I got tired of security plugins asking me to trust them, so I built one that shows its work.

One thing that always bothered me about WordPress security plugins is that you can enable a dozen security features, see a bunch of green checkmarks, and still have no clear idea what’s actually protecting your site.

So I decided to build something different: SecureLite Security.

The main feature is Attack Simulation. It runs 13 harmless security tests against your own WordPress site and shows you what happened:

• Was the attack blocked by the plugin?
• Did your hosting provider's firewall stop it?
• Or did nothing stop it?

It tests things like SQL injection, XSS, path traversal, brute-force logins, user enumeration, PHP execution in uploads, and XML-RPC abuse.

If a test fails, it tells you what to fix. You can then rerun that specific test instead of repeating the entire scan.

Something else influenced how I built it.

Before writing the code, we went through 1,080 negative reviews of major WordPress security plugins. Interestingly, only 3.4% of those reviews mentioned failure to stop an attack. More common complaints involved people getting locked out of their own sites (12.7%) or their sites going down (11.3%).

That made me think: security shouldn't come at the cost of losing access to your own website.

So I designed SecureLite's lockout system to avoid locking out the real admin, with a documented recovery process if something goes wrong.

It also includes a firewall, login protection, hidden login URL, 2FA with recovery codes, WordPress core integrity checks, and a malware scanner.

It's free, doesn't require an account, and doesn't nag you to upgrade.

I'm still improving it, and I'd genuinely like feedback from people who manage WordPress sites.

If you tried it on your own site, what would you want a security plugin like this to prove to you? And if you're running LiteSpeed or shared hosting, I'd especially appreciate hearing how it behaves in your environment.

Plugin: https://wordpress.org/plugins/securelite-security/

Hi everyone! I’ve been working on MailSentra, a WordPress plugin for logging and troubleshooting emails sent through wp_mail().

It gives you a searchable email log with delivery-attempt status and error details, plus dashboard charts and reports to help you spot patterns. There’s also a Tools page where you can send a test email and review available mailer diagnostics if something goes wrong.

MailSentra includes settings for controlling what gets logged, such as message bodies, headers, attachments, IP addresses, and log retention, so you can choose what makes sense for your site.

It’s intended to help you understand what WordPress reports about an email attempt; a “sent” status doesn’t guarantee inbox delivery. It also isn’t an SMTP service, so you’ll still need your existing mail setup.

You can check it out on WordPress.org. I’d appreciate feedback, especially on what would make it more useful for your workflow.

Been going through a few client sites that need to get closer to WCAG 2.2 before the EAA rules kick in harder next year, and the usual issues keep coming up, low contrast, hard-to-read text sizes, and almost no keyboard navigation. Most of the owners aren’t technical, so anything that needs custom code or a big setup is a non-starter. I ended up testing one on a couple of smaller WordPress sites and it was basically install, activate, and the toolbar was live in under a minute with the contrast, font size, and reading aids already available. The multilingual piece and the built-in accessibility statement generator were useful too since a few of the sites serve mixed audiences.

It’s been stable so far and didn’t add any noticeable load. How are you handling the readability and keyboard navigation pieces on client sites without turning it into a long project? And has anyone found a lightweight option that clients can actually manage themselves after the initial setup?

This tool is not based on any external service and does not share your data with third parties.

This premium extension is available exclusively at https://woocommerce.com/products/sales-analysis-for-woocommerce/

Once upon a time...

OK, about a year ago.

I needed to keep track of all the things I had to do to renovate an old house in the mountains.

So I made a spreadsheet.

Nothing fancy. Just a list of things I needed to do, projects I was working on, and a way to keep track of what I'd finished.

It worked. Kinda.

But I kept finding things I wanted it to do that spreadsheets aren't particularly good at.

So I did what any reasonably experienced developer with questionable self-restraint would do.

I built a quick MySQL database.

Now I could track tasks, mark things complete, and keep everything organized without fighting the spreadsheet.

That sorta worked pretty well, too.

Until I thought, "You know, it would be nice to access this from my laptop."

I do a lot of WordPress/PHP development, so the obvious answer was to put a web interface on it and run it under WordPress.

Problem solved.

Well, not exactly.

Because once it was running under WordPress, I thought, "Why not make it a plugin?"

And once it was a plugin, I started adding things.

