Growtoria

Growtoria makes done-for-you business spreadsheets, calculators and templates for small businesses, makers, freelancers, real estate...
Talence, FR
•
•Created byProfile pictureZak
10 joined
Home
ProductsReviews
Profile picture
ZakProfile picture@growtoria·5h

Web host Beget wiped by malware: how to check your own WordPress backup

BleepingComputer reports that Russian cloud and hosting provider Beget is rebuilding its cloud infrastructure from scratch after a data-wiping malware attack on the night of November 1st, in which the attacker reached the management layer of its whole architecture and ran data-zeroing scripts. According to Beget's own announcements cited in that report, all data in its cloud infrastructure, including VPS, S3 and Kubernetes, was lost along with CDN settings and IP configurations, VPS binary backups were completely lost, and VPS file backups only partly survived. BleepingComputer reports that more than a week later 60% of shared hosting and 40% of managed dedicated servers had been restored, and that Beget said "it is impossible to recover all data."


Are you affected?

  • Directly affected: customers hosted with Beget. BleepingComputer reports the company serves more than 200,000 customers, including online stores, media and educational services.

  • Beget VPS customers are worst hit: Beget said VPS binary backups were completely lost, and its November 6 assessment said VPS file backups would be available for only about half of its VPS users.

  • Not affected: sites on any other host. There is nothing here you need to patch, and nothing suggesting your own site was touched.

  • This was destruction, not theft. Beget said its investigation found no evidence the attacker tried to download or modify data on the compromised servers.


Check your site in a few minutes

  1. Find out where your backup actually lives. Log in to your hosting control panel and look for a "Backups" or "Backup & Restore" section. Note the date of the newest one and how far back the oldest one goes.

  2. Check your backup plugin in WordPress admin. For UpdraftPlus: Settings → UpdraftPlus Backups → Existing Backups. For Jetpack VaultPress Backup: Jetpack → Backup. Look at the date of the last successful run, not just that the plugin is active.

  3. Check whether any copy sits somewhere other than your host. In UpdraftPlus that is Settings → UpdraftPlus Backups → Settings → "Remote Storage". If nothing is selected, your backups are stored on the same server as your site.

  4. Open your newest backup file on your own computer and look inside. A full WordPress backup should include your database (a .sql file) plus wp-content. Tools → Export in WordPress admin only gives you posts and pages, not themes, plugins, images or settings.

  5. Write down who to contact if the host goes dark: your hosting login, your domain registrar login, and your host's status page URL. Beget's status page was how customers followed recovery.


What to do now

  • Download one complete backup to a place your host does not control, such as your own laptop plus a cloud drive you pay for. Beget's case shows that backups living beside the thing they protect can go down with it.

  • Set your backup tool to send future backups to remote storage automatically, and set the schedule to match how often your site changes. Daily is sensible for a shop taking orders.

  • Test a restore before you ever need one. Restore to a staging copy, never over your live site, and take a fresh backup first. A backup you have never restored is an assumption, not a safety net.

  • If your store is heading into a busy sales period, do this check in the quiet hours before traffic picks up, so a restore test cannot disrupt live orders.


Source: BleepingComputer:


Need a hand with it?

This is exactly what our WordPress Backup & Restore work covers: we set up backups that are stored away from your site, then prove they restore by rebuilding your site on a staging copy first. Fixed price, a backup taken before any change we make, a real developer rather than a bot, and a plain-English explanation of what we found. We never ask for a password by email. WordPress Backup & Restore: from $60, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Where does your site backup live right now: your host, a plugin, or you're honestly not sure? Vote in the poll.


#WordPress #Backup #WebsiteSecurity #SmallBusiness #BlackFriday #HostingOutage

Profile picture
ZakProfile picture@growtoria·1d

SonicWall SSL-VPN MFA bypass (CVE-2026-19868): how to check your firewall

SonicWall has released updates for seven SonicOS firewall vulnerabilities, including an SSL-VPN authentication bypass tracked as CVE-2026-19868, which BleepingComputer reports has a CVSS score of 7.1. According to the report, the flaw lets an attacker who already has valid credentials for an alternate login method bypass SAML authentication controls, potentially including SAML-enforced MFA, and it only affects SSL-VPN services configured to use SAML authentication. SonicWall said its PSIRT investigated a report of potential exploitation and strongly urged customers to upgrade as soon as possible; CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to secure affected systems by November 20, 2026.


