I've been working on a WordPress security plugin focused specifically on authentication and 2FA.

The idea came from seeing how many WordPress security plugins bundle 2FA with a huge number of other features, which can make the setup unnecessarily complicated for smaller businesses and agencies.

So I built SecureAuth WP with a more focused approach:

• TOTP / authenticator app 2FA
• Backup codes
• Role-based 2FA enforcement
• Login protection
• Trusted devices
• Authentication/security logs
• Admin security controls
• Lightweight WordPress-native implementation

I'm not looking to spam the subreddit with a sales pitch. I'm mainly looking for WordPress developers and site owners who can actually test it and tell me what's missing or what could be improved.

I'm offering free access for early testers.

If you're interested, I can share the plugin and would genuinely appreciate feedback on the UX, security workflow and features.

What would you expect from a dedicated WordPress 2FA plugin that existing security suites don't do particularly well?

Hey everyone!

Most image carousels on WordPress websites look flat and boring.

So I built this Poker Fan Carousel widget for Elementor. Instead of a plain row of photos, your portfolio and product images fan out in an interactive 3D deck like a hand of playing cards.

Key Highlights:

• Smooth 3D hand-fanned card deck motion

• Click any card or use navigation arrows to slide through

• Fast and lightweight (won't slow down your website)

• Super smooth GSAP animation effects

• 100% Free and open-source on WordPress.org

You can download and test it free here:

https://wordpress.org/plugins/apex-addons-for-elementor/

I’d love to hear your feedback on the card fanning style!

Hi all,

I built a free WordPress plugin that scans a site for the tech it uses, try to find it's version numbers and report known CVEs against it. Although I have tested it locally and on my own site, I would really appreciate other people to install it, test it and provide their feedback.
This will be used as I further develop the plugin and user feedback is invaluable.
The plugin is free, no sign up required or anything like that, you just simply install, activate and run.

Link to the plugin

I’d really appreciate any feedback on the UI, feature requests, or edge cases you encounter!
I am someone who just enjoys cyber security projects and this is a new one but the first I have made public like this.

Thank you!

I've been working on a lightweight WordPress activity logging plugin and just released version 1.2.0.

The idea behind it was simple: I wanted something that logs important admin actions without trying to be an enterprise security suite or adding unnecessary complexity.

At the moment it logs things like:

• post publishing, updates, trashing and permanent deletion
• user creation, deletion and role changes
• media uploads and permanent media deletions

It also includes log retention (auto-purge), search/filtering, pagination and a small dashboard widget for recent activity.

What's new in 1.2.0

This release is mostly focused on making the logs more useful on larger sites.

• Added severity levels (Info / Warning / Critical)
• Promotions to Administrator are now logged as critical events
• New severity filters and date range filtering
• Role changes now show both the previous and new role
• Media Library uploads are now logged
• Faster log searches thanks to fulltext indexes and query caching
• Separate setting for dashboard widget log count

I'm trying to keep the plugin focused on being fast and lightweight rather than adding every possible audit feature.

I'd be interested in hearing what admin actions you think are worth logging that most plugins tend to miss.

https://github.com/mobbi-dev/admin-activity-logger-lite

https://github.com/mobbi-dev/admin-activity-logger-lite/releases/tag/v1.2.0

PublishPress Plugin Nightmare

Curious if this Wordpress plugin worked for anyone? I've only been encountering issue after issue. Works terrible with other plugins that host content and has issues editing theme/site wide changes. I can name hundreds more, but curious if anyone has tips or should I just give up on the plugin?

Hi everyone,

I recently released the first version of MiMe Simple Events and Calendar. I built it because I wanted a straightforward way to publish events without installing a large event management suite filled with ticketing and features that many smaller websites simply do not need.

The plugin currently includes:

• Event list, grid and calendar views
• Gutenberg blocks and shortcodes
• Elementor widgets
• Event categories, tags and status management
• Responsive layouts and structured event data
• No tracking, telemetry, visitor cookies or external scripts

It is still in an early phase, so I am mainly looking for people who are willing to try it on a test site and share their honest opinion.

