Browse all posts, newest first.
CVE-2026-84383 is a 9.8-rated flaw in libheif, the library most servers use to read HEIC and AVIF. WordPress accepts those uploads by default and opens every one. Three commands to check your server, how to patch it, and what to do while you wait.
Disk almost full and backups timing out? Before deleting images, measure what is in wp-content/uploads: plugin folders, stray backups, resized copies, -scaled originals, old theme sizes and duplicate formats. A safe, ordered audit, plus when offloading is actually worth it.
WooCommerce shows more orders than Google Analytics 4 records as purchases. How to build a reconciliation sheet in 20 minutes, the seven reasons sales go missing or get credited to PayPal, and which ones you can actually fix.
WordPress says "Update package not available" and stops. That one line has four different causes, from a lapsed licence to a plugin that was never licensed to your site. Here is how to tell which, and how to check whether what is installed is genuine.
Analytics only counts visitors who run JavaScript. Your access log counts everyone, including AI crawlers on your bandwidth bill and scanners probing for the actively exploited Elementor Pro flaw. How to read the log, and how to check whether you were hit before you patched.
Nothing has been lost. Four ways back into the dashboard in order of least effort, how to read the exact message you got, and the twenty minutes today that make next time easier.
When a WordPress site stops sending email, nothing on the site changes and nobody reports it. How the failure hides, what the major providers now require, and three checks that find it.
Event registration fees are quoted as percentages and behave like a flat charge. What that costs at low ticket prices, plus the operational details that decide whether an event runs smoothly.
Community platforms are chosen at fifty members and operated at five thousand. The six things that break in between, and what to ask a platform before they do.
Hosted course platform limits are commercial decisions, not technical ones. What the tiers, transaction fees and import caps actually cost a course business as it grows, and when owning the stack starts to make sense.
If a member asked for everything you hold about them, could you produce it? What an ordinary WordPress site accumulates, the two tools already in your admin, and an afternoon that fixes most of it.
AI assistants read the same description of your site that a screen reader reads. The five things that now pay off twice, what WordPress fixes for you on 19 August, and an hour of checks that need no code.
You switched on a few AI features and nothing broke. That is the problem. The six ways AI quietly makes a mess of a site, where it genuinely helps, and an hour-long check that tells you where you stand.
Notification volume is highest for exactly the members you can least afford to annoy. The three settings that stop anyone reaching for the master switch, sensible defaults, why broadcasts need their own opt-out, and a twenty minute audit you can run today.
Forum, Q&A, idea board or activity feed? The format decides whether your community survives. How to sort your last thirty conversations into piles and let the biggest pile choose for you.
Free security plugin tiers get new firewall rules about a month after paying customers. What that means in plain English, how to check where you stand, and the three things that protect you more than the tier does.
Passkeys replace your password with your phone or laptop. WordPress has no built-in support yet, so here is what your real options are, what setup looks like, and who should wait.
Installing a plugin is a bigger decision than it looks. An active plugin runs with the same access as WordPress itself, with no permission prompt and no sandbox. What that really means, why the number of plugins matters more than which ones, and five questions worth asking before you install anything.
Attackers are actively exploiting WordPress sites that updated late. The plain-English signs that your site has been compromised, the checks anyone can run in ten minutes without touching code, what to do in the first hour, and the mistakes that make things worse.
A growing share of people ask an assistant instead of searching and clicking. What is actually happening, which of your pages are exposed, the handful of changes worth making, and which advice is someone selling you something.