There are no images saved on my website by this name, no page names with this name, I scanned the entire website for default images or images with this name, and I see nothing.

I use Surerank for my SEO but surely I'm doing something wrong; can anyone please offer any advise?

I built a plugin for real estate sites that lets visitors click on apartments/units directly on a building image or floor plan, instead of scrolling through a plain list.

Key Features

• Draw clickable hotspot areas over any building image or floor plan layout.
• Visitors click a unit to instantly see details (price, area, status, availability).
• Filter units by price range, room count, or status directly from the interactive view.
• 360° feature - building rotation.

Free on wp.org: https://wordpress.org/plugins/interactive-real-estate

It’s live on wp.org, and I'd love to get your feedback on performance, UI/UX, or features you'd like to see next. Let me know what you think!

Hi there!

So since the beginning of the year i got obsessed over wordpress development and did a lot of websites, specially with elementor, while playing with a lot of different plugins e.g. wpforms, wordfence, yoast, rank math, google site kit etc.

ive started freelancing online with a little bit of sucess (yes on this infamous upwork) and ive fell in love with it!

id like some tips to upskill (pun intended) my work and learn some other types of useful gigs i can offer in the wordpress niche!

ive been thinking:

1 learning other constructors e.g. wpbakery, divi and gutenberg(ouch)

2 learn to clean malware

3 transfer hosting

4 learn otimization web core vitals

5 improve seo knowledge

6 improve woocommerce knowledge

7 learn the backend of wordpress php and mysql

8 plugin development

id like to ask which of these skills, if any other, would help me stand out more in the wordpress online freelancing world and be able to earn more with this passion of mine! Thanks a lot!

This is not a wordpress bashing post. I like wordpress a lot, use it daily and will continue to. When I first started as a graphic/web designer, I wasn't a good coder at all, and my html sites were pretty bad.

Then, years ago I discovered wordpress and it made things so much easier. Lately though, I've been thinking of the upkeep wordpress has vs html sites. Updating plugins, themes, checking security plugins, etc.

A client had another designer do a wordpress site for him. It looked good, but it had some plugins that required a subscription, and once it expired he didnt want to pay to update the subscription. I told him the longer he waits to update, there's a chance his sites will be hacked (shared hosting).

That happened recently, his entire shared hosting was hacked. I don't know how the hacker got in, but I suspected the outdated plugins. The fact that he's using one of the cheaper/low quality hosts didn't help.

I have several clients that have extremely simple, one page sites. Now that my coding knowledge is better, I'm wondering if in the future it may be better to do sites like that in html? The few html sites I do have are so low maintenance plus my understanding is that simple html sites are in less danger of being hacked than php sites?

Thank you for any feedback.

It's going to be a bit long but please hang on with me.

I really liked Squarespace until recently. I had a customer who needed to pay with credit cards so I happily created a product, provided the payment link and the customer paid. Then they blocked my account, blocked 100% of the customer's money. I wasn't able to provide my services because the money didn't reach me, the customer couldn't use another form of payment because the money was with Squarespace and Squarespace, drumroll, happily kept all the fees. Dispute still ongoing.

The only thing that made me pay $200 per year for this shitty service was the possibility to make payments 'safely and conveniently'. Obviously it's neither safe nor convenient. So I said to myself: fck Squarespace, let's go back to WP.

I've been with Worpress since they launched and built multiple websites but I am close to 50y.o. and have other problems in life so I will need some help.

I have 2 weeks till they charge me over $200 again and would like to know if there is a tool that costs no more than $60 and can migrate my website layout to Wordpress. I've put a bit of effort into making my site more or less decent and would like to have the same look but on Wordpress. I've spent hours building my website and don't want my work to go in vain.

This is my website: www.exmotech.com

Can it be easily copied? I am worried about the hover effects of the images or the images popping up and zooming when you scroll the page. Can it be duplicated in WP?

