Blog

  • Benefits of Joomla Migration

    Benefits of Joomla Migration

    The benefits of Joomla migration are concrete: you leave an unsupported major (especially Joomla 3 after August 2023), land on a release that still receives security fixes, run on PHP 8.x hosting hosts still sell, and unlock core features that used to need third-party extensions. In project language, a migration is a major structural hop (typically 3.10 to 4.4). A upgrade is the smoother path the project documents for 4.4 to 5 and 5.4 to 6. Both are what buyers mean when they search for Joomla migration benefits.

    Most articles on this topic stop at “security and speed,” or they stop at Joomla 5. Official docs explain why to migrate. Agency posts list three to ten reasons. Almost none combine official terminology, the full 3 through 6 hop map, Joomla 6 auto-updates, support end dates, when you should wait, the Behaviour – Backward Compatibility 6 rules, cleanup ROI, and a staging plan in one place. That is what this guide does, plus how Infyways runs the work from $149 with a free audit within 12 hours.

    What you will learn

    • Migration versus upgrade versus patch update (with the hop order that actually works)
    • Every major benefit: security, PHP and hosting, performance, admin UX, SEO, accessibility, multilingual, core features, Joomla 6 auto-updates
    • Official support windows so you know when urgency is real versus marketing panic
    • Why migration is also a cleanup project (the angle official docs emphasize)
    • What you lose by waiting on Joomla 3 or early 4, and when Joomla 5 owners can wait
    • How to start with Infyways without treating “click Update” as a plan

    Migration, upgrade, or patch: use the right word

    Confusion here is why thin competitor posts mislead people into a one-click 3 to 6 fantasy.

    Change Official framing Example What you should expect
    Patch Update 5.4.2 to 5.4.3 Same major. Use System → Update → Joomla. See update errors
    4.4 to 5.x Upgrade (not a full migration) 4.4.x to 5.4.x Many extensions work; Behaviour – Backward Compatibility helps. Plan on staging
    5.4 to 6.x Upgrade 5.4 to 6.0+ Disable Behaviour – Backward Compatibility (no number). Keep Behaviour – Backward Compatibility 6 enabled. See compat plugin guide
    3.10 to 4.4 Mini-migration / migration 3.10 to 4.4 Template and extension triage. Protostar does not survive
    3.x toward 5 or 6 Multi-hop migration 3.10 → 4.4 → 5.4 → 6 Never a single updater click. Path: 3 to 4, 5, and 6

    Primary sources: Why Migrate, 4.4 to 5 planning, 5 to 6 planning, and the Joomla 6.0 / 5.4 announcement.

    Support windows that decide urgency

    Scare posts skip dates. The Joomla roadmap and project announcements make urgency measurable:

    Line Bugfix / regular support Security-only support What that means for migration
    Joomla 3.10 Ended August 2023 Ended August 2023 Migrate now. There is no official patch line left
    Joomla 4.x Ended (security ended 14 October 2025) Ended Treat as EOL. Move to 5.4 then plan 6
    Joomla 5.4.x Through 13 October 2026 Through 12 October 2027 Safe to stay while extensions catch up for J6, if you are already on 5.4
    Joomla 6.x Through 17 October 2028 Through 16 October 2029 Active feature line. Finish here when staging is green

    So: Joomla 3 and 4 owners have a real security deadline. Joomla 5.4 owners have a planning window, not a midnight panic, unless the host or an abandoned extension forces the move sooner.

    Benefit 1: Security support that still exists

    Joomla 3.10 reached end of life in August 2023. The site does not magically shut off. Official security patches stop. That is the first benefit of migrating: you are on a maintained line again.

    • Core CVEs ship on current 5.x and 6.x.
    • Abandoned Joomla 3 extensions stop being a permanent attack surface once you replace or rebuild them.
    • Hosts and insurers increasingly treat EOL CMS stacks as unacceptable risk.

    Thin “3 reasons” posts mention security once. The operational point is this: every month on EOL core is a month where your risk grows and your vendor options shrink.

    Benefit 2: PHP and database versions you can still buy

    Hosts retire PHP 7 and old MySQL. Joomla 5 needs PHP 8.1 or newer. Joomla 6 needs PHP 8.3 or newer (8.4 recommended), with MySQL 8.0.13+ / MariaDB in the supported range or PostgreSQL 14+ class. Requirements: Joomla technical requirements.

    Target PHP Why migration unlocks hosting
    Joomla 5 8.1+ Matches mainstream shared hosting in 2026
    Joomla 6 8.3+ (8.4 recommended) Keeps the next renewal cycle viable

    Official docs also warn that hosts will not keep ancient stacks forever. Migration is often forced by the server long before the marketing team asks for new features.

    Benefit 3: Performance without the legacy JS tax

    Current Joomla uses modern PHP, a cleaned codebase, and the Web Asset Manager so templates load scripts only when needed. Core no longer ships MooTools. Default templates are built for current Core Web Vitals expectations.

    The caveat competitors skip: speed appears when the template and bloated extensions move with the core. Migrating the CMS and keeping a Joomla 3 club template untouched does not deliver the performance benefit. Related: remove MooTools from Joomla.

    Benefit 4: An administrator people will actually use

    From Joomla 4 onward the back end is a different product: clearer navigation, Guided Tours, a usable media manager (including AVIF on modern releases), and Dark Mode that editors notice. Magazine writers call out the adjustment period from Joomla 3, then the productivity gain. That matches what we see on client handovers.

    Modern Joomla media manager after migration with drag and drop uploads

    Benefit 5: Core features that replace paid extensions

    This is the benefit Why Migrate stresses and most agency blogs underwrite. Current Joomla can cover work that used to need a stack of third-party tools:

    • Custom fields for structured content
    • Workflows for editorial approval
    • Tags and Smart Search instead of legacy Search
    • Media manager improvements instead of a separate DAM for small sites
    • Cassiopeia child-style customization on recent releases without forking the whole template

    Migration is the moment to uninstall unused modules, kill “great ideas” that never launched, and reduce license sprawl. That lowers cost after go-live, not only risk.

    Benefit 6: SEO you can defend

    Joomla does not rank higher because the version number changed. You benefit because:

    • Modern routing and SEF stay maintainable
    • You can keep aliases and ship a 301 map when something must change
    • Schema and accessibility improvements support how Google evaluates pages
    • The site stays fast enough and online during crawl windows

    Rankings die on broken SEF, 500s after a botched live update, or months of downtime. Staging protects that. Troubleshooting: Joomla upgrade issues and Joomla SEO.

    Benefit 7: Accessibility, multilingual, and compliance

    • Accessibility: current admin and Cassiopeia-oriented front ends take WCAG-oriented patterns seriously. Public sector and education RFPs increasingly require that.
    • Multilingual: language handling and related tooling are stronger than on Joomla 3-era stacks, which matters for EU and multi-region sites.
    • Support window: majors follow a planned lifecycle (on the order of multi-year support per major). You get time to plan the next hop instead of living in permanent panic.

    Benefit 8: Joomla 6 features worth finishing the path for

    Posts that stop at “move to Joomla 5” are already dated. From 5.4 into 6 you also gain reasons to complete the journey:

    • Automatic core updates with the secure update framework introduced across 5.4 and 6.0
    • Behaviour – Backward Compatibility 6 so more extensions survive the hop while vendors catch up
    • Extended versioning that reaches further into custom fields and related content structures
    • Language file caching and media manager improvements
    • Editor updates (TinyMCE on the current 6.x line) for day-to-day publishing
    • Child templates and richer content tools that reduce forking Cassiopeia for small design changes

    Before the hop: prove every third-party extension runs on Joomla 5.4 with the older Behaviour – Backward Compatibility plugin disabled. Then upgrade with Behaviour – Backward Compatibility 6 enabled. After vendors ship native J6 builds, disable BC6 to drop the compatibility overhead. Full rules: 5 to 6 planning.

    Product overview: Joomla 6. Community write-up: What is new in Joomla 6.0.

    Benefit 9: The cost of not migrating

    If you stay on What usually happens next
    Joomla 3 No official security line, vendors gone, PHP upgrades break the site
    Early Joomla 4 on PHP 8.0 hosts Host forces PHP up; site fatals; emergency weekend work
    Joomla 5 without a 6 plan You miss auto-update and lifecycle planning; the next hop becomes a fire drill
    Heavy abandoned extensions Every delay makes rebuild cost higher, not lower

    Waiting rarely saves money. It concentrates risk into a single emergency project.

