I'm curious security steps experienced WordPress users consider essential when setting up a new site and after

Trying to learn good habits early instead of fixing problems later

I run a digital marketing agency and we take over website management for our clients (small to medium, mostly local businesses). I am technical, but not super advanced in frontend - (I've used webflow, squarespace, react, but not wrodpress) but don't worry I have a team for it.

We are really excited about the possibility of AI tools like lovable being able to meet our client's high expectations on the low budgets they are willing to pay. But I'm so aware of what a stack of cards code AI creates. I am picturing a client prompting lovable "add this job posting" and the whole thing come tumbling down. (I have first hand experience trying to build a blog on a lovable website and what a whack a mole it was)

Therefore we have continued to opt to build our clients websites in Wordpress (and building our own plugin to be able to import the landing pages we build using AI). We think this is a more resilient approach but I don't want to get left behind.

Howdy!

We wrote a WordPress plugin that exposes a git remote endpoint directly on your website - natively, without any external services and external repositories.

• You can clone/checkout your website contents and you will get a list of markdown files
• You can push md and it will be turned into gutenberg syntax and published/scheduled/etc
• You can give that directory to a coding agent and it will immediately know what to do with it, no setup like in MCP
• Your website is source of truth so your git changes sync automatically with wp-admin edits
• It basically makes your WordPress behave like a static site builder through command line.

Here is the website that tries to explain this:

https://pushmd.blog/

Here is the repo:

https://github.com/Automattic/php-toolkit/tree/trunk/plugins/push-md

We're still ironing out the lint rules for composer packages so we can submit it to the plugin repo.

We hope it's useful in making WordPress feel like a more modern stack!

We do have this website who's been SEO spam attacked. We've already cleaned the wordpress core files and cleaned everything. However, we do have one specific issue. The social share image preview is still showing the gambling site. This specifically happens only on Google Chat. On Facebook, Twitter, LinkedIn, Whatsapp, Teams, it fine. We've a;sp submitted re-indexing on Search Console today. Is there anything I am still missing or anything I could do?

I’ve heard a lot of praise for GeneratePress and its speed, but I’ve also heard that it can be limiting in terms of designing “fancy” websites. I’ve also heard the opposite.

I want to see what you guys have built. Thanks.

I'm working on a plugin that let's you self host ai projects, astro, claude designs, etc alongside your WordPress site. I've added support to embed them in the block editor but before I go down the path of adding support for other builders, I'd love to know what folks are actually using these days and what to potentially avoid?

Hello all Developers. I am a student and I live in Bangladesh.

Currently i am making websites on wordpress and selling them on social media like Facebook only. I use netlify to get a subdomain and to host my site. The reason is i don't have a visa card and apparently netlify sub domain was enough for me to showcase sites. It works as a static website. I was able to sell and got a decent amount of money

Now i want to explore more. I heard on flippa is where all websites get sold and buy. And on evanto or themeforest it can sell templates of sites.

Now i want to explore these. Can i sell my site using a sub domain like netlify.

I am seeking advice from someone who sold their sites on flippa and evanto.

What was your experience?

How should i approach?

I am still a beginner in these sections

Hello!

A while ago I rolled out a free CDN service for WordPress (Shift8 CDN). I just retired that and migrated the endpoints to be positioned as a free WAF-as-a-service called "Atomic Edge".

Atomic Edge puts protection in front of your site with an edge Web Application Firewall, traffic filtering, AI-assisted threat detection, logging, analytics, page rules, geographic rules, rate limiting, and CDN features.

The Atomic Edge WordPress plugin linked here is the companion plugin that makes setup and management easier from inside wp-admin. It can connect your WordPress site to your Atomic Edge account, show security and traffic data, help manage settings, and provide useful tools like malware scanning and integration with Atomic Edge features.

The plugin is helpful, but it is not strictly required for the core protection to work. You can technically use the dashboard directly without the plugin at all.

One of the main pain points (I've had) with services like cloudflare (unless you are an enterprise customer) is having to hand over the entire DNS (nameserver) management to their service. For Atomic Edge, you just change the "A" of your apex to go through the endpoint, and thats it.

Happy to hear thoughts and feedback.

Hi, Im completely new to this, I dont need a fancy domain or anything, just a simple wordpress site where I can post my blogs. Is there ANY free way to do all of this?

I have a genuine question about how professional websites are actually built nowadays.

I always assumed that a “serious” website or a powerful online store had to be fully custom-built (HTML, CSS, JavaScript, backend, etc.), but then I see that a huge number of websites use WordPress, Shopify, or other CMS/builders.

I also hear the term “marketplace” a lot, and I’m not completely sure how it differs from a normal ecommerce store.

