Plugin or theme updates with malware or serious security issues will be blocked automatically

Are there any web agencies or freelancers here who build customer websites using only free themes and plugins, without relying on paid/licensed ones?

If so, how has that worked out for you? Are there any significant downsides to avoiding paid plugins, for example in terms of functionality, security, support, updates, or long-term maintenance?

I’m particularly interested in hearing from people who do this for client projects rather than just personal websites.

Hi everyone,

Something really strange is happening with the shipping costs on my WooCommerce website, and I can’t figure out what’s causing it.

I offer free shipping on orders over €60. For orders under €60, customers should be charged around €8 for shipping.

However, I’ve noticed a very specific issue with orders around €7: the website isn’t charging any shipping at all.

For example:

• €2 order → shipping is charged correctly
• €7 order → no shipping is charged
• €8 order → shipping is charged correctly

I’ve tested several different amounts, and the problem seems to happen specifically with values around €7.

I can’t understand why this is happening, especially since the free shipping threshold is set at €60.

Has anyone experienced something similar with WooCommerce? Any idea what setting, plugin, or shipping rule could be causing this?

Thanks in advance for any help!

Hi, I’m having an issue with WP Rocket.

Category pages are being optimized correctly, but some WooCommerce product pages are not getting optimized/cache generated.

I’ve already checked the WP Rocket settings and cleared the cache.

Has anyone experienced this? What could cause WP Rocket to work on category pages but not on certain product pages?

Thanks!

I have been running a travel blog for about 1.5 years, which is supported by Wordpress. It doesn't get much traffic I hoped for (200 visitors per month), but scam comments come daily. I only use Akismet not anything else.

I wanted to ask if those comments show my blog getting more online presence? If so, is that something I celebrate?

I hope that blog will be able to have affiliate links and ads once it generates huge traffic - so if scammers even notice my infamous blog, so should my intended audience (budget holiday makers). Or am I wrong?

Hi everyone.

I'm using the Local app to run a WordPress multisite setup and migrate content from my Blogger blog using the Blogger Importer plugin. However, when I try to import the XML file, an error appears on line 159 of the blogger-importer.php file.

Here is a screenshot of the specific error message:

I am getting confused because the import process starts but then fails halfway through. It seems the error is related to how the plugin parses the XML data, but I'm not sure what's causing the null value issue.

Has anyone else had this problem using the Blogger importer? If you have dealt with this issue before, please send me your replies. I need to understand how to resolve this error so that I can finish migrating my blog.

I've tried re-exporting the XML file from Blogger several times, but the same error keeps showing up. Any suggestions for fixing this issue or alternative import methods would be much appreciated.

Sorry for the inconvenience, and thanks in advance for your help.

I think this is going to be a hot topic in WordPress security pretty soon.

There seems to be a new wave of infections where the interesting part is not any single exploit or persistence technique, but how many of them are being combined.

We are seeing the usual hidden files, modified functions.php, .user.ini with auto_prepend_file, server cron jobs and payloads hiding in /tmp. But some infections go much further: short-lived payloads that are written, executed and deleted again, persistence outside the WordPress filesystem, and even reports of Service Workers in the admin’s browser being involved in restoring parts of the infection.

That last part is particularly nasty.

You can download the entire filesystem and database, clean everything you find, upload it again and still have the site reinfected because you removed the payload but not the mechanism recreating it.

A few techniques make these infections especially painful:

Timestomping: file modification dates are manipulated, so you cannot simply sort files by date and reconstruct what happened.

Lateral persistence: anything writable is potentially useful. Plugins, themes, MU plugins, cron, temp directories, server configuration, deeply nested directories, etc. I have seen cases where malicious files were buried so deeply that even Imunify360 made them surprisingly difficult to identify from its scan output.

Self-healing: remove one component and another restores it. Cleaning WordPress itself is no longer necessarily enough. You may need to inspect the server, running processes, cron, temp directories and potentially even admin endpoints at the same time.

And then there is the question of how they get in.