    Who benefits most (urgency map)

    Situation Main benefit Urgency
    Still on Joomla 3 Security + PHP + vendors High
    Joomla 4, host retiring PHP Stay online High
    VirtueMart / custom components Commerce on supported builds High if vendors dropped your major
    Government / education Supported CMS for audits High
    Joomla 5.4, PHP 8.3+, extensions J6-ready Joomla 6 features + lifecycle Upgrade on staging now
    Joomla 5.4, critical extensions not J6-ready Stay secure on 5.4 while vendors catch up Medium: schedule, do not freeze forever
    Agencies with many client sites One standard stack, fewer snowflake servers High for white-label ops

    What thinner articles leave out

    Topic Typical competitor post This guide
    Versions covered Joomla 3 to 5, or 5 to 6 only 3 through 6 with hop order
    Migration vs upgrade Mixed or wrong Official project language in a table
    Support end dates Vague “EOL soon” Roadmap dates for 3, 4, 5.4, and 6
    Joomla 6 auto-updates Often missing Called out as a finish-line benefit
    BC6 plugin rules Skipped or one line Disable old BC, keep BC6, retire later
    When waiting is OK Rarely said J5.4 security window through October 2027
    Cleanup / core replacements Mentioned lightly Tied to Why Migrate and cost reduction
    Staging + SEO cutover Generic “take a backup” Steps, Pre-Update Check, 301 map, Search Console
    Commercial next step Vague contact form Audit in 12 hours, packages from $149

    Step 1: Inventory version, PHP, and extensions

    1. System → System Information: Joomla, PHP, database.
    2. Export or screenshot Manage → Extensions.
    3. Mark each extension: has a current build, needs rebuild, or can be replaced by core.
    4. Pick only the next hop from the table above.

    Step 2: Back up with a restore test

    A migration benefit is worthless without rollback. Take files + database, store a copy off-server, and confirm restore once. Method: how to backup a Joomla website.

    Step 3: Prove it on staging

    Joomla Pre-Update Check used when planning a migration on staging
    1. Clone production to staging.
    2. Run Pre-Update Check. Fix or replace blockers.
    3. Complete the hop. Run Database Fix. Clear caches.
    4. Click through login, forms, multilingual switchers, and checkout if you have a store.
    5. Only then book the production window.

    When something breaks, use the issue map: common Joomla upgrade issues.

    Step 4: Cut over with SEO and support intact

    • 301 map ready for any alias that must change
    • Search Console checked in week one
    • CDN and page cache purged
    • 30 days of watch for extension edge cases

    How Infyways delivers those benefits

    We are not a generic “we love Joomla 5” essay. We migrate production sites:

    • Free compatibility audit within 12 hours (credentials optional for the first pass)
    • Fixed packages from $149 small / $299 medium / custom enterprise and stores
    • 125 Joomla extensions built in-house, so rebuilds are normal work, not a surprise
    • Staging-first cutover and 30 days of post-launch support on migration defects

    Start: Joomla Upgrade Services.

    Key takeaways

    1. Migration benefits are security, hosting, performance, admin UX, fewer extensions, SEO resilience, accessibility, and Joomla 6 lifecycle features.
    2. Use official words: 3 to 4 is a migration; 4.4 to 5 and 5.4 to 6 are upgrades.
    3. Hop order is 3.10 → 4.4 → 5.4 → 6. No shortcuts.
    4. Urgency follows support windows: EOL on 3/4 is immediate; 5.4 still has a security lane into late 2027.
    5. Cleanup is part of the ROI: drop unused extensions and replace them with core where you can.
    6. Speed and SEO appear only when template and extensions move with the CMS.
    7. Waiting on EOL core increases cost. Fixed-price staging work is cheaper than an emergency rebuild.

    Frequently asked questions

    What are the benefits of Joomla migration?

    You regain security updates, PHP 8 hosting, a modern administrator, vendor-supported extensions, better performance potential, stronger accessibility and multilingual options, and a path into Joomla 5 and 6 features such as automatic core updates.

    Is Joomla 4 to 5 a migration or an upgrade?

    The Joomla project treats 4.4.x to 5.x as an upgrade, not a full migration. Extension checks and staging are still required.

    Is Joomla 5 to 6 a migration?

    No. From 5.4.x it is an upgrade, with Behaviour – Backward Compatibility 6 involved. From Joomla 3 it is still a multi-hop migration.

    Do I need to upgrade from Joomla 5 to Joomla 6 immediately?

    No. Joomla 5.4 remains on a security path through 12 October 2027. Upgrade when templates and extensions are J6-ready and staging is green, not because a headline says “now or never.”

    What is the Behaviour – Backward Compatibility 6 rule before upgrading?

    On Joomla 5.4, disable the older Behaviour – Backward Compatibility plugin (no number in the name) only after extensions run without it. Keep Behaviour – Backward Compatibility 6 enabled for the move into Joomla 6. Disable BC6 later when every extension is native.

    Does my Joomla 3 site stop working after end of life?

    No. It keeps running without official security fixes while hosts and vendors move on.

    Will migration improve Google rankings by itself?

    No. It protects the technical baseline (uptime, SEF, modern HTML performance). Content and links still decide rankings.

    Can core Joomla replace some of my extensions after migration?

    Often yes. Custom fields, workflows, tags, and Smart Search cover many older third-party use cases. That is a deliberate benefit of migrating now.

    How much does Joomla migration cost with Infyways?

    Packages start at $149 for small sites and $299 for medium sites. Enterprise and stores are custom after the free audit.

    How long does it take?

    Small brochure sites can finish in days after staging is ready. Stores and custom components take longer. The audit sets the timeline.

    Where do we start?

    Request a Joomla upgrade audit or contact Infyways.

  • How to Get the Featured Image URL in WordPress (Code Examples)

    How to Get the Featured Image URL in WordPress (Code Examples)

    Updated 15 October 2026 · By Abhilash Sahoo, Founder, Infyways

    To get the featured image URL in WordPress, use get_the_post_thumbnail_url(). For the current post, at full size:

    <?php echo esc_url( get_the_post_thumbnail_url( get_the_ID(), 'full' ) ); ?>

    It returns the image URL as a string, or false when the post has no featured image. Pass a post ID to get the image for any post, and a size name such as 'thumbnail', 'medium', 'large' or 'full' to choose the size.

    In short: get_the_post_thumbnail_url( $post, $size ) for the URL, get_post_thumbnail_id() for the attachment ID, wp_get_attachment_image_src() when you also need width and height, and _embed=wp:featuredmedia in the REST API.

    How do I get the featured image URL inside the loop?

    PHP code in single.php using has_post_thumbnail() and get_the_post_thumbnail_url() in the loop, plus a by-ID example with a fallback image
    Using get_the_post_thumbnail_url() in the loop and by post ID, with a fallback.

    Call get_the_post_thumbnail_url() without a post argument. It uses the global $post, so it works in single.php, index.php, archive templates and any WP_Query loop. Check has_post_thumbnail() first so you don’t print an empty src:

    <?php if ( has_post_thumbnail() ) : ?>
        <img src="<?php echo esc_url( get_the_post_thumbnail_url( null, 'large' ) ); ?>"
             alt="<?php echo esc_attr( get_the_title() ); ?>">
    <?php endif; ?>

    The signature is get_the_post_thumbnail_url( int|WP_Post|null $post = null, string|int[] $size = 'post-thumbnail' ): string|false. It was introduced in WordPress 4.4.

    How do I get the featured image URL by post ID?

    Diagram of how WordPress resolves a featured image URL: post, thumbnail ID from _thumbnail_id meta, attachment, then URL in thumbnail, medium, medium_large, large or full size
    From post to thumbnail ID to attachment to a URL in the size you ask for.

    Pass the post ID (or a WP_Post object) as the first argument. This works anywhere, including outside the loop, in shortcodes, widgets and REST callbacks:

    $post_id = 123;
    $url     = get_the_post_thumbnail_url( $post_id, 'full' );
    
    if ( $url ) {
        echo esc_url( $url );
    }

    If you need the attachment ID instead, use get_post_thumbnail_id( $post_id ). It returns the attachment ID, or false if there is none.

    How do I get a specific image size?

    The $size argument accepts any registered size name or an array of width and height in pixels:

    get_the_post_thumbnail_url( $post_id, 'thumbnail' );    // Settings > Media size
    get_the_post_thumbnail_url( $post_id, 'medium_large' ); // 768px wide by default
    get_the_post_thumbnail_url( $post_id, 'full' );         // original upload
    get_the_post_thumbnail_url( $post_id, array( 600, 400 ) );

    The default is 'post-thumbnail', a special size registered when a theme adds post-thumbnail support. It is not the same as the 'thumbnail' size in Settings > Media.

