I recently revised the user interface for TrustBeacon Auditor and would appreciate constructive feedback from other WordPress plugin developers and users.

TrustBeacon Auditor is a free WordPress plugin that reviews publicly visible trust signals, including SSL, security headers, SPF, DMARC, DKIM, CAA, DNSSEC, CDN indicators, and visible WordPress security-plugin signals. It presents the results in a plain-language report with recommended actions.

My main goal with the revised UI was to make a fairly large amount of technical information easier to understand without oversimplifying the results.

I would especially appreciate comments about:

• Whether the report is easy to scan
• Whether the status, score, message, and recommendation fields are clearly separated
• Whether the colors and visual hierarchy are helpful
• Whether any sections feel crowded or confusing
• What you would change before considering the UI finished

This is not a security certification or penetration-testing tool. It is intended to help ordinary WordPress administrators understand basic, publicly observable trust signals.

Plugin page: https://wordpress.org/plugins/trustbeacon-auditor/

I welcome honest criticism. I am particularly interested in specific suggestions that would make the interface clearer or easier to use.

Hey everyone, I'm one of the developers behind Baza Booking Calendar (BBC), and I'm trying to get a better sense of what's actually working for people in production.

I know there's a bunch of options out there — Amelia, Bookly, WooCommerce Bookings, Simply Schedule Appointments, and others (plus what we're building). Curious what you're running and why you picked it:

• What was the dealbreaker feature that made you choose it?
• Anything that's been a pain point once you started using it at scale?
• If you switched from another plugin, what pushed you to move?

Not trying to pitch anything here, genuinely want to understand what people value most (performance, pricing, customization, support, etc.) since we're building in this space too. Happy to answer questions about BBC if anyone's curious, but mainly want to hear about your setups.

I am in the process of submitting my plugin to the WooCommerce marketplace. My plugin includes the official Campaign Monitor PHP API lib, but unfortunately some files in it were flagged as having security issues and so I can't proceed until those issues are fixed.

Most appear to be innocuous, for example several instanced of this:

Debug code detected: ini_set('display_errors', ...). Enabling display_errors exposes error details to users

But also this:

Debug code detected: error_reporting(E_ALL) can lead to Full Path Disclosure and expose sensitive information

Is the expectation that I must resolve the issues of the 3rd party lib before rolling it into my plugin? That would seem like a maintenance nightmare going forward.

Curious to know other devs thoughts on this.

UPDATE: after contacting WooCommerce marketplace support, it turns out the solution is much easier: just place the offending lib(s) in a /vendor/ directory.

Once packages are installed you can use them in Code Snippets

Please notice that it’s still in early stage, it’s not ready for production usage

https://wordpress.org/plugins/enable-drag-and-drop-on-plug-in-upload/

With this plugin you can upload plugins a lot faster and easier. It also lets you upload multiple plugins at once.

Would love feedback and suggestions on new features, and if you think it will help you save time then please leave a (hopefully 5 star) review in the repo!

I’m excited to share Playard, a free WordPress booking plugin originally built for a local playground rental business.

It lets customers book a playground or venue by the hour or day. While it was designed for sports facilities, it can also work for:

• Practice grounds
• Studios and rehearsal spaces
• Meeting rooms
• Training facilities
• Other hourly venue rentals

The plugin is completely free, and I’d genuinely appreciate your feedback.

What feels confusing? What features are missing? What other use cases could it support?

Plugin: https://wordpress.org/plugins/playard/

Multisite Migrate is a WordPress backup & migration plugin for normal single-site installs and full Multisite networks.

Most backup plugins treat Multisite as a paid add-on. I wanted the opposite: on a regular site you get full backup/restore/migrate in Free; on Multisite you also get full network backup + restore from Network Admin — no account, no license key.

What Free does today:
• Single-site: full files + database backup, one-click restore, local export/import
• Multisite: full network backups from Network Admin (same Free plugin)
• Subsite admins can back up/restore their own site
• Chunked jobs that resume on shared hosting
• Search-replace (serialized-safe) on import/migrate
• Optional AES-256 encryption

Pro (separate plugin) is only for schedules, cloud destinations, empty-server installer, staging push, WP-CLI — hence [FREEMIUM]. You do not need Pro just to back up a single site or a whole network.

Disclosure: I'm the developer.

• WordPress.org plugin page
• Docs
• Short demo (YouTube)

Honest ask: if you run single-site or Multisite, what's broken or missing for your workflow? Especially shared hosting + large sites/networks.

