r/Wordpress • • 20d ago

Start Here: Essential Resources & FAQs

9 Upvotes

The idea for this post came up to avoid the number of similar questions we get around here and to serve as a megathread for any/all questions of a similar nature.

What's covered:

  • The .COM vs .ORG Issue

  • Hosting - Where should I host?

  • Hacked? Follow this guide for how to clean your site

  • Performance - Why is my site slow / Pagespeed score appalling?

  • Building Your WordPress Site: Is X builder better than Y? What is the best theme? Etc.

  • Updates

  • Backups

  • Security

  • Combating spam comments, contact form submissions & bot registrations

  • Hacks/Malware: Err guys help, there’s some weird stuff on my front end

  • Resources to learn WordPress

  • Where to find plugins/add feature X?

  • I found a plugin that costs $50 for $5 on a “GPLDL” source, is it safe to use?

  • How much should I charge?

  • Is a site using WordPress?

The .COM vs .ORG issue

This one is probably the single most asked question in this sub. Why can’t I do x,y,z?, Why do I have to pay more to install a plugin or edit a theme? There are literally 100’s of threads about this. If you want more info please search the sub for wordpress.com or read this resource for a comparison.

To summarise:
WordPress is free, open source software which can be found at wordpress.org.

Think of wordpress.com as a host that is using .org’s software and has various functionality locked behind pricing tiers.

What you want to do is get your own cheaper hosting and self install and manage WordPress so you don’t have any restrictions at base software level.

Hacked?

Cleaning a WP site is relatively simple (you need server (ftp, ssh or a file manager access):

  1. Delete all files and folders, including the WP files - the only folder you need to keep is /wp-content/uploads. (If you're using a child theme, keep that too, but check all its code). Note down your DB connection strings from wp-config.php. Doing this will not affect your content.

  2. If not deleted, check /wp-content/mu-plugins for anything that shouldn't be there

  3. Check cron for anything that shouldn't be there

  4. Change the WP salts https://api.wordpress.org/secret-key/1.1/salt/

  5. Change all admin passwords

  6. Reinstall Wordpress - download the WP zip from wordpress.org

  7. Reinstall your theme and plugins from the OG source eg wordpress.org, the theme seller, etc. Do not use backups. Before doing this though, audit your plugins. Don't install anything that hasn't received an update in > 6 months. Check the changelogs.

  8. Don't install anything that hasn't received an update in the last 6 months.

  9. Install Wordfence, set the Scan Options to "High Sensitivity" and run a scan.

Claude will do most of this for you in a few minutes - and will generally also be able to tell you how the infection occurred.

Hosting - Where should I host?

The next big question is who is a good host? This is better suited for r/webhosting.

Having said that, there are plenty of different hosts to choose from. Shared web hosting is the cheapest but comes with the caveat that performance is shared with others on your same server. Dedicated, VPS and Cloud solutions are faster but more expensive.

The thing to remember here is performance is directly tied to price and you get what you pay for.

The most recommended hosts around here that I’ve seen are Digital Ocean, Cloudways and Siteground. Again, for specific hosting questions you will get better support at r/webhosting

Performance - Why is my site slow / Pagespeed score apalling?

Hosting

Most of the time it's just bad hosting. As mentioned earlier, cheap shared hosting is notorious for bad performance. If your host is slow then nothing else will matter much, so this is your first port of call.

Properly optimise images

This is a relatively simple one. Don’t use images that are 6000 x 4000px. Figure out the max display size for your use case and resize.

Secondly ditch PNG and JPG and use WEBP. The recommendation is to convert before you upload. Most image editors will let you save in webp and 75-80% compression works well for a balance.

To bulk convert, use XnConvert or Photoshop Batch process.

For existing media you can use a plugin. There are many Smush, Optimole etc. Converter For Media is a free option.

Some servers like Siteground and/or other optimisation plugins may have this feature inbuilt so always check so you don’t end up doubling up.

