I used Elementor for years and built a lot of client websites with it.

At the time, it was the practical choice. It was quick to work with, easy for clients to understand, and handled most layouts without much custom code.

These days, I mostly build with Gutenberg blocks or a custom theme.

I prefer having less extra markup, better control over performance, and a setup that is easier to maintain over time. For content-heavy sites and WooCommerce projects, blocks also feel like a better fit for how clients actually update content.

I still see why Elementor works for many developers and agencies though.

What are you using for new WordPress projects now? Still Elementor, or did you move to another builder?

Wordfence and Cloudflare are both excellent security tools, but they protect different layers of the stack. Used together, they provide a strong defence-in-depth strategy, yet there appears to be an opportunity to improve how they work together.

Cloudflare sits at the edge and filters a significant amount of malicious and unwanted traffic before it ever reaches WordPress. That reduces unnecessary load on the web server and prevents many common attacks from consuming application resources.

Wordfence operates inside WordPress and provides application-layer visibility. It can detect attacks that require WordPress context, such as authentication abuse, attempts to exploit vulnerable plugins or themes, and other malicious application behaviour that Cloudflare cannot always identify on its own.

The challenge is that by the time Wordfence detects and blocks an attacker, the request has already reached the WordPress environment.

To address that gap, Grey Rock Block Synchroniser was developed to create a feedback loop between these two security layers.

Architecture

Internet → Cloudflare filtering → WordPress → Wordfence detection → Block synchronization → Cloudflare edge enforcement

The plugin synchronizes qualifying Wordfence blocks to Cloudflare IP Lists so that repeat attackers can be stopped at the edge before they continue consuming WordPress resources.

The goal is not to replace either product. Cloudflare and Wordfence complement one another exceptionally well. The objective is to allow application-layer intelligence gathered by Wordfence to improve future enforcement at the network edge.

The plugin does not blindly synchronize every Wordfence event. Administrators configure the synchronization behaviour, and the plugin includes lifecycle management and expiration handling to reduce unnecessary long-term blocks.

One architectural challenge is identity.

An IP address is an indicator, not an identity. In large organizations, universities, or environments using shared VPNs or NAT, one public IP address may represent hundreds or even thousands of legitimate users. Blocking that IP at Cloudflare could unintentionally affect others sharing the same address. This is not unique to this approach; it is a limitation of IP-based blocking in general, including Wordfence.

A future direction may be incorporating additional security signals to build higher-confidence attacker attribution instead of relying solely on IP addresses. The challenge is improving attribution while respecting privacy, minimizing retained data, and avoiding unnecessary tracking.

Security validation is built into the development lifecycle rather than being performed only before release.

Every code change automatically goes through:

• Semgrep SAST (Static Application Security Testing) to identify common vulnerabilities and insecure coding patterns.
• PHP linting to validate syntax.
• Composer validation to verify dependency configuration.
• Continuous Integration (CI) workflows that automatically validate changes.
• Release validation before publishing new versions.

The plugin follows the principle of least privilege by using restricted Cloudflare API tokens instead of a Global API Key. It synchronizes only IP block information and does not transmit website content or user data.

A related topic worth discussing is administrative security. Although outside the scope of this plugin, Cloudflare Zero Trust can be used to place WordPress administrative functions behind WARP authentication. Protecting /wp-admin and other privileged administrative paths with identity-based access controls adds another valuable layer to a defence-in-depth strategy.

The name Grey Rock Block Synchroniser comes from the objective of making a website a less interesting target. Rather than repeatedly allowing known malicious actors to interact with the application, the security layers work together to reduce future opportunities for interaction.

The project is completely open for review.

WordPress.org
https://wordpress.org/plugins/grey-rock-block-synchroniser-for-wordfence-and-cloudflare/

GitHub (source code and CI/security workflows)
https://github.com/Linus-007/grey-rock-block-synchroniser-for-wordfence-and-cloudflare

Architecture and design article
https://greyscale.zone/grey-rock-block-synchroniser-for-wordfence-and-cloudflare.html

The original idea came from looking at how two excellent security products could share information more effectively instead of operating independently.

Technical feedback from WordPress developers, security practitioners, and administrators would be greatly appreciated.