Are you affected?

  • Affected: SonicOS Gen7 versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier, per BleepingComputer. SonicWall fixed the issues in 7.3.4-7013 and 8.2.3-8015.

  • The MFA bypass itself only applies where SSL-VPN is configured to use SAML authentication, according to the report. If your SSL-VPN does not use SAML, that specific flaw does not apply to you.

  • The same advisory also covers six other SonicOS issues, including two management interface flaws rated 8.8 that BleepingComputer reports allow unauthenticated attackers to perform unauthorized operations under specific conditions, pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service, and weak password hashing on virtual appliances. So firmware still matters even without SAML.

  • Not affected: sites with no SonicWall device in front of them. If your WordPress or WooCommerce site sits on a plain VPS or shared hosting with no SonicWall firewall, there is nothing for you to do here.


Check your site in a few minutes

  1. Find out if you actually have one. Ask whoever set up your network or your IT provider whether a SonicWall firewall sits in front of your office or your server, and whether staff use its SSL-VPN to get in. Many small businesses on a VPS do not.

  2. Log in to the SonicOS management interface and note the firmware version shown on the dashboard. Compare it to the affected builds above: Gen7 7.3.3-7015 or earlier, Gen8 8.2.2-8015 or earlier.

  3. Check whether SSL-VPN is switched on at all, and if it is, whether its authentication is set to SAML (sometimes labelled SSO or an identity provider such as Entra ID or Okta). That combination is the one BleepingComputer describes as affected.

  4. Look at your recent SSL-VPN login records and confirm the accounts and times match people you expect to see. This is just a normal sanity check, not a sign anything has gone wrong.

  5. Make a short list of who can reach the firewall's management interface, and from where. Narrower is better, and it is useful information to have before any update.


What to do now

  • Before you change firmware, export and save a copy of the firewall configuration, and write down the version you are on now. If an update needs to be rolled back, you will want both.

  • Plan the upgrade to SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). BleepingComputer reports SonicWall says no workarounds are available, so updating is the fix, and SonicWall urged customers to upgrade as soon as possible.

  • Pick a quiet window and tell staff. A firewall update drops VPN sessions while it reboots, so avoid doing it during a busy sales period or a shipping cut-off.

  • After the update, confirm the version has changed, then have one person test an SSL-VPN login before you tell the whole team it is done. CISA's deadline of November 20, 2026 applies to federal agencies, but it is a reasonable marker for your own planning.


Source: BleepingComputer:


Need a hand with it?

Our Server Management work covers exactly this kind of job on Linux and VPS setups: we confirm what you are running, take a backup before any change, test on a staging copy first where that is possible, and give you a plain-English explanation of the cause and what we did. It is a fixed price, you deal with a real developer rather than a bot, and we never ask for a password by email. Server Management (Linux / VPS): from $160, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Is there a SonicWall SSL-VPN in front of your server or office, and do you know if it uses SAML? Vote in the poll.


#VPS #Linux #SysAdmin #WebHosting #BlackFriday #SonicWall

Profile picture
ZakProfile picture@growtoria·2d

Google AI Mode checkout opens in Canada: how to check your product feed

Search Engine Journal reports that Google is expanding direct checkout powered by the Universal Commerce Protocol (UCP) to shoppers in Canada, inside AI Mode in Google Search and the Gemini app. According to the article, Sabrina Geremia, Vice President and Country Managing Director at Google Canada, announced the rollout on November 4, 2026, starting with four partners and merchant groups: lululemon, select Shopify merchants, Shoppers Drug Mart and Simons. Google also said that starting next year it will make simplified UCP integration available directly inside Merchant Center, so retailers can enable direct checkout from their own accounts.