Hi everyone,

I'm one of the founders of SignalMix , a company focused on AdTech, SEO and web development. We're currently standardizing the WordPress stack we use for client projects, and I'm evaluating whether Rank Math is still the best long-term option.

We've used Rank Math for a while and like features such as:

• Schema support
• Redirect manager
• Sitemap generation
• Content optimization
• WooCommerce integration

However, I've seen mixed opinions lately regarding performance, feature bloat, and the increasing push toward premium features. We tried to find a montly subscription for testing but it´s impossible.

I'm considering switching again to Yoast SEO, but I'm not sure if it's actually a better choice in 2026 or if it's simply more established.

For those managing multiple WordPress sites:

• Did you move from Rank Math to Yoast (or vice versa)?
• Any SEO gains or losses after migrating?
• How has plugin stability and performance been?
• Are there other plugins you'd recommend instead (SEOPress, The SEO Framework, Slim SEO, etc.)?

I'm more interested in real-world experiences than feature comparison tables.

Thanks in advance!

Someone published a piece claiming a theme author was inflating his active install counts on WordPress.org. I read it, got annoyed at how plausible it sounded, and decided to check it myself instead of taking anyone’s word for it.

That took a day. What I found is worse than the original accusation, and it has nothing to do with that one author.

The number in the plugin directory that says “10,000+ active installations” is the softest number in the whole ecosystem. It has no public history, it’s rounded to one significant digit, it costs about a third of a kilobyte to fake, and it drives your position in search. Every other number on that page can be checked by anyone. This one can’t be checked by anybody outside wp org, including the plugin author whose reputation is attached to it.

Hi, in making my website I want to add multiple pages that customers can click linked buttons to get to. I was able to successfully make one page (and link it) and in trying to do the same thing again, I had a lot more trouble making the second page how I wanted it to be but finally settled on something. I have now made four pages, but have just realised that in editing pages 2, 3, and 4, they are all exactly the same - what I do to one it does it to all three. The first page is unaffected by this and still perfectly as it should be.

Does anyone know what I have done wrong here? How do I make a proper completely separate page from blank?

Thank you so much!

Hi everyone,

I wanted to share a plugin I've been working on called NinjaDraw. It is designed for bloggers, developers, and marketers who need to create flowcharts, mind maps, process layouts, or UI wireframes directly in their WordPress dashboard without using complex external tools.

It's based on Excalidraw lib and works in two parts:

1. WordPress Admin Backend - the full, feature-rich editor.
2. Frontend - displays only the lightweight SVGs generated by the editor.

🛠️ Key Features

• Excalidraw Canvas Editor: build visual content with a popular, easy-to-use sketching and hand-drawn interface.
• Media Library Integration: You can insert images from your standard WordPress Media Library straight into your drawings. Note: I modified the Excalidraw core so that it now uses image URLs instead of the default base64 format, which keeps the output size minimal and prevents bloated database records.
• Lightweight SVG Renders: The frontend displays clean vector SVGs generated by the editor.
• Gutenberg & Shortcode Support: Embed your sketches anywhere using native core blocks or a simple [ninjadraw id="123"] shortcode.

Download from here - https://wordpress.org/plugins/ninjadraw/

I would love to get your feedback and any features you'd like to see in future updates.
Let me know what you think!

Hi everyone,

I wanted to share a small open source plugin I've been working on.

Over the years I've seen a lot of WordPress sites get compromised simply because an installed plugin had a publicly known vulnerability that went unnoticed.

The goal of this plugin is very simple:

• Checks WordPress core
• Checks installed plugins
• Checks installed themes
• Warns if a known vulnerability exists
• Uses the public WPVulnerability API
• No account required
• Lightweight and focused on one job

It isn't trying to replace Wordfence or Patchstack. There are no malware scans, firewall rules or dozens of settings. It's simply an easy way to see if your site is running software with known vulnerabilities.