    When you also need the width and height, use wp_get_attachment_image_src(). It returns an array: index 0 is the URL, 1 the width, 2 the height, and 3 whether the image is a resized version:

    $image = wp_get_attachment_image_src( get_post_thumbnail_id( $post_id ), 'large' );
    
    if ( $image ) {
        list( $url, $width, $height ) = $image;
    }

    How do I get the featured image URL from the REST API?

    Example WordPress REST API response with _embed=wp:featuredmedia showing featured_media, source_url and media_details sizes
    A trimmed REST API response: read source_url from _embedded wp:featuredmedia.

    Posts in the REST API only include featured_media, the attachment ID. Add _embed=wp:featuredmedia to get the media object in the same request, then read source_url:

    GET /wp-json/wp/v2/posts/123?_embed=wp:featuredmedia
    fetch( '/wp-json/wp/v2/posts/123?_embed=wp:featuredmedia' )
      .then( ( res ) => res.json() )
      .then( ( post ) => {
        const media = post._embedded?.['wp:featuredmedia']?.[0];
        const url   = media?.source_url;                              // full size
        const thumb = media?.media_details?.sizes?.thumbnail?.source_url;
      } );

    If you use _fields to slim the response, include _links and _embedded, or the embed is dropped: ?_embed=wp:featuredmedia&_fields=id,featured_media,_links,_embedded. We tested this on our own site. Without _embed, request /wp-json/wp/v2/media/{featured_media} as a second call.

    How do I show the featured image in a block theme?

    Block themes don’t use PHP templates for this. Use the Post Featured Image block (core/post-featured-image) inside a single template or a Query Loop. Its settings include the image size (sizeSlug), aspect ratio, whether it links to the post (isLink), and an option to use the first image in the post when no featured image is set (useFirstImageFromPost).

    You only need PHP in a block theme when you build a custom block or a render callback. There, get_the_post_thumbnail_url() works the same way.

    How do I set a fallback image when there is no featured image?

    Because the function returns false when there is no featured image, fall back with a short check:

    $url = get_the_post_thumbnail_url( get_the_ID(), 'large' );
    
    if ( ! $url ) {
        $url = get_theme_file_uri( 'assets/images/default-featured.jpg' );
    }

    In a block theme, the Post Featured Image block’s “use first image from post” option is a no-code alternative.

    How do I get the featured image alt text and srcset?

    PHP code getting the featured image alt text with _wp_attachment_image_alt, srcset with wp_get_attachment_image_srcset and width and height with wp_get_attachment_image_src
    Getting the alt text, srcset and dimensions from the thumbnail ID.

    The URL functions return only the URL. The alt text is stored as attachment meta, and srcset is built from the registered sizes:

    $thumb_id = get_post_thumbnail_id( $post_id );
    $alt      = get_post_meta( $thumb_id, '_wp_attachment_image_alt', true );
    $srcset   = wp_get_attachment_image_srcset( $thumb_id, 'large' );
    $url      = wp_get_attachment_image_url( $thumb_id, 'large' );

    If you just want a complete, responsive <img> tag with alt, srcset and sizes, use get_the_post_thumbnail() or the_post_thumbnail() instead of building it yourself.

    Which featured image function should I use?

    Comparison table of get_the_post_thumbnail_url, wp_get_attachment_image_url, wp_get_attachment_image_src, the_post_thumbnail and get_post_thumbnail_id: what each takes and returns
    Which featured image function to use.
    Function Takes Returns Use it when
    get_the_post_thumbnail_url( $post, $size ) Post ID or object (optional) URL string or false You need the featured image URL
    wp_get_attachment_image_url( $attachment_id, $size, $icon ) Attachment ID URL string or false You already have an attachment ID
    wp_get_attachment_image_src( $attachment_id, $size, $icon ) Attachment ID Array (URL, width, height, resized) or false You also need width and height
    the_post_thumbnail( $size, $attr ) Current post in the loop Prints an <img> tag You want the full responsive image tag output
    get_post_thumbnail_id( $post ) Post ID or object (optional) Attachment ID or false You need the ID for alt text, srcset or other sizes

    Signatures checked against the WordPress Code Reference on 15 October 2026.

    Why is get_the_post_thumbnail_url() not working?

    • The theme has no featured image support. Add it in functions.php: add_action( 'after_setup_theme', function () { add_theme_support( 'post-thumbnails' ); } );. Block themes and most modern themes already have it.
    • It returns false. The post has no featured image set, or you are outside the loop without passing a post ID. Use has_post_thumbnail( $post_id ) to check.
    • It returns the wrong size. The size name may not be registered, or the image was uploaded before the size existed. Regenerate thumbnails (for example with WP-CLI: wp media regenerate) so the missing sizes are created.
    • The URL is the full image instead of the size you asked for. WordPress falls back to a larger file when the requested size does not exist for that image. Regenerate thumbnails or pick a registered size.
    • Nothing prints. get_the_post_thumbnail_url() returns a value; it does not echo. Use echo esc_url( ... ).
    • The REST response has no _embedded. Add _embed=wp:featuredmedia, and include _links,_embedded if you use _fields.

    Frequently asked questions

    How do I get the featured image URL in WordPress?

    Use get_the_post_thumbnail_url(). Inside the loop call it without arguments; elsewhere pass the post ID, for example get_the_post_thumbnail_url( 123, 'full' ).

    What does get_the_post_thumbnail_url() return if there is no featured image?

    It returns false, so check the result or call has_post_thumbnail() before printing it.

    How do I get the full-size featured image URL?

    Pass 'full' as the size: get_the_post_thumbnail_url( $post_id, 'full' ). Without a size it returns the 'post-thumbnail' size.

    How do I get the featured image ID?

    Use get_post_thumbnail_id( $post_id ). It returns the attachment ID, or false if the post has no featured image.

    How do I get the featured image URL in the REST API?

    Request the post with ?_embed=wp:featuredmedia and read _embedded['wp:featuredmedia'][0].source_url, or fetch /wp-json/wp/v2/media/{featured_media} separately.

    How do I get the featured image width and height?

    Use wp_get_attachment_image_src( get_post_thumbnail_id( $post_id ), 'large' ). It returns the URL, width, height and whether the image is resized.

    How do I get the featured image alt text?

    Read the attachment meta: get_post_meta( get_post_thumbnail_id( $post_id ), '_wp_attachment_image_alt', true ).

    Why does my theme not show the Featured Image box?

    The theme hasn’t declared support. Add add_theme_support( 'post-thumbnails' ) on the after_setup_theme hook in functions.php.

  • How to Change the Template in Joomla 5 & 6: Step-by-Step Guide

    How to Change the Template in Joomla 5 & 6: Step-by-Step Guide

    To change the template in Joomla 5 or 6, go to System → Site Template Styles, click the star in the Default column next to the style you want, and check the front end. The same steps work in Joomla 4.

    Step 1: Back up first

    A new template can move modules and hide content. Take a full backup with Akeeba Backup (see how to back up Joomla) or test on a staging copy.

    Step 2: Install the new template

    Go to System → Install → Extensions and upload the template ZIP from the vendor. Make sure the vendor lists Joomla 5 or 6 compatibility; templates made for Joomla 3 will not work and may break the site.

    Step 3: Make it the default

    1. Go to System → Templates → Site Template Styles.
    2. Find the new style and click the grey star in the Default column. It turns gold.
    3. To keep the old template for some pages instead, open the new style, go to the Menu Assignment tab and tick only those menu items.

    Step 4: Map module positions

    Each template has its own position names. Go to Content → Site Modules, filter by template, and move modules that disappeared to the new positions. Append ?tp=1 to a page URL to preview positions (enable “Preview Module Positions” in System → Templates → Options first; switch it off again afterwards).

    Step 5: Check overrides and child templates

    Layout overrides live inside the old template folder, so they do not carry over. Recreate the ones you need in the new template, ideally in a Joomla child template so vendor updates do not overwrite them. If changes do not appear, see Joomla CSS changes not showing and template override not working.

    Changing the administrator template

    System → Administrator Template Styles works the same way. Joomla 4, 5 and 6 ship Atum; change it only if an extension needs it.

    Want a custom design instead of a stock template? See Joomla design services or start from the free Joomla template generator.

    Frequently asked questions

    Where are templates in Joomla 5?

    System → Templates → Site Template Styles for the front end, and Site Templates to edit the files.

    Can I use different templates on different pages?

    Yes. Open a template style, go to Menu Assignment and choose the menu items that should use it.