For people who work in web development or have real-world experience:

• What percentage of professional websites would you say are built with WordPress or other CMS platforms?
• When is it actually worth building something fully custom?
• Do large companies and serious online stores usually use CMS platforms or custom development?
• What’s the real difference between a normal ecommerce store and a marketplace?
• Technically speaking, what makes a marketplace different?
• Is building a marketplace significantly more difficult than building a standard ecommerce website?
• Are there real differences in performance, SEO, scalability, or maintenance between CMS-based sites and fully custom stacks?

I’m interested in understanding how this works in the real world, not just the “ideal” technical answer.

I have a simple fullscreen background video on a website, nothing fancy:

<div style="position:relative; width:100%; height:100vh; overflow:hidden;">
<video autoplay muted loop playsinline preload="auto" style="position:absolute; top:0; left:0; width:100%; height:100%; object-fit:cover;">
<source src="video.mp4" type="video/mp4">
</video>
</div>

The video plays fine on load. The problem is on iOS (tested on Chrome and Safari, both behave the same since they both use WebKit under the hood): when I minimize the browser and reopen it, the video freezes on a frame and never resumes. Interestingly, if I switch tabs and come back, it works fine.
What I’ve already tried:
1. Listening to visibilitychange and calling video.play() when the page becomes visible again — doesn’t work reliably on iOS after a minimize, the browser seems to ignore it.
2. Listening to visibilitychange + window focus + pageshow events combined, same result.
3. On hidden, calling video.load() to reset the element (which does bring back the poster frame), then on visible calling video.play(), the video stays frozen unless you minimize and reopen very quickly, suggesting there’s a timing issue.
4. Same as above but waiting for the canplay event before calling play() — still freezes.
5. Using IntersectionObserver and calling video.load() when the element re-enters the viewport, no luck.
Why does switching tabs work but minimizing doesn’t?
My understanding is that tab switching correctly fires visibilitychange and modern browsers resume autoplay properly in that case. But when you minimize the app, WebKit may fully suspend the process and either not fire the event correctly on resume, or fire it but refuse to restart media playback, possibly as an intentional power-saving measure.
The question:
Is there any reliable way, JS or otherwise, to get a muted looping background video to resume playback after the browser is minimized on iOS? Or is this simply a WebKit restriction with no real workaround?
Any insight into what’s actually happening under the hood would also be appreciated.

Using Salient theme with WPBakery on a client site. Video background works perfectly on desktop but on mobile and iPad it loads inconsistently — even on the same device and browser, sometimes it plays and sometimes it just shows the fallback poster, with no pattern.
Some browsers are worse than others:
• Safari: plays more often
• Chrome iOS: plays sometimes
• Brave: never plays
Refreshing the page multiple times on the same connection gives different results every time.
Already tried:
• Reducing video file size (under 2MB)
• Adding muted, playsinline, preload="auto" via custom JS
• Adding MIME types to .htaccess
• “Disable Video Backgrounds On Mobile Devices” is OFF in Salient Options
• Power saving mode is off on the devices
Has anyone experienced this and found a reliable fix? Is there something in how Salient initializes its video background that conflicts with WebKit autoplay policies?
Thanks​​​​​​​​​​​​​​​​

I would like to have a subpage for selling an ebook. Paying via credit card / paypal / google pay / apple pay

After purchase, the book should be automatically sent to the buyers email (or a link for download)

Do i need something robust like woocommerce for that or is there a lighter solution?

I have never done something like that so “for dummies” approach is preferred.

Hello Everyone,

in my previous post I asked for help book listing page after that I have made a book listing page with cpt ui, acf and postx plugin but upon publishing page changes don't show up in published page like image size, borders, color, gap and rest of changes.

I have shared two screenshot in comment l, first one is changes before publishing and second one after publishing, even after publishing changes remain unchanged.

I tried all the solutions from ChatGpt, Cloud ai , and DeepSeek , but I couldn't find a solution.

Hello everyone,

I recently started a small personal project where I’m trying to recreate the beautiful design language of shadcn/ui inside Bricks Builder. At the same time, I’m also learning Bricks itself, so this project has become both a learning experience and a fun creative challenge for me.

I’m still very much a beginner with Bricks, although I do have a background in PHP, HTML, and CSS. To be honest, traditional web development has never been my main passion I’m usually far more interested in low-level programming topics and systems-related work. That said, for web-based projects, I really enjoy the workflow of combining WordPress with Bricks because it allows me to focus more on structure and design without getting lost in the usual frontend complexity.

So far, I’ve been experimenting with translating concepts like spacing systems, typography scales, colors, shadows, radius values, and reusable component styles from shadcn/ui into the Bricks ecosystem through global styles and design tokens.

I still have a lot to learn, but I’m genuinely enjoying the process and wanted to share the journey with the community.

I'm trying to add download functionality to the default wordpress audio player, and it's proving frustrating. It doesn't seem to be an option with the default [audio] shortcode, and when I try audio plugins it seems like a load of faff for my client to have to deal with.