Are you affected?

  • Affected now: the four launch partners and merchant groups named by Google, selling to shoppers in Canada. Shoppers pay with Google Pay using details saved in Google Wallet, and Google says the retailer stays the seller of record.

  • Not affected now: everyone else, including WordPress and WooCommerce stores. Search Engine Journal notes Google has not disclosed eligibility criteria or onboarding steps for Canadian retailers outside the initial launch group, and no release date for the Merchant Center integration.

  • Worth your attention: any store that sends a product feed to Google Merchant Center. Google's generative AI optimization guide states that generative AI responses can include product listings and product information where appropriate, so feed quality is the groundwork for later.

  • Shopify owners selling into Canada: Shopify's Mani Fazeli says merchants can be bought from directly with zero extra work, but Google specifies the initial checkout access is limited to select Shopify merchants.


Check your site in a few minutes

  1. Find out whether you send a feed to Google at all. Log in to Google Merchant Center and open Products, then All products. An empty or missing list means your products are not in Google's shopping data yet.

  2. In Merchant Center, look at the Products section for items flagged as needing attention or disapproved. These are the listings Google is not showing.

  3. Spot-check three products. Put the Merchant Center title, description, price and availability next to the live product page on your site. Prices and stock that drifted apart are the most common problem.

  4. In WordPress, go to Plugins, then Installed Plugins, and note which feed plugin you use (for example Google Listings & Ads or a feed exporter). Just read the list, no changes needed.

  5. If you sell into Canada, search for one of your own products in AI Mode and in the Gemini app and see how it appears. Search Engine Journal suggests this test for Shopify stores in the launch window.


What to do now

  • Clean up feed data at the source, on your product pages, rather than in the feed file. Take a backup of the site and database before editing products or plugin settings, so you can roll back.

  • There is nothing to switch on today. Google has not given a date for the simplified UCP integration in Merchant Center, so put a note in your calendar for the new year instead of changing anything now.

  • Loop in whoever handles your orders, invoices and tax. Search Engine Journal advises reviewing how Google Pay transactions and Google Wallet shipping details would fit your existing order and tax process, and how returns would be handled, before enabling direct checkout later.

  • Plan holiday promotions without relying on loyalty rewards in this flow. Google says support for things like loyalty rewards is coming in the following months, not at launch.


Source: Search Engine Journal:


Need a hand with it?

If your WooCommerce product data, feed plugin or price and stock sync is out of step with Google, we fix it as a Website Edit at a fixed price, tested on a staging copy of your site first and with a backup taken before any change. You get a plain-English explanation of what caused it from a real developer, and we never ask for a password by email. Website Edits: from $90, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Do you send a product feed to Google Merchant Center right now? Vote in the poll.


#WordPress #SmallBusiness #WebDevelopment #WordPressTips #BlackFriday #GoogleAIMode

Profile picture
ZakProfile picture@growtoria·3d

WooCommerce 11.2.2 and 11.3.1 ship security fixes: how to check your store

On 6 November 2026, Darren Ethier published a post on the WooCommerce Developer Blog explaining why so many security updates have shipped since June. According to that post, AI tools have made vulnerabilities much easier to find, and WooCommerce is now running its own automated scans: deep scans in August flagged roughly 700 potential issues, and an October enrolment in Anthropic's OSS Scanner program flagged roughly 200 findings across enrolled projects, with about 90% deemed valid within the platform software after triage. Those fixes are shipping in WooCommerce 11.2.2 and 11.3.1, and the post says security fixes now get their own dedicated patch releases by default.


Are you affected?

  • Anyone running a WooCommerce store: the post asks merchants and agencies to keep WooCommerce, extensions and WordPress up to date, and to check the installed version after a security update even if auto-updates are on.

  • Stores on old PHP: WooCommerce 11.3 adds an admin notice for stores on PHP 7.4 and 8.0, 11.5 is the last release supporting them, and 11.6 (February 2027) requires PHP 8.1 or newer, with 8.3 or newer recommended. The post says about 9% of tracked stores run 7.4 or 8.0.