Plugin:
https://wordpress.org/plugins/simple-wp-vulnerability-watcher/

I'd really appreciate feedback from other WordPress developers.

What would make a tool like this more useful for you?

Disclosure up front: I built this plugin. It is free on WordPress.org with no usage limits and no nag screens, and I am here for feedback, not just installs.

The problem: If you run staging sites for clients, getting approved pages to production usually means trade-offs:

1. Manual copy-paste: Recreating pages, re-uploading media, fixing meta, categories, alt text, and hoping you did not miss anything.
2. Full DB overwrite or custom WP-CLI scripts: You either nuke production with a full database clone, or you handpick database tables and write custom scripts that only a developer can run. Because your client can't touch any of that, they just edit directly on production whenever small updates are needed.

Standard migration plugins solve host moves, not this weekly editorial grind.

What Migro does: You connect staging and production once via REST + Application Passwords. Then select individual posts, pages, or batches, and push them. The content moves with its taxonomies, featured images, embedded media, meta, and alt text. Nothing else on production is touched. Pulling works the same way in reverse.

Full control for clients and non-devs: This is not just a tool for developers. Because Migro supports Editor-level permissions without requiring full admin or database access, clients and content teams control their own deployments. They can move approved staging content to production themselves, without waiting on a developer to run a deploy or a script.

Technical details:

• Sync keys: Re-deployments update in place instead of creating duplicates when IDs or slugs drift.
• Pre-overwrite backups: Automatic local backups run before any overwrite, with one-click restore applied in a single database transaction.
• Media deduplication: Images are hashed (MD5) so duplicate files link to existing attachments instead of re-uploading.
• Resumable transfers: Chunked deploys and streamed media prevent server time-limit errors on shared hosting.
• Structure preserved: Parent/child page relationships, attached PDFs/videos, and core page settings (front page, privacy policy) carry over automatically.
• AI Connector: I'm using the new AI Connectors to update missing Alt Text. It updates in the media gallery and carries over to the FSE.

What it does NOT do: Full-site host migrations, multisite, or user account migration.

WordPress.org: https://wordpress.org/plugins/migro-content-migrator/

Since my initial launch a lot happened: resumable large deployments, streamed media, transactional backups that abort on failure, builder compatibility checks, and parent/child page relationships surviving the move. Full changelog is on the plugin page.

How are you and your clients handling staging-to-production pushes today? Custom WP-CLI scripts, manual copy-pasting, DB cloning, or something else?

You can see it here Build With AI | Breakdance

Personally, this is what I've been waiting for.

https://www.youtube.com/watch?v=i80sNuVYQoU

I have a client who hosts an event 2x per year that has attendance globally. They invest heavily in photography and videography, but they do not sell the content - it's all available for free download with a watermark on their website after the event. It's a non-profit, and they typically have a good budget for web fees, but I don't want to lock them into anything they might not like long-term.

I'm rebuilding their site on Wordpress with Elementor. It has an extensive blog, informational pages, etc. so it's not "photos first" by any means, but the galleries are very important fat the time of the event and for historical content.

They were using a very old, free version of NextGen (Imagely). It is incredibly buggy and hard to manage (for them - they do much of the uploads and edits themselves). I was about to pull the trigger on Modula, but am irritated that they don't have an individual license option for the features they want (included in their business plan). $200/year seems steep for a non profit, but maybe I'm just being cheap?

Is there a better option out there I'm not seeing? I looked at FooGallery and still liked Modula's interface better. The client needs watermarking, image download, lightbox zoom, gallery sort, filters & search, image optimization, social sharing...

I messed something up so I restored an Updraft backup, but the whole site's colours, widths, radiuses etc are completely messed up

I checked Site Settings Custom CSS and all the CSS I had is completely blank

Additional CSS is fine

Any way I can get that Custom CSS back? I have the Updraft backup

UPDATE:

I downloaded the Updraft database file and extracted it. It was very big so I gave it to Claude and it found all the CSS.

