Rezwan Shiblu
Forum Replies Created
-
Forum: Fixing WordPress
In reply to: updates to WP post navigation?Yes, this changed in WordPress 6.9. If posts share the exact same published date and time, WordPress now uses the post ID to decide which one comes next. Before 6.9 it only looked at the date, so same time posts got skipped. Dev note here:
Adjacent Post Navigation Changes in WordPress 6.9 and Compatibility Issues
So before changing 50 sites, check the published dates on those gallery posts. If a batch of them all have the same date and time, which is common with bulk imports, the order inside that batch is now set by post ID and can come out opposite to what you saw before.
Forum: Fixing WordPress
In reply to: WP JSON 401 errorsGlad you found it. That explains the 401s. If the plugin was blocking the REST API for logged out visitors, every one of those requests would get refused.
The thing is, they still had to load WordPress first before getting blocked, so the CPU cost stayed the same. With the attack traffic on top, blocking or rate limiting /wp-json/ at your CDN or server level would help more, since it stops them before PHP runs.
You can mark the topic resolved once things settle.
Good to hear the delivery side is sorted.
That message only means the send came back as failed, it doesn’t say why. The actual reason will be in the FluentSMTP email log, since that test email goes out through wp_mail the same way your order emails do. Send it once more, then open the log and look at the failed entry, it should show the error returned by the server.
One thing worth checking while you’re there is the From address on the email you’re testing. Now that everything goes through Gmail, that account can only send as an address it’s been set up to send as, so if any of your WooCommerce emails still use the old jorjmart.com addresses, those sends can fail while the rest keep working fine.
WooCommerce records failed attempts too, under WooCommerce > Status > Logs with the source transactional-emails, so you can cross check there if the FluentSMTP entry isn’t clear.
The recipient field in both of your log entries shows as “msrahman” with no domain attached, so that isn’t a complete email address. That’s worth checking first, since WooCommerce sends those two emails to whatever address is stored on the customer’s user account, not to the address you used for the FluentSMTP test.
Open the FluentSMTP email log, find those two messages, and look at the actual To address on each one. If it’s different from the Gmail address you’ve been watching, that explains why the SMTP server returns OK and the logs say sent but nothing shows up.
If the To address does turn out to be correct, compare the headers of one of those emails against one of the test emails that arrived. That will show whether both actually went out through the same connection, or whether your snippet is changing something along the way.
Forum: Plugins
In reply to: [Two Factor] Issue with autofill by using internal OTP of a Password ManagerThe screen you land on first is whichever method is set as primary in your profile, and the link under it switches you to TOTP. So if your primary is email codes or backup codes, the code your password manager fills in will come back invalid no matter how fast it happens. That would explain why the same code works once you click through to the TOTP screen.
Check Users > Your Profile, scroll to Two-Factor Options, and see which method is set as primary. If it isn’t the authenticator app, switch it and save.
If TOTP is already your primary and it still fails the first time, worth reporting here: https://github.com/WordPress/two-factor/issues
Forum: Fixing WordPress
In reply to: WP JSON 401 errorsThose 401s mean the requests are already being refused, so nothing is getting through. The CPU hit is just the volume, since each one still loads WordPress before it gets rejected. The IPs are all different too, so blocking them one by one won’t help much. Rate limiting or blocking /wp-json/ at the server or CDN level, before PHP runs, is what actually brings the load down.
One thing worth checking, a logged out request to /wp-json/wp/v2/posts/123 on a published post normally returns 200, not 401. Do you have a security plugin or a host firewall rule that restricts the REST API for logged out visitors? That would explain the 401 and tell you where to add the rate limiting.
That CSS file is part of WordPress core, not something Classic Editor ships, so the rule you found is coming from 7.0.x itself. Classic Editor just opens the same media modal core does.
Since it was reproduced on a clean 7.0.2 install in that other thread, it looks more like a core regression than a plugin bug. A quick way to confirm on your end, deactivate Classic Editor for a minute and open the media modal from an image or gallery block in the block editor. If the bottom selection bar is broken there too, Classic Editor isn’t the cause.
If it turns out to be core, reporting it at https://core.trac.wordpress.org/ with your steps and screenshots is probably the fastest route, since that’s where a CSS fix would have to land anyway.