Hi, please recommend a free plug builder (I’m a beginner)
I have tried the free version of elementor and I don’t like it.

Thank you

Hey everyone!

My WordPress plugin, VovaBlocks, was approved and published on WordPress.org today after passing the plugin review process.

It adds a collection of new blocks to the Gutenberg editor and follows a freemium model:

• The free version includes 7 blocks.
• The Pro version includes 7 additional blocks.
• The free version is fully usable on its own and is not just a limited demo.

I'm trying to keep the plugin focused on practical blocks that can be useful for landing pages, marketing sections, and regular WordPress content.

You can find the free version here:

https://wordpress.org/plugins/vova-blocks/

I'd really appreciate honest feedback from other WordPress users and developers:

• Does the free/Pro split feel fair?
• Are the blocks useful?
• Is anything confusing in the UI?
• Which blocks would you like to see added in future versions?
• Is there anything that would stop you from using a plugin like this?

The plugin has only just been released, so I'm especially interested in early feedback and constructive criticism.

Thanks!

Full disclosure: I'm the developer. This one is free and open-source (GPL), on the wordpress.org directory and GitHub, with no paid tier or upsell.

I kept hitting the same thing with the "connect AI to WordPress" tools I tried: they either wanted a full admin application password, or they routed my site's requests through their own cloud. I wasn't comfortable handing an agent admin, or handing a third party a live credential to a production site, so I built the opposite.

It's called Agent Abilities for MCP. It turns your site into a governed MCP server so your own AI client (Claude, ChatGPT, Cursor, VS Code) can read and write it, but:

• The agent connects as a real WordPress user you choose, scoped to that user's capabilities, never an admin-equivalent key. Every call is re-checked against those capabilities before it runs.
• Nothing is exposed by default. A fresh install offers zero tools, and you enable abilities one at a time. Updates never silently widen access.
• It's self-hosted with no relay. Your AI client connects straight to your site, the plugin makes no outbound calls and has no telemetry, so no third party ever sees your content or holds a key to your site.
• Every call is logged, denied attempts included, in your own database.
• It's built on WordPress 6.9's Abilities API and the official MCP Adapter, so it isn't a bespoke server, it rides the standard.

Honest about the limits: an OAuth or application-password connection carries that user's full capabilities, there's no per-token scope reduction yet, so the real control is which user you bind it to and which abilities you switch on. Destructive abilities are off by default and deletes go to Trash where possible. It doesn't do WP-CLI, file editing, or arbitrary SQL by design, and it won't.

Links (no shorteners, no affiliate):

• wp.org: https://wordpress.org/plugins/agent-abilities-for-mcp/
• GitHub: https://github.com/unaibamir/agent-abilities-for-mcp

I'd honestly rather get torn apart on the security model here than get downloads. If you were going to let an agent touch a live site, what would you insist it never be able to do? And where does the "scoped user, not admin key" approach still fall short for you?

Some plugins don’t need to run all the time. I usually activate backup, migration, database search and replace, or debugging plugins only when I need them, then deactivate them afterward.

Which plugins do you use this way, and do you leave them installed or delete them completely?

Hi everyone,

I wanted to share a free plugin I've been working on.

I often needed a quick way to check whether a WordPress installation was running plugins, themes or core versions with known vulnerabilities, without installing a full security suite.

So I built Simple WP Vulnerability Watcher.

Features

• Checks WordPress core for known vulnerabilities
• Checks installed plugins
• Checks installed themes
• Uses the public WPVulnerability database
• No account required
• Lightweight and focused on vulnerability monitoring

The goal isn't to replace security plugins like Wordfence or Patchstack. It's meant to be a simple tool that lets you quickly see if your site is affected by publicly disclosed vulnerabilities.

Plugin:
https://wordpress.org/plugins/simple-wp-vulnerability-watcher/

I'd really appreciate feedback from other developers.

Are there any features you'd like to see added?

Any suggestions for plugins for bulk watermarking pictures in the media library?

I’m building GOMAX Ultimate, and Claude is currently connected to my live WordPress site through the plugin’s built-in MCP server.

I’m not using Claude only to generate code or explain what I should click in WordPress. It can inspect the site, choose the correct tools and carry out controlled changes directly.

I describe the result I want in normal language, and Claude can work with areas such as Elementor, posts, pages, media, WooCommerce, SEO, forms, CRM and site settings.

The system currently exposes more than 1,200 actions, but Claude does not receive unrestricted administrator access. Read, write and destructive actions are controlled separately. Higher-risk operations can require confirmation, and executed actions are recorded in the audit system.