Hi everyone.

I'm about to launch a wordpress plugin that helps a lot of websites to have instant results for wordpress/woocommerce.

It can be woocommerce products, wordpress posts, or CPT...it's something I've built on Algolia.

Basically In a few weeks i'm gonna launch this plugin.
Already tested on different websites, with WPML, without, with woocomerce and without...

Seems that really works really fine. Even if you have like 10k posts, it instantly gives you results on what you're typing.

I have seens that there's no plugins that are doing this available anywhere, even the premium ones.

They just allow you to use the basic wordpress search results integrated with algolia, but not like a shortcode with the search bar, the elementor widget...where you can style it or use a preset...

What do you think about a plugin like this?

This is just a feedback that I need from you. Do you think it can help most of the websites with a lot of content?

Thanks!

I'm surprised that I haven't been able to find a solution for what I'm looking for. Basically need a document repository managed in the backend that is synced bidirectionally with Google Drive. Then, folders and files are displayed on the frontend but able to be filtered by user-role.

There seem to be plenty of plugins that do this per-folder. Joom WP File Download practically does everything, except for the per-file level for user-role. Barn2 Document Library has user-role restrictions per-file, but does not have a bidirectional Google Drive sync. Advanced File Manager has a Google Drive sync, but their individual file-access settings are very convoluted and honestly not even sure if I can accomplish my goal with it.

My other thought is that if I could 1-to-1 manage and sync Google Drive with a physical folder in wp-content, let's say wp-content/uploads/library, via a plugin, then I could use another plugin (such as Barn2) to be the frontend and permissions layer. But, I cannot find a solution for that.

Anybody have any ideas?

Hi,
I bought a domain (registered and live a few years back) with high search volume and very low SEO difficulty.
I have had it live for nearly 6 months, and the homepage is still not indexed (some inner pages are indexed, but only 5 out of about 25).
A few backlinks, but nothing toxic and no manual actions.
Using SEO Yoast, SEO is green, and readability is green. A lot of content, unique. Used Google Search Console to fetch, plus others.
All keywords that I am tracking say pending/unstable.

This website has huge potential but just will not index. Any ideas why?

Hi everyone,

If your site was hit by the recent WordPress REST Batch API (wp2shell) vulnerability, attackers gained the ability to execute code (RCE) without authentication. Patching WordPress alone is not enough - you must completely clean the site of backdoors, check users, and clean up the database.

Here is a complete step-by-step guide on how to get a compromised site back in order.

IMPORTANT WARNING: Always make a full backup of files and the database before making any changes!

Step 1: File system cleanup (via FTP / SSH)

Attackers exploited SQL injection to write malicious PHP files directly to the disk (using the INTO OUTFILE command).

• Delete webshells in cache: Check the /wp-content/cache/ folder (or similar cache folders) and delete all suspicious PHP files (they often have nonsensical alphanumeric names like e042u9xy9ra1.php).
• Remove fake plugins: Attackers often create a persistent backdoor disguised as a security patch. Check the /wp-content/mu-plugins/ folder and delete files you didn't put there yourself (e.g., galex_patch.php). Also check the standard /wp-content/plugins/ to see if an unknown plugin has been added.
• Update WordPress: Immediately update WordPress core to the patched versions 6.9.5 or 7.0.2. This seals the hole in the Batch API itself.
• Disable file editing: For future protection, add these lines to the wp-config.php file, which disables the installation and editing of plugins via the administration:
• define( 'DISALLOW_FILE_EDIT', true );
• define( 'DISALLOW_FILE_MODS', true );

Step 2: Users, passwords, and sessions

Attackers had full access to the database and highly likely obtained password hashes, or logged in directly as administrators.