  • Stores not connected to WooCommerce.com: from WooCommerce 11.2, WooCommerce.com can mark an extension's security release as required, and connected stores with an active subscription install it on their next update check, usually within a day, even if auto-updates are off. Stores without that connection don't get fixes pushed to them.

  • Not an emergency for most: the post says about three quarters of the valid issues tracked in WooCommerce core since July are Medium or Low severity. Stores on Automattic hosting (VIP, Pressable, WordPress.com) were already covered for the October PHP release.


Check your site in a few minutes

  1. Check your PHP version: WordPress admin > Tools > Site Health > Info > Server. The post notes PHP versions before 8.2 no longer get security updates from the PHP project.

  2. Check your WooCommerce version: Plugins > Installed Plugins, and look at the version next to WooCommerce. The post says to check the installed version after a security update even if automatic updates are turned on.

  3. Check your WooCommerce.com connection and whether your extension subscriptions are still active, since that is how required security fixes reach a store on their own.

  4. Check every site you manage, not just the main one, including any publicly reachable staging or development copy. The post puts it plainly: one updated site tells you nothing about the others.

  5. Ask your host, in writing, whether they have applied the latest PHP security releases to your server.


What to do now

  • Take a full backup (files and database) before you update anything, so you can put the site back exactly as it was if a plugin misbehaves.

  • Update WordPress, WooCommerce and your extensions, then reload the Plugins page and confirm the new version numbers are actually installed.

  • Keep your store connected to WooCommerce.com with active subscriptions, and buy extensions through the WooCommerce Marketplace, so security fixes can reach you without you noticing them first.

  • If you are on PHP 7.4 or 8.0, plan a move to PHP 8.3 or newer with your host. Test it on a copy of the site first, because old plugins and themes can break on a newer PHP.


Source: WooCommerce Developer Blog:

Source: Wordfence:


Need a hand with it?

If you would rather not click Update and hope, our WordPress Maintenance work is a fixed price: we test the updates and any PHP move on a staging copy of your site first, and we take a backup before we change anything. A real developer does the work, not a bot, and you get a plain-English explanation of what was wrong and what we changed. Monthly care plans are there if you want this handled every month instead. WordPress Maintenance: from $45, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

What PHP version is your store running right now? Vote in the poll.


#WooCommerce #WebsiteSecurity #WordPress #SmallBusiness #BlackFriday #PHPVersionCheck

Profile picture
ZakProfile picture@growtoria·4d

WordPress core 'Upgrade Window' flaw: Wordfence sees probing — how to check your site

Wordfence reports that attackers are actively probing WordPress sites for a remote code execution vulnerability in WordPress core that it calls "Upgrade Window". Remote code execution means a flaw that could let someone run their own code on your server, which is why core flaws get this much attention. Probing means automated scanning for sites that might be vulnerable — it is not a sign that any particular site has been broken into.


Are you affected?

  • This is about WordPress core, the WordPress software itself, not one plugin or theme — so it is worth a look even on a simple brochure site.

  • Sites where core updates have been sitting unapplied are the ones to check first. Sites kept on the current release are in the better position.

  • Not affected: anything that is not WordPress — Shopify, Wix, Squarespace, or a plain HTML site.

  • Scanning like this is broad and automated, so a small local business site gets looked at the same as a large one. Wordfence's own post carries the exact version numbers and their full recommendation — read it before you change anything.


Check your site in a few minutes

  1. Log in and open Dashboard → Updates. The top of that screen tells you which WordPress version you are running and whether a newer one is waiting.

  2. Dashboard → Home shows an "At a Glance" box with your WordPress version and active theme — the fastest way to see where you stand.

  3. Still on Dashboard → Updates, read the line under the version box. It says whether this site updates automatically for all new versions, or only for maintenance releases.

  4. Open Users → All Users and scan for any administrator account you do not recognise. Good housekeeping at any time, not just this week.