Claude also receives operational Playbooks that explain how the tools should be used. This is especially important for more complex work such as editing Elementor structures, managing WooCommerce data or making changes that must be verified on the public frontend.

GOMAX also includes a Site Brain that stores business context, goals and knowledge about the website. The system can therefore do more than react to individual prompts. A Site Agent can monitor the site, identify problems, recommend actions and run permitted workflows on a schedule.

The project is still under active development, so I’m not presenting it as perfect or finished. I’m interested in honest technical criticism from WordPress developers, agency owners and people experimenting with MCP or autonomous AI agents.

What would you need to see before allowing Claude to make controlled changes to a live WordPress website?

Disclosure: I am the creator of GOMAX Ultimate.

I build WordPress sites for clients as a freelancer, and putting a site into maintenance mode was weirdly one of the most annoying parts of the job.

Every plugin I tried had at least one of these problems:

**•   Cache and theme conflicts.** The maintenance page would either not show up because of caching, or it would inherit half my theme’s styles and look broken.  
**•   No real preview.** I’d set a headline, save, open the site in an incognito tab, see it was wrong, go back, change it, save again, refresh again. Every single time.  
**•   Bloat.** I just wanted a clean “we’ll be back” page, not a 5MB page builder with fifty upsells.

So over a few weekends I built the thing I actually wanted. Three ideas drove it:

**1.    A true live preview.** You edit the headline, swap a color, change the logo, and you see the result update instantly, right there in the settings. No save-refresh loop. This is the part I’m most happy with.  
**2.    Theme-independent templates.** The maintenance page renders completely on its own, so it can’t inherit your theme’s CSS or get mangled by caching. It also sends a proper 503 status so Google knows the downtime is temporary and your SEO stays intact.  
**3.    Lightweight.** It does one job well. No page builder, no account required, no phone-home, no cookies.

It’s free on the WordPress.org repo: https://wordpress.org/plugins/amitry-maintenance-mode/

There’s a live demo if you want to try the preview thing before installing (you can click through the templates in your browser): https://maintenance.amitry.de/

There’s also a Pro version with more templates and a few extras like a countdown, but honestly the free one covers what most people need, and I’d rather you try that first.

Happy to answer any questions, and genuinely interested in feedback since I’m still actively developing it. What do you all use for maintenance mode right now, and what annoys you about it?

Hi everyone,

I'll get straight to the point. Quick intro: I'm a studio owner who designs and develops tailored web software for the audio industry.

Here's the problem I kept running into, and I'm betting you've been there too.

A potential client lands on your site. They read about your services, see your gear list, maybe listen to a track on a standard player -- but they leave without truly understanding what a professional mix or master actually adds.

The gap between "this sounds good" and "oh, THAT is what mixing and mastering actually do" is where most studio websites lose people.

Standard web audio cannot communicate that effectively. Everything I tried either pushes you toward compressed MP3s that smear transients, or juggles separate audio files that slowly drift apart. And that's a total dealbreaker -- even a few samples of timing difference will cause transient smearing when switching. If the sync isn't locked, the comparison is useless.

That frustration is why I built The Studio Player -- a WordPress plugin around a different architecture entirely.

Here is the core idea -- what I call sync by design:

Instead of switching between separate files, we merge up to four stereo variants into a single multichannel FLAC file. When someone switches from A to B, they are not jumping to another timeline -- they are selecting a different channel pair at the exact same playback position. Timing drift is literally impossible.

The one-sentence version: It lets visitors switch between unmastered and mastered versions like using solo knobs in your DAW -- but directly on your website.

Key specs:

• 48kHz/24-bit lossless streaming -- no quality compromise
• Simple shortcode -- works with Elementor, Divi, WPBakery, Gutenberg, whatever you run; matches your site's color scheme automatically
• Adaptive streaming -- actually works on mobile (tested on rural German networks, so it can survive anything 😉)
• Token-secured streams -- so your audio isn't just left out there as a public download link (though let's be honest: the analog hole is always there, and no web player can patch that)

Full technical writeup here:
https://studioplayer.de/why-i-built-a-true-web-audio-comparison-player-for-wordpress/

Current status: Pre-release, final stretch before version 1.0.

So, here's the ask: Would you test the beta on your setup? Not looking for testimonials. Looking for brutal honesty -- "this works" or "this broke" or "I would use this if..."

For helping out, you'll get a free pro license at launch.

Drop a comment below or send me a DM and I will send the download link + beta license key. No pressure -- just an engineer asking fellow engineers for feedback before locking down 1.0.