← Feed

Posts

• View post

  eBay UK is offering grants of up to £200,000 through their Up & Running programme — worth knowing if you run a WooCommerce store alongside an eBay channel. Syncing inventory and orders across both platforms is a real ongoing cost. A grant like this could cover the tooling or resource to automate it properly. #WooCommerce #WordPress #eCommerce #eBay #SmallBusiness https://wpguy.uk/blog/ebay-grants-for-woocommerce-sellers-up-to-200000/

• View post

  A 9.2 CVSS score in WordPress core means an attacker can read server files or execute malicious code with no login required whatsoever. No credentials, no brute force — just an unpatched site and an opportunity. I would not wait on this one. Check your version and update now. #WordPress #WordPressSecurity #SecurityHardening #WebSecurity #CyberSecurity https://wpguy.uk/blog/wordpress-core-flaw-scores-92-patch-your-site-now/

• View post

  If your site runs Elementor 4.3.0 or 4.3.1, I would update immediately. CVE-2026-62062 allows any authenticated user — a subscriber or WooCommerce customer — to escalate their privileges to admin level. Open registration or a membership area makes this a concrete, present risk rather than a theoretical one. #WordPress #Elementor #SecurityHardening #CVE #WordPressSecurity https://wpguy.uk/blog/elementor-privilege-escalation-cve-2026-62062-update-now/

• View post

  Amazon UK now offers Affirm instalment payments, and it raises the bar for every WooCommerce store competing for the same customers. When a buyer can spread the cost on Amazon but not on your site, the checkout decision gets harder. I work with store owners to close that gap with instalment payment options built properly into WooCommerce. #WooCommerce #WordPress #Ecommerce #CartAbandonment #PaymentUX https://wpguy.uk/blog/woocommerce-instalment-payments-reduce-cart-abandonment/

• View post

  Sole trader simplicity has its limits. Once income grows, that structure can cost more in tax than a limited company and leaves personal assets exposed — risks a separate legal entity would prevent. I explore whether incorporation is the right move and what the practical advantages actually look like. #WordPress #SmallBusiness #SoleTrader #LimitedCompany #BusinessStrategy https://wpguy.uk/blog/sole-trader-to-limited-company-is-incorporation-right-for-you/

• View post

  CVE-2026-87902 scored 9.2 out of 10, affected every WordPress version since 2016, and was actively exploited within 24 hours of disclosure — no login required. Most site owners never heard a word about it. That silence is the real vulnerability. Knowing your site runs WordPress is not the same as knowing what is happening to it. #WordPress #WordPressSecurity #CyberSecurity #SecurityHardening https://wpguy.uk/blog/cve-2026-87902-the-wordpress-flaw-most-owners-missed/

• View post

  A critical RCE vulnerability in WordPress core means attackers can execute arbitrary code on your server with zero credentials — no login, no insider access required. Automated scanning began almost immediately after disclosure. If your site is not running 7.1.2, the risk is active right now. Update today. #WordPress #Security #RCE #WordPressSecurity #WebDev https://wpguy.uk/blog/wordpress-712-critical-rce-vulnerability-explained/

• View post

  Two-thirds of UK shoppers go straight to Amazon before they even consider an independent retailer. The real problem is not price — it is that independent stores never enter the consideration set at all. No discount fixes that. In my latest post I look at what UK independent stores can actually do about it. #WordPress #WooCommerce #eCommerce #UKRetail #IndependentRetail https://wpguy.uk/blog/how-uk-independent-stores-can-compete-with-amazon/

• View post

  87% of UK consumers bought secondhand in the past year — making the UK the most active pre-loved market in the world. That is not a niche trend. If you run a WooCommerce store, your product strategy should be responding to it. I have written about what this means practically. #WooCommerce #WordPress #Recommerce #eCommerce #SecondhandUK https://wpguy.uk/blog/woocommerce-for-secondhand-sales-meeting-uk-demand/

• View post

  Manual tracking entries and carrier portal-switching might feel manageable in October. Come November, that friction multiplies across thousands of European orders and the cracks show fast. Shopify has been investing heavily here — WooCommerce stores need to close that gap before peak trading hits. #WooCommerce #WordPress #eCommerce #EuropeanShipping #WordPressdeveloper https://wpguy.uk/blog/woocommerce-european-shipping-closing-the-shopify-gap/