Since 6.3, WordPress can also convert to WEBP on upload. You can use the Performance Lab plugin by the WordPress team themselves to manage this.

If, like me, you don’t want your server getting clogged up with multiple image types and you only want to have the WEBP files OR you don’t want to use a plugin use this snippet.

Lazy load

Lazy loading images, videos and iframes will speed up things significantly since 5.3 this has been a feature in core WordPress and should work out of the box for most cases. Some themes/page builders will have an option for this as well. Some hosts and caching plugins like WP Rocket will also have this option.

If you find that it is not working on your site for some reason you can use a plugin such as Lazy Load by WP Rocket or A3 Lazy Load for more control.

Caching, CDNs. Minification Etc.

You should be using caching on your website if you care about performance.

WARNING: Using minification and/or combining files and scripts can cause your website to break so always test, test and test again!

There are many, many free and paid plugins for this. Some hosts will have their own caching plugin, this should be preferred over others. If you have a Litespeed enabled server use Litespeed.

The general recommendation here is to use Cloudflare free with Super Page Cache For CF. Here is a guide on how to set up your domain, after that follow the plugin instructions.

Common question #1: Should I keep my hosts caching on with CF?
Yes. Your server is the origin server and having your own files cached means it is less taxing on your server resources and CF fetches files faster.

Common Question #2: I’m getting an SSL error or redirect loop.
Make sure you have a valid SSL certificate server on your origin server and make sure to set Cloudflare > SSL/TLS > Overview to Full.

Other popular recommended options:

Advanced optimisation

If you really want to get under the hood and squeeze every last bit out of your setup then:

  • Use a plugin like Debloat for a quick clean up.

  • Use Asset Clean Up to go through each page and disable unused crap. (Time consuming but potentially massive gains).

  • Use Query Monitor to inspect what is going on under the hood and find unnecessary scripts etc.

Building Your WordPress Site: Is X builder better than Y? What is the best theme? Etc.

There are many conflicting opinions on this because there is no one way to do things on WordPress. Each camp will tell you the other one is inferior and purists dislike all of them.

You can build your site with:

  • A page builder : Bricks, Elementor, Divi etc.

  • Using prebuilt themes. Each theme will have its own settings that’s exclusive to it.

  • A completely custom coded setup, written with a combination of html, css and php using WordPress actions, filters and hooks.

My two cents on the matter: Budget, experience and skill all come into play here. Thus, what works for you to achieve your end goal is the best.

  • If you like a WYSIWYG approach then page builders will more likely be your thing. Play around with the demos, watch some tutorials and if one of them looks more likely to work for you, then take it for a spin.

  • The Twenty Twenty Four theme along with the block builder is a solid place to start. There are many tutorials on how to get started with 2024 including the official WordPress documentation.

  • A CSS editor such as Yellow Pencil or Microthemer will assist you to fix a lot of front end annoyances and supplements any workflow.

Updates

Stay up to date with all plugins and core software at all times if you don’t want to have security holes and get hacked.

Backups

Taking/having backups of your website are essential. Servers can crash and data can be lost and you will cry if you end up without a backup in this scenario. The stress and grief of not having a backup and having to rebuild your site from scratch is not worth it. There's a few ways you can go about taking backups.

You can:

  • Use a recommended plugin like UpdraftPlus to schedule for daily, weekly or monthly backups. Send backups to remote servers (AWS S3, Dropbox, Google Drive) or your local machine. Remember having them stored on the same server as the website is not going to help.

  • Include this in your hosting requirements and find a host that automatically provides a scheduled backup process.

  • In the very least, take a manual backup using your hosts control panel whenever you make a significant change to your website,.

Security

  • Keep everything up to date at all times.

  • Run updates at least once a month. Fortnightly is better. More frequently is better

  • Use plugins and themes that are well supported, frequently updated, high install counts, well ranked, well established.

