page while in elementor and I have done that and the site has been working just fine, then suddenly this feature stopped working, id edit the page toggle it off and on again in hopes of it resetting to work, and it doesn’t, I updated my theme, I updated Wordpress, I cleared the cache, it literally says the option is there and when I turn it off and on it disappears till I publish the page again and it’s back. I haven’t touched anything else or changed anything

We keep getting dinged in securiry scans about "weak ciphers" for our sites hosted on WP Engine, and we have been given an ultimatum to finally deal with it over the next 90 days.

I have not seen anywhere where ciphers can be adjusted on WP Engine. I have a ticket in with WP Engine support, but I didn't know if anyone knew whether there are controls for it and maybe I just have been missing them.

Anyone used this to change links across their site? If so, how was your experience? Anything to be aware of?

Just wanted to share this interesting case I recently investigated. It started with an AWS suspicious activity alert and ended with around $8k in unexpected Bedrock charges..

Digging through CloudTrail, found thousands of Bedrock API requests using a compromised root access key. Someone had been using it to run Claude models through streaming responses.

Then I noticed the same key showing up in S3 backup requests from UpdraftPlus. Went ahead ahead to check the client's WordPress sites hosted on the same EC2 server, and yes! They were using the same key in UpdraftPlus across multiple websites and backup buckets.

The CloudTrail logs showed UpdraftPlus requests with different version numbers in the user-agent field, including the outdated version 1.24.3. Checked further and found an old WordPress multisite installation still running that version. There are known vulnerabilities in older versions, including one that could expose stored backup credentials under certain post-migration conditions. But we haven't found any solid evidence that this was how the key leaked.

Another interesting thing, besides the careless use of a root access key for S3 backups, was that the stored AWS secret key could be revealed right from the UpdraftPlus settings page using the browser's "Reveal Password" option. Of course, someone would need access to that admin page first.

I also found an old WordPress support forum post where someone raised the same concern, and an UpdraftPlus developer defended the approach, arguing that the credentials could be retrieved from the database anyway.

We still don't know exactly how the attacker got hold of the key. CloudTrail showed the key was first tested on August 23 using TruffleHog, a credential-scanning tool. Then came the actual Bedrock abuse around October 18–19, racking up an $8k bill.

Someone tried to save some time by using the same access key for all sites backup configuration - no fixed permission..

And maybe a little more careful credential handling on the plugin side wouldn't hurt either. But that's another debate.

I have a WordPress catalogue website where I only display product images and catalogues

A few days ago, I received an email saying my WordPress password had been changed, even though I hadn’t changed it.

I immediately changed all my passwords and updated WordPress, PHP (8.3.6), plugins, my paid WoodMart theme. My WordPress version is 7.1.3.

However, someone keeps publishing spam blog posts on my website every day. I delete them, but they reappear.

What’s the best way to fix this permanently? Could it be a backdoor or malware?

Could this security issue affect my business email deliverability or put my emails at risk? Or someone may try to contact my customers through it ( this is a serious concern )

I’d appreciate advice from anyone who has dealt with a similar issue.

I'm not a Dev. I build WordPress sites using Divi 5 for external clients and we charge for a website with no custom code (only official plugins/tools are used on the sites). Lately, we've been having customers request that we implement their claude coded 'apps': like an interactive event program (so they don't have to pay for a mobile app) or an interactive company archive (so they don't have to pay for a premium timeline plugin), and I'm wondering if this is happening to anyone else? There's obviously going to be a market for turning client's AI coded 'apps' into legit Wordpress tools/plugins that can be updated properly and secured, etc. How is everyone thinking about handling this type of request? Would love to hear ideas!

Most small sites run too many plugins. One for bookings, one for forms, one for a quiz, one for reviews.

So I built Widgeteer. It's not your typical AI slop that spouts more slop.

You "say" what you need and you "see" a widget that actually works. I mean, literally, a working widget("sorted").

Some examples people tried so far:

- Call booking (Calendly). Booked slots vanish for everyone else.

- Table booking (OpenTable). Knows when you're full.

- Enquiry form (Typeform). One question at a time.

- Instant quote. Price adds up live, then they book.

- Review booster. Happy customers to Google, unhappy ones to you.

- Event RSVP. Closes itself when full.

- Voting board (Canny). One vote each, top ideas rise.

- Spin to win (Privy). Your prizes, your odds.

- Mini course (Teachable). Remembers each student's progress.

Every action(submission) is saved in your dashboard, and you can also have it sent to your email, Telegram, n8n, Webhook etc.