• View post

  If your WooCommerce store runs any version from 9.8.0 to 11.1.x, it is currently exposed to CVE-2026-106608, a CVSS 7.2 vulnerability that allows unauthenticated remote access to your store data and admin functions. I recommend updating to 11.2.0 immediately. #WordPress #WooCommerce #CVE #SecurityHardening #WordPressSecurity https://wpguy.uk/blog/woocommerce-cve-2026-106608-update-to-1120-now/

• View post

  European shoppers are waiting a median of 16 days for refunds from UK online stores, according to ShopReturns research. The delay usually sits inside warehouse processing, not transit — the parcel arrives back quickly, then waits. That distinction matters if you are trying to fix the problem on a WooCommerce store. #WooCommerce #WordPress #Ecommerce #UX #RetailOperations https://wpguy.uk/blog/why-european-refunds-take-16-days-on-woocommerce-stores/

• View post

  Most WordPress site owners have never heard of Ghostscript. I hadn't expected that to matter — until CVE-2025-27830. It processes PDF uploads at OS level, before WordPress even sees the file. A crafted PDF can exploit it silently. If your server runs Ghostscript unpatched, your media library could be a door left open. #WordPress #Security #Ghostscript #WordPressSecurity #CVE https://wpguy.uk/blog/ghostscript-cve-2025-27830-is-your-wordpress-server-safe/

• View post

  The plugin you trust to protect your site can itself become the attack vector. Backuply, installed on over 600,000 WordPress sites, contained a Path Traversal flaw (CVE-2025-2877) that let a basic subscriber account gain full admin access. That is a serious supply chain concern worth understanding. #WordPress #WordPressSecurity #SecurityHardening #WebSecurity https://wpguy.uk/blog/backuply-vulnerability-how-subscribers-gain-admin-access/

• View post

  Every plugin you install carries a measurable cost — HTTP requests, database queries, PHP execution time on every page load. A site with thirty poorly-built plugins is not just slower, it is slower in proportion to how badly they conflict and how often they load where they are not needed. Across dozens of client sites, that compounds fast. #WordPress #WebPerformance #WordPressAgency #PluginOptimisation https://wpguy.uk/blog/how-plugins-are-slowing-down-your-client-sites/

• View post

  Your postcode does not set a ceiling on what you can earn online. The data backs this up — some of Europe's most active small business ecommerce regions are Greater Manchester and the wider North West, not London. A well-configured WooCommerce store is a significant part of that story, and it is something I work on daily. #WooCommerce #WordPress #Ecommerce #SmallBusiness #WordPressGuy https://wpguy.uk/blog/woocommerce-vs-marketplaces-own-your-ecommerce-revenue/

• View post

  Since July 2026, EU supplement shipments from UK warehouses carry flat per-category customs duties. That cost lands somewhere — either in your margin or your conversion rate. If your WooCommerce store is not reflecting this at checkout, you are absorbing it silently. I have been updating pricing logic for affected stores and the fix is not optional. #WooCommerce #WordPress #eCommerce #UKBusiness #Supplements https://wpguy.uk/blog/eu-supplement-duties-fix-your-woocommerce-pricing-now/

• View post

  Two PHP vulnerabilities disclosed July 2025 — CVE-2025-1736 and CVE-2025-1861, collectively PHP2Shell — affect every WordPress site. The worst scores 9.8 CVSS and requires no account to exploit. No plugin or WordPress update fixes this. The patch must be applied at server level by your host. If you manage your own server, check your PHP version now. #WordPress #PHP #Security #WordPressSecurity #WebHosting https://wpguy.uk/blog/php2shell-critical-php-vulnerabilities-affecting-wordpress/

• View post

  Your WordPress site can be taken over without anyone touching it. The PHP2Shell vulnerability class, disclosed in October 2024, exposed how a flaw in the PHP layer alone is enough. No compromised plugin, no login attack. Whether that flaw gets patched depends entirely on your host, not you. Choose carefully. #WordPress #WebSecurity #PHP #WordPressSecurity #Hosting https://wpguy.uk/blog/php2shell-why-your-host-decides-if-youre-protected/

• View post

  WordPress 6.7.2 patches a confirmed critical-severity remote code execution vulnerability — meaning an attacker can run code on your server with no login credentials whatsoever. In my view, this is not optional. If you have not updated yet, do it now. The risk of malware, hidden admin accounts, and data theft is real and immediate. #WordPress #Security #WebDev #WordPressSecurity #WPGuy https://wpguy.uk/blog/wordpress-672-critical-rce-patch-you-must-apply-now/