  • Use Wordfence - it’ll alert you when any plugins that you’re using have a known vulnerability or haven’t been updated (by the developer) for 2 or more years. It will also protect you from known attack vectors for vulnerable plugins (for the free version, this protection is only available after the vulnerability is 30 days old, but there’s nothing stopping you updating your plugins, assuming a patch is available).

  • Don’t use hosting where multiple sites sit in the one account (common on shared hosting). Each website should have its own owner.

Combating spam comments, contact form submissions & bot registrations

Disable comments and user sign ups sitewide if you don't use them.

Use a captcha on login, register and all contact/comment forms.

Hacks/Malware: Err guys help, there’s some weird stuff on my front end.

Congratulations you got hacked. Most of us have dealt with this in one way or another at some point so you aren’t alone.

Do you have a backup?

  • Easy, wipe everything and restore.

  • Run a scan with Wordfence and/or GOTMLS to be doubly sure you are clean.

  • Harden your security to avoid repeat issues.

No backup? (Get the tissues)

  • Install Wordfence and run scan.

  • Alternatively my first port of call for this has always been GOTMLS. Update definitions and run a root scan the plugin should find any code that shouldn’t be there and you should be good to go.

Resources to learn WordPress

If you are serious about your WordPress journey then you must equip yourself with some coding knowledge. Some skills in PHP, Javascript, CSS & HTML will help you immensely.

Where to find plugins/add feature X?

The WordPress plugin repository should be your first stop. You can access this library via your Dashboard > Plugins > Add New Plugin

Codecanyon is a decent marketplace to get premium plugins for a one off buy without ongoing subscription costs.

For code snippets and help with your own code StackOverflow or r/prowordpress is your best bet.

Warning: Remember to always double check the source and reputability of a source before installing third-party plugins and/or scripts.

I found a plugin that costs $50 for $5 on a “GPLDL” source, is it safe to use?

The simple answer here is NO. No you shouldn’t and that should be the end of that.

But alas, we still have many more questions:

  • Will the plugin still work? Probably.

  • Are there any guarantees that it will work and demo content will be provided? Absolutely not.

  • Will there be links to turn one’s junk into a cyborg on my site? Most likely.

  • Will Google blacklist you? If you have malware. Most definitely.

  • Will your host shut you down? If detected, any reputable one will.

  • Is rebuilding an entire site and losing the trust of your audience worth all this? Not to me, but only you can answer this for yourself.

How much should I charge?

We unfortunately can't provide specific answers to pricing questions as everyone's experience and locations vary widely. For guidance on pricing strategies, we recommend searching 'your country + web developer/designer rates'. Standard hourly rates for your locality can offer insights into various pricing approaches that may be applicable to you.

Please also read this article on Pricing Strategies on how to tackle this sort of question.

Is a site using WordPress?

  • Check the Page Source: Right-click on the page and select "View Page Source" (or use Ctrl+U). Search for typical WordPress identifiers like /wp-content/, /wp-includes/, or wp-json. If you see these, the site is likely WordPress.

  • Online Tools: Websites like IsItWP, Wappalyzer or BuiltWith can analyze a website's technology stack. These tools should be able to identify if the site is using WordPress in most cases.

That’s it, hopefully this gets you started on your WordPress journey. If you have any further questions feel free to leave a comment and someone should be able to assist.


r/Wordpress • • 7h ago

How long it take to get the plugin approval from wordpress.org

4 Upvotes

I have submitted my first plugin to wordpress, i got few initial feedback quickly within a day, which I fixed and resubmit again, then got next feedback also within a day. But now Its been more then a week, I did not get any update. I just want to know how much time it usually take and what is the acceptance rate.


r/Wordpress • • 4h ago

Google rankings tanked after theme change

0 Upvotes

We migrated our established Wordpress / WooCommerce site from Divi to Bricks in August, and our Google rankings took a huge hit almost immediately. Product pages that previously ranked in positions 1–3 dropped to 30–50.

We found some issues after the migration, including incorrect heading tags, infinite scrolling, and some indexing problems. Most were fixed within a couple of weeks. During these two weeks though I think a lot of wonky stuff was going on, including links on important pages being directed to the dev site… dumb- I know.