    Why did my modules disappear after changing template?

    The new template uses different position names. Move the modules to the new positions in Content → Site Modules.

  • White Hat vs Black Hat SEO – Which One You Should Pick?

    White Hat vs Black Hat SEO – Which One You Should Pick?

    Wondering about the most effective Search Engine Optimization techniques?

    Don’t let your SEO backfiring you! Let us guide you through different techniques and strategies of White Hat vs. Black Hat SEO. Understand major differences between black hat & white hat SEO with this blog!

    Knowing the differences between White Hat and Black Hat SEO Tactics is vital for the success of your SEO campaign.

    While working on an SEO project, you may come across many tactics. Not all options are useful for achieving good search engine optimization.

    Though many prominent and unseen SEO tactics can work, determining the “most effective one” is subjective.

    One distinction to be aware of is White Hat vs. Black Hat SEO. It’s a key aspect that separates various SEO strategies.

    Understanding this difference can guide your approach to SEO, helping to ensure that your methods align with best practices.

    Defining Differences Between White Hat & Black Hat

    At their core, both white hat and Black Hat Techniques aim at the same result – driving good search results for your website.

    Both white hat and black hat methods are applied to give your site higher rankings on search engines.

    The only big difference between both strategies is their ethics of driving results.

    White Hat SEO Techniques are the Google approved methods to achieve the best result on search engines.

    But, a Black hat is kinda unprincipled. Black hat SEO is the process of using shortcuts and wrong hacks to exploit other websites’ weaknesses in their algorithms.

    Outlining White Hat SEO With Essential Tactics

    White Hat Strategy stands in compliance with Google’s SEO rules and algorithms. Instead of search engines, white hat methods target the human audience to gain better results.

    When Google colonizes search results for its guests, the higher Quality Content your site has, the higher ranks you’ll get. So, White Hat SEO aims at making Google like your site.

    It can be sometimes exhausting to get faster results from this ethical technique of SEO. It takes a longer time for your page to pop up at the top result pages.

    But the wait is worth it, as it ensures Long Term results. White hat SEO revolves around focusing more on the human audience.

    Making your website easy to navigate, speeding up your webpage load times, keyword research and using relevant keywords, optimizing your contents, and driving backlinks from leading websites are key strategies.

    White hat SEO revolves around

    • Focusing more on the human audience
    • Making your website easy to navigate
    • Speeding up your webpage load times
    • Keyword research and using relevant keywords
    • Optimizing your contents
    • Driving backlinks from leading websites

    Black Hat Strategy – A Big No-No For SEO

    Technically speaking, Black Hat SEO Technique is a set of unlawful practices. It focuses more on improving search engine results using others’ weaknesses.

    It takes advantage of limitations, gaps, or blind spots in Google’s algorithms. Black hat strategies maximize the Short Term gains for Page SEO.

    It also entails spam and corrupt practices to enhance the user experience. It violates search engine guidelines by relying on manipulative tactics.

    All black hat SEO strategies focus on exploiting loopholes in Google’s algorithm. It lets you achieve quick wins over fewer efforts.

    But all of them are short-lived. This approach may provide rapid gains but often leads to penalties and long-term damage to your site’s reputation.

    Black hat SEO involves

    • Focusing more on search engines than the human audience
    • Exploiting security vulnerabilities for short-lived SEO gains
    • Stealing or destroying private data from other sites
    • Transmitting malicious contents and links to drive search results
    • Acquiring higher page rankings following unethical means
    • Tricking search engines into redirecting users to other sites

    What Do White Hat SEO Tactics Include?

    Use Of Relevant Keywords

    Using relevant keywords is the major White hat tactic to improve the website’s visibility. It ensures your strong niche for leading search engines.

    Find out how your targeted audience or customers think. This understanding is key to SEO success.

    It helps you find suitable keywords for your contents, aligning with what your audience is looking for.

    Focusing on these keywords can increase the relevance of your site to potential visitors.

    This White Hat SEO strategy not only complies with search engine guidelines but also builds trust with your audience, leading to long-term success.

    Quality Contents

    Writing and updating webpages with quality contents is another white hat SEO Strategy. If your content satisfies the queries people are looking for; you get more clicks. Google doesn’t scan for relevant keywords only. It also scans for content relevance for potential readers.

    Following a reliable Link Scheme is an excellent strategy to enhance User Experience. Your link building strategy is the biggest consideration point for Google’s decision-making process. Inserting more relevant backlinks gives you higher page ranks.

    Properly Labeled Images & Titles

    Engaging titles and properly labeled images are crucial for white hat SEO. The title should be attention-grabbing and relevant to the page subject. The images you upload must be catchy and relevant to the content. Pay attention to alt tags to improve your overall on-page SEO strategy.

    Guest Blogging

    Guest Blogging is the ultimate white or Gray Hats strategy for SEO. It is practical for link building and Link Farming. It helps to boost your rankings and getting more web traffic. It is a manual outreach technique to get High-Quality in-content links.

    What Does Black Hat Strategy Include?

    Duplicate Contents

    Duplicating or posting plagiarized contents is a typical Black Hats practice. It involves website posting on wikis and duplicating other blogs and forums. They never Create Content. Instead, they post random comments or commercial services on web pages to improve clicks.

    Hidden Text Insertion

    Stuffing contents with hidden text is another black hat strategy. Readers cannot see the hidden contents, but search engines can. It involves spamming contents and pages with annoying links and texts. It helps to achieve a higher ranking in search engine result pages.

    Keyword Stuffing

    Black hat strategy never does researches for relevant keywords. Instead, it focuses on stuffing contents with unrelated keywords. It promotes cloaking of contents, using private link networks. Keywords won’t be visible to readers. They make the search engine to crawl and achieve higher ranking within the SERPs.

    Gateway Pages

    Creating gateway pages or doorway pages is another black hat SEO tactic. It involves haphazardly stuffing pages with keyword phrases. The primary goal of this practice is to achieve higher rankings and then automatically redirect guests to a separate page.

    Bait-and-Switch

    It involves the practice of getting a web page indexed and then changing the entire page. It never keeps a page’s overall topics intact. Clicking on result pages redirect readers to a new page; irrelevant to the keywords searched for.

    So, these are the major points to define White Hat vs. Black Hat SEO. If you need to find out more about the powerful SEO techniques

  • update_post_meta() in WordPress: Return Values, prev_value, Arrays & REST

    update_post_meta() in WordPress: Return Values, prev_value, Arrays & REST

    Updated 16 October 2026 · By Abhilash Sahoo, Infyways

    Quick answer: update_post_meta() saves a custom field (post meta) value. If the key doesn’t exist for that post, it adds it; if it does, it updates it.

    $result = update_post_meta( $post_id, $meta_key, $meta_value, $prev_value = '' );
    • Returns the new meta ID (int) when it adds a row, true when it changes a value, and false on failure or when the value is unchanged.
    • Without $prev_value it overwrites every row with that key.
    • Arrays are serialized for you, and backslashes are stripped unless you wrap the value in wp_slash().

    Every result on this page comes from a real WordPress 7.1.3 install (PHP 8.4) tested with WP-CLI, not copied from the manual.

    What are the parameters of update_post_meta()?

    The signature from the official WordPress developer reference is:

    update_post_meta( int $post_id, string $meta_key, mixed $meta_value, mixed $prev_value = '' ): int|bool
    Parameter Type Notes
    $post_id int Required. If you pass a revision ID, WordPress saves the meta on the parent post instead.
    $meta_key string Required. Start it with _ to hide it from the Custom Fields box.
    $meta_value mixed Required. Arrays and objects are serialized. Expected to be slashed.
    $prev_value mixed Optional. Only update rows that currently hold this value. Default '' means all rows with the key.

    Internally, update_post_meta() is a thin wrapper: it swaps a revision ID for its parent and then calls update_metadata( 'post', ... ), the same engine behind user, term and comment meta.

    What does update_post_meta() return?

