There are also big differences between hosting providers. Some focus on low-cost shared hosting, while others offer managed WordPress hosting, cloud hosting, or plans built for businesses and agencies. The tools included with each plan can vary just as much. Backups, staging sites, caching, security, migrations, CDN access, and developer tools may be included, limited, or cost extra.

This comparison looks at six popular WordPress hosts: WordPress.com, Bluehost, Pressable, Cloudways, Kinsta, and SiteGround. Each provider has been tested and compared across the areas that matter when running a WordPress website.

The goal isn’t to name one host that works for everyone. A personal blog, WooCommerce store, client website, and busy online publication have very different hosting needs. Instead, the results should make it easier to see where each provider works well, where it falls short, and which type of WordPress website it suits best.

Best WordPress Hosting: Quick Recommendations

Not everyone needs to compare every plan and technical detail. These recommendations offer a quick starting point based on common WordPress projects. Each host has been selected for a different type of user, with performance, management tools, support, pricing, and the overall hosting experience taken into account.

Best Overall WordPress Host: WordPress.com

WordPress.com is our best overall host because it combines managed WordPress hosting with the flexibility and ease of use many websites need. It works well for blogs and business sites, with plans suitable for larger publications and WooCommerce stores.

Much of the technical work is handled for you, including caching, security, updates, SSL, and CDN access. All paid plans now support third-party plugins and custom theme uploads. Business adds daily backups, staging, SFTP, SSH, database access, WP-CLI, and other developer tools.

WordPress.com is run by Automattic, a company with deep ties to the WordPress open-source project and WordPress.org. That experience carries through to its managed hosting and support, which is useful when a problem involves both WordPress and the hosting platform.

There is less server maintenance to handle, while developers can choose Business when they need more advanced access. Those needing full server control may prefer cloud or VPS hosting.

Pricing varies between plans, so always compare promotional rates with the normal renewal price.

Further Information:

WordPress.com Plans & Pricing

• Personal: Supports third-party plugins and themes, custom CSS and code, along with security, support, and migration tools.
• Premium: Includes everything in Personal, with additional design, analytics, SEO, advertising, and monetization tools.
• Business: Adds daily backups, staging, SFTP, SSH, WP-CLI, database access, GitHub deployments, and other developer tools.
• Commerce: Includes the tools available with Business and adds WooCommerce and online selling tools.

All data correct as of August, 2026.

Best WordPress Managed Host: Kinsta

Kinsta is our choice for the best managed WordPress host. It is built for WordPress sites that need strong performance, reliable hosting, and useful management tools without the site owner having to manage the server.

Every WordPress site runs in its own isolated container, with access to Kinsta’s cloud infrastructure and a choice of 30 data center locations. Server caching, edge caching, a Cloudflare-powered CDN, security, daily backups, and performance monitoring are included.

Kinsta also provides a strong set of developer tools, including DevKinsta. SSH and SFTP are included with all WordPress hosting plans, WP-CLI is installed by default, and staging gives developers a separate platform to test changes. MyKinsta also offers database management, logs, analytics, and Kinsta’s APM performance tool.

The main drawback is price. Kinsta costs more than budget WordPress hosting, so it is harder to justify for a small personal site. But for businesses, busy publications, stores, and other sites where performance and support matter, the extra cost makes sense.

Further Information:

Kinsta Plans & Pricing

• Single Site Plans: Built for one WordPress website, with several levels based on traffic or bandwidth. All include CDN, edge caching, daily backups, staging, security, migrations, SSH, SFTP, and WP-CLI.
• Multiple Site Plans: Designed for users who manage several WordPress installations. These plans increase the number of sites and available resources while keeping them under one Kinsta account.
• Agency Plans: Made for agencies that manage larger collections of client sites. They provide higher limits and more capacity while retaining the same managed WordPress platform and development tools.
• Custom Plans: Available for WordPress projects that need more resources than the standard plans provide. These are better suited to very busy sites and projects with unusual hosting requirements.

All data correct as of August, 2026.

Best WordPress Blogger Host: Cloudways

Cloudways is our choice for the best WordPress blogger host, particularly for established blogs and publications that have grown beyond basic shared hosting. It provides managed cloud hosting while still giving site owners more control over server resources than most managed WordPress platforms.

With Cloudways Flexible, WordPress can run on cloud infrastructure from DigitalOcean, Vultr, Linode, AWS, or Google Cloud. You choose the provider, server size, and location, while Cloudways handles much of the server setup and management. Resources can also be increased as traffic grows.

WordPress tools include server caching, staging, cloning, automated backups, SSL, migrations, security tools, SSH, SFTP, Git, and WP-CLI. Multiple WordPress sites can also run on the same server, provided it has enough resources.

This flexibility is why Cloudways works well for established bloggers. A growing publication can increase its hosting resources without moving to another platform. The tradeoff is complexity. There are more server settings to understand than with WordPress.com or Kinsta. But for bloggers comfortable managing WordPress, that extra control can be useful.

Further Information:

Cloudways Plans & Pricing

• DigitalOcean: The most practical starting point for many WordPress blogs. Plans provide dedicated cloud resources, SSD or NVMe storage, vertical scaling, and a choice of server locations.
• Vultr: Offers a broad choice of data center locations and server configurations. It is useful when the main audience is closer to a Vultr location or a different server setup is required.
• Linode: Another option for blogs that want predictable cloud resources and a choice of server locations while keeping Cloudways responsible for much of the server management.
• AWS: Uses Amazon Web Services infrastructure and provides more server configuration choices. It is generally more expensive and is better suited to sites with requirements that justify the added cost.
• Google Cloud: Runs WordPress on Google Compute Engine through the Cloudways dashboard. Like AWS, it provides flexible server resources but usually costs more than the simpler cloud options.

All data correct as of August, 2026.

Best WordPress Developer Host: Pressable

Pressable is our choice for the best WordPress developer host. It is a fully managed WordPress platform from Automattic, the company behind WordPress.com and WooCommerce, and runs on its WP Cloud infrastructure. That WordPress focus is one of the main reasons it works so well for development work.

Developers get staging and sandbox environments for every site, along with SSH, SFTP, WP-CLI, Git, database access, and other tools needed for building and maintaining WordPress sites. DupliKits can also be used to create reusable site templates, which can save time when several projects start with a similar setup.

Pressable handles much of the hosting work in the background. Hourly and daily backups, caching, security monitoring, automatic scaling, a global CDN, and site migrations are included. There is also 24/7 support from a team that works with WordPress every day.

Pricing is higher than budget hosting, but that is not really what Pressable is competing with. The value comes from reducing server maintenance while keeping the development tools needed for regular WordPress work. For freelance developers and teams managing several sites, that balance makes Pressable a strong choice.

Further Information:

Pressable Plans & Pricing

• Signature 1: Supports one WordPress site, 30,000 monthly visits, and 20GB of storage. Suitable for developers managing a single business or client site.
• Signature 2: Supports three WordPress sites, 50,000 monthly visits, and 30GB of storage. Useful for developers who manage a small collection of client sites.
• Signature 3: Supports five WordPress sites, 75,000 monthly visits, and 35GB of storage. Offers more room for freelancers maintaining several active WordPress projects.
• Signature 4: Supports ten WordPress sites, 150,000 monthly visits, and 50GB of storage. Excellent for developers and small teams that manage a larger group of websites.
• Signature 5 and Above: Plans increase from 20 to 100 WordPress installations, with higher traffic and storage limits. They are aimed at larger development teams and agencies with many sites.

All data correct as of August, 2026.

Best WordPress Agency Host: SiteGround

SiteGround is our choice for the best WordPress agency host. It combines managed WordPress hosting with tools for building, testing, managing, and handing client websites once a project is complete and launched. GrowBig and GoGeek also allow multiple websites under one account, which makes them better suited to agency work than the single site StartUp plan.

SiteGround handles many routine hosting jobs, including WordPress updates, daily backups, caching, CDN access, SSL, security, and server maintenance. GrowBig and GoGeek also include WordPress staging, while developers have access to SSH, SFTP, WP-CLI, databases, and other common development tools.

The agency tools are the main reason for choosing SiteGround here. Team members can be added as collaborators without sharing the main account login. Finished websites can also be transferred to clients while the agency remains attached as a collaborator. GoGeek adds white label client access, so clients using Site Tools do not see SiteGround branding.