  5. Confirm you have a backup you could actually restore. Check your backup plugin's log, or ask your host where their backups live and how far back they go.


What to do now

  • Take a backup first — files and database — before you update anything. If a plugin clashes with the new core version, the backup is what saves your afternoon.

  • Update WordPress core from Dashboard → Updates. On a shop or a site that brings in leads, test the update on a staging copy before touching the live one.

  • Then update plugins and themes in small batches, loading your homepage and checkout after each batch so you know which one caused any wobble.

  • Read Wordfence's post for the exact affected versions and their own advice. They found the activity, so they are the source to follow on this.


Source: Wordfence:


Need a hand with it?

If updating core makes you nervous, or the last update broke something and you have been avoiding it since, our WordPress Maintenance work covers exactly this: we take a backup, test the update on a staging copy first, then explain in plain English what the cause was. A real developer does the work, not a bot, and we never ask for a password by email. WordPress Maintenance: from $45, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

When did you last update WordPress core on your site? Vote in the poll.


#WordPress #WebsiteSecurity #WebsiteMaintenance #SmallBusiness #BlackFriday #WordPressCoreUpdate

Profile picture
ZakProfile picture@growtoria·5d

WooCommerce 11.2.2 and WooPayments security updates: how to check your store

On November 4, 2026, the WooCommerce Developer Blog published the release notes for WooCommerce 11.2.2, described as a security release with multiple security updates, and said "we strongly recommend updating as soon as possible." The same blog posted a separate advisory on November 3, 2026 about a security update for WooPayments, which addresses a security issue in the subscriptions functionality bundled with WooPayments and extends a fix announced in August. According to the release notes, 11.2.2 also includes a database update, listed as hardening of Store API and REST API handling, CSV import validation and admin endpoints.


Are you affected?

  • Stores running a WooCommerce version older than 11.2.2 — the release notes mark this as a security update with a database update.

  • Stores running WooPayments: the advisory lists a fixed version for each release line (for example 11.2.0 is fixed in 11.2.1, 10.9.0 in 10.9.1, 9.0.0 in 9.0.1, and anything older than 9.0.0 goes to 11.2.1).

  • WooCommerce says to check the installed version even if automatic updates are enabled or your host manages updates for you, and that a store already on a fixed version does not need to repeat the update.

  • Not affected: WordPress sites with no WooCommerce or no WooPayments installed. If you manage several sites, WooCommerce notes that a completed update on one site does not confirm the status of another, including publicly accessible staging and development sites.


Check your site in a few minutes

  1. In WP Admin, go to Plugins → Installed Plugins. Find WooCommerce and note the installed version number next to it.

  2. In the same list, find WooPayments and note its installed version, then compare it with the fixed version for that release line in the WooCommerce advisory table.

  3. Do this even if auto-updates are on or your host handles updates — WooCommerce specifically asks you to confirm the version yourself.

  4. If you look after more than one site, check each one and write down the versions you have confirmed, as WooCommerce recommends, so you can follow up on the rest.

  5. If your store is run by a host or another developer, ask them to confirm the installed WooPayments version.


What to do now

  • Take a full backup of files and database before updating anything, so you have a way back if something behaves oddly.

  • Update WooCommerce to 11.2.2 and WooPayments to the fixed version for your line, then re-check Plugins → Installed Plugins to confirm the new numbers. The release notes say 11.2.2 includes a database update, so allow WooCommerce to finish any update routine it prompts for.

  • Afterwards, place one small test order yourself. The release notes explain that Store API checkout now stops if the order fails to save, and that if an extension's callback on woocommerce_before_order_object_save, woocommerce_new_order or woocommerce_update_order throws during Store API checkout, checkout now returns a 500 error instead of carrying on with a partially saved order.

  • If you have integrations that talk to your store, note that two wc-admin connection endpoints (onboarding/plugins/jetpack-authorization-url and plugins/connect-jetpack) now need a logged-in administrator session and a wp_rest nonce; the notes say requests using REST API keys, WP-CLI or application passwords get a 403. If the update is unavailable or fails, WooCommerce asks you to contact WooCommerce Support with your installed version and any error shown.