    Real wp-cli output of update_post_meta return values: meta ID, true and false
    Situation (tested) Return
    Key didn’t exist, so a row was added Meta ID, e.g. 5
    Key existed and the value changed true
    Same value as stored false
    Integer 5 stored, then string "5" saved false (treated as unchanged)
    $post_id of 0, or an empty $meta_key false
    A post ID that doesn’t exist (999999) Meta ID: the row is still added
    A filter on update_post_metadata short-circuits it Whatever the filter returns

    Two practical lessons follow. First, don’t treat false as an error: it usually means “nothing to change”. Second, WordPress doesn’t check that the post exists, so validate the ID yourself or you’ll leave orphaned rows in wp_postmeta:

    if ( ! get_post( $post_id ) ) {
        return; // avoid orphaned meta
    }
    $result = update_post_meta( $post_id, 'color', 'blue' );
    if ( false === $result && get_post_meta( $post_id, 'color', true ) !== 'blue' ) {
        error_log( 'Saving color failed' ); // a real failure
    }

    How do I use update_post_meta()? (examples)

    Save a custom field on save_post (secure version)

    add_action( 'save_post_product', function ( $post_id ) {
        if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) return;
        if ( wp_is_post_revision( $post_id ) ) return;
        if ( ! isset( $_POST['iw_price_nonce'] ) || ! wp_verify_nonce( $_POST['iw_price_nonce'], 'iw_save_price' ) ) return;
        if ( ! current_user_can( 'edit_post', $post_id ) ) return;
    
        if ( isset( $_POST['iw_price'] ) ) {
            $price = sanitize_text_field( wp_unslash( $_POST['iw_price'] ) );
            update_post_meta( $post_id, '_iw_price', $price );
        }
    } );

    $_POST data is already slashed by WordPress, so wp_unslash() it before sanitizing. update_post_meta() then strips slashes again, so plain text values come out right. See the slashing section below for the case where this goes wrong.

    Read the value back

    $price = get_post_meta( $post_id, '_iw_price', true ); // single value (string)

    Change a page template

    update_post_meta( $page_id, '_wp_page_template', 'templates/full-width.php' );

    Increment a counter

    $views = (int) get_post_meta( $post_id, 'iw_views', true );
    update_post_meta( $post_id, 'iw_views', $views + 1 );

    Under heavy traffic, two requests can read the same number and both write +1. For accurate counters, use a custom table or an atomic SQL UPDATE.

    How does the $prev_value parameter work?

    Real output showing add_post_meta multiple values and the update_post_meta prev_value parameter

    A post can hold several rows with the same key (added with add_post_meta()). $prev_value picks which one to change:

    Call (rows: happy, sad) Return Rows afterwards
    update_post_meta( $p, 'mood', 'excited', 'sad' ) true happy, excited
    update_post_meta( $p, 'mood', 'calm', 'nope' ) false unchanged (no match)
    update_post_meta( $p, 'mood', 'calm' ) true calm, calm (every row overwritten)

    That last row is the classic bug: calling update_post_meta() without $prev_value on a multi-value key silently destroys the other values.

    Unique vs multiple values: add_post_meta() and get_post_meta()

    Call Real result
    add_post_meta( $p, 'mood', 'happy' ) 8 (meta ID)
    add_post_meta( $p, 'mood', 'sad' ) 9, so a second row is added
    add_post_meta( $p, 'mood', 'x', true ) false, because $unique is true and the key exists
    get_post_meta( $p, 'mood', true ) 'happy' (first row only)
    get_post_meta( $p, 'mood', false ) ['happy', 'sad']
    get_post_meta( $p, 'missing', true ) '' (empty string)
    get_post_meta( $p, 'missing', false ) [] (empty array)

    Because a missing key returns '', you can’t tell “empty” from “not set” with get_post_meta() alone. Use metadata_exists( 'post', $post_id, $key ).

    What happens when you save an array?

    update_post_meta storing an array as a serialized string and scalars returned as strings

    WordPress serializes arrays and objects on save and unserializes them on read. The real stored value for [12, 15, 18] is a:3:{i:0;i:12;i:1;i:15;i:2;i:18;}.

    • get_post_meta( $p, 'gallery', true ) returns the array. With false you get it nested one level deeper ([[12, 15, 18]]), which is a common source of “my array has an extra level” bugs.
    • Saving the identical array again returns false. Saving ['12','15','18'] (strings) returns true, because the serialized form differs.
    • Scalars come back as strings: 5 → '5', true → '1', false → '' (and the row still exists).
    • You can’t query inside serialized data with meta_query reliably. If you need to filter by a value, store it in its own key.

    Why do backslashes disappear? (wp_slash and JSON)

    update_post_meta stripping backslashes from JSON and the wp_slash fix

    For historical reasons, update_post_meta() expects the key and value to be slashed, and runs stripslashes() on them before saving. Our test results:

    You save You get back
    {"key":"value with \"quotes\""} {"key":"value with "quotes""}, which json_decode() can’t parse
    wp_slash( $json ) {"key":"value with \"quotes\""}, which decodes fine
    'C:\Users\demo' 'C:Usersdemo'
    ['p' => 'C:\Users'] ['p' => 'C:Users'] (arrays are stripped too)

    The rule is simple: if a value can contain a backslash (JSON, Windows paths, regex), wrap it in wp_slash(). Values from $_POST are the exception, since they arrive slashed. wp_unslash() them for sanitizing, and pass the result straight to update_post_meta() only if it contains no backslashes you need to keep.

    What are protected meta keys (underscore prefix)?

    Keys starting with _ are “protected”: is_protected_meta( '_price', 'post' ) returns true, and is_protected_meta( 'price', 'post' ) returns false. Protected keys are hidden from the classic Custom Fields meta box, so editors can’t change them by accident. That’s why WooCommerce uses _price and core uses _wp_page_template and _thumbnail_id (see our guide to getting the featured image URL in PHP). Protection is about the UI only. It isn’t security, as the REST test below shows.

    How do I delete post meta?

    Call (rows: a, b) Return Result
    delete_post_meta( $p, 'tag', 'a' ) true only “b” remains
    delete_post_meta( $p, 'tag' ) true all rows removed
    delete_post_meta( $p, 'tag' ) again false nothing to delete

    To remove a key from every post, use delete_post_meta_by_key( 'tag' ). Don’t set a value to '' when you mean “remove”, because that leaves a row behind.

    How do I update post meta through the REST API?

    Updating registered post meta through the WordPress REST API with register_post_meta

    Meta only appears in /wp-json/wp/v2/posts/<id> (and in the block editor) after you register it with show_in_rest:

    add_action( 'init', function () {
        register_post_meta( 'post', 'iw_price', array(
            'type'              => 'number',
            'single'            => true,
            'show_in_rest'      => true,
            'sanitize_callback' => fn( $value ) => round( (float) $value, 2 ),
            'auth_callback'     => fn() => current_user_can( 'edit_posts' ),
        ) );
        register_post_meta( 'post', 'iw_tags', array(
            'type'         => 'array',
            'single'       => true,
            'show_in_rest' => array( 'schema' => array( 'items' => array( 'type' => 'string' ) ) ),
        ) );
    } );

    Then send POST /wp-json/wp/v2/posts/4 with {"meta":{"iw_price":19.999,"iw_tags":["a","b"]}}. What we saw:

    Request Real response
    iw_price: 19.999, iw_tags: ["a","b"] Saved as 20 and ["a","b"] (the sanitize_callback ran)
    iw_price: "lots" rest_invalid_type: “meta.iw_price is not of type number.”
    An unregistered key (color) Silently ignored, with no error
    Anonymous GET on a published post Registered meta is visible, including _iw_secret
    'sanitize_callback' => 'floatval' Fatal error: “floatval() expects exactly 1 argument, 4 given”

    Three gotchas here that most tutorials miss:

    • auth_callback protects writes, not reads. Never register a secret with show_in_rest.
    • WordPress passes 4 arguments to sanitize_callback, and strict PHP built-ins like floatval crash. Wrap them in a closure.
    • The sanitize_callback also runs on direct PHP calls. Our update_post_meta( 4, 'iw_price', '7.456abc' ) was stored as '7.46'.

    Site-wide settings work the same way through register_setting(). See our WordPress get_option() guide for the REST settings endpoint.

    Is update_post_meta() slow? (meta cache and performance)

    Measured database queries for get_post_meta, update_post_meta and update_meta_cache

    WordPress loads all meta for a post in one query and keeps it in the object cache. We counted $wpdb->num_queries:

    Operation DB queries
    5× get_post_meta() on one post (cold cache) 1
    Other keys on the same post afterwards 0
    update_post_meta() with a changed value 3
    update_post_meta() with the same value 1
    get_post_meta() in a loop over 20 posts 20
    The same loop after update_meta_cache( 'post', $ids ) 1
    • When you loop over IDs you fetched yourself, prime the cache with update_meta_cache( 'post', $ids ). WP_Query does this for you by default (update_post_meta_cache).
    • Each changed update_post_meta() clears that post’s meta cache. In bulk imports, compare values first or batch your writes.
    • wp_postmeta has no index on meta_value, so meta_query filters on large sites get slow. Use a taxonomy or a custom table for data you filter on heavily.
    • On a case-insensitive collation (the default, utf8mb4_unicode_520_ci), update_post_meta( $p, 'color2', 'Y' ) updated our existing Color2 row, but get_post_meta( $p, 'color2', true ) returned ''. Keep keys lowercase.