The main drawback is renewal pricing. SiteGround offers large discounts for the first year, but regular rates are much higher. Agencies should use those renewal prices when calculating the long-term cost of hosting client websites.

Further Information:

SiteGround Plans & Pricing

• StartUp: Supports one website, around 10,000 monthly visits, and 10GB of storage. It includes managed WordPress tools, daily backups, caching, CDN access, SSL, and email. The single site limit makes it less useful for agency hosting.
• GrowBig: Supports unlimited websites within its resource limits, around 100,000 monthly visits, and 50GB of storage. It adds more server resources, WordPress staging, on-demand backups, and collaboration tools. This is a good starting point for smaller agencies.
• GoGeek: Supports unlimited websites within its resource limits, around 400,000 monthly visits, and 100GB of storage. It provides more server resources and adds white-label client access, making it the strongest shared hosting plan for agencies managing client websites.

All data correct as of August, 2026.

WordPress.com is our choice for the best WooCommerce host. WooCommerce can now be installed on any paid WordPress.com plan, giving store owners more choice over how much hosting and how many store tools they actually need.

The close connection with WooCommerce is a major advantage. WordPress.com and WooCommerce are both part of Automattic, so the hosting platform is built and supported by people with a deep understanding of WordPress and WooCommerce. This becomes useful when a problem involves the store, WordPress, and the hosting environment.

For larger stores, the Commerce plan includes everything in Business, along with WooCommerce and additional selling tools. This includes real-time backups, staging, SFTP, SSH, database access, payment tools, shipping integrations, automated taxes, product recommendations, and other WooCommerce extensions.

WordPress.com also handles much of the hosting work, including caching, security, updates, SSL, and server management. Store owners can concentrate on products, orders, customers, and sales rather than maintaining the server. It may cost more than basic WooCommerce hosting, but the managed setup makes more sense as a store becomes busier.

Further Information:

WordPress.com Commerce Plans & Pricing

• Personal: WooCommerce can be installed alongside third-party plugins and themes. It provides a low-cost starting point for a very small store, but it does not include the advanced backups, staging, and developer tools available on higher plans.
• Premium: Includes everything in Personal, along with additional design, analytics, SEO, advertising, and monetization tools. WooCommerce can be installed, although growing stores may benefit from the stronger hosting tools available with Business.
• Business: Adds real-time backups, staging, SFTP, SSH, database access, WP-CLI, and other developer tools. WooCommerce can be installed normally, making Business a good choice for store owners who want to build their own WooCommerce setup.
• Commerce: Includes everything in Business and adds WooCommerce with a collection of store tools and extensions. It supports unlimited products and orders, payments, shipping integrations, automated taxes, product recommendations, abandoned cart emails, and other selling tools.

All data correct as of August, 2026.

Best Budget WordPress Host: Bluehost

Bluehost is our choice for the best budget WordPress host. Its lower-priced plans provide the tools needed to run a blog, portfolio, small business site, or other WordPress project without paying the higher monthly cost of premium managed hosting.

WordPress hosting includes managed updates, SSL, CDN access, malware scanning, backups, migration tools, and a domain for the first year. Bluehost also provides a 99.99% uptime SLA and several server locations. WordPress setup and site management are handled through a dashboard aimed at users who may not have much hosting experience.

Starter is the obvious choice for smaller sites, while Business provides more storage, supports more websites, and adds further security and backup tools. Higher performance plans are available when a site needs more resources, so there is room to move beyond the entry-level packages.

The main issue is renewal pricing. Bluehost offers large discounts for the initial term, but the regular price is considerably higher. That needs to be included when comparing it with other budget hosts. For a smaller WordPress site where keeping the initial cost low matters, Bluehost still provides a strong set of hosting tools for the money.

Further Information:

Bluehost Plans & Pricing

• Starter: Supports up to ten websites with 10GB of NVMe storage. It includes managed WordPress updates, CDN access, SSL, malware scanning, weekly backups, migration tools, and a domain for the first year. It is the best fit for blogs and smaller WordPress sites.
• Business: Supports up to 50 websites with 50GB of NVMe storage. It provides more room for growing sites and is better suited to users managing several WordPress installations or a busier business website.

All data correct as of August, 2026.

Most WordPress hosts include more than just server space. Backups, staging sites, caching, CDN access, SSL, security, and migration tools reduce the amount of work needed to maintain a site. A host may advertise backups but run them only weekly, or offer staging only on its more expensive plans.

There is also a difference between a tool being included and it being well connected to the hosting platform. The right setup depends on whether the project needs simple management or greater control.

Developer requirements can be very different from those of someone running a single blog. Staging sites, SSH, SFTP, WP-CLI, Git, database access, logs, and local development tools will save a lot of time. They are also useful when testing updates or tracking down a problem without making changes directly on a live site.

Cloudways provides the greatest server control of the hosts compared here, while Kinsta and Pressable combine strong development tools with a more managed setup. WordPress.com also provides many common development tools on suitable plans. SiteGround covers most everyday development needs, while Bluehost provides enough access for many smaller projects.

The main question is how much control is actually required. More server access is useful for some developers, but it also means taking responsibility for more of the hosting setup.

AI tools are starting to appear in WordPress hosting platforms. Many providers now use it to help monitor websites, detect security threats, improve performance, and simplify routine management tasks. Some platforms also include AI assistants that can answer questions, troubleshoot common issues, or help configure hosting settings.

While these tools can save time, they shouldn’t be the main reason for choosing a host. Performance, reliability, support, and security still matter more. AI is best viewed as a useful addition rather than a replacement for a well-managed hosting platform.

The table below shows how the six hosts in this comparison currently approach AI.

All data correct as of August, 2026.

WordPress.com currently has the most complete AI setup of the hosts compared here. Its AI website builder can create a new WordPress site, while WordPress Agent continues working inside the site after it has been built. It can help with content, layouts, images, pages, and other editing jobs.

The more interesting addition for developers is MCP support. WordPress.com can connect with outside AI agents such as ChatGPT, Claude, Cursor, and other compatible tools. These agents can read site information and, with permission, carry out tasks such as creating posts, managing content, working with media, and changing site settings. MCP is available across paid WordPress.com plans.

Other hosts are using AI in narrower ways, often concentrating on initial site creation, content generation, or hosting support. Those tools can still be useful, but they should not be a major reason to choose a host on their own. Hosting performance, support, backups, security, development tools, and long-term cost still matter much more.

How to Choose a WordPress Host

Choosing a WordPress host is one of the biggest decisions you’ll make for your website. Your hosting provider affects performance, reliability, security, and how easy your site is to manage. The right host will keep your website running smoothly and give you access to support when you need it.

No hosting plan suits every website. A personal blog has different needs than an online store or an agency managing client sites. Knowing what your website requires before comparing providers will help you narrow your options and avoid paying for services you won’t use.

When comparing hosts, look at uptime, page speed, server locations, backups, staging sites, security, support, and renewal pricing. These factors often matter just as much as the monthly cost.

The articles below cover the main topics involved in choosing a WordPress host. Whether you’re building your first website or moving to a new provider, they’ll help you compare your options and make a confident choice.

WordPress Hosting for Different Needs

Choosing a hosting plan that matches your needs can improve performance, make your website easier to manage, and help you avoid paying for resources you won’t use. As your website grows, you can move to a plan with more storage, power, and management tools.

Whether you’re building your first WordPress website, running an online store, or managing client sites, understanding the strengths of each hosting option will make it easier to choose the right provider.

WordPress Performance & Security

A good hosting provider gives your WordPress website a solid foundation, but hosting is only part of the picture. Your website’s setup, the tools you use, and your security practices all affect performance, reliability, and keeping your visitors safe.

Many WordPress hosts include caching, content delivery networks (CDNs), backups, malware scanning, and SSL certificates. Knowing how these features work will help you get more from your hosting plan. Regular maintenance also helps keep your website running well. Updating WordPress, plugins, and themes, monitoring performance, and following good security practices can prevent many common problems.

The articles below cover the tools and techniques that can improve website speed, strengthen security, and simplify day-to-day management.

Managing Your WordPress Hosting

Launching a WordPress website is only the start. Regular maintenance helps keep your website secure, reliable, and running smoothly. Many hosting providers include tools that simplify routine tasks, but it still helps to understand how they work.