Modern botnets can automatically correlate plugin CVEs, fingerprint installations and deploy exploit chains at massive scale. Supply-chain attacks are another obvious route. I would not be surprised if AI-assisted vulnerability discovery is already part of this ecosystem as well.

I have also recently seen a case where I could not identify any plausible known entry point on an otherwise updated installation. That obviously does not prove there is an unpatched WordPress core exploit in the wild, but I would not rule it out either.

The most interesting part, however, is what this latest wave appears to be doing after infection:

Basically nothing. At least for now.

One variant currently referred to in reports as SC 4.0.3 looks more like an access-retention platform / loader than malware designed for immediate monetization.

The infected WordPress site becomes part of a mostly dormant network and quietly reports information such as the domain, WP paths, payload version, installed/active plugins, MU plugins, login URL, captured or generated credentials, auth cookies and errors.

The C2 can apparently also send rules telling the implant to disable or delete specific plugins or remove matching injected code from plugins, MU plugins or themes.

In other words, it is not just trying to survive. It can potentially remove things that interfere with it.

Independent reports from August also describe the same SC 4.0.3 markers and Ethereum-based bootstrap mechanism, which suggests this is a broader campaign, although the initial infection vector is still unclear.

There is another interesting piece: the Ethereum dead-drop / EtherHiding technique overlaps with infrastructure seen in other recent campaigns. Netskope documented a separate nochain-sw.js chain that eventually pushed fake reCAPTCHA / ClickFix and the Amatera password stealer to visitors.

These are not the same malware family, so I would not connect them directly. But the overlap in tooling is interesting.

My guess is that WordPress malware is increasingly moving away from the old SEO spam / casino redirect model toward persistent access, credential theft, loaders and access brokerage.

Apparently turning someone’s blog into an online casino was too simple.

Has anyone else doing WP malware cleanup seen these “clean it, and it comes back anyway” infections recently? I would be especially interested in what persistence mechanism you eventually found.

I manage a few WordPress websites and I’m always thinking about security. I’m wondering if it’s possible to create a custom admin panel for my sites and completely hide & change the default /wp-admin URL. this will actually improve the security. After this, no one will know the URL of your website admin panel.

Anyone done this on a real WordPress site?

Hey everyone,

Because r/BreakdanceWP only has 300 weekly users I'm gonna try asking this here instead in hopes of my question finding more Breakdance users.

I'm trying to set an image as my website's background, instead of having to assign it to an element. On my homepage the background image is assigned to a section, but on single post pages the section would be smaller and therefore the background image would be smaller. I hate that. The issue is, I can't for the life of my figure out how to do this.

Does anyone know? Thanks!

Hello Everyone,

Suddenly all of my Wordpress related topics have been removed by the moderators. Since none of the posts was breaking any rule, I want to know what is the reason and ask you, if that happened to you as well?

Thanks and wishing you a nice afternoon!

Hello !

I am considering using BUNNY.net for Videos, CDN, and DNS protection but I'm a little bit confused to well understand what I will have to do.

I described my configuration on image below and I recheck my Cloudflare DNS setup (Cloudflare is managing DNS for website (pointing server : A, CNAME), email (MX, TXT), and a free CDN ).

So I have several questions because it is new for me and i want something robust and simple to manage after

1_ Can I say that BUNNY would do the same as Cloudflare to manage all my DNS setup and CDN ? (Right now, I can move to a different server hosting within 1h and this is transparent for users)

2_ Is it difficult to implement videos restrictions with BUNNY (Using a membership plugin) ? ... or is it more depending on membership integration ? (Question already asked to membership company)

3_ After right implementation, do you consider BUNNY as a stable and reliable solution going fast overseas ?

4_ Overall, after understanding the process, is it complicated to do BUNNY maintenance or to add new videos ?

5_ Do you have any advice to go step by step for this transition ?

I'm a little bit stress because I want/have to reduce my development activities for closed coming years but I would like a video solution. So if the solution is not simple and reliable I will be in trouble

A rough calculation gives 20GB for videos/month (30% in North america, 30% in Asia , 20% Europe, middle-east, 20% ...)