Source: WooCommerce Developer Blog:

Source: WooCommerce Developer Blog:


Need a hand with it?

If you would rather not touch a live shop yourself, this is exactly what our WordPress Maintenance work covers: we take a backup first, test the updates on a staging copy, then apply them to your live store and check that checkout still works. A real developer does it, not a bot, and you get a plain-English explanation of what changed. We never ask for a password by email. WordPress Maintenance: from $45, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Have you checked which WooCommerce and WooPayments versions your store is on? Vote in the poll.


#WooCommerce #WebsiteSecurity #WordPress #SmallBusiness #BlackFriday #WooPayments

Profile picture
ZakProfile picture@growtoria·6d

CISA flags a WordPress core flaw as actively exploited: how to check your site

BleepingComputer reports that CISA has confirmed attackers are now exploiting CVE-2026-119977, a high-severity flaw in WordPress Core, and has added it to its Known Exploited Vulnerabilities catalog. The WordPress security team patched it in WordPress 7.1.4 on October 28, describing it as a weakness in the WordPress upgrade process that can lead to remote code execution during the upgrade window, and saying "because this is a security release, it is recommended that you update your sites immediately." Wordfence said in an advisory update over the weekend that it "blocked 13,095 attacks targeting this vulnerability in the past 24 hours."


Are you affected?

  • Sites still running a WordPress Core version older than 7.1.4 — this is WordPress itself, not a single plugin, so it applies whatever theme or plugins you use.

  • Sites already on WordPress 7.1.4 or newer have the fix. If your dashboard shows 7.1.4+, you are patched for this one.

  • Per BleepingComputer, CISA's Friday deadline under BOD 26-04 legally binds US federal agencies only, but CISA urged all network defenders, including the private sector, to prioritise patching.

  • The flaw was reported by Picus Security researcher Umut Bayram and is described as unauthenticated — no login needed — but exploited in high-complexity attacks, per the article.


Check your site in a few minutes

  1. Log in to wp-admin and go to Dashboard → Updates. The top line tells you which version you are running and whether an update is waiting.

  2. Or go to Tools → Site Health → Info → WordPress and read the version number there. Anything below 7.1.4 is not yet patched for this issue.

  3. On the same Dashboard → Updates screen, look for the automatic updates line. It will say whether your site installs new WordPress versions on its own or waits for you.

  4. Check who has access under Users → All Users. Set anyone who does not need full control to a lower role than Administrator — good practice regardless of this news.

  5. If a hosting dashboard manages updates for you (look for a "WordPress" or "Manage site" panel), check the version shown there too — it sometimes differs from what you expect.


What to do now

  • Take a full backup first — files and database — and make sure you can download a copy, not just see it listed in a panel.

  • Update WordPress Core to 7.1.4 or newer from Dashboard → Updates. The WordPress security team's own advice for this release was to update immediately.

  • Because the reported weakness sits in the upgrade process itself, run the update deliberately in one sitting rather than starting it and walking away mid-way.

  • After updating, load your homepage, a product or service page and your checkout or contact form while logged out, to confirm nothing visual or functional broke.


Source: BleepingComputer:


Need a hand with it?

If your site is heavily customised, runs WooCommerce, or has stalled on updates for a while, we do the core update for you at a fixed price: tested on a staging copy first, with a backup taken before any change. A real developer handles it, not a bot, and you get a plain-English explanation of what was wrong and what we changed. We never ask for a password by email. WordPress Maintenance: from $45, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Which WordPress version does your site show under Dashboard → Updates? Vote in the poll.


#WordPress #WebsiteSecurity #WebsiteMaintenance #SmallBusiness #BlackFriday #WordPress714

Profile picture
ZakProfile picture@growtoria·Nov 3

NEEDS SOURCE: title must name the affected software and what Wordfence reported

NEEDS SOURCE: 2-3 sentences summarising the Wordfence report, with attribution ('Wordfence reports...') and only the CVE IDs, versions and scores printed in the post.