Common tasks include migrating websites, installing SSL certificates, updating PHP, managing domains, restoring backups, and monitoring uptime. Learning these skills will help you solve problems more quickly and get more from your hosting provider.

Whether you’re looking after one website or several client projects, a regular maintenance routine can reduce downtime and keep your websites in good shape.

The articles below cover the most common hosting management tasks and show you how to handle them with confidence.

• When Your WordPress Website Has Outgrown its Hosting

  How do you know when a hosting change is needed? Here are a few things to consider.

• Hosting Your Client’s WordPress Website

  Learn how to avoid common hosting mistakes when hosting WordPress sites for clients.

• Understanding Your Web Host

  Your host may not cover all your needs. Take these steps to ensure your website runs smoothly.

• Building a Performant WordPress Website

  Learn how to boost performance with better hosting, lighter themes, and smart optimzation strategies.

• What To Know About Your Client’s WordPress Website

  We cover what to check first, including themes, plugins, custom code, hosting, and unused tools.

• Add an SSL Certificate to Your WordPress Website

  A quick SSL certificate setup can mean big benefits for your site and visitors.

• WordPress Website Email Issues

  Learn how to test sending, check logs, change the from address, set up SMTP, or use a mail delivery service.

Final Verdict: Which WordPress Host Should You Choose?

WordPress.com is our best overall choice because it works for a broad range of WordPress projects while handling much of the hosting management. It is suitable for blogs, business websites, larger publications, and WooCommerce stores, with access to plugins, themes, staging, backups, security, caching, and development tools on suitable plans.

Kinsta is the better choice for users who want premium managed WordPress hosting and are willing to pay more for it. Cloudways suits established bloggers and publications that want greater control over server resources. Pressable is our choice for developers because its managed platform includes a strong set of WordPress development tools.

SiteGround makes sense for agencies managing several client websites, particularly when collaboration and site management tools are needed. And Bluehost remains the budget choice for smaller WordPress sites where keeping the hosting bill low matters more than having advanced management tools.

No host wins every category because WordPress websites have different requirements. The best option is the provider that has enough performance and resources for the site, includes the tools that will actually be used, and remains affordable after introductory pricing ends. For most WordPress users looking for a balance across those areas, WordPress.com gets our overall recommendation.

WordPress Hosting FAQs

WordPress hosting can look more complicated than it needs to be. Hosting companies use different plan names, prices, limits, and technical terms, even when the services are similar. These answers cover some of the most common questions about choosing and using WordPress hosting.

• What is the best hosting for WordPress?
  WordPress.com is our best overall WordPress host because it combines managed hosting with good performance, security, backups, CDN access, and WordPress support. Kinsta is our choice for managed hosting, Cloudways for bloggers, Pressable for developers, SiteGround for agencies, and Bluehost for smaller budgets.
• How much should WordPress hosting cost?
  Basic WordPress hosting can cost only a few dollars per month, while managed hosting may cost $20 to $50 per month or more. Larger sites and stores can cost considerably more. Always check the regular renewal price because introductory rates can make the first term look much cheaper.
• Do I need managed WordPress hosting?
  No. Smaller blogs, portfolios, and business sites can run well on lower-cost hosting. Managed WordPress hosting becomes more useful for busy sites, stores, and businesses that benefit from automatic backups, security, caching, staging, and WordPress-focused support.
• Can I change WordPress hosts later?
  Yes. WordPress sites can be moved between hosting providers. Many hosts provide migration tools or will move the site for you. Keep the old hosting active until the new site has been checked and the domain is pointing to the new server.
• Does better hosting make WordPress faster?
  Better hosting can improve WordPress performance by providing faster servers, more resources, caching, and CDN access. But hosting cannot fix every problem. Large images, heavy themes, slow plugins, external scripts, and database problems can still make a site slow.
• Is WordPress hosting different from regular web hosting?
  WordPress hosting is web hosting set up with WordPress in mind. It may include WordPress updates, caching, backups, security, staging, WP-CLI, and specialist support. WordPress can also run on regular hosting as long as the server meets its requirements.
• Do I need separate hosting for WooCommerce?
  No. WooCommerce runs on WordPress and does not require a separate type of hosting. But stores can need more server resources because carts, checkout pages, customer accounts, orders, and stock changes create more database activity than a typical WordPress site.
• How much traffic can WordPress hosting handle?
  There is no single number. A cached blog and a busy WooCommerce store can use very different resources even with the same number of visitors. Check the host’s traffic, bandwidth, storage, CPU, memory, and other resource limits before choosing a plan.

Read more articles by Paul Andrew

The post The Best WordPress Hosting in 2026 appeared first on The NOKIA Blog.

I’ve experienced both scenarios. Sometimes, there’s no rhyme or reason why clients come and go. You can do everything right, and still a client looks elsewhere when it’s time for a redesign or new project. Perhaps they were swayed by a sales pitch. Or, a new person comes in and wants to shake things up. It’s an unfortunate part of this business.

Regardless, there’s still work to be done. Their website may need to be migrated to a different host. Credentials need to be created for the new freelancer. There are project assets and notes to share.

It’s an awkward situation at best. But never fear, I have some tips for making the transition as smooth as possible. Keep reading to learn the do’s and don’ts of working with that new (or old) developer!

Keep It Professional

Maybe it sounds obvious. However, it’s easy to become emotional when letting go of a project (and its revenue). The same thing applies when you’re the new developer. Some clients will paint an unfortunate picture of their previous agency. Don’t get caught up in it.

Odds are, neither you nor the other party is evil or inept. There are always two sides to a story, and you’ll probably only hear one of them.

As such, there’s no reason to be rude or unhelpful. Answer questions, document processes, and respond within a reasonable period of time. These are common courtesies that will speed up the transition. After all, no one wants this thing to drag on for too long.

The funny part is that you may encounter the same developer again. For example, I’ve gained and lost clients to the same local agency. It’s a reminder to keep it professional and avoid burning bridges.

We may be competitors, but we’re all in the same boat.

Get Paid Before Doing the Work

These transitions can be especially frustrating if a client owes you money. They may expect you to work with their new developer with a promise to pay later. Avoid this scenario at all costs!

A client who is always late with payment is unlikely to make good on their debt after you’re gone. As such, getting paid should be a condition for transferring the site to someone else.

Create an agreement (in writing) that outlines what you need from them before you can do the work. Don’t provide a single file or login until that condition has been met. This places the ball firmly in their court. If they want to move on, they’ll need to settle their outstanding debt. It’s a perfectly reasonable request.

If the client balks at the idea, you may need to bring a lawyer into the fold. It’s not ideal, but it may be the only way you’ll get your money.

Think Before You Share Sensitive Information

Sharing credentials is part of any website transition. There are logins for hosting, content management systems (CMS) like WordPress, and third-party SaaS applications. Not to mention API keys and software licensing details.

You may be tempted to send a laundry list of logins to the new developer. However, it’s worth taking a step back and ensuring you aren’t exposing yourself to risk.

If you manage a client’s hosting or domain name, for example, be sure that anything you share is specific to their website. You wouldn’t want someone to have access to other client data. If possible, create delegate accounts that provide only the necessary permissions.

Also, create a new administrator account for their CMS, rather than sharing your login. This takes you off the hook for any user activity or, worse yet, a hacked password. And make sure your account is deleted when you’re out of the picture.

Software licensing can be tricky, especially if they aren’t under your client’s name. If you have a developer license for a WordPress plugin, consider your comfort level with allowing a client to continue using it. It might be worth recommending they purchase a separate license.

If you’re inheriting the site from another developer, think about what you’ll need. Ask about all of the above and find out as much as you can. The goal is to avoid any surprises once you take over.

Transitions Are a Part of the Job

It’s safe to say that no one enjoys transitioning a website from one developer to another. It’s often a messy process and can raise your anxiety levels, regardless of which side you’re on. But there’s an opportunity to make the best of a difficult situation.

Maintaining a professional attitude is a must. Treat it as just another business transaction and do your best to leave personal feelings out of it. Work with integrity and aim to produce the best possible outcome.

It’s also important to protect your interests. A client who’s leaving must live up to their end of the bargain. Don’t allow them to walk away without paying their outstanding balance. Also, be careful about the information you share with a new developer.

The most positive aspect is the experience you’ll gain. Learning to manage clients coming and going will serve you well. Doing so will allow you to focus on the task at hand while avoiding all the negatives. That’s great, because you’re likely to need those skills again and again.

