We clean up hacked WordPress sites for our clients and since July we've been fighting the same malware family over and over. It calls itself "SC" in its own files. If you've ever had a site get hacked again right after it was cleaned, some of this might sound familiar.

The weirdest one was a browser tab. We'd done a full cleanup, and then the malware plugin got uploaded again from a real admin's computer, logged in as that admin. We were about to tell the client their laptop was infected. It wasn't. That admin still had a tab open on the site from back when it was hacked, and the bad code in that tab was still running. Every minute it checked whether an admin was logged in, and as soon as one was, it uploaded itself again. They closed the tab and that was the end of it.

So now after every cleanup we tell everyone who uses wp-admin to close every tab on the site and restart their browser. Sounds silly. Cost us days.

The other big one was a saved password. This thing records every username and password typed into the login page. A site we cleaned in September got reinfected this week by someone who just logged in with a password it had saved back then. The owner never changed it. So everyone who logged in while the site was infected needs a new password, and 2FA on the admin accounts would have stopped that login cold.

Other stuff that tripped us up

• It makes admin accounts that don't show on the Users screen, so the user list looks totally normal
• It hides in files with normal WordPress names, so you won't spot it scrolling through the files
• Part of it lives in the database, so restoring files or reinstalling plugins leaves that bit behind and it comes back later
• Newer versions run a background process on the server that puts the files back within minutes, and restarting PHP doesn't kill it. If a host cleaned your site and it was back the same afternoon, that's one way it happens

Anyone else seen the browser tab thing? That was a first for us.

So i've decided to build my own website for my business, since budget is short, and am doing this is Wordpress.

This is going to be a service based business, with both one-time paying customers, aswell as subscription based clients, this then entails that prices need to be shown different for both. And this goes for both my services and add-ons.

So i need a booking plugin that allows me to show different prices, depending on subscription type, and then also combine the available times, so i dont get double bookings.

Currently building with Astra and Elementor, with some help from a well-known friend (ChatGPT).

Any recommendations on plug-ins for; 1. Login, 2. Booking?

Any tips or tricks shared are more than appreciated :)

​

Hey everyone,

I'm setting up a fresh WordPress site with the Twenty Twenty-Five theme and I'm stuck on publishing a page. Hoping someone here has run into this before and can point me in the right direction.

The setup:

Fresh WordPress install, Twenty Twenty-Five theme

Creating a new page, selecting a pattern (following the official tutorial)

Clicking "Publish" gives me:

Publishing failed. Could not update post in the database.

Are you ready to publish? Double-check your settings before publishing.

In the browser console (F12 → Network), the actual culprit is an HTTP 500 Internal Server Error.

Affected URL (anonymized): https://my-site.com/wp-admin/post.php?post=XXX&action=edit

What I've already tried / ruled out:

Permalinks reset (Settings → Permalinks → "Post name" → save). No change.

All plugins disabled temporarily. Error persists – so it's not a plugin conflict.

Site Health: No critical issues, only 5 "recommended improvements" (inactive plugins/themes, missing opcode cache, no page cache detected, server response time OK). The REST API is not flagged as broken there.

It's a brand-new, empty page using a default pattern – no legacy content, nothing exotic.

My suspicion:

Since everything on the WordPress side looks clean, I'm leaning toward a server-side issue. The 500 hits exactly when the editor tries to write the page to the database via the REST API (/wp-json/...).

Questions for the hive mind:

Has anyone seen this behavior with Twenty Twenty-Five (or Block Editor + patterns in general)? What was the root cause?

Which server-side settings should I check first? I'm thinking:

PHP error log / debug.log

Firewall / ModSecurity / WAF blocking POST requests to /wp-json/

Cloudflare (if in front) – Bot Fight Mode / security rules

WP_MEMORY_LIMIT / max_execution_time

Database charset (collation) – utf8mb4 vs. utf8

Is there a way to export the Site Health report (e.g. as a file) to hand off to the host/admin? I've only found the dashboard view so far.

Any known workaround to publish the page in the meantime (e.g. Classic Editor as a stopgap)? I know that's just a band-aid, not a fix.

I've already reached out to the backend/server admin to check logs and the firewall. But if anyone here has hit this exact error, I'd love to hear what solved it.

Thanks in advance!

UPDATE: Blank page also fails with 500 – so it's not the pattern

Hey everyone, thanks for the quick replies – all three were genuinely helpful. Quick update since a few people asked for follow-up:

What I tested based on your suggestions:

    Blank-page test (u/CombinationParty7358 – the first reply): Tried publishing a completely empty page, no pattern, no content. Same 500 error. So it's not weird Unicode characters in the pattern – it's something more fundamental in the write path. Good call, that narrowed it down a lot.

    debug.log before ModSecurity (u/Jealous-Machine-5192  Took your advice and prioritized the PHP log over the ModSec rabbit hole. I've asked the server admin to pull wp-content/debug.log and the PHP error log around the timestamp of the failed publish. Will update once I have the output.

    DB charset (u/ – answer b): This is now my top suspect given the blank-page result. Asked the admin to verify:

        define('DB_CHARSET', 'utf8mb4'); in wp-config.php

        tables actually on utf8mb4_general_ci / utf8mb4_unicode_ci (not just utf8)

        Will report back if that's the culprit – your "exact same thing last month" story is very much on my mind.

    Site Health export: Found it – Tools → Site Health → Info gives the raw dump to copy. No export button, as you said. Thanks for the pointer.

    Classic Editor workaround: Keeping it in my back pocket. If we need the page live short-term, I'll activate it as a stopgap – but I'd rather fix the real cause first.

Current status: Waiting on the server admin's log output. The blank-page result makes me lean even more toward a server-side write/permission/DB issue rather than anything content-related. Will post the final solution here once we've nailed it – so the next person with this error has a reference.

Thanks again, this sub is great.

Rank Math Pro version was apparently impacted by a supply chain attack affecting some users who had recently updated the plugin. Rank Math has a write up on their site that users may wish to review. WordFence provided the following summary:

Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code (9.8, Critical)

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.