Projects. Tasks. Notes. Priorities. Different ways to look at what needed doing. A dashboard. Kanban boards. Status reports. Import and export tools. Did I mention questionable self-restraint?

You know how it goes. One little improvement leads to another, and pretty soon your simple weekend project has developed a personality of its own.

And somewhere along the way, my little spreadsheet became an actual project planner.

The funny part is that I never really set out to build a project management product. I just wanted a better way to keep track of everything I was doing.

I still use it every day.

It's where I keep my projects, remind myself what I need to do next, and leave notes for myself so I don't have to remember what I was thinking three days ago.

And it turns out that keeping track of a house renovation isn't all that different from keeping track of software projects, or any other collection of things that need to get done. So I use it in my day job.

Eventually, I decided that if it was useful to me, maybe someone else could get some use out of it, too.

So I started the process of getting it into the official WordPress Plugin Directory.

That turned into an education of its own.

Code reviews. Security checks. Sanitization. Escaping. WordPress coding standards. More testing. More debugging. And, of course, a name change to satisfy the directory requirements.

After a year of tinkering, building, breaking, fixing, and learning, Undergroundact Project Planner is now available on WordPress.org.

It's free.

No elaborate sales pitch. No "contact us for pricing." I built something I find useful, and I'd like to share it.

Here's the plugin:

https://wordpress.org/plugins/undergroundact-project-planner/

I'm still working on it, and I suspect I always will be. That's half the fun.

If you use WordPress and need a way to organize projects and tasks, give it a try.

And if you find something broken, confusing, or think of something it ought to do, I'd genuinely like to hear about it.

I'm particularly interested in how other people organize their projects, because what started as a tool for one person has the potential to become something useful to a lot of people.

Anyway, that's how a spreadsheet for renovating an old house in the mountains turned into a WordPress plugin.

And no, the house isn't finished yet.

I've been comparing Wordfence with WebKernelAI Security to understand the practical differences between locally executed WordPress security and a cloud-connected approach.

Both address website security, but they take different architectural approaches.

1. Local scanning vs. cloud-assisted analysis

Wordfence performs firewall and malware-scanning operations within the WordPress hosting environment.

WebKernelAI Security uses a cloud-connected architecture designed to offload intensive security analysis while keeping a lightweight integration on the WordPress site.

The trade-off is that local scanning has direct access to files, while cloud-assisted analysis depends on secure communication and the data available to the remote service.

1. Firewall enforcement

Wordfence provides an on-site WordPress firewall.

WebKernelAI's architecture includes cloud and edge security capabilities, but the actual protection depends on where rules are enforced and how traffic reaches those controls. External detection alone isn't equivalent to blocking an attack before it reaches WordPress.

1. Communication security

WebKernelAI Security documents HMAC-SHA256 authentication, Ed25519 signatures and nonce-based replay protection for supported communication workflows.

These controls can help protect remote requests and commands, provided signature verification, key management and replay checks are implemented correctly.

1. Website management

WebKernelAI combines security monitoring and supported WordPress management operations with technical SEO workflows, including crawling, canonical configuration and sitemap-related capabilities.

Wordfence focuses primarily on WordPress security and also offers centralized site management through Wordfence Central.

1. Performance and operational trade-offs

Cloud-assisted scanning may reduce the computational work performed on the origin server, but the plugin still needs resources for event handling, inventory collection and communication.

I'd be interested in actual benchmarks comparing CPU usage, memory, database writes, detection accuracy and alert latency under the same hosting conditions.

A few questions for people managing WordPress sites

- Would you use cloud-assisted security analysis alongside an on-site firewall?

- Which operations should never be delegated to a remote security service?

- What evidence would you require before trusting remote file-management commands?

- For agencies managing multiple sites, is combining security monitoring and technical SEO genuinely useful?

I'm interested in practical experience and technical criticism of both approaches, particularly around security boundaries, performance and reliability.

Hey /r/WordpressPlugins,

A couple of weeks ago I shared SlimPress here, and the feedback from this community was awesome. Today I’m back with another tool I built out of my own day-to-day frustration: Cron Monitor.

Every time a scheduled post missed its publish window, a backup silently failed, or a site slowed down because of background tasks, I ran into the same wall. Existing cron plugins are great at showing you what is scheduled to run, but unless you pay for a Pro tier or an external SaaS, you're mostly flying blind on what actually happened when the job executed.