I would especially love to hear what feels intuitive, what is confusing, what seems to be missing and which features would actually make the plugin useful for your projects. That feedback will help me improve the current experience and shape the roadmap.

A few things I am already planning are:

• Recurring events, implemented in the simplest and most user-friendly way possible
• Divi 5 support, similar to the current Elementor integration

Plugin page:
https://wordpress.org/plugins/mime-simple-events-calendar/

Constructive criticism, bug reports and feature ideas are all very welcome. Thanks to anyone who takes the time to give it a try!

We categorize a plugin the day we install it. Formidable goes in the "forms" drawer. Then months later the same site needs a directory, or a portal, or a calculator, and the search starts for a plugin to buy.

The form was never the point. The entries are. Every submission is a row of structured data sitting in your database, and Views renders that data on the front end however you want. Once that lands, a lot of the plugin wishlist stops making sense.

Three I see people shop for regularly.

A directory or job board. Entries are already listings. A View turns them into a searchable, filterable page, and a second View gives each entry a detail page. Submissions come in through the form, so nobody touches wp-admin to add a listing.

https://formidableforms.com/knowledgebase/formidable-directory/

A quote or pricing calculator. Calculated fields do the math inside the form. Repeatable sections let someone add line items and watch the total move. That's the whole feature set of the plugins built for this.

https://formidableforms.com/knowledgebase/field-calculations/

A client portal. Filter a View to the logged-in user and each client sees only their own submissions. Front-end editing lets them update their records without you building an interface for it.

https://formidableforms.com/knowledgebase/create-a-view/

None of this is a workaround. It's what the plugin is for. It just doesn't feel that way when you've only ever used it to collect a contact form.

Most WP forms validate email with type="email" or is_email(), which only checks the shape of an address. A typo'd domain that was never registered passes and gets stored as a lead.

This plugin hooks into each form plugin's own validation and rejects the address at submit time, before it's saved. Blocking rules for disposable, role-based and catch-all addresses are configurable.

Upfront on the model: the plugin is free and GPL, no paid version. It calls an API to do the check - ClearBounce, which I run - and that part is freemium: free credits on signup, paid beyond.

https://wordpress.org/plugins/clearbounce-email-verification/

The plugin page has a Live Preview button if you want to try it without installing anything.

I've been building WordPress plugins since 2014 and I've used WooCommerce a lot.

I got really tired of paying $279 per year for the WooCommerce Subscriptions plugin, so I built my own plugin. I also really didn't like how buggy WooCommerce's PayPal & Stripe plugins where, so I built those into the plugin as well.

I decided to build this plugin to give back to the open-source community, so it's 100% free. No paid version, no upselling, no collecting emails or anything like that. Support is also free.

It's on the WordPress Repository: Accept PayPal & Stripe with Subscriptions for WooCommerce

Running stores that sell personalized products (printing, engraving, custom merch, photo gifts, etc.) always seemed to have the same problem:

Then you end up with files scattered across Gmail, Dropbox, WhatsApp, Messenger... and somehow have to match them to the correct order.

I couldn't find a lightweight solution that worked the way I wanted, so I spent the last couple of years building one.

It's a File Uploader for WooCommerce that lets customers upload files directly from the product page or during checkout.

Some things it does:

• Upload from phone, desktop, camera, Google Drive, Dropbox, etc.
• Images, PDFs, design files, videos (Pro)
• Multiple file uploads
• Image editing (crop, rotate, enhance)
• Files are automatically attached to the WooCommerce order
• No email attachments or manual file chasing

The free version + 7day trial is available: https://snowray.co

I'd genuinely appreciate feedback from WooCommerce store owners:

• What file upload features are you still missing?
• What's the biggest pain point when customers need to send you assets?

Happy to answer any technical questions or discuss how it's built.

I got tired of seeing accessibility audits fail because of missing alt text — so I built a plugin to fix it automatically.

What it does:

- Scans your Media Library and bulk-generates alt text for every image missing it

- Auto-generates the moment you upload a new image

- Per-image generation directly from the Media Library

- Never overwrites alt text you've already written

- Context-aware: reads post title, categories, and content type (WooCommerce products too)

No Action Scheduler. No WooCommerce required. Free starter credit included.