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post How to Work With Your Client’s Next (Or Previous) Developer appeared first on The NOKIA Blog.

Designers, photographers, illustrators, and other creative professionals also have practical requirements. Staging makes it possible to test layout changes privately. Automatic backups protect client work, while collaboration tools can help freelancers and agencies manage several websites. Good support is also valuable when a technical problem interrupts a project or affects a live site.

This collection compares WordPress hosts based on the features that matter most to creatives. These include performance, media handling, storage, theme and plugin support, staging, backups, client management, and long term cost.

Some options are suited to a single portfolio, while others provide the tools needed to manage client websites or run a creative agency. The best choice depends on the type of work being presented and how much control the website owner needs.

Quick Recommendations

Each of these hosts suits a different type of creative website. WordPress.com offers the simplest overall package, while Kinsta and Pressable provide stronger tools for studios and client work. Cloudways gives experienced users more control, and Rocket.net is a good match for image heavy portfolios.

WordPress.com is the best choice for creatives who want managed hosting with little technical maintenance. Kinsta is better suited to established studios that place greater value on performance, staging, and developer tools. Pressable is worth considering when several client websites need to be built, tested, and managed from one account.

Cloudways offers more flexibility but requires greater technical confidence. Rocket.net offers managed performance and a built in CDN for visual websites with an international audience. SiteGround and Hostinger cost less at the start, although their renewal prices are considerably higher.

Prices shown are monthly equivalents based on the billing terms displayed by each provider.

What Creatives Should Look for in WordPress Hosting

Creative websites often contain large images, complex layouts, video, animation, and interactive features. These elements can place more pressure on hosting than a basic blog or small business website.

• Image and media performance: Look for server caching, CDN access, and enough storage for a growing media library. Image compression and support for WebP or AVIF can also help portfolio pages load faster.
• Theme and design tool support: The host should support custom themes and third party plugins. Designers using page builders, animation plugins, or Advanced Custom Fields may also benefit from higher PHP memory and stronger server resources.
• Staging and development tools: Staging allows design changes, theme updates, and new layouts to be tested privately. SFTP, SSH, WP CLI, Git, database access, and PHP controls are also useful for custom and client websites.
• Client and team management: Freelancers and agencies may need collaborator accounts, separate permissions, site cloning, and a central dashboard for managing several projects. Site transfer and billing handover tools can also simplify client delivery.
• Backups and site recovery: Automatic backups provide protection when an update, code change, or plugin conflict causes a problem. Check how often backups are created, how long they are stored, and whether the website can be restored with a single click.
• Pricing and renewal costs: Check the regular renewal rate rather than relying on the introductory price. Storage, traffic, staging, backups, email, and additional websites may depend on the plan, so the cheapest option is not always the best value.

Top WordPress Hosts for Designers & Creatives

1. Best Overall for Creatives: WordPress.com

WordPress.com is a good choice for creatives who want managed hosting without spending much time on server maintenance. Updates, security, backups, caching, and performance tools are handled for you, leaving designers to manage their website through a familiar WordPress dashboard.

The Business plan is the best fit for a professional portfolio or creative business. It includes 50GB of storage, a global CDN, staging, real time backups, and 250GB of separate VideoPress storage. Custom themes and third party plugins are supported, so designers are not limited to the themes and tools supplied. SFTP, SSH, WP CLI, Git commands, and GitHub deployments are also available for more advanced projects.

The main drawback is cost. Each website requires its own plan, which may not suit freelancers or agencies managing a large number of client sites. However, it remains a practical option for individual designers, photographers, illustrators, and creative businesses that want strong performance without dealing with the technical side of hosting.

• Recommended plan: Business.
• Best for: Professional portfolios and creative business websites.
• Key strength: Managed hosting with strong media and development tools.
• Main drawback: A separate plan is required for each website.

Read moreThe joy of art

Further Information:

2. Best for Creative Studios: Kinsta

Kinsta is well suited to established designers and creative studios that need dependable managed hosting for a professional portfolio, company website, or online store. Its platform handles caching, security, backups, and server maintenance, while the MyKinsta dashboard provides access to staging, analytics, redirects, and other WordPress tools.

Every plan includes a global CDN, automatic daily backups, free migrations, application performance monitoring, and malware removal. Designers can create a staging copy before changing a layout, installing a new plugin, or updating a custom theme. Site transfer and user access controls are also useful when a studio works with outside developers or needs to hand a project over to a client.

The main limitation for visual websites is storage. The entry plan includes 10GB, which may be restrictive for a large photography or video portfolio. Visitor, bandwidth, storage, and CDN limits can also lead to additional charges. Kinsta costs more than shared hosting, but its performance and management tools make it a strong option when the website supports an established creative business.

• Recommended plan: Single 20GB
• Best for: Established creative studios and professional portfolios
• Key strength: Managed performance and development tools
• Main drawback: Limited storage on the entry plan

Further Information:

3. Best for Freelance Designers: Cloudways

Cloudways is a good option for freelance designers who want more control than a typical managed WordPress plan provides. Websites run on cloud servers, with Cloudways supplying the dashboard, security tools, caching, backups, staging, and technical support.

The Flexible Micro plan includes 2GB of RAM, one virtual CPU, 50GB of storage, and 2TB of transfer bandwidth. It can host multiple WordPress installations, although every site shares the same server resources. Designers can create staging sites, clone existing projects, change the PHP version, and access files through SFTP or SSH. Monthly and hourly billing also make it possible to increase server resources as client work grows.

Cloudways requires more technical knowledge than WordPress.com or Kinsta. The dashboard includes server settings that may be unfamiliar to less experienced users. Cloudflare Enterprise is a paid addition on Flexible plans, while offsite backup storage is charged separately. Business email is not included. These extra costs need to be considered, but the flexible setup remains useful for freelancers managing several client websites.

• Recommended plan: Flexible Micro
• Best for: Freelance designers managing several websites
• Key strength: Flexible cloud resources and server controls
• Main drawback: More technical than fully managed alternatives

Further Information:

4. Best for Managing Client Websites: Pressable

Pressable is designed for WordPress professionals who build and maintain websites for clients. Its dashboard provides access to production, staging, and sandbox environments, giving designers separate spaces for development, testing, and client review.

The Signature plans include automatic backups, a global CDN, edge caching, free migrations, malware monitoring, and WordPress support. Granular collaborator permissions allow developers, designers, and clients to receive different levels of access. Pressable also provides site templates through DupliKits, which can save time when several projects use the same plugins, theme, or starting configuration.

The Signature 1 plan is suitable for a single client website, while higher plans support several installations. Storage and monthly visits are limited, and additional usage can result in extra charges. Pressable is also more expensive than placing several sites on one shared hosting account. However, its staging, sandbox, cloning, and collaboration tools make it a practical choice for designers who include hosting and maintenance in their client services.

• Recommended plan: Signature 1
• Best for: Designers building and maintaining client websites
• Key strength: Staging, sandbox, and collaboration tools
• Main drawback: Additional charges for storage and visitor overages

Further Information:

5. Best for Small Creative Studios: SiteGround

SiteGround is a practical choice for designers and small creative studios that need to host several websites without paying for each installation separately. Its custom Site Tools dashboard provides access to domains, email, backups, caching, security, and development tools.

The GrowBig plan supports unlimited websites and includes 50GB of storage, a CDN, daily backups, on demand backups, collaborators, and WordPress staging. Designers can test theme and layout changes before publishing them, while collaborator accounts allow clients or team members to access individual websites. Email hosting is included, which can reduce the need for another paid service.

The introductory price is low, but the renewal rate is much higher. SiteGround also uses shared hosting, so demanding WooCommerce sites or portfolios with heavy media libraries may require a more powerful plan. Even so, GrowBig offers a useful balance of storage, development tools, and multiple site support for small studios. Agencies needing Git, white label access, and priority support should consider the GoGeek plan.

• Recommended plan: GrowBig
• Best for: Small creative studios hosting several websites
• Key strength: Multiple websites with staging and collaboration tools
• Main drawback: A large price increase at renewal

Further Information:

6. Best for Portfolio Performance: Rocket.net

Rocket.net is a managed WordPress host built around Cloudflare Enterprise. Its global CDN caches website content closer to visitors, which can improve the delivery of portfolio images, fonts, scripts, and other visual assets to an international audience.

