Practical WordPress guidance drawn from the sites we actually run: core updates, plugin choices, hosting, performance, and the fixes that hold up over time.
A box that looks like a Cloudflare check asks a visitor to press a couple of keys to prove they are real. It is not real. It is malware living inside the website, and the owner had no idea it was there. Here is what it is and how to stay ahead of it.
I used to keep seven sets of font sizes on every site, one per Divi breakpoint, so a single design tweak meant editing the same number in seven places. One size that grows smoothly with the screen ended that. Here is how CSS clamp works and how I set it up.
I had clients still getting spam with Google reCAPTCHA installed and turned up to its strictest setting. Adding a honeypot to a Divi form did not finish the job either. Here is how reCAPTCHA, a plain honeypot and the WP Armor plugin compare, and what I run now instead.
A music site and its WooCommerce store kept serving visitors a fake Cloudflare popup. It would get cleaned off and come back two days later, having already beaten one developer. Malware that returns means the cause was never removed. Here is how we found where it was actually living.
Akismet’s free key stopped covering commercial sites, and every client site I manage counts as commercial. Paid starts at $9.95 a month for one site, which across thirty sites stops working fast. Here is why I moved to Antispam Bee, and what you give up by doing it.
Mobile is 59.6 percent of global web traffic and desktop is 38.8 percent, so designing on the 27 inch monitor in front of you has the priority backwards. There is no single screen size to design for. Here is the small set of widths that covers where your visitors really are.
Images are the heaviest thing a browser downloads, at 911 KB of the median 2.56 MB mobile page. Most of that weight is wasted on 4000 pixel photos dropped into 600 pixel slots. You need three numbers in your head, not a degree in compression. Here they are.
For the first time in over a decade, the question of whether WordPress is still worth it has a real debate behind it. Back in December 2025, WordPress powered 43.2% of all websites. By May 27, 2026, that number had dropped to 41.9%, according to W3Techs. Six months of steady decline is not a blip. It is a trend. So the honest version of “is WordPress worth it in 2026” is no longer an automatic yes. It depends on what you are trying to do, how much you want to own, and how comfortable you are with a tool that rewards effort instead of hiding it.
Child themes are what every WordPress course teaches, and in 2026 they are the wrong default for most sites. Here is why I reach for FluentSnippets instead, where Code Snippets hides CSS and JavaScript behind a $149 paywall, and the three cases that still genuinely call for a child theme.
Sephora paid $1.2 million in 2022 without being hacked and without losing a single credit card. Their cookie consent banner simply did not work properly. Here is the patchwork of privacy laws now in play, and what a small business actually has to get right to stay clear of it.
Feel free to follow us on social media for the latest news and more inspiration.