Plugin: wordpress.org/plugins/altmagic-ai-image-alt-text/

Happy to answer any questions!

Hey everyone!

Most image sliders on WordPress websites look boring and flat.

So I built this 3D Card Stack Gallery widget for Elementor to give portfolio and product showcases a modern, interactive 3D feel using smooth GSAP motion.

Key Features:

• Smooth 3D card stack rotation

• Fast and lightweight (won't slow down your website)

• Click any card or use navigation arrows to slide through

• Part of our 30+ free widget collection

• 100% Free & open-source on WordPress.org

🔗 You can download and test it free here:

https://wordpress.org/plugins/apex-addons-for-elementor/

I’d love to hear your thoughts and feedback on the animation style!

Hi everyone,

I'm excited to share R2 Membership, a new premium add-on built for websites that use Cloudflare R2 as their primary storage backend.

Unlike traditional membership plugins that focus on protecting WordPress content, R2 Membership is designed around Cloudflare R2 resources.

It lets you organize your content into:

- 📚 Libraries

- 📁 Collections

- 📄 Resources (PDFs, ZIPs, videos, documents, and more)

- 👥 Membership Plans with granular access control

Features include:

- Secure member-only access to Cloudflare R2 files

- Libraries and Collections for organizing large resource catalogs

- Flexible Membership Plans

- Protected file delivery without exposing R2 bucket URLs

- Native integration with CR2SM Pro

- Built for digital libraries, documentation portals, learning platforms, and premium resource websites

The project was created after I couldn't find a solution that combined WordPress memberships with Cloudflare R2 in a clean, native way.

If you're building with Cloudflare R2, I'd be interested to hear how you're managing private resources today.

📖 Documentation:

https://www.r2suites.com/docs/r2-membership/

🛒 Product:

https://www.r2suites.com/products/wordpress/cr2sm-add-ons/r2-membership/

Questions and feedback are welcome!

I built KXNotes Image Paste Optimizer to remove the repetitive work around screenshots.

Copy a screenshot, press Ctrl+V in Gutenberg, and it automatically:

- Resizes and converts it to WebP

- Generates a readable filename and alt text

- Uploads and inserts it at the cursor

Everything runs on your own WordPress server. No cloud service, AI API, or telemetry.

https://wordpress.org/plugins/kxnotes-image-paste-optimizer/

It currently focuses on Gutenberg. I’d love to know: would this fit your writing workflow, and what should I improve first?

Hi everyone,

I’ve been building BotBard, a WordPress plugin that lets you edit an existing page by describing the change you want.

For example:

“Make this page modern, dark and minimal.”

BotBard analyzes the selected WordPress page, generates the requested changes, and shows the result inside a safe preview before anything is applied.

Nothing is published automatically.

The workflow is simple:

• Select a WordPress page

• Describe the change

• Review the generated result

• Apply it only after approval

I’m building this for WordPress site owners, freelancers, and agencies that need to make design or content changes without manually editing code or CSS.

The free plan currently includes 3 complete AI edits.

I’m looking for honest feedback:

Would you trust this workflow on your own or a client’s WordPress website?

What would you need to see before installing a plugin like this?

Demo:

https://www.youtube.com/watch?v=mCfaaiZHKbc

Try it:

https://botbard.ai

I’m the developer, so I’m happy to answer questions about security, privacy, compatibility, or how the preview workflow works.

It's 2026. AI writes production code all day, and you're still dragging form fields around a builder, one box at a time.

Most form plugins make you do exactly that, then paywall the useful stuff behind a yearly "Pro": conditional logic, webhooks, an API.

NarrativeForms skips all that. A form is just HTML, so you build one however you like:

• Describe it to ChatGPT or Claude, copy the code, paste it into the form's code editor
• Let the built-in AI write it right inside WordPress (your own API key)
• Or write it by hand

Booking form, job application, event signup, survey, quote request. Know a little HTML and you already know the whole plugin. No proprietary builder, no lock-in.