The Starter plan includes one WordPress website, unmetered visitors, 10GB of storage, 50GB of bandwidth, unlimited PHP workers, and a 99.99% uptime guarantee. Security features include a web application firewall, malware protection, and automatic updates. Daily backups are retained for 30 days, while free migrations are available for existing websites.

The 10GB storage allowance is the main concern for photographers and other creatives with large media libraries. Storage overages cost $2 per GB, so images should be resized and compressed before being uploaded. Video should usually be hosted through a separate video platform. Rocket.net is not the cheapest option for a single website, but its CDN, managed security, and straightforward pricing make it a strong choice when portfolio performance matters more than storage capacity.

• Recommended plan: Starter
• Best for: Portfolios serving visitors in several countries
• Key strength: Cloudflare Enterprise CDN included with every plan
• Main drawback: Only 10GB of storage on the Starter plan

Further Information:

7. Best Budget Option: Hostinger

Hostinger offers low cost managed WordPress hosting for designers creating a first portfolio, personal website, or small creative business site. Its custom dashboard handles WordPress installation, updates, backups, domains, email, and other common hosting tasks.

The Unlimited plan is the better choice for creative work. It includes 50GB of NVMe storage, daily backups, a CDN, and support for unlimited websites. One click staging allows designers to test theme updates and layout changes before publishing them. Email accounts, ecommerce support, and AI tools are also included, although some features are only available during the initial contract period.

The advertised monthly price requires payment for 48 months in advance. The plan renews at a much higher rate, so the full contract cost should be considered before signing up. Unlimited website claims are also governed by a fair usage policy, which means the account still has resource limits. Hostinger does not provide the same level of server control or advanced management tools found as other hosts, but it offers useful features for creatives working with a smaller budget.

• Recommended plan: Unlimited
• Best for: New portfolios and budget conscious creative businesses
• Key strength: Generous storage and multiple website support
• Main drawback: The lowest price requires a four year commitment

Further Information:

Performance Tips for Creative WordPress Websites

Good hosting can only do so much if images, video, fonts, and animation are not properly managed. The following steps can help keep a visual WordPress website responsive.

• Resize images to match the largest dimensions at which they will be displayed.
• Use WebP or AVIF files where browser support and image quality allow.
• Compress portfolio images before uploading them to WordPress.
• Use lazy loading so images outside the visible area are not loaded immediately.
• Serve images, scripts, and stylesheets through a CDN.
• Host long or high resolution videos through a dedicated video platform.
• Limit unnecessary font files, background videos, and complex animations.
• Test important portfolio pages on mobile devices and slower connections.
• Monitor storage and bandwidth use as the media library grows.

How the Hosts Were Assessed

Each host was assessed using its published plan details, feature documentation, pricing, and suitability for creative WordPress websites. The recommendations place particular weight on the following factors:

• Performance when serving images and other visual content.
• Storage, bandwidth, and visitor limits.
• Support for custom themes, plugins, and design tools.
• Staging, backups, site cloning, and recovery options.
• Developer access through SFTP, SSH, WP CLI, or Git.
• Tools for managing team members and client websites.
• Introductory pricing, renewal rates, and additional charges.

The final rankings reflect how useful each hosting service is for designers, photographers, freelancers, and creative studios. Pricing and plan limits were checked against the information published by each provider while this article was being prepared.

Final Verdict

WordPress.com is the best overall choice for designers and creatives who want managed hosting with strong media support. The Business plan includes 50GB of storage, separate VideoPress storage, staging, backups, a CDN, and developer tools. It is particularly well suited to professional portfolios and creative business websites.

Kinsta is a stronger option for established studios that value managed performance and detailed site controls. Pressable provides useful staging, sandbox, cloning, and collaboration features for designers maintaining client websites. Cloudways offers more server control and flexible resources, although it requires greater technical confidence.

SiteGround works well for small studios that want to host several websites from one account. Rocket.net is suited to portfolios with an international audience, but its storage limits need careful management. Hostinger is the most affordable option at the start and provides enough storage for a new portfolio, though its long contract and higher renewal rate should be considered.

Read more articles by Paul Andrew

The post Best WordPress Hosts for Designers & Creatives in 2026 appeared first on The NOKIA Blog.

In the early days of cloud computing, AWS supported intensive learning for builders in a physical space called the AWS Pop-up Lofts in cities worldwide. These spaces were accessible to startup entrepreneurs, developers, and others interested in learning more about AWS for events, meetings, and co-working. With the recent emergence of generative AI, AWS Gen AI Lofts provided pop-up style collaborative spaces across the world and immersive experiences for startups and developers.

We realized the need of permanent community spaces give students and developers a place to learn, connect, and contribute through hands-on experiences, community-led sharing, and technical collaboration. Since opening in San Francisco in July 2025, the first AWS Builder Loft has welcomed more than 22,500 developers through its doors, hosting hackathons, workshops, demo nights, and community-led events that bring the local tech community together under one roof.

Today, we are announcing plans to open new Builder Lofts in Berlin, Hyderabad, and São Paulo. Each location will be a permanent community space to offer free workshops, networking events, pitch nights, content creation spaces, collaboration/co-working areas, and event hosting for developers, students, or tech professionals who want to walk through the doors.

You’ll still be able to meet AWS experts there, but beyond that we further want to establish a home for local tech communities from AWS User Groups and AWS Student Builder Groups, to independent developer groups you’re already part of. As a tech community leader, you are welcome to request booking of our space to host your meetup at no cost.

Why three cities
The expansion reflects fast-growing developer cities which are important talent and innovation hubs for each region:

• Berlin: After launching AWS European Sovereign Cloud, we’re deepening our commitment to Europe’s developer community. Berlin’s Builder Loft will host educational sessions on digital sovereignty, hackathons, security-readiness workshops, and community meetups that connect Germany’s growing startup ecosystem with the broader European and global tech landscape.
• Hyderabad: The Hyderabad Builder Loft will give Indian developers a dedicated space to upskill on AI, explore cloud-native architecture, and connect with peers building the next generation of applications.
• São Paulo: Brazil’s cloud market is growing at 30% annually, and São Paulo sits at the center of Latin America’s tech boom. The Builder Loft will serve as a hub for the region’s developers, offering free programming in partnership with local communities, universities, and startup networks.

A typical week at the Builder Loft
The Builder Loft in San Francisco hosts four to eight community events weekly from technical deep dives on generative AI to startup pitch nights, from coding workshops for students to networking sessions that bring together developers from across the region.

The spaces are designed to be flexible. A training room fills with over 50 students on a Tuesday morning. By evening, it transforms into a demo stage where a startup showcases its latest prototype to a room of potential collaborators. On weekends, community groups host their own meetups.

What makes the model work is that it’s driven by the community itself. Local developers, meetup organizers, and tech leaders shape the programming. AWS provides the space, the infrastructure, and the support, but the energy comes from the builders who participate. Find upcoming events or request to host your own event at the Builder Loft San Francisco.

Stay tuned
We’ll announce Builder Loft openings in three cities in future blog posts, so stay tuned for updates! To learn more about Builder Lofts for details and to follow along for updates, read Rick’s blog post and visit the AWS Builder Loft page.

— Channy

The post In the works: AWS Builder Lofts in Berlin, Hyderabad, and São Paulo appeared first on The NOKIA Blog.

That tendency fades as you build your business. You move on to the bigger fish in the pond in an effort to make more money and expand your reach. Any small fish left in your portfolio could potentially hold you back from leveling up.

Even so, you’ll still hear from potential clients who want you to take on their small project. Or you might be asked to undercut a competitor’s price on a large WordPress site. Either way, it may lead to mixed feelings. How should you respond?

Established agencies don’t need to take every project. It’s worth considering where you draw the line, however. How small is too small? Does a lower upfront cost mean there’s no potential for future profit? And, is it ever worth taking on a large project for a bargain price?

These are important questions to ask as your business evolves. Let’s explore the pros and cons of “going low”. We’ll also share some tips for determining the minimum requirements for accepting a project.

Does the Project Offer Any Additional Benefits?

Money is an important part of any project (we all need to keep the lights on and the AI tokens flowing). However, there are other potential benefits. That may be enough to make a small or heavily-discounted project worthwhile.

For example, consider working with a charity or other non-profit organization. These clients are often bootstrapped and have a limited budget. As such, the project is more about doing good than making a big profit. This is both a source of pride and something you can use in your marketing efforts.

