WordPress

Explore Gutenberg 24.3, from cross-block formatting and Notes reactions to clearer save errors, media browsing, and safer update workflows.

PHP2Shell shows why managed WordPress hosting security depends on fast PHP patching, core updates, plugin maintenance, isolation, and recovery.

October's MagicWP updates bring team workspaces, scoped API tokens, AI-assisted site management, retained backups and site-wide WordPress updates.

PHP fixed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Here is what changed, which versions fix them, and what we did.

Some Rank Math SEO PRO 3.0.123 downloads carried a backdoor (CVE-2026-111862). Find out if your site was affected and how to clean it properly.

Automattic's liberate.sh copies a Wix, Squarespace, Shopify or Webflow site and hands it back as a WordPress zip. Here is how it works and what to check.

Ipsum is the minimal block theme planned to ship with WordPress 7.2. See what's in it, what changed from Twenty Twenty-Seven, and how to test it safely.

WordPress 7.1.3 fixes seven security issues. Here is who can exploit each one, which sites are exposed, and how to update and check your site.

Attackers are using XSS bugs in Ninja Forms and WPC Product Bundles to plant four backdoors. Update to Ninja Forms 3.15.5, then check and clean up.

WooCommerce 11.2 lands October 6. See the date filter change, the removed experiments, and what to test on staging before you update.

A WordPress backdoor called SC rebuilds itself from files, the database, and shared memory. Here is how to find every copy and remove it in the right order.

Try MagicWP on a real WordPress site before you pay, start from a ready-made template, pick themes and plugins up front, and run your sites on PHP 8.5.

Elementor 4.3.0 and 4.3.1 let one click from a logged-in admin create a new admin account. Update to 4.3.2, then check your users.

CVE-2026-87902 lets anyone load local PHP files via WordPress page templates in 4.7 to 7.1.1. Which version to update to, and how to check your exposure.

Comment2Shell (CVE-2026-93485) lets an anonymous comment turn into stored XSS and, through an admin session, server code execution. Fixed in WordPress 7.1.1.

What's on the WordPress 7.2 roadmap: sudo mode, a Secrets API, Notes suggestions, new blocks, the December schedule, and what to test first.

Click2Shell lets a crafted link install a WordPress.org theme with no click, and chains to code execution. What it is and how 7.1.1 fixes it.

WordPress 7.1.1 fixes 11 vulnerabilities, including an unauthenticated comment XSS. Which fixes affect your site and how to confirm you're patched.

Two critical Events Calendar flaws let a stranger take over a site through an event comment. Only 6.17.4.1 fixes both. How to check and update.

WordPress.org now scores every plugin release during its cooldown and blocks high-risk ones before distribution. What the check covers, and what it misses.

Google says no special optimization is needed for AI Overviews. Here's what its documentation actually supports, and which AI SEO tactics are noise.

Caching fixes LCP. It does nothing for INP, because INP is a JavaScript problem measured after the page has already loaded.

WordPress 7.1.1 lands September 17 as a defect-only cleanup after 7.1. Here is the schedule, what is in scope, and how to test RC1 a week early.

Rank Math's paused Support Agent created a WordPress Application Password without asking. Here is how to audit every credential on your site.

Forty students earned a WordPress AI credential by contributing to open source, and got paid for it. Here's how the program actually works.

Test changes on a full copy of your live site and push them live in one action, manage Cloudflare from the Domain page, and clean up your database from the dashboard.

WooCommerce 11.1 adds EU order withdrawal and REST API refund tools, while 11.2 changes core product hooks. Here's what to check before updating.

CVE-2026-18978 lets unmoderated comments inject scripts on LiteSpeed Cache sites up to 7.8.1. Update to 7.9 and check two settings.

Two miniOrange SAML SSO flaws let anyone log in as admin. Paid editions read as patched because seven version lines share one plugin slug.

Avada 7.16.1 fixes a remote code execution flaw in the Fusion Patcher. What is confirmed, what is not, and how to check and update every Avada site you run.

TranslatePress 3.3.4 patches an unauthenticated flaw reachable from the comment form. Here is who is affected, what to check, and how to clean up.

Elementor Pro 4.2.1 and below let anonymous visitors upload PHP through a form field. Update to 4.2.2, then check your uploads folder.

WordPress ships real privacy tools, but they only cover part of GDPR. Here's what core handles, what it misses, and what changed in 2026.