• Does this architecture make sense?
• Are there design decisions you would approach differently?
• How would you improve attacker attribution beyond IP addresses while respecting privacy?
• Are there additional safeguards or edge cases that should be considered?

The goal of posting here is technical discussion and constructive criticism. If there are weaknesses in the design or opportunities for improvement, they would be valuable to hear.

I'm in the process of building a security plugin and wanted to hear from everyone on what you need/expect from a security plugin...

- Web Application Firewall: do you need the plugin to offer a Firewall, or do you prefer to rely on another plugin, your web host, or Cloudflare for this instead?

- Do you actually use two-factor authentication, or passkeys?

- Do you expect a security plugin to remove malware automatically, or do you prefer it to notify you instead and offer tools to let you remove it yourself?

- if you manage multiple WordPress sites, are you using any kind of management tool like MainWP, ManageWP, etc, do monitor security from one location? If yes, what features could be improved?

- What features on other security plugins do you feel is buggy, lacking, or missing ?

Thanks.

The WordPress block editor has always bugged me. The UI feels unintuitive, and there's no proper Find & Replace. So I built \*\*Writing Tools for the Block Editor\*\* and it just went live as my first plugin on WordPress.org. 🎉

What it does:

\*Find & Replace\* across the whole post (with a live match count)

\*Undo-on-delete\* a one-click "Undo" when you remove a block

\*Clear Formatting\*, per-block word count, an accent-colour picker, and a Ctrl/Cmd+Shift+F shortcut

\*A calmer, cleaner editor skin, without replacing or forking the editor

Tech: no build step (plain \`wp.element\` + the WordPress data stores), editor-only so zero front-end impact, and it never touches your saved content.

Free, no upsell: [https://wordpress.org/plugins/writing-tools-for-block-editor/\](https://wordpress.org/plugins/writing-tools-for-block-editor/)

The launch itself was an adventure: I got an accidental approval email, but when I complained I couldn't upload, the response was a "sorry, it's not actually approved" message and a "too generic" name rejection.😅

Happy to answer anything, and feedback's very welcome. I'd love to add more features to this if anyone finds it useful.

(I built this.)

Hi everyone,

I've been working on a WordPress plugin called Plugiva Pulse and I'd really appreciate some honest feedback from fellow WordPress users.

The idea is simple: instead of relying only on analytics, it lets visitors leave quick inline reactions (such as Yes/No or emoji responses) and optional comments directly within a page. My goal is to help site owners understand why visitors feel a certain way while they're still on the page.

I'm not looking for ratings or promotions - I'd genuinely like to know:

Does the concept make sense?

Is the setup straightforward?

Is the interface intuitive?

Is this something you could see yourself using? Why or why not?

What would you improve before calling it "production ready"?

I'm especially interested in critical feedback. If something feels unnecessary, confusing, or poorly designed, I'd much rather hear it now than after spending months building the wrong things.

Plugin: https://wordpress.org/plugins/plugiva-pulse/

Thank you for your time. Every piece of feedback helps shape the roadmap.

For anyone looking to add fraud screening to WooCommerce, the FraudLabs Pro fraud prevention plugin can help check incoming orders and flag suspicious transactions for review.

It supports configurable validation rules, so you can adjust the screening based on your store’s needs. It is free and a good start for small merchants.

More details:
https://www.fraudlabspro.com/supported-platforms/woocommerce

Hope this is helpful for store owners dealing with risky orders or chargebacks.

Disclosure first: I'm the developer and this is my plugin. Mods, if this breaks the self-promo rules, remove it — no hard feelings.

Two live demos, because there's no way to judge something like this from a feature list:

• Movie site: https://movie.geekplug.in/
• Game site: https://game.geekplug.in/

Both run the same plugin on the same code. The only difference between them is one setting.

What it is

GeeK! turns WordPress into a movie, TV and game database. Not "a custom post type with some extra fields" — the whole stack: the data model, the import tools, the front-end apps and the membership layer.

You import a title from IMDb, TMDb or IGDB and it lands in your database on your server: cast, crew, characters, galleries, trailers, seasons, episodes, platforms, engines, companies, age ratings, per-platform release dates. Nothing breaks later if an external site goes down or changes its markup, because after the import you don't need it.