It’s now been about three months, and rankings still haven’t recovered.

Has anyone experienced something similar after a WordPress redesign? Could Google genuinely take several months to recover after the issues are fixed, or does this suggest something is still wrong?


r/Wordpress • • 5h ago

I'm The New Admin for My Student Org's website and I'm Confused. Help!

1 Upvotes

*EDIT: It appears that my issues stem from admin access for student organization leaders being slightly limited for safety reasons. It's looking like I'll have to request plug-ins be added by the Ultimate Admins (aka Web Services). Thanks for all your help guys! You'll probably see me around with further questions.

--------

I recently took on a new role as the Publicist for a student organization at my college, which includes social media management and website admin. Our site (and socials) have been collecting dust for almost 3 years, so I've been in the process of getting back into everything. Our WordPress site is hosted through the school along with most of the other student org websites, (org.collegename.edu/organizationname), and that's been making it difficult for me to figure out where to start. I'm excited to build experience in this useful field and am raring to get started.

The site needs a total revamp. None of the information is current, the branding is no longer accurate, and it's functionally not customizable. To be clear: I'm so down and excited for the challenge, but my research is informing me that WordPress pretty much needs a hosting application so new themes and plugins can be installed. I've tried to do preliminary edits and I would agree with that assessment. I'm accessing the software via web as far as I can tell.

Basically, I'm pretty sure my school is hosting the site so I don't have full control and can't add new themes or install plugins. I've emailed our Web Services but I'd like to get a fuller understanding while they take forever to get back to me.

Is anyone with greater knowledge of WordPress able to confirm or deny my assumptions? I'm open to using code or importing from other sites... but quality of life-wise I'd really like to install Elementor lol. Any other student web admins?? Useless beginner looking to learn, here.

Shout out YouTube University for all the WordPress guides though! Thanks in advance.


r/Wordpress • • 15h ago

What’s the most interesting thing you’ve built with ACF?

5 Upvotes

I run a small web agency and have been using ACF for years, mostly for custom WordPress builds.

One of the more interesting things we’ve built was a custom quiz builder for a client. They can manage questions and answers in the backend, automatically generate all possible answer combinations, and assign different outcomes. Visitors then get personalized recommendations based on their answers.

Got me curious about what other developers have built with ACF beyond the usual custom fields and page templates.

Anyone built their own tools, workflows, or frameworks around it? Would love to hear what you’ve come up with.


r/Wordpress • • 6h ago

Learndash issue how to solve it

1 Upvotes

I have just saw that learndash has changed it's website and there is a message that they no longer give me that price and I have to pay about double or triple price at my renewal date. That it will be atomatically move to that package. How can I build a training system with another plugin? I am using WordPress with Learndash. I am not able to pay that much and not for 10 websites.


r/Wordpress • • 10h ago

[PROMO] Made a Local WP add-on to pull and push sites to any server over SSH

2 Upvotes

Local WP's Connect only works with WP Engine and Flywheel, and my sites are on different VPSs on different providers, so every time I wanted a site locally it was wp db export, rsync, wp db import and a search-replace...

So I ended up building an add-on for it, SSH Sync for Local. It just uses your SSH access (key or password), and it does pull and push of files and the database. Before a push it shows the files that will change, and the last push can be undone.

github.com/fabiomsnunes/local-addon-ssh-sync

A pulled site runs all the live plugins, so I added a safe mode that blocks emails, turns off backup plugins and puts Stripe in test mode. It only covers some use cases for now, but it's on by default.

There's also a small CLI (ssh-sync pull/push/undo) next to Local WP's localwp.

It's free and open source (MIT), no paid version, no upsell, nothing to sell. macOS only for now and still early (v0.1.3). I've only tested it on my own servers, so I'd really like feedback from other devs!!
And if it breaks please open an issue on GitHub.


r/Wordpress • • 12h ago

narrow width issue in container

Post image
0 Upvotes

I made new checkout page using elementor pro but final checkout page is narrow like this . I tried all settings nothing worked. what to do? Already purged all cache. Elementor full width selected in page settings


r/Wordpress • • 13h ago

How do I keep my plugins alive!!