• View post

  If your site runs Elementor Pro with a file upload field in any form, patch immediately. Versions 4.2.1 and below contain a critical flaw that allows complete site takeover — no account, no password, no interaction required. The upload field your visitors use daily is the attack vector. I recommend updating now without delay. #WordPress #Elementor #WebSecurity #WordPressSecurity #SecurityHardening https://wpguy.uk/blog/elementor-pro-file-upload-vulnerability-patch-now/

• View post

  With 59,000+ free plugins available, the question is never just "which plugin does this job" — it is "which plugin does this job without costing more than it delivers." Quality beats quantity every time. A lean set of well-coded plugins will always outperform a bloated collection. #WordPress #WebPerformance #WordPressPlugins #PerformanceOptimisation https://wpguy.uk/blog/which-wordpress-plugins-actually-improve-site-speed-and-business-performance/

• View post

  PCI DSS certification confirms you met a minimum standard for handling cardholder data. It does not confirm your WooCommerce checkout is secure. Conflating the two is one of the more expensive mistakes a store owner can make — and I see it regularly. #WordPress #WooCommerce #PCICompliance #WebSecurity #WordPressSecurity https://wpguy.uk/blog/why-pci-compliance-alone-will-not-protect-your-woocommerce-checkout/

• View post

  Stricter returns policies are quietly killing WooCommerce sales. Locus research puts £34.1bn in UK online revenue at risk because shoppers are abandoning stores with tough returns rules. I see this with clients regularly — tightening policy to cut costs often costs more in lost conversions. Worth reviewing before your next sale season. #WooCommerce #eCommerce #WordPress #ReturnsPolicies #OnlineRetail https://wpguy.uk/blog/could-your-returns-policy-be-costing-your-woocommerce-store-customers/

• View post

  Quadrant, Lando Norris's sports brand, chose Shopify to run their London pop-up at Outernet ahead of British Grand Prix week — opening in days, not weeks. In my view, WooCommerce can handle pop-up retail, but it requires more setup time. Worth weighing up before your next physical activation. #WooCommerce #Shopify #WordPress #RetailTech #eCommerce https://wpguy.uk/blog/can-woocommerce-power-a-pop-up-store-as-well-as-shopify-can/

• View post

  Up to £3.2 billion in UK online retail sales each year involve sellers fraudulently claiming to be UK-established to dodge VAT. That 20% margin gives overseas operators a structural pricing advantage over legitimate sellers. As a WooCommerce specialist, I'm watching this consultation closely — the outcome will directly affect how UK stores compete. #WooCommerce #WordPress #UKVat #eCommerce #OnlineRetail https://wpguy.uk/blog/vat-loophole-costing-uk-online-sellers-millions-what-changes-...

• View post

  Critical plugin flaws disclosed in June 2026 mean attackers can create admin accounts with no password — WP Maps Pro exposes a nonce in every frontend page, making its "protection" worthless. I see sites exploited within hours of disclosure. Patch immediately or remove plugins you are not actively using. #WordPress #Security #WordPressSecurity #PluginSecurity https://wpguy.uk/blog/wordpress-plugin-flaws-in-june-2026-put-thousands-of-business-sites-at-risk/

• View post

  Many self-employed owners only discover they have crossed the £90,000 VAT threshold at year end — by which point they already owe VAT they never collected. If you expect to hit it within 30 days, you must register before reaching it. I have linked a full guide below. #WordPress #SelfEmployed #VAT #UKBusiness #SmallBusiness https://wpguy.uk/blog/vat-registration-for-the-self-employed-what-business-owners-must-know-in-2026/

• View post

  Two CVEs in WordPress 6.8 and 6.9 were patched on 17 July 2026. One allows arbitrary code execution on your server — that is as serious as it sounds. If my sites were still on either version, updating to 7.0.2 would be the first thing I did this morning. Both CVEs are publicly logged, meaning unpatched sites are visible targets. #WordPress #WordPressSecurity #CVE #WebSecurity #WPSecurity https://wpguy.uk/blog/wordpress-security-flaw-what-business-owners-must-do-right-now/

• View post

  WP2Shell is being actively exploited right now. If your site runs WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1, a single unauthenticated HTTP request can hand an attacker full control. No plugin, no login, no prior access needed. CVSS 9.8. Update immediately. #WordPress #WordPressSecurity #WP2Shell #CVE #SecurityHardening https://wpguy.uk/blog/wp2shell-what-wordpress-site-owners-must-do-right-now/