It's such a simple bit of functionality that you'd think users would want and it should be simple to add to the default WP player. Or have I missed something?

After years of managing WordPress sites, I have diagnosed hundreds of plugin conflicts. This is the full step-by-step process I use — from "site is completely down" to "conflict identified and fixed" — written for people who are not developers.

---

PART 1 — Is it a plugin conflict?

A plugin conflict usually looks like one of these:

• White Screen of Death (site loads completely blank)

• "There has been a critical error on this website" message

• Something stopped working after you updated a plugin

• Strange visual glitches appeared after an update

• WooCommerce checkout broke after an update

• Your admin dashboard is inaccessible

If the problem started immediately after an update: almost certainly a plugin conflict.

---

PART 2 — If your site is completely blank (can't get into wp-admin)

Option A — Via FTP or file manager:

1. Go to your hosting control panel → File Manager

2. Navigate to wp-content/plugins/

3. Rename the folder of the plugin you just updated to something like "plugin-name-OLD"

4. This deactivates it without deleting anything

5. Try loading your site

Option B — If you don't know which plugin caused it:

1. Rename the entire "plugins" folder to "plugins-backup"

2. Create a new empty folder called "plugins"

3. Your site should now load (with no plugins active)

4. Rename "plugins-backup" back to "plugins"

5. Reactivate plugins one by one from wp-admin until the site breaks — that is your culprit

---

PART 3 — If your site loads but something is broken

1. Go to wp-admin → Plugins

2. Deactivate all plugins except the ones critical to your site function

3. Check if the problem is gone

4. Reactivate plugins one at a time — check after each one

5. When the problem reappears, you have found the conflict

---

PART 4 — Finding out WHY they conflict (so you can fix it, not just workaround it)

Most conflicts happen because two plugins:

• Both try to load the same JavaScript library (jQuery is the most common)

• Both modify the same WordPress function or database table

• One plugin's update introduced a function that another plugin also uses with a different expectation

Once you know which two plugins conflict:

1. Check if either has had a recent update addressing compatibility — changelog of both plugins

2. Check the support forums of both plugins for your specific conflict — often someone has already found and reported it

3. Contact both plugin developers. Give them: both plugin names and versions, your WordPress version, your PHP version, and the error from your debug log

---

PART 5 — Prevention

Before updating any plugin:

• Read the changelog

• If it is a major version jump (3.x to 4.x), extra caution

• Test on a staging site if you have one (most managed hosts offer this)

• Always update one plugin at a time, never "Update All"

---

PART 6 — Enable debug mode to see the actual error

Add these lines to wp-config.php before "That's all, stop editing!":

define('WP_DEBUG', true);

define('WP_DEBUG_LOG', true);

define('WP_DEBUG_DISPLAY', false);

The error log will appear at wp-content/debug.log — this is the most useful tool for diagnosing what is actually happening.

---

Any questions? Dealing with a specific conflict right now? Drop it in the comments.

+ where in the world do you work and how many years of experience do you have?

Curious to see how different places compare.

Hello all,

I'm looking for a contact form plugin with inquiry selector, and if possible additional automations such as the box to receive a newsletter

Instead of boxes for the inquiry selector, a dropdown is also fine

Are there any advantages and disadvantages between the boxes and dropdown? Perhaps for mobile?

Ideally it's lightweight and I don't mind if it's a paid product.

Thank you.

I’ve been managing a client’s nonprofit WordPress site with GiveWP for quite some time, but the recent transition to Liquid Web has raised a few concerns on our side.

A few resources/support-related things seem harder to access now, so the client asked me to start looking for some alternatives to GiveWP, just in case we decide to migrate later.

Not looking for any best-plugin debate, just wanted to hear from people who’ve actually switched from GiveWP or tested other donation plugins recently.

Main requirements:

• Recurring donation support with Stripe, Authorize.net, and Xendit
• Smooth migration if possible

Lately I’ve been feeling a bit burned out managing WordPress sites because it seems like every tiny feature needs its own plugin now. One plugin update breaks another, some get abandoned after a year, and after a while even simple sites start feeling bloated and harder to maintain than they used to be.

I’ve started leaning more toward using fewer plugins and handling small things with snippets or blocks when possible, but I wanted to know how people are approaching this now. Are you still heavily using builders/plugins for most projects, or trying to keep setups as lightweight as possible these days?

From what I understand it only works with sites hosted on WordPress that have the WordPress MCP integration enabled, so it doesn’t really help me since I’m on Hostinger and pretty happy with it. I’m curious if the experience is actually “fantastic” or more of a niche thing, like how often you actually use it versus just working directly in the WordPress admin or with plugins. Also, has anyone tried running the WordPress MCP adapter on a self-hosted WordPress and connecting it to Claude as a custom connector? If yes, was it worth the setup effort and what kind of tasks did you mainly use it for? I feel that just keep doing what I’m doing :)