WordPress Insights
Expert advice, security warnings, and performance guides to help you manage your WordPress site successfully.
Key Takeaways A WordPress error check plugin can help make troubleshooting more organised, but it is only one part of finding and fixing a site issue. Work carefully, keep a record of what you change, and check that the site behaves normally afterwards. Use error messages and timestamps as clues, not as a diagnosis on…
Automattic, the company behind WordPress.com, Tumblr and WooCommerce, has reportedly reshaped its board and leadership after directors attempted to place CEO Matt Mullenweg on leave. Mullenweg is said to have regained control within roughly 33 hours. The upheaval comes as the company faces a high-profile legal dispute with hosting provider WP Engine. Key takeaways Automattic’s…
Cloudflare has moved its main blog from WordPress to EmDash, a content management system it developed in-house. The company says the new setup delivers more consistent performance during traffic spikes and tested successfully at up to 7,000 requests per second. Its gradual rollout also offers useful lessons for teams maintaining high-traffic websites. Key takeaways Cloudflare’s…
Two disclosed vulnerabilities in The Events Calendar plugin could let attackers run code on affected WordPress sites without logging in. Both flaws involve event comments processed during page rendering, but use different technical routes. Site owners should check their plugin version, confirm a fix for both issues is installed and review comment settings while they…
Key Takeaways A WordPress site is easier to build when you make a few clear decisions before getting started. Work through the setup in stages, then keep your site tidy after launch. Decide what your website is for and who it should reach. Choose a domain and hosting arrangement that suits your needs. Set up…
A supply-chain attack involving Brevo-hosted scripts exposed more than 100,000 websites to malicious code on 14 September. The attackers used the compromised resources to target WordPress administrators with a plugin upload attempt and show other visitors a fake verification prompt. Researchers say the incident highlights how a single trusted supplier can put many sites at…
WordPress.org is adding automated security checks to plugin and theme releases before they reach websites through its update API. The move follows the discovery of a backdoor in a plugin used by about 20,000 sites. High-risk releases can now be blocked automatically, reducing the chance that harmful code reaches users while developers are offline. Key…
Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take control of affected websites. The flaws can enable remote code execution, administrator password resets and malware installation. With more than 600,000 active installations, site owners should treat updating the plugin as an urgent maintenance task. Key takeaways Two flaws, CVE-2026-78006…
How I Fixed Fail2ban, Plugin Lockouts and WP-CLI Problems on AWS Lightsail Getting locked out of WordPress sounds simple. Reset the password. Log back in. Done. Except sometimes there are multiple security systems involved, and each one can block you independently. That is exactly what happened to me on a WordPress site hosted on AWS…
It’s not a great start to a relationship managing a WordPress site when the very next day the client sends a message “Our website is down, can you get it back up quickly?” I had just taken over the management of the WordPress site and had planned to get familiar with the setup that day…