Are you affected?

  • NEEDS SOURCE: affected software and exact version range, as stated by Wordfence

  • NEEDS SOURCE: patched version, and who is already safe

  • NEEDS SOURCE: who is not affected (e.g. setups without the component involved)


Check your site in a few minutes

  1. Open your WordPress dashboard and go to Dashboard → Updates. Anything listed as 'Update available' tells you at a glance whether your site is behind.

  2. Go to Plugins → Installed Plugins and read the version number next to each plugin. Compare it with the patched version named in the Wordfence post.

  3. Go to Tools → Site Health → Info → Server. That panel shows your PHP version and web server software, which is what tells you whether a server-level issue applies to you.

  4. On a VPS, ask your host (or check your control panel) which web server you run and when it was last updated. You do not need to log in over SSH to find this out.

  5. NEEDS SOURCE: the one check specific to this issue, using the indicator Wordfence names


What to do now

  • Take a full backup first — files and database — and keep a copy somewhere other than the server itself. Do this before any update, even a small one.

  • NEEDS SOURCE: the specific update or version to move to, as recommended by Wordfence

  • If you can, apply the update on a staging copy first, click through your key pages (checkout, contact form, login) and only then repeat it on the live site.

  • If the fix is at server level rather than inside WordPress, send the Wordfence post to your host and ask whether your server has already been patched.


Source: Wordfence:


Need a hand with it?

If the fix turns out to be on the server rather than inside WordPress, our Server Management work covers exactly that: a fixed price, tested on a staging copy first, and a backup taken before any change is made. You get a plain-English explanation of the cause from a real developer, not a bot, and we never ask for a password by email. Server Management (Linux / VPS): from $160, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Which host is your site on, and have they told you anything about this yet? Vote in the poll.


#VPS #Linux #SysAdmin #WebHosting #SmallBusinessSaturday #NEEDSSOURCE

Profile picture
ZakProfile picture@growtoria·Nov 2

WooCommerce 11.3 arrives week of Nov 9: how to check your store first

The WooCommerce Developer Blog says WooCommerce 11.3 is scheduled for the week of November 9, 2026, and the first beta is already out for testing. Brian Coords describes it as a big one, with 1,310 commits and 117 contributors so far: more styling controls for product blocks, an On-Sale Badge that can show the amount or percentage saved, and smoother mobile swiping in the Product Gallery. A separate advisory on October 27 explains a new filter extensions can use so bundled items stop making a product button say "1 in cart" when the shopper never added it on its own.


Are you affected?

  • Stores running a block theme with Product Collection or Product Filters blocks: the blog says Product Collection now uses the same filtering engine as Product Filters for URL filters, so filtered category pages are worth a look after updating.

  • Stores using bundles, composite products, mix and match, force sells, chained products or "frequently bought together": per the October 27 advisory, the "N in cart" count will leave out items an extension declares as children. The post says nothing breaks if the extension doesn't adopt the new filter.

  • Stores with custom code or a connected app calling the products REST API: WooCommerce reports that on_sale combined with include or exclude now behaves differently, and recommends re-testing those requests.

  • Not affected in any special way: an ordinary store on a classic theme with no custom product queries. For most owners this is a normal plugin update, not an emergency.


Check your site in a few minutes

  1. See which version you're on: Plugins → Installed Plugins, find WooCommerce and read the version number under the name. Dashboard → Updates shows what's waiting.

  2. Find out if you're on a block theme (the newer editing style WooCommerce mentions): Appearance → Editor exists on a block theme. Older classic themes show Appearance → Customize instead.

  3. If you have a sale running, open a category page and a product page and check prices, the sale badge and the Add to Cart button all look right today. That gives you a "before" picture to compare against after you update.

  4. If you sell bundles or kits, add the bundle to the cart, then look at the button on one of the products it brought in. The advisory says if it reads "1 in cart", that extension is the one that should adopt the new filter.