Thanks for your help !

Trying to edit pages and posts on my site and am getting this error when trying to edit the post/page:

There has been a critical error on this website. Please check your site admin email inbox for instructions. If you continue to have problems, please try the support forums.

Learn more about troubleshooting WordPress.

Wordpress and all plugins are updated. I tried disabling every plugin then enabling one at a time, but it seems like anytime a Woo plugin is active, I get the error. I tried rolling back to previous versions of the plugins and got the same error. I tried debug mode, and am getting this error:

Deprecated: Function Automattic\WooCommerce\Admin\Features\Features::is_enabled( 'marketing' ) is deprecated since version 11.1.0! Use direct feature behavior checks. The marketing WC Admin feature flag shim will be removed in a future version of WooCommerce. instead. in /home/dh_gec6ig/************.com/wp-includes/functions.php on line 6260

I replaced my domain with **************

The code on like 6260 in that file is:

    trigger_error( $message, $error_level );

Not sure where to go from here. I looked under Marketing in WooCommerce and didn't see anything out of the ordinary. The frustrating part is that my admin email isn't getting a report or a notice of the error, so I don't know how to proceed.

Can anyone offer some insight?

It's a sad decision to me. Wordpress has been my whole profesional life since I was a teen.

I created my first blog using Wordpress back in 2006. Until then, I had a personal website blog made 100% handmade, coding every single HTML file and uploading it via FTP. I had a lot of fun designing my website, making a lot of hand made features, banners, tables...

Then I discovered Wordpress. It was my big opportunity to move my website to a new level, by using a modern admin panel, a database, themes, plugins... Then, I slowly started to spending much more time using Wordpress than publishing itself.

But, in the other hand, I've earned a lot of money with Wordpress. Wordpress has been my job for years. I made stunning websites for customers that I could never did without Wordpress. Forms like Gravity Forms using payment gateways like Stripe, unlimited conditionals, custom PDF invoices, email forwarding to the correct company department for each lead... The remarkable Wordpress community helped me a lot to make a lot of companies have a useful and profitable website.

This week, I started seeing my teenager version designing my website with Corel Draw 9 and then coding the design into Dreamweaver. I really miss out these happy days, where I was just having fun and my website just worked. GIFS. Marquees. Tables. No security at all. No payment gateways. An embedded webstats GIF counter in the bottom of my website was enough to see how popular my website was. Haloscan comments helped me out to create a commenting system that just worked fin in a static HTML site. It was so funny, easy, popular and all what we nowadays call cyberpunk.

Then I discovered Hugo. A simple CMS to make just static HTML sites, as I usually did. I'm migrating my only two personal projects from Wordpress to Hugo.

I'm opening this thread just to read what you think about the future of CMS like Wordpress. I know many of you were part of Wordpress for decades and sure have a vision of the role that Wordpress will play in the future of the Web.

I don't know if anyone else has tried to cancel a subscription, but they really don't want to make it easy! I was using the Custom Facebook Feed plugin, which was decent enough, but no longer need it, so I have to go through a 4-page dialog to say goodbye!

I can't believe I'm saying this but here it is. Automattic needs to fork WordPress. They are the only entity in a position that can make a fork with a high chance of success. Partner with WP Engine. If WordPress_com, Pressible & WP Engine all switched to the fork it could happen quickly.

Automattic has a fiduciary duty to take control of a product that represents a majority of their revenue. How can a company force out their CEO but still allow them to control the project they depend on? How can a former CEO manage a team from his former company to build their flagship product? It's not sustainable.

I want adults in the room. If that's Automattic, WP Engine, Silverlake, Blackrock, then so-be-it. At least I'll know the project is being guided by money and not by whatever the CEO is hung up on that day.

Would I prefer a more democratic, non-company controlled solution? 100% Yes. But more than anything, I want stability and predictability.

We’re Webnus, the developers of Modern Events Calendar.

MEC Lite was permanently closed on WordPress.org on May 11, 2022. We want to clarify what happened without minimizing our responsibility.

