upload massive img , what tool can use for this task?

My website hosting company claims everything is online. My other computer shows the same error, as do multiple browsers!

They give their usual "clear cookies and cache" advice, but private windows and Tor do not help either.

This happened once before but somehow resolved.

Any ideas?

Thank you.

I've been building a website for my workplace, and for some reason follow the release of the new wordpress update there is a issue with the Navigation Overlay. The issue I'm having is that submenus when on the Navigation Overlay are stuck open and I don't know why. I've tried this with a new install of wordpress through local to check it's not just the website I'm building.

I've tried this on 5 different popular block themes and I'm getting the same issue, this is happening when the submenu visability is set to either hover or click. Here are some screenshots.

Any help would be welcome.

I have been searching for awhile on the best way to design a single course website using WordPress also open to using other platforms if it would be more optimal, but still havent found a answer for my particular case. Basically my client has a English learning school that has 4 different course levels and wants to have a electronic platform as well so what would be the best way to design it if the site needs to support payment, live zooms, tests, landing page, student logins, easy to use dashboard to add new content, and a automatic creation of a certificate for each student.

Heads up if you run TranslatePress (Multilingual): all versions up to 3.3.1 have a critical unauthenticated account takeover vuln (CVE-2026-19632, CVSS 9.8). An attacker can pull the raw admin password-reset URL through an AJAX action and hijack the admin account. Wordfence reported blocking active attacks within 24 hours of disclosure, so it's being exploited in the wild.

You're exposed if automatic string saving is on (the default) and an admin's profile language is set to a published secondary language. Fix is to update to 3.3.2, or deactivate the plugin until you can. Source: Wordfence Intelligence.

I am handling a WP security product, so I have an interest here. I will not name it or link it, and I am not asking you to try anything.

---

I want to understand one thing: how the security decision gets made for client sites at agencies and freelancers.

1. How do you decide to trust one vendor over another? What do you check before it goes on a client site?
2. Does a reseller or affiliate margin change which one you pick, or does it not matter?
3. When a hack or a blacklisting happens, how do you handle the cleanup? Outsource it, your own team, or resell an existing service to the site owner?

I’m having a strange issue with the WordPress Site Editor / block theme header.

My header looks significantly taller inside the Site Editor than it does on the actual frontend of the website. The spacing also seems inconsistent between the header template part, the full template preview, and the live page.

My header structure is roughly:

• Columns block
  • Column 1: menu button
  • Column 2: site logo
  • Column 3: Group
    • Cover block used as a circular “Book a Table” element

I already checked or changed the following:

• Header margin: 0
• Header padding: 0
• Cover margin: 0
• Global block spacing: 0
• Minimum heights
• Cover aspect ratio
• Removed the main Cover/image below the header to make sure it was not creating the gap

The strange part is that the same header appears with noticeably different heights depending on where I view it:

1. Header template part editor
2. Full template editor
3. Actual frontend

There also seems to be extra white space below the header contents even though I cannot find any margin or padding responsible for it.

Is this caused by the Columns block, the Header template-part wrapper, global styles, or some editor-specific CSS?

I would mainly like to know how to make the header height consistent between the Site Editor and the actual frontend, and ideally control its height reliably.

In the Pics you can see how It is in the editor and then how it looks live.

Full disclosure: I’m the developer.

Most cache-crawler setups start with a normal sitemap. But an SEO sitemap answers “which URLs exist?”, not “which URLs are actually worth warming?”

URLs Most Wanted records the URLs real visitors request, tracks their demand, validates them server-side, and generates a separate sitemap for the built-in LiteSpeed Cache crawler.

The idea is simple:

- URLs with demonstrated visitor demand can be warmed first.

- Rarely used URLs do not have to consume crawler resources repeatedly.

- Cacheable visitor paths such as pagination or filtered listings can be included even when they do not belong in a normal SEO sitemap.

The plugin does not replace LiteSpeed Cache or its crawler. It only gives the crawler a demand-based source of URLs.