• Reset passwords: Immediately change passwords for all users, especially those with administrator privileges. Also, change the password to the MySQL database itself (and update it in wp-config.php).
• Terminate active sessions (Log everyone out): The attacker might still be logged in. Go to the official WordPress Salt Keys generator and overwrite the old keys in your wp-config.php. This will immediately log out all devices.
• Check for fake administrators: Go to the Users section in the administration and check if the attacker created a new secret administrator account. If so, delete it without compromise.

Step 3: Database cleanup (SQL)

To bypass WordPress security filters, attackers used an in-memory exploit that temporarily generates fake menu items and spoofed changesets in the database. These records often have a fixed date of 2020-01-01 00:00:00 and contain a URL payload pointing to example.invalid.

Note: The queries below use the default database prefix wp_. If your database uses a different prefix, do not forget to change it in the code before running it.

1. Delete spoofed changesets

SQL

DELETE FROM wp_posts 
WHERE post_type = 'customize_changeset' 
AND post_date = '2020-01-01 00:00:00';

2. Delete fake navigation menu items

SQL

DELETE FROM wp_posts 
WHERE post_type = 'nav_menu_item' 
AND post_date = '2020-01-01 00:00:00';

3. Delete malicious metadata

SQL

DELETE FROM wp_postmeta 
WHERE meta_value LIKE '%example.invalid%';

Step 4: Tightening security (Prevention)

To minimize the chance that a similar type of attack (writing from the database to the disk) will ever happen again, revoke the FILE privilege from your WordPress database user. WordPress does not need this privilege at all for its normal operation.

Log in to the database as root and run:

SQL

REVOKE FILE ON *.* FROM 'wp_user_name'@'localhost';
FLUSH PRIVILEGES;

Hopefully, this complete guide will save someone's site and save time during the cleanup. Happy hunting!

I currently use a combination of bookmarks and a password manager, but I am curious how other freelancers handle this as the number of client sites grows.

Think about the last time a client asked you to change something:

1. Where did you look first to find the correct site or WP Admin page?
2. Does your password manager also help you find the site, or does it mainly handle signing in?
3. Do you keep client names, custom WP Admin paths, or site notes somewhere else?
4. Roughly how many active client sites do you handle?

Does your current approach work well?

At the moment, if we even a fairly minor change that impacts both files and database, we're using WPVivid to download a snapshot of the site, making the change locally and then WPVivid again to upload to staging before pushing live. This seems horribly complicated as well as meaning the site isn't available for editing until changes are pushed live. Plus even fairly small sites are taking ages to download and reupload.

How are you deal with this workflow? Any thoughts / suggestions welcome. Thanks reddit hivemind!

I'm an SWE student is Wordpress still the best option for a dynamic CMS in 2026?
I have to make a website for my own company with lots of products and a clean look that i will be maintaining and taking care of in the future.

EDIT: more detail

I need to build a website for my company. The website would mainly be a product catalog/e-commerce style website with around 1000+ products, I would be updating and maintaing the website all by myself.

I am considering options like WordPress + WooCommerce, but I am not sure if that is still the best choice in 2026 for this type of website or if there are better alternatives

What would you recommend for:

• A self-managed website
• 1000+ products
• Good performance and SEO
• Easy product management
• Reasonable maintenance costs

EDIT: The website would serve as a product catalog, with potentially Fast delivery local country shipping, or just making orders and having them ready in the store ( I live in a small 3rd world country).

2027 will be an exponentially challenging year for WordPress.

For most of WordPress’s history, building and maintaining the PHP code that powers plugins, themes, and WordPress itself required a real skill set. It required experience, patience, and a special kind of concentration.

That has changed.

In 2026, WordPress entered what I would call its unveiling year.

By unveiling, I mean that the barrier to both creating WordPress code and finding weaknesses in WordPress code has collapsed. Pretty much anyone with a basic education, a few dollars, and access to modern AI tools can now generate plugins, build themes, review PHP, test code paths, and discover vulnerabilities that previously required years of specialized experience.