    Which hooks fire when post meta is updated?

    Hook When
    update_post_metadata (filter) Before saving. Return anything other than null to short-circuit. In our test, returning false blocked the write.
    add_post_meta / added_post_meta Before and after a new row is inserted (on the first update_post_meta() call for a key)
    update_post_meta / updated_post_meta Before and after an existing row changes. Doesn’t fire when the value is unchanged.
    sanitize_post_meta_{$meta_key} Sanitizes the value (this is what register_post_meta‘s sanitize_callback hooks into)

    update_post_meta vs add_post_meta vs update_metadata

    Function Use it when
    update_post_meta() One value per key: add or overwrite
    add_post_meta() Several values per key, or “only add if missing” ($unique = true)
    delete_post_meta() Remove one value or the whole key
    update_metadata() The same logic for any object type ('post', 'user', 'term', 'comment')
    update_user_meta() / update_term_meta() The equivalents for users and terms
    wp_insert_post( [ 'meta_input' => [...] ] ) Setting meta while creating or updating a post in one call
    update_option() Site-wide settings, not per post (see get_option())

    What are the most common update_post_meta mistakes?

    1. Treating false as failure. An unchanged value also returns false.
    2. Overwriting multi-value keys. Leaving out $prev_value overwrites every row.
    3. Breaking JSON. Values with backslashes need wp_slash().
    4. Using get_post_meta( ..., false ) for an array. It’s nested one level deeper, so use true.
    5. Skipping nonce and capability checks on save_post, and not skipping autosaves.
    6. Saving meta for post IDs that don’t exist. WordPress adds the orphan row without complaint.
    7. Thinking _keys are private. They’re only hidden from the meta box, and REST can still expose them.
    8. Running get_post_meta() in a loop without priming the meta cache.
    9. Using built-in PHP functions as sanitize_callback, which causes an ArgumentCountError fatal.

    Need the current page’s slug or title before saving meta for it? See how to get the current page name in WordPress.

    FAQs

    What does update_post_meta return?

    The new meta ID (int) if the key didn’t exist, true if an existing value changed, and false on failure or when the new value equals the stored one.

    Why does update_post_meta return false?

    Most often because the value is identical to what’s stored (including 5 vs "5"). It also returns false for a post ID of 0, an empty key, a $prev_value that doesn’t match, or a filter that blocks the write.

    Does update_post_meta create the key if it doesn’t exist?

    Yes. It behaves like add_post_meta() and returns the new meta ID.

    Does update_post_meta check that the post exists?

    No. In our test, update_post_meta( 999999, 'x', 'y' ) returned a meta ID for a post that doesn’t exist. Check with get_post() first.

    How do I update only one of several values with the same key?

    Pass the current value as the fourth argument: update_post_meta( $id, 'mood', 'excited', 'sad' ).

    Can I store an array with update_post_meta?

    Yes. WordPress serializes it automatically. Read it back with get_post_meta( $id, $key, true ).

    Why are backslashes removed from my meta value?

    update_post_meta() runs stripslashes() on input. Wrap the value in wp_slash() to keep backslashes in JSON or file paths.

    What is the difference between update_post_meta and add_post_meta?

    update_post_meta() adds or overwrites. add_post_meta() always adds a new row, unless $unique is true and the key already exists.

    How do I update post meta via the REST API?

    Register the key with register_post_meta() and show_in_rest => true, then send {"meta":{"key":"value"}} to /wp-json/wp/v2/posts/<id> as an authenticated user. Unregistered keys are ignored.

    Does update_post_meta work on revisions?

    If you pass a revision ID, the meta is saved on the parent post. In our test, the revision itself got nothing.

    Is calling get_post_meta many times slow?

    Not for one post. All its meta loads in one query and is then cached. Across many posts, prime the cache with update_meta_cache(), or let WP_Query do it.

    Conclusion

    update_post_meta() is simple to call but easy to misuse. Treat false as “maybe unchanged”, use $prev_value for multi-value keys, wp_slash() anything with backslashes, register keys before using them over REST, and prime the meta cache in loops. If you’d rather have a team build custom fields, meta boxes or a full plugin for you, our WordPress plugin development service can help.

  • Literally the Best Platforms: Showit vs WordPress

    Literally the Best Platforms: Showit vs WordPress

    In the digital age, having a website is essential for businesses, bloggers, and creatives. Two platforms that stand out in the website design landscape are Showit and WordPress. But which one is right for you? This article will provide a detailed comparison to help you make the best choice.

    Showit: An Overview

    Showit Logo

    Showit is a modern, drag-and-drop website builder known for its stunning design capabilities. It’s perfect for those who want to create visually appealing sites without needing to know code.

    WordPress: An Overview

    wordpress logo

    WordPress is a powerful content management system (CMS) that powers over 40% of the web. It’s a go-to platform for bloggers, e-commerce sites, and large businesses.

    Showit vs WordPress: A Comprehensive Comparison

    Feature/AspectShowitWordPress
    Ease of UseUser-friendly, drag-and-drop interface, no coding required.Steeper learning curve, more control, coding knowledge beneficial.
    Design FlexibilityKnown for beautiful, artistic designs, great for creative sites.Endless customization with themes and plugins, versatile.
    SEO CapabilitiesBasic SEO tools, may require additional efforts for advanced SEO.Robust SEO capabilities with plugins like Yoast, preferred by experts.
    Performance and SpeedGenerally good but may vary with design complexity.Known for speed, especially with proper optimization and caching.
    PricingSubscription-based pricing with different tiers.Free to use, costs may arise from hosting, themes, plugins.
    Security MeasuresBuilt-in security features, SSL certificates.Requires regular updates, security plugins for optimal protection.
    Community and SupportOfficial support, community of designers.Extensive community support through forums, blogs, tutorials.
    Integration and PluginsLimited integration options.Thousands of plugins available for various functionalities.
    Mobile ResponsivenessDesigns are mobile-friendly, adapt to different screen sizes.Themes must be chosen carefully for mobile optimization.
    E-commerce CapabilitiesLimited e-commerce options, suitable for small stores.Robust e-commerce capabilities with plugins like WooCommerce.
    Content ManagementSimple content management, best for visual sites.Advanced content management, ideal for blogs and large sites.
    Migration and PortabilityPossible but may require professional help.Easier migration options with various tools and plugins.
    User Reviews and TestimonialsPraised for design and ease of use, criticized for limited functionality.Loved for flexibility and community support, may be complex for beginners.
    ProsBeautiful designs, ease of use.Flexibility, community support.
    ConsLimited functionality, higher cost.Steeper learning curve, potential security risks.

    Conclusion

    Choosing between Showit and WordPress is a significant decision that depends on your specific needs, budget, and skills. Both platforms offer unique features and benefits, and understanding them will help you make the best choice for your website.

    Frequently Asked Questions​

    Showit is a visual website builder known for its artistic designs and ease of use, especially for beginners. WordPress is a robust content management system (CMS) offering extensive customization and functionality. While Showit focuses on visual appeal, WordPress provides more control and versatility.

    Showit is generally considered more beginner-friendly due to its drag-and-drop interface and no coding requirement. WordPress, while offering more control and flexibility, may have a steeper learning curve for those new to website development.

    Showit operates on a subscription-based pricing model with different tiers, while WordPress itself is free to use. However, costs may arise in WordPress from hosting, themes, plugins, and other additional features.

    Migration between Showit and WordPress is possible but may require professional assistance or specific tools, depending on the complexity of the site.

    Showit offers basic SEO tools but may require additional efforts for advanced optimization. WordPress, on the other hand, has robust SEO capabilities, especially with plugins like Yoast, making it a preferred choice for SEO professionals.

    For e-commerce, WordPress typically offers more robust capabilities, especially with plugins like WooCommerce. Showit has limited e-commerce options, making it more suitable for small stores or simple selling functionalities.

    Showit offers built-in security features and SSL certificates. WordPress requires regular updates and may need additional security plugins for optimal protection. Both platforms prioritize security, but the measures may vary.

    Both Showit and WordPress offer customization options. Showit focuses on visual design with a user-friendly interface, while WordPress offers endless customization through themes, plugins, and coding.

    Showit offers official support and has a community of designers for assistance. WordPress has extensive community support through forums, blogs, tutorials, and a vast network of developers and users.