WP Rocket 3.23.2.2 fixes the WordPress 7.1 fatal error. How to recover a site that is already down, and why the crash happened.

CVE-2026-19598 lets unauthenticated attackers take over sites running Pods 2.8 through 3.3.9. How to check your version, patch it, and look for damage.

Elementor Pro 4.2.1 and below let anonymous visitors upload PHP through the Forms file field. Update to 4.2.2 and check your uploads directory.

WordPress core now handles sitemaps, robots, canonicals and titles on its own. Here's what an SEO plugin still adds, and what's just noise.

CVE-2026-15748 lets unauthenticated attackers upload PHP files through Forminator. Check whether your forms are exposed and which version really patches it.

Every WordPress page load queries all autoloaded options at once. Here's how that table quietly bloats, and how to find and fix the offenders.

Fonts sit right at the intersection of LCP and CLS. Here's how font-display, preloading and metric overrides actually behave, and what WordPress gives you.

A practical look at the official WordPress browser extension: what it changes about daily work, what permissions it needs, and where it stops short.

WordPress 7.0.4 patches CVE-2026-65640, an Author-level RCE on servers using Imagick and Ghostscript. How to check your exposure and update safely.

PHP workers are your real concurrency limit, OPcache is why WordPress isn't slower, and JIT probably won't help. Here's the layer under the plugins.

Most cart abandonment is caused by costs, trust and forced accounts, not missing urgency timers. Here's what to fix at WooCommerce checkout.

CVE-2026-64638 is a pre-auth reflected XSS on the WordPress login screen that can escalate to PHP execution. Here is who is affected and how to fix it.

A practical guide to backing up a WordPress site, restoring it without breaking serialized data, and testing that your backups actually work.

WordPress 7.1 adds a single public flag to the Abilities API, replacing per-channel exposure settings for REST, MCP, and future clients.

Route WordPress email through a provider's API instead of PHP mail() or SMTP, with the domain authentication that actually keeps messages out of spam.

A fast front end and a sluggish wp-admin is normal, not contradictory. Page caching can't touch the admin, so it exposes your real backend speed.

AVIF and WebP both work in WordPress now, but format choice is rarely the bottleneck. Here's what actually makes image-heavy pages fast.

TTFB isn't one number, it's five stages stacked together. Here's how to find which one is slow before you blame your host.

WordCamp US runs August 16-19 in Phoenix with a new beginner track and 18 AI sessions. Ticket sales are lagging badly. Here's the state of play.

A backdoored WordPress plugin was caught within about two hours of publication. Here's what the code did, and why it barely spread.

WordPress 7.1 lands August 19, 2026, with real-time collaboration tools, new blocks, and editor changes. Here's what's actually in it.

WordPress recommends PHP 8.3, but 8.3 already lost active support in 2026. Here's the version that actually makes sense for your site.

WooCommerce 10.8 brings review-request emails, custom shipping providers, and WordPress 7.0 compatibility. Here's what changed and how to update safely.

wp2shell is a pre-auth RCE chain in WordPress core (CVE-2026-63030 + CVE-2026-60137). Here's what it is, who's affected, and how to protect your site.

Understand how GEO, AEO, and SEO differ, why they share one foundation, and how to optimize your WordPress site for AI answers and classic search alike.

MySQL Error 1045 means the server rejected your login. Learn the real causes behind access denied and how to fix each one on a WordPress site.

AEO for WordPress isn't only about better content. If your server, caching, and rendering aren't right, AI answer engines never see the work.

A step-by-step guide to configuring Cloudflare settings for WordPress: SSL/TLS, caching, rules, and security, without breaking your admin or login.

Stop scrapers, credential-stuffing bots, and xmlrpc abuse before they hit your server. A step-by-step guide to blocking WordPress bot traffic with Cloudflare.

Per-minute resource monitoring, clone onto an existing site, reset WordPress user passwords, set a custom database prefix, and transfer sites between accounts.

Snapshots move any backup onto any site, dashboard Redirects and cache controls steer traffic, and real server-side cron keeps every site's jobs running on time.

WordPress 7.0 'Armstrong' adds native AI infrastructure, new blocks, a redesigned admin, and a higher PHP minimum. Here's what changed and how to update safely.

See included resources on every plan, rotate your database password from the dashboard, and run encoded plugins with ionCube Loader and more PHP extensions.

Manage themes and plugins across all your WordPress sites from one screen, work in a faster dashboard, and track every release in a new changelog.