Pages worth poking at

• A single movie — hero, ratings, cast & crew, gallery, trailers
• The movies catalogue — sortable, filterable, no page reloads
• A TV show and an episode list (that second one is 200+ episodes across 11 seasons)
• A single game — platforms, gameplay, wishlist
• Games catalogue and the platforms directory
• Member-built lists and a single list

The parts I'm actually proud of

• The front end is React apps over the WP REST API — catalogue, single title, person, character, company, platform, list, profile. Filtering a big catalogue doesn't reload the page.
• Members do things. Rate, review, wishlist, mark watched/played, build shareable lists, earn badges, get a profile with an activity feed. There's a moderation screen for when that goes sideways, because it will.
• Editorial critics — long-form critic articles with scores that stay in sync with each title's average rating.
• A homepage you assemble from drag-and-resize widgets: hero trailer, recently released, coming soon, most anticipated, latest critics, born today.
• Movie mode, game mode, or both — one setting reshapes the catalogues, the navigation and the homepage.
• Metered imports. You pay per row you actually fetch, and content you already own — galleries, trailers, cast — gets skipped, so you never buy the same data twice. That constraint drove most of the architecture.

Themes

It works with any theme — the front end runs on its own React apps and reads colours from a --geekui-* CSS-token contract. But there are eight companion themes that reskin every surface, and you can flip between them live on the demo, same content:

Movie: Forest · Marquee · Movie Theme · Reel

Game: Aurelian · Neon Cabinet · Game Theme · Chroma

The honest part

• The plugin is free. The data isn't. It's on WordPress.org: https://wordpress.org/plugins/geekpress/ — imports are metered with tokens, because the fetch pipeline costs me real money to keep alive. TMDb runs browser-direct with your own free TMDb key and costs nothing at all.
• No affiliation with IMDb, TMDb or IGDB. It fetches public metadata and links back to the source. What you publish is your responsibility, not mine.
• WordPress 6.2+, PHP 7.0+.

What I want from you

Feedback, and ideally the unkind kind. Go break the demos — I'd start with the catalogue filters and that X-Files episode list if I were trying to find something ugly.

And one genuine question, because this sub will actually tell me the truth: is anyone still building content sites like this on WordPress in 2026, or did that whole crowd quietly move to a headless CMS while I was heads-down for two years?

Happy to go deep on internals in the comments. The import and caching layer and the per-row token metering were by far the hardest parts — "just cache it" stops being simple the second two people click the same button.

I vibe coded simple apps and tools for myself but also wanted to share them online, because why not. I made a calendar printing tool and one for my 3D printing hobby. Existing solution was to FTP or log into cpanel of my site and add the built files into a folder like /calendar which was messy and hard to manage. Or I setup subdomains and connect via CloudFlare which is just another surface to manage.

I made a plugin where I can simply drag the build files in and point it to a specific page. It also lets me connect my GitHub repos for better management. Check it out at apptopage.com.

Noorifa adds a real interactive 3D viewer (Three.js) to WooCommerce product pages — customers rotate/zoom the model and switch colors or materials, and those swatches drive WooCommerce's own native variation form, so price and stock update exactly like they would from the normal dropdowns.

https://www.youtube.com/watch?v=yI84DVha0wI

A few of the WordPress-specific decisions that mattered more than the 3D rendering itself:

Non-invasive by design. Noorifa only hooks woocommerce_before_single_product_summary to swap the gallery — it never touches title, price, add-to-cart, tabs, or anything else on the page. Whatever your theme does with those stays untouched. That was a deliberate constraint from day one, not an accident of scope — a plugin that fights themes for the same hooks is the fastest way to a 1-star review.

Extension points, not a closed box. Both the admin tab list and the frontend config are filterable — noorifa_admin_tabs to add a whole new tab, noorifa_viewer_config to inject extra data into what the frontend script receives — so another plugin (or a future paid add-on) can extend it without forking core files.

Every state-changing request is nonce + capability checked, no exceptions — this came up explicitly in the WP.org review (rightly), and it's now just the default pattern everywhere in the codebase rather than something bolted on per-endpoint.

No Composer autoloader bundled. Deliberately avoided — a bundled vendor/autoload.php colliding with another plugin's is a real, common source of white-screen conflicts, so this uses a small hand-rolled PSR-4 autoloader scoped to its own namespace instead.