That shift is not coming someday. It is already here.

This past week made that painfully clear. WordPress Core received an emergency security release after serious vulnerabilities were discovered and patched. Reporting around the issue indicated that AI tooling was involved in developing or validating the exploit chain. Whether one prompt or many, whether cheap or expensive, the larger point remains the same:

The old assumptions no longer hold. The ability to find exploitable PHP vulnerabilities is now available to everyone.

For years, WordPress security has depended on a mix of responsible disclosure, plugin developer responsiveness, managed hosting protections, security plugins, vulnerability databases, and the quiet assumption that finding exploitable bugs still required enough expertise to slow attackers down. That assumption is disappearing.

The Avalanche Problem

The greatest threat to WordPress is not only the next vulnerability in Core. It is the vast installed base of old plugins and themes.

WordPress has succeeded because it made publishing easy and extensibility nearly unlimited. That same success has created a security problem of historic scale.

There are millions of WordPress sites running plugins and themes written years ago, often by developers who have moved on, businesses that no longer exist, or maintainers who never expected their code to be reviewed by AI powered vulnerability testing tools.

Many of these plugins work fine. Many of them are useful. Many of them also contain insecure patterns that were common, unnoticed, or simply not understood at the time they were written.

In the past, those weaknesses were discovered slowly. A researcher found one. A botnet found another. A security company published a notice. A plugin developer released a patch, or did not. That pace is about to change.

As AI assisted code review and exploit generation become built into everyday tools, WordPress will face an avalanche of vulnerability reports, emergency patches, abandoned plugins, active exploitation campaigns, and confused site owners who have no idea which warnings matter and which actions are safe.

This is not a future where security remains a side concern. This is a future where security becomes the main feature WordPress must deliver.

WordPress Needs Security as a Native Product Feature

WordPress cannot depend forever on every site owner installing the right security plugin, choosing the right host, subscribing to the right vulnerability feed, understanding CVEs, reading patch notes, and manually deciding what to do when a plugin becomes dangerous. That model does not scale.

WordPress needs a native security layer that treats plugin and theme risk as a first class part of the platform.

In plain terms, WordPress Core should know when installed code is vulnerable, understand the likely severity, communicate clearly to the site owner, and take safe protective action when possible.

This does not mean WordPress needs to replace Patchstack, WPScan, Wordfence, hosts, researchers, or the existing security ecosystem.

It means WordPress needs to learn from them and bring the most essential protections into the platform itself.

What WordPress Core Should Build

1. A Native Vulnerability Intelligence Feed

WordPress should maintain or integrate a signed, trusted vulnerability feed for plugins, themes, and Core.

Every WordPress site should be able to answer basic questions without requiring a third party plugin:

• Is this installed plugin known to be vulnerable?
• Is the vulnerable version currently installed?
• Is there a safe update available?
• Is the plugin abandoned?
• Is exploitation active in the wild?
• Is this vulnerability remotely exploitable?
• Does it require authentication?
• Is there a temporary mitigation?

This information should appear directly in the WordPress admin, in Site Health, in Updates, and in a dedicated Security screen.

Site owners should not have to understand the difference between a theoretical vulnerability, a patched vulnerability, and an actively exploited vulnerability by reading scattered blog posts. WordPress should tell them plainly.

2. Vulnerability Aware Automatic Updates

WordPress already supports automatic updates, but security updates need a more intelligent model.

When a plugin or theme has a serious known vulnerability, WordPress should be able to prioritize that update differently from a routine feature release.

A modern security update system should include:

• automatic backup before high risk security updates
• compatibility checks where possible
• staged update attempts
• automatic rollback if the update breaks the site
• clear owner notification
• emergency update escalation for critical vulnerabilities
• host level coordination where available

If a vulnerability is being actively exploited, WordPress should not treat the update as just another available plugin update. It should treat it as a site safety event.