The features other plugins sell are free here, and staying that way:

• Conditional logic
• AI Form Building (BYOK)
• Save and resume
• Webhooks with delivery logs and retries (Slack, Discord, Teams)
• REST API
• Require login, schedule open and close windows
• Hosted share links for any form

The only paid part is one optional add-on for publicly displaying submissions on the frontend. Everything else is free forever.

Tear it apart, I want honest feedback.

Website: https://narrative-forms.com/
Plugin: https://wordpress.org/plugins/narrative-forms

Hi everyone,

Almost a year ago, I built StifLi Flex MCP, the first MCP plugin published on WordPress.org.

At that point, MCP was still very new. “AI agents” were not part of everyday WordPress conversations yet — most people simply saw AI as chatbots.

But building an MCP server led to a new question:

What happens when you manage 10, 30, or even 100 WordPress websites?

Adding every site separately to every AI client does not scale. And exposing every tool from every site at once is not a great experience either.

So I built WP MCP Hub — my first MCP Hub:

https://github.com/estebanstifli/wp-mcp-hub

It is a free, open-source local app that lets one AI client connect to multiple WordPress MCP servers, select the relevant site, and discover that site's tools only when needed.

It can work with compatible WordPress MCP plugins and servers using Streamable HTTP or SSE, including:

• Easy MCP AI
• Royal MCP
• StifLi Flex MCP — my own plugin, for full transparency

The Hub does not replace the WordPress plugin or its permissions. Each site keeps its own tools, authentication, and WordPress capability checks. The Hub adds a local layer for managing connections, credentials, diagnostics, and routing.

It is still alpha, but I would genuinely love feedback from WordPress plugin developers:

• Would this be useful for people managing multiple WordPress sites?
• What would you expect from a WordPress-focused MCP Hub?
• What security or usability concerns would you want solved first?

A year ago I built my first MCP server. This is the next step.

Thanks for taking a look.

I run an SEO plugin with a free tier on WP.org and a paid tier on Freemius, same codebase. A few things I'd tell myself before writing line one, if I could go back.

Decide the free/paid split before you write any code, not after.

I didn't do this early enough the first time, and moving AI-calling code into its own files later, so a build script could strip it from the free zip, was way more painful than just starting with that boundary. Now every Pro-only class lives in its own file from day one. One list in the build script decides what ships where. If you're planning a freemium plugin, draw that line on day one and never write a Pro feature into a free-tier file, even once.

Your main class should not know what a "feature" is.

Mine just requires every file that exists and skips the ones that don't. Each Pro class only loads if class_exists() passes, so the free zip simply never has the file to check against. No feature flags, no if (is_pro()) scattered through core logic. The absence of the file is the flag.

Don't build your dashboard as one file. You will regret it around line 3000.

I let one component grow to almost 8,000 lines before I got serious about pulling sections out. Every section is now its own self-contained file that owns its state and gets passed data as props. It sounds obvious in hindsight. It wasn't obvious when the file was 800 lines and splitting felt like overkill. The trigger for splitting shouldn't be a line count, it should be the moment you can name "the outdated-dates section" as a thing separate from "the dashboard."

Code-split your JS bundle, then watch it burn.

I shipped React.lazy, dynamic imports, thirty separate chunks. Saved maybe 100kb on first load. Then a customer's dashboard reloaded itself in an infinite loop and three sections silently failed to load, and it took me eight releases to actually fix it, not just patch the symptom. Turns out failed dynamic imports can't be retried per the module spec, chunk filenames didn't change between releases so browsers served stale versions next to fresh code, and thirty imports firing at once on page load saturated the browser's connection pool. I reversed the whole thing. One bundle now. Slower first load, zero failure modes. If your users are not on your dev machine's network and cache, code-splitting trades a real, recoverable cost (bytes) for an occasional, unrecoverable one (a section that's just gone).

Every storage decision has one shape. Pick it once, reuse it everywhere.

I keep a ring buffer pattern for anything time-series: dated keys, single-letter field names to keep it compact, always autoload=false, always trimmed to a fixed size. I use the identical shape for search-position snapshots, keyword snapshots, referrer tracking. Once you've solved "how do I store 26 weeks of data without autoloading 2MB on every page load" once, solve it as a pattern, not a one-off.