Likewise, some projects can open the door to a specific industry or clientele level. If you don’t have experience in the enterprise WordPress space, offering a discount could increase your chances of booking the gig. You exchange a bit of money for prestige in your portfolio. Proving your worth to one such client could make others take notice.

This won’t be the case for every project. There will always be clients looking to cut costs however they can. Others won’t have the resources to work with your agency. Still, some opportunities are beneficial beyond money.

Consider the Potential for Future Profit

Just because a project starts with a smaller profit doesn’t mean it has to stay that way. There is usually a path to increasing your revenue in the long term.

Maintenance packages are a great vehicle for keeping clients in the loop while creating dependable income. WordPress requires routine software updates, security monitoring, and hosting. Clients may also want to add new features as their website evolves. These are all things you can and should charge for.

Such recurring revenue is important for every agency and freelancer. New projects are harder to come by, and budget-conscious clients may be wary of spending big on redesigns. Maintenance and related subscription services improve your business’s sustainability.

This strategy also mirrors what we see in other industries. Clients are acquired with a lower starting cost, while the “real” money comes in the form of future services.

Book enough of these arrangements and you won’t be as susceptible to the boom/bust cycle of new design and development projects. Note that this is part of a bigger plan, rather than something to do on a one-off basis. So, think about how it fits into your business before making a decision.

Find the Price Point of Diminishing Returns

Every agency should have a minimum project price. This helps you avoid losing money and gives you more room to focus on your goals. But how do you determine that number?

You could come up with an arbitrary amount. Some agencies won’t touch a project for under $5,000, for example. It sounds reasonable. However, you still risk losing money on the proposition. It’s better to study your workflow and resources before setting a minimum.

The first consideration is the cost of taking a project from start to finish. Time spent on design and development is a part of the equation. But don’t forget about client communication, the revision process, and testing. Commercial theme and plugin licenses can also be a factor.

If your agency has employees, think about who will do the work. Their salary counts toward the ultimate cost. You might also consider where else they could be spending their time. For instance, will a small project take them away from a bigger one?

The same thing applies to solo freelancers. Lesser projects don’t always mean less work. They can overwhelm your calendar and take time away from your top clients.

Don’t leave it to guesswork! Set a minimum price based on facts. The result should be a profit margin you’re comfortable with.

Accept WordPress Projects That Are Worth Your While

Experience will help you determine which projects to accept and which ones to turn down. Yet, there’s value in digging deeper before deciding. There could be more to the story than you think.

Some projects offer long-term benefits that are easy to miss. You may find opportunities to stabilize your agency via recurring revenue. They might also be a gateway to establishing a new niche. In some cases, it’s worth taking a leap of faith.

Understanding the time and resources involved is key to the decision-making process. This will put you in a position to say “yes” or “no” with confidence. You’re also less likely to experience regret after the decision!

Take time to figure out what makes the most sense for your business. That will free you to move onward and upward.

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post How Low Will You Go for a WordPress Project? appeared first on The NOKIA Blog.

React Server Components don’t send HTML to your browser. They don’t send JSON either. When a server component renders, what actually travels over the wire is a custom streaming protocol called Flight. It’s a line-delimited format with its own type system, its own reference resolution, and its own rules for reconstructing executable behavior on the client.

Most React developers have never opened the Network tab and actually looked at a Flight payload. It looks like a mix of JSON fragments, dollar-sign-prefixed references, and module pointers that the React runtime silently reassembles into a live component tree. The framework handles it, so nobody questions it.

I’m not sure most teams have thought carefully about what that trust actually implies.

I started pulling apart the Flight protocol after CVE-2025-55182 dropped in December 2025. The security community called it React2Shell, and for good reason. It was a CVSS 10.0, unauthenticated remote code execution vulnerability sitting in the Flight deserialization layer. One crafted HTTP request to a Server Function endpoint, and an attacker had shell access. No credentials needed.

The federal Cybersecurity & Infrastructure Agency (CISA) added it to the Known Exploited Vulnerabilities catalog. Sysdig tied in-the-wild exploitation to North Korean state-sponsored actors deploying file-less implants through the Ethereum blockchain. That’s the kind of CVE that gets your attention.

After spending time in the source (mostly getOutlinedModel and getChunk, which is where the resolution logic that matters actually lives), I realized React2Shell wasn’t a one-off parsing bug. It was a symptom. Flight reconstructs executable references, lazy-loaded components, server RPC endpoints, and async state from a stream of text. That’s a deserialization system.

The attack surface extends well beyond a single missing hasOwnProperty check. This article covers how Flight works on the wire, where the deserialization sinks are, what attackers have already weaponized, and what’s still exposed.

This leads to a ranked, practical set of defenses for your own Server Components: schema validation on every Server Action, the server-only package, cross-site request forgery (CSRF) hardening beyond framework defaults, and an assessment of what the Taint API and Web Application Firewalls (WAFs) provide.

Table of Contents

Flight On The Wire

Open your browser’s Network tab on any Next.js App Router page and look for requests returning Content-Type: text/x-component. That’s Flight. It’s not a single JSON blob. It’s a streaming, line-delimited format where each line is a self-contained “row” that the client-side React runtime processes as it arrives over the connection.

Here’s what a simple Flight payload looks like in practice:

1:I["./src/components/ClientComponent.js",["chunks/main.js"],"default"]
2:J["$","article",null,{"children":"$1"}]
0:D{"name":"RootLayout","env":"Server"}

Row 1 is an import directive. It tells the client to load ClientComponent.js from the bundler’s chunk map. Row 2 is a JSON tree that constructs an <article> HTML element, and the "$1" inside children is a reference back to chunk 1 (the imported component). Row 0 defines the server execution context, marking this as a RootLayout running in the Server environment. Even in this tiny example, you can see the mix of structural data, module references, and cross-chunk pointers that makes Flight different from plain JSON.

The Row Format

Every row follows the same syntax: <ROW_ID>:<ROW_TAG><PAYLOAD>n. The row ID is a numeric identifier that other rows can reference. The tag is a single character (or short string) that tells the parser what kind of data follows. The payload is the actual content.

Here are the row tags I found while reading through the source:

So far, this might look like a benign structured data format with some custom tags, but the real complexity and attack surface live in the prefix system.

The $ Prefix System

This is where I started paying closer attention.

When the client-side parser encounters a string value starting with $, it doesn’t treat it as literal text. It intercepts the string, checks the prefix, and routes it through a type-specific resolution path. The parseModelString function in ReactFlightClient.js is where this happens. It’s essentially a big switch statement on the character after $.

Every other prefix resolves a chunk and gives you the parsed result. $@ hands you the raw internal Chunk object instead, the wrapper React uses to track resolution state, pending callbacks, and internal metadata (which is why it’s used for Promises and why exploits use it to get a mutable handle). Exposing framework plumbing through the protocol looks like a design mistake to me, though I’d be interested to hear the rationale if there is one.

And $: (property access) is the other critical prefix. It lets the protocol specify a path like $1:user:name, which tells the parser to resolve chunk 1, then access .user, then access .name on the result. That’s arbitrary property traversal driven by data in the stream. If you’ve spent any time auditing JavaScript for prototype pollution, that pattern should feel familiar.

This Is Not Just A Data Format

Flight is not JSON with extra steps. JSON gives you data. Flight gives you behavior. It reconstructs module references that trigger client-side code loading, creates server action endpoints the client can invoke as RPC calls, sets up Promise chains that the React runtime will await, and builds lazy-loaded component boundaries that execute on demand.

Whether React developers think of it that way or not, the mechanics look very similar to deserialization systems that have historically caused problems. The stream doesn’t just describe what the UI looks like. It instructs the client runtime on what code to load, what functions to call, and what to trust.

If you want to read the implementation yourself, fair warning: the chunk resolution path is miserable to follow. State transitions bounce between helper functions, and the naming obscures what the code is actually doing. I gave up on static reading and just set breakpoints. The key files are react-client/src/ReactFlightClient.js for the client-side parser (look for parseModelString, getChunk, reviveModel, and getOutlinedModel) and react-server/src/ReactFlightServer.js for the serialization side. The reply handler for Server Actions lives in react-server/src/ReactFlightReplyServer.js.