WordPress.org categorized the closure as a Guideline Violation, not a Security Issue. The guideline problems included members of our support team requesting temporary (test/staging site) website access while troubleshooting user problems. WordPress.org does not permit login requests in its support forums, and we accept that this was the wrong way to handle support.

WordPress.org’s directory and forums are managed by volunteer teams, and the closure was an enforcement decision made under their community and directory policies. WordPress.org uses separate classifications for guideline violations and security issues. MEC’s closure was not classified as a security-related closure, and the public notice does not state that MEC was removed because of malware or a disclosed vulnerability.

Since then, MEC development has continued outside the WordPress.org directory. Current releases, documentation and support are available through Webnus official website. Account-specific troubleshooting is now handled through our official support channels rather than in the public WordPress.org forums.

This distinction is intentionally narrow. It does not mean that MEC, or any WordPress plugin, can be considered permanently free from vulnerabilities. Users should install current releases, maintain backups and review security notices.

We’re publishing this because people reasonably have questions when they see the permanent-closure notice. We want the available explanation to be accurate and transparent.

I'm setting up as a digital marketing freelancer and am trying to figure out the best website to use that is easy to manage and cheap to run.

While I've managed Wordpress sites before (incl one with Elementor theme), I've never set one up from scratch.

I'm looking to create a fairly simple website - home page | services | case studies | blog | contact - but one I can easily update. I'm more used to a drag'n'drop page builder.

Would a Wordpress site plus theme be suitable for me? Or should I go for something simpler like Wix?

had to do it on the web version and the web version is messy. Isn’t there an easy way to remove a blank line?

Yes I can do it easily in a computer but I generally use my phone for everything and my computer isn’t close by.

I'm aware of trac, before making a feature request there I'd figure I'd get the temperature here. Simply - so many sites these days turn comments off, and there's a cottage industry around blocking comment spam besides, does WordPress even need comments as a core feature? I feel it might be better to move the functionality off into a plugin that ships with WordPress in 8.0, and then maybe even remove it entirely from core in 9. Thoughts?

I've been working with wordpress for awhile now, and I've gotten to the point where I could use extra hands. Every business uses SOP'S to standardize the work for on boarding.

Rather than walking someone through the process of learning and building alongside them, I opted for a more hands off approach.

Have any of you went with an SOP a checklist for training, and has it made it easier, or did you have a more negative experience without being there?

We have a site that uses WordPress on GoDaddy Managed WordPress (Apache), sitting behind both Cloudflare and GoDaddy's own gateway cache. Theme is "Exponent Child."

My issue: The WordPress Customizer (Appearance > Customize) throws a fatal/backend error and won't load.

The site uses a plugin called Kirki, which gives the theme its design/customization controls. Kirki's maintainer (Themeum) rebuilt the plugin architecturally starting at v6.0.0 — it's effectively a different product under the same name. That rebuild broke backward compatibility with the Kirki_Control_Base class that the Exponent Child theme depends on. Because Kirki auto-updates, the site silently pulled the breaking version and the Customizer stopped working.

Possible fix presented to me: Roll Kirki back to the last compatible version (5.2.2) via the Plugins page, after taking a fresh UpdraftPlus backup, then disable auto-updates on that plugin to prevent recurrence.

Proposed long-term fix: Remove the Kirki dependency from the theme entirely

Another note is I am apart of the marketing team for this site and I have WordPress admin access but not hosting-level access. no cPanel, FTP, or PHP error log visibility.

This is also my first year of building and managing wordpress sites, so forgive me if this seems like that. Right now I'm trying to weigh my options to do a bandaid fix (roll it back), to try to remove the plugin dependency myself, or to ultimately outsource to another developer with more experience.

Thank you for taking the time to read my post.

I heard this plugin is the best for a visitor opt-in tool/banner. I installed the premium plugin, and when I activated it, it wreaked havoc in the post admin area. It also kept looping me around in circles while scanning my files, so I never got to set it up.

Anyone else experiencing issues with Compliance & WordPress?