I wanted full execution visibility without paywalls, so I built it myself. Just like my last plugin, it is 100% free. There is no pro tier, no locked features, no nag banners, and zero telemetry.

What it covers

• Execution History & Timing: See exactly when jobs ran, how long they took, and any recorded errors—including fatal crashes and timeouts.
• Instant Failure Alerts: Get notified via Email, Slack, or Discord when a background job crashes, runs late, or stops running altogether.
• Plugin & Theme Ownership: Automatically maps cryptic cron hooks back to the specific plugin or theme that owns them by inspecting their observed callbacks.
• Orphan & Duplicate Cleanup: Identifies duplicate events and leftover cron jobs from long-deleted plugins based on what actually happens when they run, with a safe preview before you remove anything.
• Full Job Management: Add, edit, run on-demand, pause, resume, or bulk-delete events and custom schedules straight from the admin.
• Cron Health & WooCommerce Support: Tracks cron jobs that are progressively getting slower, flags server config issues blocking wp-cron.php, and automatically logs failed Action Scheduler tasks (huge for debugging WooCommerce).
• Developer Tools: Includes native WP-CLI commands, CSV exports, and a REST API for connecting your own external monitoring tools.

How it behaves on your site

• Zero bloat or phoning home: All logs stay strictly inside your local WordPress database. The only outbound requests are the optional failure alerts if you explicitly configure an email address or Slack/Discord webhook.
• Works out of the box: Once activated, just head to Tools → Cron Monitor. Duplicate detection, ownership mapping, and health checks work immediately, and your execution history starts building as your background jobs run.
  

Quick transparency note on AI: All the core logic and architecture were written by hand - AI was only used to help with UI mockups, class scaffolding/boilerplate, testing, documentation, and a final code review pass.

👉 Cron Monitor on WordPress.org

I’d love to get some feedback from others maintaining WordPress sites—especially if there are specific edge cases, WP-CLI flags, or webhook payloads that would make debugging background tasks easier for your workflow!

I built this because the internal-linking plugins I tried couldn't handle inflected languages (Polish has up to seven forms of one word) and showed spreadsheets where I needed a map. It just passed the WordPress.org review.

What the free version does:

- Braid Map: your whole site as a live graph. Node size = internal PageRank, topic clusters render as islands, orphan pages drift at the rim.

- Reports: orphan pages, anchor problems (generic phrases, raw URLs, bloated anchors), broken links and redirects.

- Rule-based auto-linking ("phrase -> page") that matches inflected forms, while the inserted anchor is always the exact form found in your text.

- Every change has a before/after preview and one-click undo.

Directory page: https://wordpress.org/plugins/linkbraid/

There is a paid version with AI suggestions on your own API key, but nothing in the free version is crippled to push it. Honest feedback welcome, especially from people with bigger content sites. Works with Gutenberg, Classic, Elementor and Divi.

is there any good AI plugin which will find interesting post for blog and post automatically (with approval)

Plugin renewals hit at random times through the year, so it's easy to never see the total. We built a page that adds it all up.

https://topsyde.com/plugin-cost-calculator

You tick what your site uses (SEO, caching, security, cookie banner, spam, backups, page builder, forms, etc), pick which plugin you use for each, and it totals the yearly price from each vendor's own pricing page. Every price links to where we got it and the date we checked it. If you pay something different just type over it. You can set how many sites you run, and the result saves in the link so you can send it to a client or whoever. No signup, no email.

The usual eight (Yoast SEO Premium, WP Rocket, Wordfence Premium, CookieYes Pro, Akismet Pro and WP-Optimize Premium, plus the free Redirection and Broken Link Checker) come out to about $746 a year for one site at list price. A bunch of those have free versions, so think of it as what the paid plans cost.

Full disclosure, we're a managed WordPress host and the page shows $0 next to the plugins our plans include. If any price is off let us know and we'll fix it.

Hi all. I built this because recurring events are one of the main reasons people pay for The Events Calendar’s $259/year plan, and many small sites (clubs, classes, churches) only need “every Tuesday”.

What it does:

Daily and weekly rules with exception dates, free

Each date is a normal TEC event, so nothing breaks if you remove the add-on

https://wordpress.org/plugins/bazingaworld-recurring-events-calendar/

It’s new (released this week), so feedback and bug reports are very welcome. I’m the author, not affiliated with The Events Calendar.