    Choosing between Showit and WordPress depends on your specific needs, preferences, budget, and skills. Showit is ideal for visually stunning, artistic sites, while WordPress provides more functionality and control. Consider factors like design, functionality, SEO, pricing, and support to make the best choice for your website.

  • Steps to fix hacked WordPress website

    Steps to fix hacked WordPress website

    Is your WordPress site hacked? Don’t panic! I’ll guide you through the steps to fix a hacked WordPress website in this article.

    First, understand that WordPress is secure. However, hacking is still possible. Various reasons could explain why your site was hacked.

    We’ve assisted many website owners over the past years. We’ve helped them recover hacked sites and remove malicious code.

    WordPress powers 43.1% of all websites on the internet. That makes it a tempting target for hackers.

    Forbes published a report with a startling fact. Almost 30,000 websites get hacked daily. Seeing your website hacked is stressful.

    A hacked site damages your reputation. It affects your customers and Google rankings. Therefore, fixing it quickly is crucial to avoid impacting your business.

    Things to know before we start

    No website is 100% secure. Hundreds of vulnerabilities are found daily. Hackers can exploit these to hack sites. It’s not always the WordPress core files at fault.

    The PHP version on your server may be the issue. It could be anything. So, use the latest versions of both the CMS and PHP.

    Google and some browsers may warn visitors about hacked sites. This warning harms your website’s reputation. Hacked websites often contain or point to inappropriate content.

    Website security must be a top priority if you run an online business. It’s vital to pick a reputable hosting company.

    Good hosting companies update their servers and scan hosted sites regularly. We’ve used LiquidWeb for years without compromise. Regular backups are also essential; ask your host for auto-backup.

    You can use online scanners like Sucuri to check for hacks. We’ve used this site to scan client websites for malicious code.

    About 40% of websites get hacked through server vulnerabilities. Good hosting, regular backups, and scanning are essential for security.

    But if you’re reading this, your site might be hacked. Or you want to secure your WordPress website.

    How to identify if a WordPress website is Hacked?

    Using View Source

    Open your website in a browser. Right-click and select “View Page Source.” Look for unfamiliar website links. Search for anything you didn’t add to your pages.

    You might find HTML iframe codes. Words like Viagra or Cialis could appear on the pages. You may not see these words or links upfront.

    Hackers often hide these with CSS. They set the properties to ‘hidden’ or ‘none.’ The page loads these hidden elements, but users don’t see them.

    When Google crawls your website’s pages, it may mark the site as spam or hacked. This occurs because of these hidden elements.


    Redirections

    If you see that your website gets redirected to any different pharma, porn or weird websites, then it is a confirmation that the site has been hacked.

    Keyword Autolink

    Some hackers insert scripts into the WordPress site which auto links the words in your website to some other websites.

    Crashing and Freezing

    Upon visiting, the site loads slowly, crash and freezes. The reason behind this is the script that has been added to the site by the hacker.

    Unnecessary Popups and Windows

    Popups, alerts and new windows to different porn or objectionable URLs open when the site is visited.

    Notices and Alert from Hosting Provider

    Most of the hosting providers send you emails and alerts if any files get infected by malicious code or scripts. If you are using shared hosting, then other sites in the host generally get affected in such situations.

    So, these are some of the techniques to find out if a website is hacked. Now let me tell you how you can fix the hacked WordPress website.

    If you want your things to get done quickly without wasting a single minute, then you can hire a professional to fix the site for you.

    Hire website security Professional

    If you’re a skilled web security professional, you can handle this. Not a coder or comfortable with servers? Then hiring a WordPress Security Expert is recommended.

    An expert can investigate the cause. They can find infected files, remove malicious code, and restore the website.

    Hackers often inject malicious code into many files. Every file on the server must be scanned and checked precisely. Even one hacked file can ruin the site again.

    As said, we have been fixing and cleaning up Malware from WordPress websites for years; so you may consider us to help you with securing your WordPress website. We charge between $99-$199 depending upon the severity.

    Well, this is a secondary option. Let me first guide you the steps to remove Malware and clean up your hacked WordPress website.

    Okay, let’s begin.

    Step 1: Scan the computer which connects to the server

    Before you start any fixes to the website, the first and foremost thing is to scan your computer, which gets connected to the server via FTP. If your computer is affected by Malware, virus and Trojans, the FTP details get stolen by the hackers. I would recommend you to use a reputed anti-virus and then connect to the server.

    Step 2: Change all the passwords

    After scanning your website, you should change the usernames and passwords of FTP, WordPress Admin area login details and hosting details. Use a strong password for all the three. You can also use a strong password generator and keep the password safe.

    Step 3: Contact the Hosting Provider

    If you are using a shared server, then ask your host to check if other sites in the host are affected. Most of the hosting providers are helpful and scan the entire server to remove the Malware and update the security settings of your files.

    We had a horrible experience with our last hosting provider which hosted our site on a shared server and didn’t bother to update the server or remove Malware, so we moved our site to a VPS after cleaning the site. You may change your host or your hosting plan. Now follow the next step if your host isn’t helpful.

    Step 4: Restore from Backup

    If you regularly backup your WordPress website, then you won’t have any issues in deleting all the hacked files and replacing those with the backup files. Don’t delete the database as you might lose the changes you have done to the posts or pages. If you don’t have a backup, then follow the next step.

    Step 5: Download WordPress from Official Website

    If you don’t have a backup, then the last thing to do is downloading the version of WordPress that your website is using from the official website and UNZIP it to a folder.

    Step 6: Remove Infected files

    Now that you have cleaned your computer and extracted the WordPress files from the official site, you can now login to your website using FTP or web-based file manager and go to the folder where you have installed your WordPress and delete all the files except wp-config.php and the wp-content folder.

    Check the wp-config.php file and other files inside the wp-content folder properly and make sure that the file doesn’t contain any malicious code. Remove additional files with weird names. You can search for a PHP function base64(); which is used by the hackers to encrypt the data. Try to remove those codes. You can also use an online base64 decoder to check and verify the encrypted infected codes.

    For example, you see some data like this PGEgaHJlZj0iaHR0cHM6Ly93d3cuaW5meXdheXMuY29tIj5JbmZ5d2F5czwvYT4 . Copy the encoded contents and decode it. The decoding code shows you the following:

    <a href="https://data.infyways.com/new">Infyways</a>

    Check all the folders inside the wp-content thoroughly. You can also remove the WordPress plugins folder and the themes which you aren’t using. If you have a clean backup of your active theme, then you can delete all the themes. Plugins can be installed later once you complete the process.

    Step 7: Re-Upload Core WordPress Files

    If you have checked all the files which are there in the server, the next step is uploading the extracted WordPress files (Step 5) into the server through FTP.

    Step 8: Update the site and files

    Once you re-upload the core files, you can now login to the backend and install all the missing plugins and themes. Activate the theme and plugins. Your site is ready now, but it is still not secured. Follow the next step and make the site secured.

    Step 9: Securing a WordPress Website

    • Download all the plugins from the official repository of WordPress.
    • Don’t’ use nulled theme or plugins. All nulled files have malicious or infected codes inside them.
    • Set the folder permission to 755 and files to 644. Avoid chmod permission 777
    • Check the list of users and see if it contains any new user with admin access. An admin has access to change the theme files directly in the wp-admin or WordPress Dashboard.
    • You can set up a firewall monitoring system by installing plugins such as Acunetix or Sucuri. These security plugins enhance security and block the attack on the website.
    • Disable file edits in the backend.
    • Limit the login attempts in the backed. This can be done by installing a plugin called Limit Login Attempts

    Step 10: Remove Google Malware Warning

    Site Harmful Browser Screenshot

    Removing Malware warning is the last step which has to be done once your site is free from malware infection. You can submit the website to Google for review once again in order to remove the warning “This site may harm your computer”. The warning can be removed using the Google Webmaster Tools.

    Conclusion

    Never use nulled WordPress themes or plugins and keep your WordPress, themes and plugins updated. If you don’t, the website may get hacked and ultimately lose rank on SERPs. The recent Google algorithm impacts the hacked or spam website. So, keeping your website secured should be your utmost priority.

    I hope the guide must have helped you to fix hacked WordPress website. If you are still facing issues, then feel free to contact us. We are happy to help you any time.

    Frequently Asked Questions​

    When your WordPress site is hacked, you can follow these steps: Scan your computer for malware, change all your passwords (FTP, WordPress admin, and hosting), contact your hosting provider, restore your website from a backup if available, remove infected files, re-upload core WordPress files, update your site and files, and secure your WordPress website. Lastly, remove the Google malware warning.