  5. Check your backups are actually running and that you know how to restore one, before any update.


What to do now

  • Take a backup first, and keep it somewhere you can reach it if the site is down.

  • Don't rush. The release is scheduled for the week of November 9, so there's time to let it land, then update WooCommerce and your extensions together on a quiet day.

  • If you have custom code or paid extensions, test the beta on a copy of the site, not the live one. WooCommerce says to use the Beta Tester plugin on a non-production site running WordPress 6.8 or newer, and to update that plugin first.

  • If your store is mid-sale and you'd rather not touch anything, that's a reasonable call: write the update down and do it once the sale ends.


Source: WooCommerce Developer Blog:

Source: WooCommerce Developer Blog:


Need a hand with it?

We handle this update for you on a staging copy of your site first, take a backup before any change, and only push it live once the product pages, cart and checkout still work. Fixed price, a real developer rather than a bot, and a plain-English explanation of anything we had to fix. We never ask for a password by email. WordPress Maintenance: from $45, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Are you updating WooCommerce before Black Friday, or waiting until it's over? Vote in the poll.


#WooCommerce #WordPress #WebsiteMaintenance #SmallBusiness #BlackFriday #WooCommerce113

Profile picture
ZakProfile picture@growtoria·Nov 1

WordPress security release fixes a code execution flaw: how to check your site

Wordfence reports that WordPress has published a security release fixing a remote code execution issue in WordPress core — in plain English, a flaw that could let someone run their own code on a site. Wordfence has also posted a follow-up on the "php2shell" issue, saying there are still no confirmed WordPress compromises and answering the questions they are hearing most. Because the fix is in WordPress core rather than a single plugin, it is worth a two-minute check on any site you own.


Are you affected?

  • Any WordPress site still running a core version older than the current security release — this is core, not one plugin, so it is worth checking even on a small brochure site.

  • Sites left on WordPress's default setting for minor and security releases have most likely updated themselves already. Confirm it rather than assume it.

  • Sites where core auto-updates were switched off, or where a host or agency controls updates on its own schedule, are the ones most likely still waiting.

  • Being behind on updates is not the same as being affected. Wordfence reports there are still no confirmed WordPress compromises connected to php2shell.


Check your site in a few minutes

  1. Log in and go to Dashboard > Updates. It either says you have the latest version of WordPress, or it offers you an update — that one line answers the main question.

  2. On the same Dashboard > Updates screen, read the line about automatic updates. It tells you whether this site keeps itself up to date or whether someone has to do it by hand.

  3. Go to Tools > Site Health. The Status tab flags an out-of-date core, and the Info tab under "WordPress" shows the exact version you are running.

  4. In Tools > Site Health > Info > Server, note your PHP version. PHP is the language WordPress runs on, and it is useful to know before any update.

  5. If your hosting control panel has its own WordPress or updates section, look there too. A host setting can override what you choose inside WordPress.


What to do now

  • Take a full backup first — files and database — and check you can actually download it. Do this before any update, not after.

  • Update WordPress core from Dashboard > Updates. If your site takes orders or bookings, test the update on a staging copy first, then apply it to live.

  • Turn automatic updates back on for maintenance and security releases if they are off, so the next one does not need you.

  • While you are in there, update plugins and themes and delete the ones you no longer use. Fewer moving parts means fewer things to keep patched.


Source: Wordfence:

Source: Wordfence:


Need a hand with it?

If you would rather not touch it yourself, this is exactly what our WordPress Maintenance work covers: we take a backup, test the update on a staging copy, then apply it to your live site for a fixed price. A real developer does the work, not a bot, you get a plain-English explanation of the cause, and we never ask for a password by email. WordPress Maintenance: from $45, fixed price.

👉 Message us on WhatsApp with your site and what you see. We check it and send a fixed-price quote, no obligation:

Service details:


Your turn 👇

Did your site take this WordPress update on its own, or did you do it by hand? Vote in the poll.


#WordPress #WebsiteSecurity #WebsiteMaintenance #SmallBusiness #BlackFriday #WordPressSecurityRelease