Why Flight Is A Deserialization Sink

The deserialization pattern is familiar: Java’s ObjectInputStream gave us ysoserial, Python’s pickle executes code on load(), PHP’s unserialize chains __wakeup and __destruct methods, and .NET’s BinaryFormatter was deprecated entirely.

The pattern: deserialize attacker-controlled input → invoke behavior during reconstruction → lose control of execution.

So JavaScript should be immune to this, right? JSON.parse() only produces plain data objects. No constructors fire. No magic methods run. You get back exactly what the JSON string describes, nothing more.

That’s true for raw JSON.parse(). But it stops being true the moment a framework wraps custom deserialization logic around it. And that’s exactly what Flight does.

Prototype Pollution

JavaScript uses prototype-based inheritance. Every object has a __proto__ link to its prototype, and property lookups walk up this chain. If an attacker injects __proto__ or constructor.prototype as a key during reconstruction, they modify the shared base prototypes that all objects inherit from. Downstream code reads attacker-controlled values without knowing.

Flight’s $: prefix performs property traversal on deserialized objects. The getOutlinedModel function walks colon-separated paths like $1:user:name by iterating through each segment and accessing it on the parent object. If those path segments include __proto__ or constructor, the traversal walks straight up the prototype chain. That’s not a theoretical risk. It’s exactly how React2Shell worked.

Duck Typing and Thenables

The V8 engine (and the JavaScript spec) treats any object with a .then property as a Thenable. When you await something, the runtime checks for .then and calls it if it exists. No class check. No internal slot verification. If .then is callable, it gets invoked.

Flight resolves chunks asynchronously. If an attacker constructs an object with a manipulated .then property and gets it into the chunk resolution pipeline, the runtime calls the attacker’s function during normal await behavior. The language semantics do the work.

I initially focused on $F because forging Server Action references seemed like the obvious attack surface. After tracing the resolution path, $: property traversal looked much more interesting. I also spent a few hours examining chunk status transitions (pending, blocked, resolved, errored) to see if you could force a chunk into an unexpected state, though that approach didn’t yield any results.

The Core Problem

These two risks converge in Flight because the protocol doesn’t just deserialize data. It deserializes behavior. The $ prefix system dictates which execution path the parser takes: $F creates a callable server endpoint, $L sets up lazy code loading, $B triggers a blob handler, $@ exposes internal framework state. The parser’s control flow is driven entirely by what’s in the stream.

If an attacker can influence the stream’s content, they control which functions the parser calls, which objects it constructs, and which internal state it exposes.

The Mechanics Of React2Shell

This is the CVE that proved the theory. CVE-2025-55182, nicknamed React2Shell, is a CVSS 10.0 unauthenticated remote code execution vulnerability in the Flight deserialization layer. One HTTP request, no login required, full shell access.

I want to walk through the entire gadget chain because understanding it reveals how much power the Flight protocol hands to an attacker who can control the stream.

The Root Cause

The vulnerability sits in getOutlinedModel, a function responsible for resolving deep property paths from the $: reference system. The instance used in the exploit chain lives in the server-side reply handling code (ReactFlightReplyServer.js). When the parser encounters a reference like $1:user:name, it splits on the colons and walks the path segment by segment. Here’s the vulnerable loop:

for (key = 1; key < reference.length; key++)
    parentObject = parentObject[reference[key]];

Two lines. No hasOwnProperty check. No validation that the property exists on the object itself rather than somewhere up the prototype chain. Just parentObject[reference[key]] and move on.

So an attacker supplies $1:__proto__:constructor:constructor, and the loop traverses from a plain JSON object up through Object.prototype to the Object constructor to the Function constructor. Function in JavaScript behaves like eval(). Function("arbitrary code")() executes.

No allowlist on property names. No check for __proto__. I searched reviveModel and the chunk initialization path for any filtering. Nothing.

The Gadget Chain

Getting from “I can reach the Function constructor” to “I have RCE” requires chaining several Flight protocol features together. The Resecurity write-up covers the full chain in detail; here’s the high-level sequence:

• Step 1: Prototype walk to Function.
  The $: path __proto__:constructor:constructor walks from any plain object to Object.prototype, then to the Object constructor, then to Function — JavaScript’s built-in eval() equivalent.
• Step 2: Raw chunk self-reference.
  $@0 returns the raw internal Chunk wrapper instead of its resolved value, giving the attacker a mutable handle on React’s internal state machine.
• Step 3: Thenable hijack.
  The attacker sets the chunk’s .then to Chunk.prototype.then, so React’s resolution pipeline treats the manipulated chunk as a legitimate Promise-like object and awaits it.
• Step 4: Context confusion.
  During the second deserialization pass, the payload overwrites _response._formData.get to point to the hijacked Function constructor and places the attacker’s shell command into _response._prefix.
• Step 5: Trigger via blob handler.
  $B0 invokes the blob handler, which internally calls response._formData.get(response._prefix + blobId) — now equivalent to Function("attacker_shell_command")(). That’s arbitrary code execution with whatever privileges the Node.js process has.

Each step uses a legitimate Flight protocol feature in a way the designers didn’t anticipate. There’s no single “broken” feature. The vulnerability emerges from how these features compose when an attacker controls the input.

Impact

The numbers on this one are stark:

• CVSS 10.0. The maximum possible score.
• Unauthenticated and pre-auth. No credentials needed — and the deserialization happens before any application-level auth checks run, so even endpoints behind login walls are exposed.
• Single HTTP request. One POST to a Server Function endpoint.
• Affected React 19.0.0, 19.1.0, 19.1.1, and 19.2.0, across react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
• CISA added it to the Known Exploited Vulnerabilities catalog within days.

What Happened In The Wild

Exploitation was immediate. Sysdig published research linking EtherRAT deployments to North Korean state-sponsored actors who weaponized the vulnerability within hours of disclosure. EtherRAT is a file-less implant that uses the Ethereum blockchain for command-and-control communication — a technique researchers call “EtherHiding” — making takedown nearly impossible because you can’t seize a blockchain.

Separately, Palo Alto’s Unit 42 documented a backdoor called KSwapDoor that masquerades as [kswapd1] on infected Linux systems, blending into process lists alongside the legitimate kswapd0 kernel swap daemon; their analysis confirms KSwapDoor uses RC4 encryption to protect its internal strings and configuration data, while C2 communications run over AES-256-CFB with Diffie-Hellman key exchange across a P2P mesh network. The speed and sophistication of these campaigns — state-sponsored actors deploying novel implants through a single unauthenticated HTTP request — underscores why a CVSS 10.0 in a deserialization layer demands immediate patching, not triage.

The Fix

The React team’s patch is clean and targeted. The core change caches the genuine hasOwnProperty method at module load time:

var hasOwnProperty = Object.prototype.hasOwnProperty;

Then every property check in the deserialization path uses .call() to invoke the cached reference:

hasOwnProperty.call(value, i);

Even if an attacker shadows hasOwnProperty on a malicious object, the check uses the original prototype method. The prototype chain traversal that powered the gadget chain is blocked. This fix shipped in React 19.0.1, 19.1.2, and 19.2.1.

The fix is correct. But reading through the patches, I noticed the React team hardened ownership checks while leaving the property traversal model intact. The $: prefix still walks colon-separated paths; it just validates each step now. I think exposing arbitrary property traversal through a network protocol was a design mistake, and the patch treats the symptom. If future bugs emerge, they’ll likely come from this same area.

The framework patch closes the known gadget chain, but it doesn’t change the fundamental dynamic: the Flight protocol still reconstructs behavior — executable references, module imports, RPC endpoints, async state — from a stream of text. That reconstruction happens before your application code runs, before your validation logic fires, before your auth middleware even sees the request. Relying solely on the framework to protect your Server Components means trusting that every edge case in a complex deserialization parser has been found and fixed. The defenses that follow are the practical steps you can take to limit the blast radius on your own.

Defenses, Ranked By Impact

Some of these close real attack paths. Others mostly make you feel safer than you are. I’ve ranked these from most-to-least impactful based on what I’ve seen in the vulnerability research. If you only have time for one change, start at the top.

1. Input Validation On Server Actions (Zod, Valibot)

This is the single most impactful thing you can do at the application level. The Flight deserializer processes raw, unvalidated network input before your code takes control. Strict schema validation is your primary defense against whatever the protocol reconstructs.