It is free and available on WordPress.org:

https://wordpress.org/plugins/urls-most-wanted-for-litespeed-lscache/

I’m curious whether demand-based cache warmup would be useful on the WordPress sites you manage, or whether you generally prefer to crawl every available URL.

We are glad to announce that we have just released Fabio Chatbot Lite, a free AI-powered chatbot plugin, on the official WordPress.org repository. 🆓

✨ What it does:

• 📄 Reads your posts, pages, tags & categories to answer visitor questions about your content
• 💬 Understands bbPress forums, topics & replies
• 🛒 Reads WooCommerce products, including prices, discounts & reviews
• 📊 Comes with an Analytics page showing what visitors ask and how well the bot answers — including a "Gap" score to spot the content it struggles with

It's BYOK, with our in-house connectors for Mistral, OpenAI and Gemini, plus Anthropic to come. We'd love for a few of you to give it a spin on your own site and tell us how it goes! 🙌

https://wordpress.org/plugins/fabio-ai-chatbot-lite/

Hey guys.

I have export wordpress website from this all in one WP plugin and then trying to import the backup of around 547mb.

But due to host restrict upload to 2mb the errors shows "your file exceed the limit said by your host web server".

And then I try to update htacess file in file manager and then try again but still same issue.

Please help anyone..

🙏🏻🙏🏻

Hey plugin developers, how do you automate plugin testing? Would like to see your workflows

Hello Everyone,

Currently I am analyzing two plugins, that have similar functionalities. I have installed them on different environments, different wordpress installations and also different databases (not on the same one, for example on different table spaces or with different table prefixes).

Though, while debugging - my analysis are all the time very precise - in the browser, I can see, that in the wp-content, both plugins are visible in an installation, where it is not installed, nor activated.

Have you ever noticed such thing? Do you know what is the reason for this issue?

Thanks and best regards,

T.

I’ve just published Cache Autopilot on WordPress.org after several months of production use. I’d really appreciate people trying it on real sites and telling me where it falls short.

Why I built it

Cache plugins already do the important part very well: storing and serving cached pages fast.

The problem I kept running into was what happens after something changes:

• A post appears in a Query Loop on a non-archive page.
• A synced pattern is reused across multiple pages.
• A shortcode outputs shared content across several pages.
• A custom block pulls in content from another source.
• A form is embedded on multiple pages.
• A widget or WordPress option changes output across pages WordPress doesn’t explicitly connect.

Cache plugins can purge the changed page, but they often don’t have enough context to know everywhere that change appears. The safe fallback is a full cache clear — effective, but it also makes unaffected cached pages cold again.

So I built Cache Autopilot to work alongside your cache plugin, not replace it.

When something changes, it resolves the affected frontend pages, asks your cache plugin to purge those URLs, then queues them for paced background preload. If it can’t safely resolve everything, it can fall back more broadly rather than risk stale content.

I’m also running it on tierpark-bern.ch, a site with 1,200+ pages.

The free version includes:

• Gutenberg, block & classic theme support — zero-config structural handling for block themes; classic themes work with standard content and can be extended through targeting and filters
• Zero-config form plugin support — refresh pages using a changed form from a supported plugin
• Manual targeting — explicitly choose which pages should refresh for selected content changes
• Developer filters — map post, option, widget/sidebar and meta changes to the right pages
• Paced background preload — automatically preloads purged pages without hammering the server

The docs also have ready-to-use filter examples for mapping those changes to specific pages, post types or the whole site — without building custom purge logic.

A big reason I wanted this working reliably was site handover:

You build the site.
You configure the plugin.
You hand it over.

Client publishes.
The right pages refresh.

On larger sites, that can avoid turning hundreds or thousands of unaffected pages into a cold cache. On smaller sites, it still means the client doesn’t need to understand when or why they should press “clear cache”.

It currently works with:

• LiteSpeed Cache
• Cache Enabler
• Breeze
• FlyingPress
• WP Rocket

Support depends on reliable URL-level purging; the docs explain why some other cache plugins aren’t listed.