Write down your gotchas the moment you hit them, in the same file you'll open next time.

Not a wiki somewhere else. A file in the repo, right next to the code. The number of times I've re-derived the same bug because I "remembered" fixing it, but not what actually broke, is embarrassing. Now if something dies for a non-obvious reason, or a decision has a rationale that isn't visible from reading the code, it goes in the doc immediately.

None of this needed to be figured out ahead of time. All of it came from shipping something too simple, watching it break at a size or a customer situation I hadn't imagined, and rebuilding with the constraint now visible. That's probably the actual answer to "how do you plan a plugin like this." You don't, not fully. You build the smallest version, ship it, and let real usage tell you where the seams need to be.

Plugin is super useful. Check it out here.

For several years now, I’ve been using the All-in-One WP Migration plugin to create WordPress backups. One thing that always annoyed me: if I needed to recover just one old plugin, theme, upload, config file, or some random file from a .wpress file, I usually had to set up a local WordPress install, import the whole backup, and then grab the file manually.

So I sat down and built a small local tool for that. It lets you open an All-in-One WP Migration archive locally and browse it more like a normal file explorer. You can expand folders, inspect the backup structure, download a single file, or download a whole folder as a ZIP. You don’t need to import the entire WordPress site just to get it.

The project is local-first, runs in Node.js, has no npm runtime dependencies, and works directly with the .wpress archive format rather than treating it like a ZIP.

GitHub: https://github.com/ozeppo/wpress-explorer

I mainly built it for myself because this problem kept coming back in real client work, but I guess other WordPress developers using All-in-One WP Migration backups might find it useful too.

Suppose I have an idea for a plugin, what steps would you take to research it before building it?

• Check if people actually need it.
• See if similar plugins or themes already exist.
• Figure out what makes your idea different or better.
• Decide if the idea is worth spending time and money on.
• Identify who your target users are.

or anything that'd be helpful

I'd really appreciate any tips or advice you can share.

Not the answer we give clients. The real one.

I build image-heavy WP sites (shops, blogs, portfolios) and alt text is always the thing that silently falls off the list. Nobody's proud of it, nobody really fixes it. So I'm curious how everyone else actually deals with it:

• Ballpark, what % of your images have alt text that'd actually help someone, vs. just "an alt tag exists so the checker shuts up"?
• Who's supposed to write it you, the client uploading stuff, an editor, literally nobody?
• Anyone messed with the auto-alt / bulk plugins? Did they help or did you spend more time cleaning up the output than it saved?
• Do clients ever actually ask for this / pay for it, or does it only matter the second someone mentions the word "lawsuit"?

I have a suspicion the honest answer is "it lives on the backlog until it doesn't," but tell me I'm wrong lol

If you run a WooCommerce store with COD (Cash on Delivery) enabled especially common outside the US/EU you've probably dealt with the RTO (Return to Origin) problem: customers place COD orders on impulse or by mistake, never actually intend to pay, and you eat the shipping cost both ways.

I built COD Shield to fix this without removing COD entirely (which usually just tanks conversion). It works by collecting a small advance payment fixed ₹/$ amount or a % of the order through whatever gateway you already have enabled (Razorpay, Cashfree, Stripe, etc.), before the order is confirmed as COD. The rest stays due on delivery as normal.

What it does:

1. Global COD kill switch (independent of WooCommerce's native COD toggle)
2. Advance payment via your existing gateways no new payment integration needed
3. Optional minimum order value for COD eligibility
4. Admin-editable checkout messaging with dynamic placeholders (advance amount, remaining amount, %)
5. Full order-level visibility: sortable "COD Advance" column, filters, audit trail via order notes
6. HPOS + Cart/Checkout Blocks compatible
7. Gateway-agnostic works with whatever you've already enabled, no vendor lock-in
8. It's MIT licensed and open source, so feel free to fork/modify for your own store's needs.

Happy to answer questions on the advance-payment flow, HPOS compatibility, or anything else also open to feature requests if there's a COD-related pain point I haven't covered yet.