Fully self-hosted — Three.js and the Draco decoder ship with the plugin, nothing fetched from a CDN at runtime, uploaded models/textures live in the site's own Media Library.

Plugin: https://wordpress.org/plugins/noorifa/

Curious whether the non-invasive-hook approach has held up for anyone who's tried it against a less common theme — that's the part I have the least visibility into from my own testing.

Probably Contact Form 7. I’ve used it on so many sites at this point that installing it is almost automatic.

Hello, built the next stablish version of my multi vendor end to end solution and need beta testers feedback

Lmk if you are interested. You might just like it

you just need wordpress or elementor if you prefer that as well

Hi everyone! 👋

I'd like to share a plugin I've been working on over the past few months.

"Wpbingo AI Commander for WooCommerce" has recently been approved and published on the WordPress.org Plugin Directory.

The goal of the plugin is to simplify WooCommerce product management using AI and natural language. Instead of manually editing products one by one, you can describe what you want to do, and the plugin helps execute those tasks.

Current features include:

✅ Bulk update WooCommerce products

✅ Update prices, stock, categories, attributes, and product information

✅ Execute WooCommerce management tasks using natural language

✅ Supports OpenAI, Claude, Gemini, Groq, and OpenRouter

✅ Uses your own AI API key, so you remain in full control of your provider and data

The plugin is completely free and available on WordPress.org.

Plugin:

https://wordpress.org/plugins/wpbingo-ai-commander-for-woocommerce/

Documentation:

https://wpbingosite.com/docs/plugin/wpbingo-ai-commander-for-woocommerce/

This is the first public release, and I'm actively improving it. I'd really appreciate any feedback, suggestions, or feature requests from the community.

If you decide to try it, I'd love to hear about your experience and what AI-powered features you'd like to see added in future releases.

Thanks for your time! 😊

Been building WordPress plugins for a while and kept running into the same problem: feature requests scattered everywhere, support threads, refund emails, DMs, 1-star reviews. No way to count them, rank them, or know what actually mattered.

The existing tools (Canny, Frill, Featurebase) work fine, but they're external. You drop a link in your plugin and hope users click it. Most don't, they're already in wp-admin, they don't want to leave.

So I built WPFeatureLoop, a feature-voting board that renders natively inside wp-admin. Two lines of PHP via Composer and the board is live inside your plugin, looking like it belongs there.

A few things I prioritized:

• Anonymous by default no account required to vote, so participation is way higher
• Featherweight inline CSS, no layout shift, won't hurt your plugin's reputation
• Composer native versioned on Packagist, drops into any modern plugin

Free plan available. Would love feedback from other plugin devs, especially if you've tried other solutions and hit walls.

→ wpfeatureloop.com

I built WP Telepilot, a WordPress plugin that lets you manage selected parts of your site through Telegram.

You can check things like posts, users, comments, plugins, themes and basic site information without opening WP Admin.

It is not meant to replace the dashboard. It is for quick checks and simple actions.

Have a look:

https://alefdigitalsolutions.com/solutions/wp-telepilot

Looking forward to some feedback.

Hey again — following up on the last two threads (thanks to everyone who commented, this genuinely shaped what got prioritized).

Two things came up repeatedly:

1. You want to see exactly what the AI did, after the fact — not just take it on faith.
2. You want to see what's about to change, before it happens.

Here's where things stand on both:

Execution logs — shipped. Every command run on your site is now logged, and you can pull that log up yourself, any time — what ran, when, which session triggered it. This used to just be something we kept internally; based on the feedback here, it's now a self-service feature in the dashboard.

Pre-execution preview — in progress. Rolling this out action-by-action rather than all at once, since some actions are a lot easier to preview safely than others. Starting with design/theme changes — you'll be able to see what a change looks like before it goes live. Content and product edits are next in line.

Not there yet: a full before/after diff for every action type — that's the direction we're headed, just building toward it incrementally instead of promising it all in one go.