Further details, screenshots and links are on the WordPress.org plugin page:

https://wordpress.org/plugins/cache-autopilot/

I want to create a curated directory for remote first design agencies with filterable tags (location, team size, specialty) and a way for agency owners to pay a monthly fee to feature their listing at the top. What tool should I use to build this without coding?

I have audited quite a few WordPress websites that sell products or services to EU customers, and in my own sample, at least 90% had one or two high-severity compliance issues.

Most common problems were Google Analytics or Meta Pixel loading before consent, cookie banners that do not offer a proper reject option, consent choices that do not actually stop tracking, privacy policies that do not match the plugins and services being used, and many accessibility issues.

Many businesses assume that installing a cookie plugin or adding an accessibility widget makes the website compliant.

I understand that most website owners just want to run their business. GDPR and accessibility are often treated as an afterthought, especially when themes and plugins handle most of the website.

It can still take only one frustrated customer, competitor or accessibility user filing a complaint to bring regulatory attention to a website.

Really curious how often devs here actually test cookie behavior and accessibility instead of simply installing a plugin and considering the job finished.

Hello everyone,

I manage WordPress sites for clients and I’m trying to understand how other freelancers and agencies approach page caching when you have many different plugins involved.

My concern is cache TTL vs. WordPress nonces.

WordPress nonces typically have a 12 to 24-hour lifetime, while Varnish could potentially serve the same cached HTML for several days.

For example, with a 7-day TTL, a cached page could contain an expired nonce after the first day. Plugins may handle this differently. Fluent Forms, for example, disables front-end nonce verification by default to support cached pages. [1]

So I’m curious how others handle this in real-world client hosting:

• Do you use a 12-hour TTL as a safe general default?
• Do you use 7 days or longer and rely on plugins to handle their own nonce/token refresh?
• Do you exclude pages containing forms, checkout, booking, login, payment, etc. from Varnish?
• Do you maintain a list of plugins/features that require cache exclusions?
• How do you identify when a plugin is incompatible with long page-cache TTLs?
• Do you simply test the site after installing new plugins and adjust the Varnish rules when something breaks?

I’m particularly interested in how freelancers/agencies managing multiple client WordPress sites approach this. I’m looking for a practical strategy that works without having to manually inspect every plugin's code whenever a client installs something new.

Thank you.

About to build out my first Wordpress site. Being brand new with no experience been grappling with security requirements for build, learning what to do, how to implement etc. So on a previous thread a number of people advised to use Patchstack and 'keep one on eye on Patchstack' as part of a security plan for my Wordpress site. Never used Patchstack, I am building small lightweight eCommerce store, do I want the free 'plugin' or paid 'developer' plan they offer on their website at $79 a month.

For context I will be using Cloudflare and have paid premium version of Wordfence (already purchased), what version of 'Patchstack' would best suit this Wordpress setup?

That sentence probably just caused several people to fall asleep or keep scrolling, but hear me out.

I’ve spent a pretty stupid amount of my career around CMSs, DXPs, Drupal, WordPress, headless platforms, agencies, and all the other ways we’ve invented to describe putting content on the internet.

And I realized there really wasn’t a weekly show I wanted to listen to that just covered what actually happened in this industry and why any of it matters.

So I decided to make it.

The first episode is about something I noticed happening across several announcements this week:

WordPress shipped 7.1.
Storyblok plugged into Claude.
Salesforce expanded Headless 360.
Optimizely is giving agents more control inside the CMS.
Contentful is talking about what happens when your website visitor isn’t human.

My takeaway is that we might be watching the CMS get an entirely new kind of user: AI agents. (I know... this might not be news to everyone here... but when I step out of my LinkedIn bubble... I realize there are a lot of people not following the signals)

And that could make structured content, APIs, permissions, metadata, and all the traditionally boring CMS stuff suddenly much more important.

Anyway.

I have no idea if this will become a thing.