0 Upvotes

We are at 30 odd plugins. Every round of updates break something, one plugin we depend on looks abandoned and we had a security scare last quarter. Starting to wonder whether this is just the cost of Wordpress or a sign we should move. How bad is it for you? If you did leave, what did you move to and was it worth it?


r/Wordpress • • 18h ago

Using RankMath, it says my posts aren’t linking to my other pages on my blog enough. Buuuuuuut..

2 Upvotes

They’re making that assessment while ignoring my links that are embedded onto my posts as blocks, rather than text which are linked to other posts…

So I’m guessing I should stay away from embedding links to my other pages, and linking text instead? Is that goes Google prefers the links to be made or is that an oversight from Rank Math?

When pasting a URL text, Wordpress can either embed the link as an alternative or just just paste the url text

Explanation


r/Wordpress • • 12h ago

[PROMO] Soroban Delivery Dates for WooCommerce — delivery estimates calculated in the visitor's browser, so page caches can't freeze a wrong date

0 Upvotes

Hi everyone — I'm the developer of this plugin (a small studio in Tokyo). Posting under the [PROMO] rule for free open-source plugins on WordPress.org.

The problem it solves: if a delivery estimate is calculated on the server, a full-page cache or CDN freezes whatever date was true when the page was cached. After your order cut-off passes, the product page can keep promising a date you already can't meet.

What the free plugin does instead:

  • Calculates the estimate in the visitor's browser at view time (your site's timezone, DST-aware), so it stays correct behind caches — including right after the cut-off

  • Counts forward from your open weekdays, cut-off time, preparation time in business days, and carrier transit days

  • Uses official holiday calendars: UK bank holidays from GOV.UK (by division, including substitute days) or Japanese national holidays generated from the statutory rules, bundled for 2025–2028

  • Shows the result as an estimated range with its basis stated — never as a guaranteed date

  • Makes no external calls, stores no personal data, and doesn't touch orders

  • Includes an admin simulator that walks through the calculation day by day, and a fail-safe: if a date would fall outside the bundled calendar data, the estimate is hidden instead of guessed

Plugin page: https://wordpress.org/plugins/soroban-delivery-dates/

There's an optional paid add-on sold separately, but everything above is the free version.

If you run a WooCommerce store selling into the UK or Japan, I'd genuinely like feedback: what would you need to see before trusting an estimated delivery date on your own product pages?


r/Wordpress • • 20h ago

Avada + WooCommerce: Best way to display customer billing and shipping details on the Thank You page?

0 Upvotes

Hi everyone,

I'm using Avada 7.16.4 with WooCommerce and I'm redesigning my store's checkout and Thank You page using Avada Layouts.

I'm trying to display the customer's billing and shipping details (name, address, email and phone number) on the WooCommerce Thank You page.

I've noticed that Avada documentation mentions a "Woo Order Customer Details" element, but I cannot find it in my installation, either under Layout Elements or Design Elements.

I can access dynamic data options such as "Order Billing First Name", but this seems to require creating several separate text elements, which is not ideal.

My questions are:

  1. Is there a native Avada or WooCommerce solution to display all customer details in a single element?

  2. Is there a built-in shortcode that can display these details on the Thank You page?

  3. If not, would creating a custom PHP shortcode using the Code Snippets plugin be a safe and reliable solution?

  4. Is there any risk of conflicts with Avada, WooCommerce or Stripe?

I'd prefer to avoid installing additional plugins or modifying theme files.