Change any word, price or colour yourself, or just ask AI to change it for you.

Shopify stores, some trading for 8+ years, run it every day on the free plan. The WordPress plugin is new and I want to know how it holds up on your sites.

So, comment what your site needs and I'll build it for free and send you a link to try. Honest feedback is all I'm after.

Free plan, no card. There's an optional paid plan if you need more widgets:

https://wordpress.org/plugins/widgeteer/

My Bluehost site is expiring. I'm renewing the domain name if I want to restart it in the future.

But, I'm not sure if it stops me from signing into my Wordpress for my domain in the future? If so how can I make sure the log in is safe for it?

I have the log in of course but there's no 2FA. I guess I could use google authenticator but I hate having yet another app.

I always worried with a plug in what if there is an issue that stops me from logging in?

As you may have heard, the past few months have reshaped website design and website security.

In the past, we assumed that the mature software we use every day would be secure and that only through some level of neglect or incompetence would a website be compromised. Those days have passed.

In 2026, there is a high likelihood that the code used on your website "today" is, or will be, exploitable.

WordPress is built on PHP

With the latest advances in AI, what might have taken a hacker a year or more to find exploits and compromise systems has been whittled down to hours or days.

I'm not trying to scare anyone, but I am hoping that folks will come to appreciate that sites with no one manning the store are much more likely to be compromised or have their content deleted today.

I've been doing this since WordPress version 1.0, and I fully appreciate the situation we are in and the ramifications of what some are calling the "PHP Armageddon."

While none of us can prevent hackers from exploiting current and future vulnerabilities in PHP and WordPress, we can take steps to help mitigate risk. In this respect, nothing has changed. Monitoring, managing updates, and backups remain the cornerstone of my security approach.

Your choices matter…

Due to AI innovations, what was acceptable in the past is no longer acceptable today. I would like to share these concerns so you can take action before they become costly emergencies.

1. PHP 5.6 and PHP 7.4

Websites using any version of PHP prior to version 8 are much more susceptible to compromise. Most providers no longer allow PHP 7.4 or earlier on their servers.

If your provider still allows these older versions of PHP, you cannot assume you are safe. They are taking a risk by allowing them. While we can commend their willingness to help their clients by not shutting down websites running these versions of PHP, the writing is on the wall that this will not continue for long.

Any website running a PHP version older than 8 needs to be updated today, and all efforts should go into replacing code that still requires older versions of PHP.

2. Unmaintained WordPress and other PHP-based websites

Running unmaintained WordPress or other PHP-based content management system (CMS) websites is now a severe risk.

If you haven't logged into a website for over a year, or if it's no longer maintained by anyone, I strongly recommend either deleting its contents entirely or converting it to HTML only, removing PHP coding from the content as much as possible.

3. Login access

Restricting access to your PHP-based website remains one of the strongest choices you can make when securing your WordPress website. There are various ways to do this:

• 2FA or two-step verification. I know we all hate this, but it's one of the best ways to restrict access when multiple administrators are required. Wordfence includes this option for free as part of its feature list.
• Restricting login by IP address. If you are a solo operator and your IP address never changes, a simple update to your website can restrict login access to you and only you. This is my preferred method, as it's easy to set up and provides multiple benefits, including reducing your account's bandwidth usage, possibly improving website load speed, and preventing other administrator accounts from being used to log in to your dashboard.

4. Separate accounts

Not running multiple websites in the same shared account remains one of the most effective ways to reduce costs in the long term. While keeping multiple websites in a single shared account may seem more cost-effective at first, with AI agents roaming the Internet looking for exploits on websites day and night, a single exploit in a single WordPress installation could result in the complete deletion or manipulation of all content within the shared account in literal seconds.

Tools like WHM/cPanel allow websites to be placed in separate accounts.

The future of website security and preparedness

When I sat down to write this, I never intended to scare anyone into action. But it's become clear that we can no longer just hope the software that we count on for presenting our businesses and hobbies online is intrinsically safe and secure.

The actions we take can greatly mitigate the risk that AI bots and agents have created for online content management.

Some may say, "It's over, dump everything and start over with a pre-WordPress style no-code website," or convert everything to an unproven and expensive cloud-based solution. For most of us, that's not practical or is simply cost-prohibitive.

I would argue that you can keep operating as you have for the past several years, but we all need to be more mindful of the implications of future technology and the choices we make for our websites and online presence going forward.