3. Temporary Virtual Patching

WordPress should explore a native virtual patching layer for known plugin and theme vulnerabilities. This is one of the most important ideas we should consider.

When a vulnerable plugin cannot be updated immediately, WordPress should be able to apply narrow, temporary protections that block known exploit patterns until the real patch is installed.

That could include protections around:

• dangerous request parameters
• unauthenticated AJAX actions
• vulnerable REST routes
• unsafe file upload paths
• known option changes
• privilege escalation patterns
• SQL injection signatures
• cross site scripting payloads

This does not need to become a full web application firewall inside Core.

But WordPress should be able to receive signed mitigation rules for known vulnerabilities and apply limited, targeted protection.

Patchstack has already shown that vulnerability intelligence and virtual patching can be productized. I'm not saying that WordPress should not copy a commercial service wholesale, but it should recognize the model as essential infrastructure.

4. A Plugin Permission Model

One of WordPress’s deepest security problems is that plugins generally receive enormous trust.

A simple plugin can often touch the database, create users, handle uploads, register REST routes, add AJAX actions, modify options, and execute powerful code.

WordPress needs a permission model that makes plugin capabilities visible and, over time, controllable. Site owners should be able to see what a plugin is allowed to do.

For example:

• Can this plugin create administrator users?
• Can it write files?
• Can it process uploads?
• Can it expose public REST API endpoints?
• Can it modify site options?
• Can it send email?
• Can it execute scheduled tasks?
• Can it access customer or user data?

This would be a major architectural challenge, but WordPress needs to start moving in this direction.

The plugin ecosystem was built for trust. The AI exploitation era requires boundaries.

5. Plugin Isolation and Restricted Execution

WordPress should begin developing ways to isolate risky plugin behavior. Not every plugin needs full access to everything.

Over time, WordPress could introduce restricted plugin modes, stronger sandboxing patterns, safer APIs, and warnings when plugins use dangerous functions or outdated practices. Even partial isolation would help.

A contact form plugin should not casually have the same practical power as a backup plugin, a membership plugin, or an ecommerce plugin. The current all or nothing model is too dangerous for the next phase of the web.

6. Continuous AI Assisted Directory Scanning

If AI tools can be used to find vulnerabilities by attackers, they should also be used continuously by WordPress.org. At a minimum:

• Every plugin and theme in the official directories should be scanned regularly using static analysis, dynamic testing, dependency review, and AI assisted code review.
• New submissions should face stronger security review.
• Existing plugins should be rescanned as models improve.
• Abandoned plugins should be flagged.
• High risk code patterns should trigger warnings or required fixes.

The WordPress plugin directory is not just a marketplace of ideas. It is part of the software supply chain for a large portion of the public Internet. It should be protected like critical infrastructure.

7. Clear End of Life Rules for Plugins and Themes

WordPress needs a stronger policy for abandoned plugins and themes.

If a plugin has not been updated in years, has unresolved security issues, or no longer has an active maintainer, WordPress should make that status more obvious.

Possible labels could include:

• actively maintained
• security maintained
• unmaintained
• abandoned
• removed for security reasons
• replacement recommended

These labels should appear inside the WordPress admin, not only on WordPress.org. A site owner should not discover that a plugin is abandoned only after the site is hacked.

8. Signed Updates for Plugins and Themes

WordPress Core has already taken important steps with signed updates. That same thinking should continue across the plugin and theme ecosystem. Every update delivered through WordPress.org should be cryptographically verifiable. Supply chain security is no longer optional.

If attackers can compromise developer accounts, update channels, build systems, or distribution paths, then plugin and theme updates themselves become an attack surface.

WordPress must make authenticity and integrity part of the update system by default.

9. A Security Event Log in Core

WordPress should include a built in security event log.

At minimum, Core should record:

• plugin installation
• plugin activation
• plugin deactivation
• plugin updates
• theme changes
• administrator creation
• role changes
• failed login spikes
• file editor usage
• critical option changes
• vulnerability notices
• emergency mitigations applied

This does not need to be complicated.