Thanks in advance for any advice or recommendations.


r/Wordpress • • 1d ago

Need Help with Foxiz Theme

2 Upvotes

Hey I'm using Foxiz theme now, free. I got the zip file, it works, I have used it on various websites, it works fine. Now I have installed it on a new website, but there the demo importer isn't showing any demo templates? Is there any way to fix it?


r/Wordpress • • 1d ago

Plugin for members area

9 Upvotes

Hi,
I'm looking for a plugin for our clubs website.
It should be quite simple, type in a password and you can access the members area. There will be some downloadable documents and some sort of comment field or similar so members can post buy/sell/trade offers for the rest.
It's important that the sites in the members area cannot be accessed without the password in the first place.

So generally, quite simple is what I'm looking for, any recommendations?


r/Wordpress • • 2d ago

Can Anyone suggest a good WordPress page builder ?

24 Upvotes

Hi everyone,

i am new to wordpress page builders and looking for good a one to start with.

can you anyone suggest some good wordpress page builder?

i would love to know which one easy to use and good for begiener .

pls share your recommendations. thanks!


r/Wordpress • • 1d ago

Free Chrome extension to see which tracking pixels your WordPress site actually fires

1 Upvotes

WordPress sites collect tracking from everywhere: a GA4 plugin, a Meta plugin, a cookie banner, Site Kit, a theme snippet, Tag Manager. When something double-counts or stops reporting, it's hard to tell which piece sent what.

I built Pixel Debugger, a free Chrome extension that shows every ad and analytics request a page sends, decoded in the side panel:

  • which pixels are loaded vs. which actually sent events

  • each event's exact name and values (value, currency, products) as sent

  • Google consent mode commands your cookie banner issued, as observed on the page

  • possible duplicate events (two plugins sending the same thing)

It's not a plugin, so there's nothing to install on the site, and it works on any site you can open. Browser-only: it can't see server-side events.

https://chromewebstore.google.com/detail/kknfboekekeaagdoineimnebhlmiohpb

I'm the developer. Free, no account.


r/Wordpress • • 1d ago

Woocommerce cart keeps appearing under my footer

1 Upvotes

Hi, I am making a site https://dtwaalf.be/ and there is a store cart that keeps appearing under my footer, it started doing this recently I did not change anything, it's also not visible in the editor only if you travel to my site so I can't select it and delete it. Does anyone know how I can get rid of it?


r/Wordpress • • 1d ago

Editor font size different from live font size?

1 Upvotes

Probably months ago, there seemed to be an update that caused WordPress not to show my site's font size as the same across the (1) editor and (2) live site.

This causes a lot of tedious zooming in and out. I wonder if y'all know how to mitigate this—or if we should just hope for a reversal update.


r/Wordpress • • 1d ago

I made a tree-sitter grammar for block markup

0 Upvotes

I know it's 2026 and no one reads code anymore but I was recently brought onto an FSE project and was appalled that I was staring at a sea of grey lines of HTML comments. I haven't done much WordPress development nearing on three years but I can't believe this is how we're "supposed" to write code. And I was shocked to learn how thin the developer tooling was around this stuff.

Anyways, here's the grammar:

https://github.com/nickzou/tree-sitter-wp-blocks

Realistically, there should really be an LSP that can be like:

<!-- wp:template-part {"slug":"header","tagName":"header"} /-->

And then you get a squiggly that was like "header.html was not found" if the file is missing but the grammar is a start.


r/Wordpress • • 1d ago

How I check a WordPress site with only the keyboard in 5 minutes

0 Upvotes

quick routine i run through on any new WordPress site before touching anything else. all keyboard, no mouse, takes about 5 minutes.

  • load the page and press tab once. a good theme shows a "skip to content" link right there. plenty of themes don't have one

  • keep tabbing. a focus box should show up on every link and button. if it disappears for a few presses, something is hiding it

  • tab through the header, the menu, any popups. you should be able to reach every link and button, in an order that makes sense

  • hit enter on a few of them, dropdown menus especially. a lot of them only open on hover and do nothing with enter

  • tab into a contact form, fill it out, submit with enter, no mouse at all

  • open any modal or lightbox, hit esc, see if it actually closes and puts you back where you were

if more than one of these fails it's usually a theme or plugin problem, not something one setting fixes. w3c has a longer version of this if you want to go deeper: https://www.w3.org/WAI/test-evaluate/preliminary/

anyone run a different order than this, or have a step i'm missing?


r/Wordpress • • 1d ago

Do you code the webpage layout with AI?