Forum: Plugins
In reply to: [Gutenberg] Latest version of GutenbergThat notice comes from the “Tested up to” value in the plugin’s readme, nothing more. Gutenberg currently lists 7.0.5 there, so anyone running 7.1 sees it flagged as not tested. It doesn’t mean a problem has been found, just that the header hasn’t been bumped to match. Take a backup first and update at a time when you can click around and check things over.
Forum: Everything else WordPress
In reply to: Security Email AlertsCore security fixes get announced on the news blog the same day the release goes out, so that feed isn’t sitting behind the patch. 6.8.3 is a decent example, released and posted on September 30.
The vulnerability databases also track plugin and theme issues, and that’s most of what lands in them, so there’d be a lot to sort through before you hit anything about a core release.
Forum: Everything else WordPress
In reply to: Security Email AlertsBlogtrottr does exactly that. Paste the feed URL, choose real time delivery, and it emails you each new item – https://blogtrottr.com
Feedrabbit is the same idea but it caps the number of feeds: https://feedrabbit.com
If you would rather not depend on a third party, rss2email is a small Python tool you can run from cron on your own box: https://github.com/rss2email/rss2email
Either way, point it at https://wordpress.org/news/category/security/feed/ . That category is low volume, so you should only hear from it when something security related is actually published.
- This reply was modified 1 month, 1 week ago by Rezwan Shiblu.
Forum: Everything else WordPress
In reply to: Security Email AlertsThere’s no official WordPress mailing list that only sends security alerts, as far as I know.
The closest official source is the security category on the news blog:
https://wordpress.org/news/category/security/The other thing that actually arrives as email is the auto update notice from your own site. Security fixes ship as minor releases and those auto update by default, so WordPress mails the admin address once it runs.
Forum: Fixing WordPress
In reply to: Are flat Destination and Location URLs worth the custom routing?I am glad that the responses are helpful to you.
Thank you.
Forum: Plugins
In reply to: [WooCommerce] Shopfront, double scroll lines on all pages except home.Since Twenty Twenty-Five is fine and turning off the plugins didn’t change anything, that points to the theme side rather than WooCommerce itself. Two things worth ruling out first: anything sitting under Appearance > Customize > Additional CSS, and whether you’re on a Storefront child theme. Both of those stay active when plugins are off, but they get dropped the moment you switch to a different theme, so they’d fit what you’re seeing.
If that turns up nothing, right click one of the affected pages, pick Inspect, and hover through the elements until you find the one with its own scrollbar. It’s usually a wrapper with a height and an overflow value on it. Once you know which element owns that second bar, the mouse wheel behaviour on the cart should make more sense too, since the wheel scrolls whichever container the cursor happens to be over.
If it does come back to the theme, Storefront has its own support forum and that would be the better place to take it: https://wordpress.org/support/theme/storefront/
Forum: Fixing WordPress
In reply to: Are flat Destination and Location URLs worth the custom routing?I would derive them, but not only from the rules array. Most plugin roots come from post types and taxonomies, so looping over get_post_types and get_taxonomies and reading the rewrite slug and archive slug gives you those without any regex. For rules added with add_rewrite_rule, read them with $wp_rewrite->wp_rewrite_rules() and only take the first segment when the pattern starts with a plain string. Patterns starting with a group are the catch all page and post rules, so there is no root to take. Rebuild the list on the rewrite_rules_array filter so it stays current after a flush.
https://developer.wordpress.org/reference/hooks/rewrite_rules_array/
Plugins that hook parse_request directly never register a rule, so those stay site specific. A filter on your reserved list lets you add them by hand.
One last thing. The save time check only covers new content. A plugin added later can claim a root a Destination already uses, so a small health check that rebuilds the list and reports any clash is worth having.
Forum: Fixing WordPress
In reply to: Create video embedded posts in bulkWhat’s happening when you run it, do the posts get created with the URL sitting there as plain text or a link, or does the content come out empty?
Asking because WordPress only auto embeds a URL if it’s on its own line and isn’t already wrapped in a link. So if the tool lets you set post content per row, putting just the YouTube URL in there, nothing else on that line, should give you the player on the front end. If a tool only takes titles and has no content field, there’s nothing for WordPress to embed, which would explain what you’re seeing.
This page covers how the auto embed part works, might be worth comparing against what your generated posts actually contain: https://wordpress.org/documentation/article/embeds/