    Yes, a hacked website can be restored. If you have a clean backup of your website, you can delete all the hacked files and replace them with the backup files. If you don’t have a backup, you can manually clean the infected files, re-upload the core WordPress files, and update your site.

    WordPress websites can be hacked due to various reasons such as weak passwords, out-of-date software, plugin and theme backdoors, vulnerable file permissions, and insecure hosting providers. Hackers often target WordPress due to its popularity.

    To remove a virus from WordPress, you need to scan your website for malware, remove the infected files, and re-upload the clean files. You can use various security plugins available for WordPress to scan and remove the malware.

    You can secure your WordPress website by using strong passwords, keeping your WordPress, themes, and plugins updated, using trusted themes and plugins, limiting login attempts, implementing SSL encryption, and installing a web application firewall.

    Signs that your WordPress website has been hacked include unexpected redirects, spammy on-site content, warnings from Google or web host, unexplained accessibility issues, and website behaving strangely.

    If you can’t fix your hacked WordPress site on your own, you should contact a professional WordPress security service. They have the expertise to clean your website and secure it from future attacks.

    To prevent your WordPress website from being hacked in the future, ensure your passwords are secure, keep everything updated, use trusted themes and plugins, delete unused plugins and themes, protect your website from malware, and find a reputable hosting company.

    A nulled theme or plugin is a premium theme or plugin that has been cracked and made available for free illegally. You should avoid it because it often contains malicious or infected codes that can harm your website.

    Once your site is free from malware infection, you can submit your website to Google for review to remove the warning “This site may harm your computer”. You can do this using Google Webmaster Tools.

  • A Complete Guide to Improving WordPress Tag Clouds

    A Complete Guide to Improving WordPress Tag Clouds

    When you visit a website, you often see a bunch of words or tags grouped together, right?
    These are called tag clouds. They help you find the most popular topics on the website and make it easy for you to explore different content. But sometimes, the tag clouds in WordPress, a popular website-making tool, aren’t very good.
    Don’t worry, though! This guide will teach you how to make better tag clouds that will make your website visitors happy.

    What Are Tag Clouds?

    Tag clouds are like signposts on a website. They help you navigate through all the content available. The more a tag is used, the bigger or brighter it appears in the tag cloud. This way, visitors can easily find and explore topics they’re interested in.

    Think of your website as a huge library, and the tag cloud as the index. Just by looking at the tag cloud, users can find popular topics and dive into the content they like. Tag clouds give your audience the freedom to explore without feeling lost.

    What Makes Up a Tag Cloud?

    A tag cloud is made up of tags, which are clickable links. They are displayed in different sizes or colors based on how important they are. The size or color shows how often the tags are used, helping users explore content easily.

    Why Good Tag Cloud Design Matters

    Organizing Tags

    To make a better tag cloud, you need to sort your tags properly. Group them based on topics or how related they are. This will make your tag cloud easier to use.

    Making Tag Clouds User-Friendly

    The best websites focus on user experience. When you design your tag cloud, make sure it’s easy to use on all devices and screen sizes. This way, everyone can have a great experience, no matter what device they use.

    Making Tag Clouds Look Good

    A good-looking tag cloud can make users want to explore more. Try using cool fonts, bright colors, and nice layouts. This will make users want to click on the tag cloud and explore your content.

    How to Build Better WordPress Tag Clouds

    Picking the Right Plugin

    WordPress has many tag cloud plugins. Choose one that helps you reach your goals and lets you customize your tag cloud. Plugins like “Tag Cloud Magic” or Cool Tag Cloud let you control how your tag cloud looks and works.

    Adjusting Tag Cloud Settings

    Changing the tag cloud settings can help it match your website’s look and goals. You can change things like font size, color scheme, and how many tags are shown to make your tag cloud look good and easy to use.

    Making Tag Clouds Work on All Devices

    More people are using their phones to browse the web. So, it’s important to make sure your tag cloud looks good on all devices. Use responsive design techniques to make tag clouds that work well on different screen sizes.

    Adding Fun Visuals

    Tag clouds don’t have to be boring. Add fun visuals like icons, pictures, or custom images as tags. This will make your tag cloud more interesting and inviting.

    Best Practices for Tag Clouds

    Creating a Good Tag Structure

    A well-organized tag cloud needs a good tag structure. Look at your content and find common themes or categories. Create a logical structure that helps users navigate.

    Grouping Tags

    Tags work even better when they’re grouped into categories. For example, if you have a food blog, you could create categories like “desserts,” “main courses,” or “vegetarian.” This helps users find specific content easily.

    Being Consistent and Avoiding Duplicate Tags

    Make sure you use tags consistently across your content. Don’t use synonyms or similar terms as separate tags. This makes it easier for users to find what they’re looking for.

    Updating Tags

    Over time, you might end up with tags that you don’t use anymore. Regularly check your tag cloud and remove or combine tags that are too similar. This keeps your tag cloud up-to-date and accurate.

    Advanced Tips for Improving Tag Clouds

    Using SEO

    SEO, or Search Engine Optimization, helps your website show up in search results. Use relevant keywords in your tags and their descriptions to improve your website’s visibility. A well-optimized tag cloud can help your SEO efforts.

    Using Plugins for Customization and Optimization

    Plugins can be really helpful for customizing and optimizing your tag cloud. Try plugins like “Tag Manager” or “Custom Taxonomies Menu Widget” to unlock more customization options and improve user experience.

    Using Widgets

    Widgets let you show your tag cloud in different places on your website. Try putting the tag cloud in easy-to-find areas, like the sidebar or footer. This encourages users to engage and explore.

    Linking Tag Clouds to Related Content

    Link your tag cloud to related content on your website. When users click on a tag, take them to a page that shows related articles or posts. This encourages users to explore more and stay on your site longer.

    Making Tag Clouds More Interactive

    Adding Filtering and Sorting Options

    Let users filter or sort tags based on what they want. Add options like alphabetical sorting, popularity sorting, or category filtering. This lets users customize their exploration experience.

    Adding a Search Feature

    Make it easier for users by adding a search feature to your tag cloud. This lets users search for specific tags and find relevant content quickly.

    Using Tooltips

    Tooltips give users more information about tags. When users hover over a tag, show a tooltip with a brief description or related stats. This makes the user experience better and encourages users to engage more.

    Adding Animations

    Animations can make a lasting impression. Consider adding subtle animations or hover effects to your tag cloud. These small interactions make your tag cloud more fun and interesting.

    How to Measure Tag Cloud Performance

    Analyzing User Interactions

    Use tools like Google Analytics to track how users interact with your tag cloud. Look at things like how often users click on tags, how long they spend exploring tags, and which tags get the most clicks. This can help you understand user engagement and make improvements.

    Tracking Click-through Rates

    Find out which tags are popular by tracking how often they’re clicked. Use this data to make popular tags more noticeable. This attracts user attention and encourages them to explore more.

    Using Analytics Tools

    Use analytics tools designed for tag clouds, like “Tag Cloud Analyzer” or “Tag Manager Analytics.” These tools give you detailed insights into how your tag cloud is performing and how users are interacting with it.

    Conclusion

    Improving WordPress tag clouds is a journey. By understanding what tag clouds are, using best practices, and trying out advanced techniques, you can make your tag cloud a powerful tool that makes your website visitors happy.

  • Disable Joomla extension update notification?

    Disable Joomla extension update notification?

    To maintain the Joomla security and functionality of websites, it’s crucial to regularly update both the site and the third-party extensions used. Regular updates address a variety of issues, including enhancing functionality features, upgrading PHP functions, and ensuring compatibility with the latest Joomla versions.

    However, some website owners hesitate to update extensions. This could be due to modifications they’ve made to the extension’s core files, which they fear might be overwritten, or they may be reluctant to purchase the commercial extension after the license expires. As a result, they frequently encounter a red notification upon logging into the Joomla backend.

    To disable the update notification for specific extensions in the backend for Joomla 4.x.x, follow these simple steps:

    Step 1: Log in to the backend of your Joomla website using the Super admin login details.

    Step 2: Navigate to the System Menu > Update > Update Sites.

    Update sites

    Step 3: On the Update Sites page, you’ll find a list of Update Sites with an XML link below each. Select the extension for which you want to disable the update notification.

    Update sites manager

    Step 4: Select the extension(s) and click on the disable button. To clear the Joomla cache, go to the System menu > Clear Cache.

    By following these steps, you can manage your Joomla upgrade issues more effectively, ensuring a smoother and more secure user experience.