0 Upvotes

Beginner here, making an ecommerce site, for now i've been trying to learn and used AI just for guidance and did all the block by myself im using GeneratePress + Blocks / WooCommerce, i want it to be fast and lightweight as possible. How trustworthy is it to tell AI to generate code for the CodeEditor so i dont have to do everything by hand surely it cant be bloat code since it needs to be correct in order for the blocks to exist? Need some tips for the most optimized/efficient way of making a website


r/Wordpress • • 1d ago

New Security Plugin for WordPress

0 Upvotes

Hey everyone! I came up with yet another simple way to protect my and client WordPress sites. One of the simplest and super effective way is to put /wp-admin/ and wp-login.php behind basic authentication. admin-ajax.php should be excluded though because it's used in the public site for ajax stuff even though it's in /wp-admin/

So my idea is that even if someone manages to create an administrator account, they still won't be able to log in or perform any administrative actions until they are approved/trusted.

I manually approve/flag high privileged users such as Store Manager (WooCommerce), Editor or Administrator roles via WP-CLI (I could easily add a UI for this though).

Should I release this as a free/paid plugin? Anyone interested in testing it?

Just a heads-up: you might accidentally lock yourself out and it will require adding some lines to wp-config via FTP or file manager via the control panel 😃

I also made it so if anything important changes in the WordPress site like admin email that automatically deactivates the trust of the users e.g. a site is hacked and the admin email is changed that blocks access to all high privileged accounts for security reasons.

Slavi


r/Wordpress • • 2d ago

Do people install off-directory plugins?

4 Upvotes

Is it common to install plugins downloaded directly from their home page, rather than from the official repo?

I'm wondering if I should release something before it makes it into the repository (from what I was told, the review process can take up to a month, or even more).


r/Wordpress • • 2d ago

[plugin] OpenPorte 1.30.3: security release for sites using Contact Form 7 or HTML Forms (also affects ALTCHA Spam Protection ≤ 1.26.3)

2 Upvotes

I maintain OpenPorte, the community-maintained open-source fork of ALTCHA Spam Protection v1 (self-hosted, privacy-friendly CAPTCHA for WordPress). Version 1.30.3 fixes a high-severity issue, so if you run it with Contact Form 7 or HTML Forms, please update.

The issue: to show its widget inside those forms, the plugin expanded every shortcode in the displayed form, including what visitors typed into fields or put in the URL. So anyone, without logging in, could make the site run any registered shortcode. The CAPTCHA did not stop it. The bug came from the original plugin (ALTCHA Spam Protection 1.6.0 / 1.7.0). Advisory: GHSA-hvr5-q69x-jp62 (CVSS 7.3).

Still on ALTCHA Spam Protection? Every version up to its last GPL release, 1.26.3, is affected, and that plugin is no longer maintained, so no fix is coming there. OpenPorte 1.30.3 imports your 1.x settings and keeps the free, self-hosted features, including the [altcha] shortcode. Only the paid altcha.org SaaS mode wasn't carried over.

The fix: only OpenPorte's own [openporte]/[altcha] tags are rendered, and only from the form as the admin wrote it.

Heads-up: other plugins' shortcodes inside Contact Form 7 / HTML Forms forms may stop rendering. Neither form plugin renders them on its own. If yours still render after the update, another plugin is expanding them, and it may have the same kind of flaw, so check with its author. There's deliberately no switch to bring the old behaviour back. If the change breaks one of your forms, ask on the support forum and I'll help.

A lesson for anyone writing WordPress plugins: never run do_shortcode() on output that contains visitor input. WordPress assumes shortcode content comes from someone allowed to write it.

Thanks to Erik Debye for the private report.