But when something goes wrong, site owners, hosts, and security professionals need a reliable record of what happened.

Right now, too much of that visibility depends on optional plugins.

This Is Not a Criticism of the WordPress Security Team

WordPress has benefited from many dedicated people who have quietly protected the project for years. This letter is not meant to dismiss that work. It is meant to say that the threat model, scale, speed, and the economics all changed in 2026.

A vulnerability that once required a skilled researcher may soon be found by a teenager experimenting with an AI coding assistant. A plugin that sat quietly for eight years may suddenly become the target of automated hacking tools. A weakness that once affected a few sites may be weaponized across the internet in literal hours. The WordPress security model must evolve accordingly.

A Request to WordPress.org

I am asking WordPress.org to make security a central product priority, not a side project, not a plugin recommendation, and not a responsibility quietly passed to site owners, web hosts, or commercial developers/vendors.

WordPress should not expect millions of users to assemble their own security model after installation. The platform itself needs to provide native awareness, clear warnings, safer updates, and meaningful protection when known vulnerabilities put sites at risk.

Before more interface experiments or nonessential initiatives, WordPress should publicly commit to a security roadmap for the AI era.

That roadmap should include:

• native vulnerability awareness
• vulnerability aware automatic updates
• rollback safe patching
• targeted virtual patching
• plugin and theme risk scoring
• abandoned plugin visibility
• stronger plugin directory scanning
• plugin permission transparency
• a Core security event log

WordPress made publishing available to everyone. Now it must make security available to everyone.

The next wave of attacks will not wait for every site owner to become a security expert. WordPress has to carry more of that burden itself.

If WordPress wants to remain the operating system of the open web, security can no longer be treated as something users put together from search recommendations after installation.

Security must become part of what WordPress is.

Respectfully,

Jim Walker
The Hack Repair Guy

Over the last few releases, I’ve been expanding WP Optimizer, my free all-in-one WordPress performance plugin.

The idea is simple: instead of installing separate plugins for caching, database cleanup, image optimization and diagnostics, WP Optimizer puts everything into modular features you can enable only when needed.

Performance diagnostics

The Page Test compares a baseline request with your optimized configuration, showing response time, TTFB, memory usage, database queries and expensive callbacks.

The Performance Monitor can also sample real requests and attribute execution time, memory and queries to WordPress core, the active theme and individual plugins.

Multiple cache layers

WP Optimizer includes static page caching, query caching and Redis or Memcached object caching. It handles invalidation automatically and excludes WooCommerce sessions, checkout pages and page-builder previews.

Front-end optimization

It can minify HTML, CSS and JavaScript, enable compression and browser caching, lazy-load media, optimize fonts, preload LCP images and prefetch internal links.

Images are processed locally with GD or Imagick, including compression, resizing and WebP conversion—no external service required.

Backend tools

There are also tools for:

• Database cleanup and optimization
• Autoloaded-options analysis
• Cron event management
• Heartbeat control
• Media cleanup
• Scheduled maintenance
• SQL backups and restoration

Automatic configuration snapshots make it easy to roll back settings if caching or minification causes compatibility problems.

Everything runs inside one free plugin, with no premium tier. You can also keep your current caching plugin and use WP Optimizer only for diagnostics or maintenance—just avoid enabling overlapping features.

To be transparent, it still doesn’t include advanced unused-CSS removal, interaction-based JavaScript delay or a built-in CDN. The diagnostic tools identify slow queries and callbacks, but don’t automatically rewrite problematic code.

Would love honest feedback, especially bug reports and compatibility issues across different hosting environments.

Hi

I recently read a post on WP-Engine about MCP-Server for better AI results.

https://wpengine.com/mcp-server/

Has anyone tried this? If yes, what is your feedback?

TIA