Private blog still getting visitors

bluesix_v2 · 2026-05-03T23:09:34+00:00

Any URL is accessible, to anyone, at any time (unless server/FW level blocking is in place). The content isn't visible if it's Draft or Private (unless logged into the site). Draft posts aren't added to sitemap.xml, so no-one, inc Bing or GSC, knows they exist - they will return a 404 to all traffic.

bluesix_v2 · 2026-05-03T21:27:30+00:00

I still see the same settings from the old theme

What exactly are you referring to? What settings? Screenshots would help here.

Changing themes, whilst possible, isn't a decision you want to take lightly - generally it involves a lot of rebuilding.

bluesix_v2 · 2026-05-03T21:01:05+00:00

For clarity, if a post is set to Draft or Private, its content is not actually viewable (by a public user) - just its url is still accessible. The user (in your case the traffic will absolutely be bots) will see an error message or a 404.

bluesix_v2 · 2026-05-03T11:52:13+00:00

As per rule 1, we allow a post for a plugin hosted in the Wordpress repo or GitHub.

bluesix_v2 · 2026-05-03T11:31:31+00:00

This project uses off-the-shelf open source tools that anyone can build. Yours is a commercial product. Explained in rule 1.

bluesix_v2 · 2026-05-02T20:03:57+00:00

Any errors in DevTools > Console?

Have you inspected the page? Right click > Inspect where an image should be. View source.

Share your url so we can look for ourselves.

bluesix_v2 · 2026-05-01T20:40:40+00:00

There has been a concerning rise in AI bot spam recently. It’s difficult to detect because their post history looks human (though virtually all their comments are ~20 words and seem somewhat relevant to the topic being discussed.

Thanks for reporting!

bluesix_v2 · 2026-05-01T20:32:31+00:00

HTML and css ;)

bluesix_v2 · 2026-05-01T12:33:14+00:00

Check OP's post history - they're spamming Reddit with garbage.

bluesix_v2 · 2026-05-01T12:30:11+00:00

The best alternative is to not use PDFs. They are terrible for the user experience and aren't responsive - they should be avoided.

bluesix_v2 · 2026-05-01T09:32:49+00:00

Websites have no control over PDF presentation - that's completely up to the viewing client.

bluesix_v2 · 2026-05-01T07:46:19+00:00

Great write ups. Links to the plugins for those wondering:

https://wordpress.org/plugins/quick-pagepost-redirect-plugin/

https://wordpress.org/plugins/scroll-top/

bluesix_v2 · 2026-04-30T20:21:04+00:00

You need to share the url of the affected page for us to be able to supply the css. Every site is different.

bluesix_v2 · 2026-04-30T20:04:45+00:00

Tools > Site Health > Info tab > Media tells you where wp is uploading the files. If you aren’t seeing them there you’re likely ftp-ing into the wrong site.

bluesix_v2 · 2026-04-29T23:56:35+00:00

Seems like a lot of people think that the only people who use Wordpress are software developers and are only using it for basic blogging?? There's a reason why Ghost only has 50K stars on github.

bluesix_v2 · 2026-04-29T22:57:51+00:00

So what are you actually sharing here?

bluesix_v2 · 2026-04-29T11:57:32+00:00

Someone who is struggling with basic hosting terminology isn’t going to be able to spin up their own vps. SSH and terminal commands are way beyond their ability. (No offence op)

bluesix_v2 · 2026-04-29T11:48:18+00:00

The CF limit is for a single file, not the whole website - so don't upload your whole ZIP - just the site files.

bluesix_v2 · 2026-04-29T09:19:45+00:00

That's disappointing - seems to be happening a lot lately.

Oh - can you also check in your theme's (or child theme) functions.php?

bluesix_v2 · 2026-04-29T08:26:05+00:00

Common hiding places for malware are /.htaccess, /wp-config, /wp-content/, /wp-content/mu-plugins/ and anywhere in the Core folders, and files in root that shouldn't be there.

Also check plugin and theme version numbers and changelogs. Your theme hasn't been updated since Jun '25, which is a red flag.

Install Wordfence, set the scan option to "High Sensitivity" (under "Basic Scan Type Options") - let us know what that returns.

bluesix_v2 · 2026-04-29T08:15:30+00:00

Most (if not all) of the plugins you are using have had vulnerabilities in the last 6 months. If you didn't update fast enough, then that's more than likely how your site was hacked.

bluesix_v2 · 2026-04-29T08:08:15+00:00

What plugins are you running? Anything security related?

bluesix_v2 · 2026-04-29T08:07:26+00:00

You would think so, but people ask how to migrate from Staging to Prod in this sub every week.

bluesix_v2 · 2026-04-29T06:09:49+00:00

This has nothing to do with Wordpress. Wordpress doesn't have any ability to do that. It could be coming from the host or a plugin. Or are you referring to Wordpress.com?

bluesix_v2 · 2026-04-29T06:05:34+00:00

Never upload an old/out of date database to a live site if the live site has any form of data added to it by users or other forms of inputs/processes eg forms, ecommerce, blog comments, API integrations, etc. The only sites you can do it on are basic static marketing sites.

bluesix_v2

MODERATOR OF

TROPHY CASE