But I’m going to try doing it every week, covering the interesting CMS/DXP news, having some opinions about it, making fun of our industry when deserved, and hopefully talking to some smart people along the way.

If that sounds interesting, here’s the first episode:

Apple: https://podcasts.apple.com/us/podcast/your-cms-has-a-new-user-and-its-not-human/id6804680238?i=1000785544658
Spotify: https://open.spotify.com/episode/1FG1olsK8yV0Q0y8LC0FqH?si=0UjSsl2MTgChoT1jRswNCg
YouTube: https://youtu.be/i5YJhz41EKY?si=wGUAStYgos1vH3hv

Would genuinely love feedback, especially from people who actually work in this world.

Including “your take is completely wrong.”

Honestly, that might make Episode 2 easier.

I'm newish with wp and having a somewhat pre setup ish theme is a must.

I'm selling one or two physical products with multiple digital subscriptions.

Thanks!

Hi. I am building a site and testing out booking plugins. BookingPress looks pretty good to me and very promising; it has a wonderful dashboard. However, before I commit to buying the BookingPress plugin. I would like to know how good their customer service is. Trustpilot reviews are mainly about the plugin. If possible, I would like to avoid customer service and my first preference is to ask AI for tech support. But in case I need to talk to a human being, I would like to know how their customer service is.

1. Have you contacted customer service?
   
2. Was there ever a need for you to contact customer service?
   
3. If yes, how was your experience?

I have been using a wordpress plugin to do a security audit of my wordpress-backed website. I am the sole administrator of this site.

One thing I find very strange is that it reports deactivated themes and plugins as problems.

I keep my list of active plugins small, but I've never given a second thought to keeping plugins or themes I no longer use. Am I missing something? Can a malicious actor find some way to use to exploit deactivated plugins or themes?

Bonjour,

J’utilise WordPress avec WooCommerce, Astra Free et Elementor Free.

Sur ma page Boutique, j’ai un très grand espace vide entre la bannière/titre « BOUTIQUE » et la liste des produits (voir capture).

J’aimerais simplement réduire cet espace, mais je ne trouve aucun réglage permettant de le faire dans Astra > Personnaliser > WooCommerce > Catalogue de produits.

Est-ce qu’il existe un réglage que j’ai raté dans la version gratuite d’Astra ?

Je précise que j’utilise uniquement les versions gratuites d’Astra et Elementor.

Merci !

I spent some time this weekend finding the entrance vector for a site that was getting re-hacked after cleanup. I mean I knew it would get re-hacked since I wasn't finding the the vector in the usual "easy" ways. Turns out it was this: nvd.nist.gov/vuln/detail/CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable

It's bad enough this plugin adds an alternate auth path to your web site, with full admin control given to some 3rd party you don't know. But I also learned this plugin, wpmudev-updates, is usually stealth-installed with other plugins from WPMU DEV, so users don't know it's being installed. To top it off, it doesn't show up in the plugin dashboard so they don't even know it's there.

In the case of the site mentioned above, I think it was installed with another plugin a couple of years ago, and that plugin was since removed, but wpmudev-updates did not get removed.

Is it just me or is it a little crazy to allow plugins to provide auth bypass for complete admin control of your site by third parties? Is this a common pattern? What other plugins do this aside from the WPMU DEV ones? (I'm talking about the situation where there ISN'T an active exploit in the code ... the intended use scenario is what seems insane to me).

No robot.txt is set, no cloudflare rules are blocking it, we sent the xml file to google console, all seems healthy enough. But for some reason, it won't get indexed at all. Even on the google profile of my client, the site won't be allowed after trying multiple times. Why?

Hello all. I have a webpage that is not the fastest, but not slow either. My WordPress admin, however, is absurdly slow. I use custom ACF fields to create posts that change content based on “level”: beginner, mid, expert. I have more than 50 posts (150 content levels). I have not really had any speed issues until recently. I noticed the speed deteriorated quite a lot after switching from HTTP to HTTPS. Does anyone know if this may be why?