So I'm curious what others are seeing:

• Has AI-driven scanning noticeably changed what's hitting your sites or servers?
• Is anyone still running PHP 7.x in production, and what's holding the upgrade back?
• Are you converting old or abandoned sites to static HTML, or just deleting them?
• IP-restricted logins vs. 2FA: which do you actually use?
• Is "keep WordPress, just be more careful" still a reasonable position, or is it time to move on?

Hello,

I've had some experience creating and managing wordpress websites for awhile some time back.

I have an app idea that I would like to 'prototype' and ideate from.

I figured that since I don't need full functionality, and wordpress nowadays is mobile friendly, I could probably create a proof of concept kinda thing with it, focusing on UI and user flow.

So, I'm wondering if there are any themes you'd use, preferably free of course, or is gutenberg quite powerful enough for it to work?

Like, menus. Web tends to have top menus. I'd like a bottom based menu. Is that possible? I don't remember that ever being an option in the past. Or maybe it was but I never really explored that area

I'm the developer of Codeep Voice for Posts. It turns an English article already on your WordPress site into an MP3 in the Media Library, then adds a play and download button to the post.

The recording is generated on your computer, inside the WordPress admin. Readers play the saved file from your site. Readers can listen on phones too.

It's free and open source, with no account, API key or word quota. You can download the MP3 and use it elsewhere too.

A few practical limits: the voices read English, recording is best on a desktop or laptop, and the first run downloads the voice files. Keep the admin tab open while it records. Speed depends on your computer, especially for longer articles.

Plugin and source: https://wordpress.org/plugins/codeep-voice-for-posts/

If you run an English WordPress blog, try it on one short post you know well. I'd like to hear whether you got a usable MP3 and which part of the setup was confusing.

I’m looking for someone who can assist me with WooCommerce and WordPress. I need help fixing a font-size issue with my KOT (Kitchen Order Ticket) receipts.

The issue: The KOT print sample displays the correct font size and style, but when I print the actual receipt, the font is much smaller than it appears in the sample.

I’ve already tried increasing the font size in the settings, saving the changes, but the issue persists. The actual printed receipt still has very small text.

If you have experience with WooCommerce POS and can identify and fix this issue, please DM me.

Thank You.

I was hit with a malware attack over the summer, around July. My sites are on Hostgator's share servers (paid). I see in the error logs, where their security where fighting the infected files, by removing them and the file would re-populate and eventaly over powered them. Looks like attack came from some plugins.

Htaccess files were placed on EVERY file to lock the user out. I contacted Hostgator support, they want over $300 to fix and restore. I already have a back up so I wanted to do it myself. Every folder had the htaccess and php files deep in the directory tree. Some could just be deleted, others had to be change permissions and then deleted. It took hours over a couple days. (I understand why Hostgator charges so much).

Anyway, in short, after deleting and changing permissions, those file 're-populated' themselves. Back a square one. Hostgator say those files have to be deleted before 'restored' files can override the corrupted ones. I plan to use Filezilla to restore files.

Is there a way to add a malware removal tool to scan, quarantine and eliminate infected files? I would delete the whole directory and restore it but some folder wont delete without changing permissions five levels deep.

If you been through this how did you rectify the problem?

Thanks.

Hi everyone!

I'm working on my first videography portfolio website for a client, and they shared this website as a reference:

https://www.zakmulligan.com/

I really like its cinematic design, minimal navigation, video presentation, project selection layout, and overall user experience. I want to clone the website as closely as possible using WordPress, Elementor Free, and custom code, without purchasing a premium theme or Elementor Pro.

I'm currently working with LocalWP on Ubuntu and am comfortable following technical instructions, including HTML, CSS, JavaScript, and PHP if needed.

Is there a free way to clone the complete website in WordPress while keeping it editable in Elementor?

Are there any free tools or workflows that could save me time?

I'm looking to learn the right approach rather than simply import a static HTML page that I can't edit properly.

Any guidance, tutorials, or examples of similar projects would be greatly appreciated. Thanks!

What’s the best way to protect wp login and wp admin with Cloudflare now days. I’ve done this in the past with page rules but recently read something about them being retired.

Ive gotten really good at Elementor Pro and can pretty much build any design in it … however I do not want to do a subscription.

I’m looking for a builder that is similar to Elementor BUT has a lifetime license.

I just purchased Divi, but I am not liking it at all — so I will be doing a refund on it, unfortunately. I don’t really want to keep randomly spending money to find what I’m looking for. Is there any builder that has similar structure and feel as Elementor that has a lifetime license that you guys are aware of ? Thanks so much for for your time.