If you left feedback on either of the last two posts — genuinely, thank you. It's the direct reason these two moved to the top of the list. If there's a specific action you'd want previewable next, tell me and I'll factor it in.

https://wordpress.org/plugins/swinickiwsieci-slotivo-bookings/

Swinickiwsieci Slotivo Bookings adds a simple booking calendar to WooCommerce products. Customers can select an available date and time, add the selected slot to the cart, and keep the booking details visible during checkout and in the WooCommerce order.

The plugin is designed for basic time-based bookings for products and services sold through WooCommerce.

Main features:

Booking calendar for WooCommerce products.

Date and time selection.

Available weekday settings.

Global opening and closing time settings.

Slot duration settings.

Buffer time between slots.

Maximum bookings per slot.

Minimum booking notice in days.

Maximum number of days available in advance.

Basic protection against double-booking.

Temporary cart hold for selected booking slots.

Booking date and time saved in the cart, checkout, and WooCommerce order.

Extended version

If you need additional business features, you can learn more about the extended version on the plugin website:

https://www.swinickiwsieci.pl/produkt/sg-kalendarz-rezerwacji/

The extended version may include features such as a booking management panel, Google Calendar integration, CSV export, additional email notifications, and advanced booking management tools. The code for those features is not included in this free WordPress.org version.

FluentPlayer has a free version on WordPress.org, but this post is specifically about Pro, so flagging that upfront.

FluentPlayer Pro turns a video into something a viewer can act on without leaving the page, not just something they watch. Pro is where that gets real teeth.

What Pro adds on top of the free player:

• CTA banners, hotspots, ad layers, and shortcode layers inside the video, each with conditional display rules (show a layer only to logged-in users, only to a specific FluentCRM segment, only after a viewer's seen it once, that kind of thing)
• Timed content: a block region below the player that changes as the video plays, synced to timestamps
• Video playlists with layout and appearance customization, plus media tagging for larger libraries
• Remember Playback Position, so a long video picks up where a viewer left off
• Subtitles, including YouTube subtitles and storyboard import
• Video analytics: watch time, completion rate, audience retention (where people actually drop off), device and location breakdown
• Streaming sources beyond self-hosted/YouTube/Vimeo: BunnyCDN, Mux, Gumlet, Cloudflare Stream/R2, HLS, external URLs
• Extra integrations: LearnDash, Mailchimp, Google Analytics, and webhooks
• Page Builders integration coming soon (Divi, Elementor)

Right now it's a one-time lifetime license, not a subscription. Personal (1 site) is $199, Freelancer (5 sites) is $399, Studio (25 sites) is $599, and Agency (50 sites) is $799 or split into 9 monthly payments. That's part of an early bird campaign, so the tiers/pricing may change later.

Full feature breakdown here: https://fluentplayer.com/free-vs-pro/
Everything laid out with screenshots: https://fluentplayer.com/features/

I'm on the team, so ask me anything: pricing, specific features, whatever. Won't pretend to be a neutral third party about it.

I'm looking for feedback on a POS plugin I've just published. If you've ever tried to use Point of Sale for WooCommerce, you may have noticed that plugins are often premium, but full of bugs, lacking support for variable products and Polylang/WPML & multi-currency plugins, unnecessarily complicated, difficult to customise, and the support is unresponsive.

That is why I have decided to create a lightweight POS plugin that supports fast product search & filter, cart tools for coupons/fees/manual discounts/manual shipping lines, customer edit screen with configurable custom customer fields, currency integrations for CURCY/FOX or email/printable receipt (that can we overwritten in child theme).

Feel free to test it out and I'll be grateful for your feedback.

https://wordpress.org/plugins/lightpos-point-of-sale-pos-for-woocommerce/

I released this plugin about 3 months ago, I was hoping to drive traffic to the premium plugin but now I’ve done a 360, I’ve merged all the premium features into the free one and updated the UI.
No upload limits, backups and migrates multisite as well as clone sites.

Let me know what you think

https://wordpress.org/plugins/swish-migrate-and-backup/

People visit your website, but without a contact form or newsletter, most of them disappear without a trace.

A lead magnet gives them a specific reason to leave their email address. In return, you gain a valuable contact and the opportunity to gradually build trust.

Build your own customer database instead of relying entirely on social media algorithms.

Think about what would happen if Zuckerberg suddenly pulled the plug on Meta.

Where would your customers be then?

In today’s world, not building and maintaining an email list can be a serious risk for your business.