Put a schema validation call at the very top of every Server Action, before any business logic runs — and I mean before anything, including logging. If you log an argument before validating it, and that argument triggers the stringification bug from CVE-2025-55183, you’ve leaked source code before your validation even had a chance to run.

Zod and Valibot both work well for this. Validate types, shapes, string lengths, numeric bounds, and enumerated values. Reject anything that doesn’t match. Use .safeParse(), not .parse() — the throwing variant can surface internal error details in the response if you’re not careful with your error boundaries.

"use server"
import { z } from "zod"

const UpdateProfileSchema = z.object({
  name: z.string().min(1).max(100),
  email: z.string().email(),
  role: z.enum(["user", "editor"]),
})

export async function updateProfile(formData: FormData) {
  const parsed = UpdateProfileSchema.safeParse({
    name: formData.get("name"),
    email: formData.get("email"),
    role: formData.get("role"),
  })
  if (!parsed.success) return { error: "Invalid input" }
  // proceed with parsed.data, this is now the only shape
  // your business logic ever sees
}

One important nuance: If your Server Action accepts a plain object argument (not FormData), validate the whole argument — don’t destructure first and validate fields individually. Destructuring before validation means you’re already accessing properties on the unvalidated input, which is exactly the kind of operation the Flight deserializer can exploit.

"use server"
import { z } from "zod"

const CommentSchema = z.object({
  postId: z.string().uuid(),
  body: z.string().min(1).max(5000),
})

// Good: validate the raw argument first
export async function addComment(data: unknown) {
  const parsed = CommentSchema.safeParse(data)
  if (!parsed.success) return { error: "Invalid input" }
  await db.comments.create(parsed.data)
}

// Bad: destructuring before validation
export async function addCommentUnsafe(
  { postId, body }: { postId: string; body: string }
) {
  // by the time this runs, you've already accessed properties
  // on the deserialized input
  const parsed = CommentSchema.safeParse({ postId, body })
  // ...
}

If your Server Action doesn’t start with a schema parse, it’s a vulnerability waiting to happen. I’d argue this should be a lint rule — and if you’re running eslint-plugin-react, consider writing a custom rule that flags any "use server" export without a validation call in its first statement.

2. The server-only Package

The server-only package is straightforward and effective.

Import server-only at the top of any file that contains database credentials, raw API calls, internal business logic, or anything else that should never cross the server-client boundary. If a Client Component tries to import that file (directly or transitively), the build fails with a clear error.

import "server-only"
import { db } from "./database"

export async function getUser(id: string) {
  return db.query("SELECT * FROM users WHERE id = $1", [id])
}

The failure mode to watch for is barrel files. If you re-export a server-only function through an index.ts that also exports client-safe utilities, any Client Component importing from that barrel will pull in the server-only module transitively and break the build — or worse, if the barrel doesn’t include the server-only import itself, it may silently let server code through. Keep server-only modules in separate files with their own import paths.

// Don't do this: barrel re-export mixes boundaries
// src/utils/index.ts
export { getUser } from "./users"     // has "server-only"
export { formatDate } from "./dates"  // client-safe

// Do this: separate import paths
// Client Component imports from "src/utils/dates" directly
// Server Component imports from "src/utils/users" directly

It also won’t protect you from data leaking through return values. If a Server Component calls getUser() and passes the full user object (including passwordHash or internalRole) as props to a Client Component, that data rides the Flight stream to the browser. The server-only guard prevents the code from crossing the boundary, not the data the code returns. You must explicitly filter your return shapes.

3. CSRF Protections

After CVE-2026-27978, relying solely on Next.js’s built-in Origin vs. Host header check isn’t enough. The Origin: null bypass showed that framework-level CSRF protection has edge cases.

For state-changing Server Actions (anything that writes data, deletes records, or modifies permissions), layer your own protections on top of the framework’s defaults.

Cookie configuration.
Set SameSite=Strict or SameSite=Lax on session cookies. If you’re using next-auth or a custom session library, verify this is set explicitly — don’t rely on browser defaults, which vary.

// next.config.js or your auth configuration
cookies: {
  sessionToken: {
    name: "__session",
    options: {
      httpOnly: true,
      sameSite: "strict",
      secure: process.env.NODE_ENV === "production",
      path: "/",
    },
  },
}

Explicit CSRF tokens.
For high-value operations (password changes, role assignments, payment actions), generate a per-session CSRF token on the server, embed it in a hidden form field or custom header, and validate it in the Server Action before proceeding.

"use server"
import { cookies } from "next/headers"
import { validateCsrfToken } from "@/lib/csrf"

export async function deleteAccount(formData: FormData) {
  const token = formData.get("csrf_token") as string
  const sessionToken = (await cookies()).get("csrf_secret")?.value
  if (!validateCsrfToken(token, sessionToken)) {
    return { error: "Invalid request" }
  }
  // proceed with deletion
}

The allowedOrigins gotcha.
Never, under any circumstances, add 'null' to experimental.serverActions.allowedOrigins in your Next.js config (even if the officially advisory is more nuanced, saying “unless intentionally required and additionally protected”). That string literal matches Origin: null — the exact header that sandboxed iframes send — and it reopens the CVE-2026-27978 bypass. If you’re seeing CSRF failures from legitimate requests, the fix is to configure your reverse proxy to set the correct Origin and Host headers, not to weaken the validation.

// Never do this
module.exports = {
  experimental: {
    serverActions: {
      allowedOrigins: ["null"],  // reopens CSRF bypass
    },
  },
}

4. The hasOwnProperty Patch

I covered this in detail in the React2Shell section. The fix is correct, and it completely neutralizes the known gadget chain. It shipped fast, which I respect.

The action item here is to verify you’re actually running a patched version. The RCE fix landed in React 19.0.1, 19.1.2, and 19.2.1. Check your lockfile:

# npm
npm ls react react-dom react-server-dom-webpack

# pnpm
pnpm ls react react-dom react-server-dom-webpack

# yarn
yarn why react-server-dom-webpack

If you see 19.0.0, 19.1.0–19.1.1, or 19.2.0, you’re vulnerable to the RCE. Update immediately. And don’t stop there: the DoS fixes (CVE-2025-55184, CVE-2025-67779, CVE-2026-23864) require 19.0.4+, 19.1.5+, or 19.2.4+. If you updated after React2Shell and then stopped paying attention, you may still be running a version vulnerable to the DoS variants.

It’s a reactive patch, not a structural redesign.

Note: More on that in Where This Goes Next.

5. The Taint API

React’s taintObjectReference and taintUniqueValue functions register objects or strings with the runtime. If tainted data tries to pass through the Flight serializer, it throws an error. The idea is to prevent sensitive data — user records, API keys, tokens — from accidentally leaking into the client.

Here’s how it looks in practice:

import {
  experimental_taintObjectReference as taintObjectReference
} from "react"
import "server-only"

export async function getUserRecord(id: string) {
  const user = await db.users.findUnique({ where: { id } })
  taintObjectReference(
    "Do not pass the full user object to Client Components. " +
    "Select only the fields you need.",
    user
  )
  return user
}

If a Server Component passes the tainted user object as props to a Client Component, React throws it at serialization time with your custom error message. That’s genuinely useful as a development-time guardrail.

The catch — and it’s a significant one — is that taint tracks object references, not data content. Any derivation breaks the tracking:

const user = await getUserRecord(id)

// taint is lost. Spread creates a new object.
<ClientProfile user={{ ...user }} />

// taint is lost. Individual properties aren't tracked.
<ClientProfile token={user.apiToken} />

// taint is lost. Serialization round-trip creates new refs.
<ClientProfile user={JSON.parse(JSON.stringify(user))} />

// taint fires. Same object reference.
<ClientProfile user={user} />

taintUniqueValue works on specific strings (like API keys), but it’s also reference-based. If the same key value appears in a different variable, the taint doesn’t follow.

Think of taint as a development guardrail, not a security boundary. It catches honest mistakes: a developer accidentally passing a full user object to the client. It won’t stop an attacker who can influence what gets serialized, and it won’t survive routine data transformations that your own code performs. It’s a useful defense-in-depth layer, but shouldn’t be your primary boundary.

6. WAFs

Web Application Firewalls can add a detection layer for known attack patterns. They can inspect POST requests carrying the Next-Action header, block payloads containing constructor:constructor or __proto__ chains, and flag error responses containing E{"digest" patterns that indicate the server is leaking internal error details.

If you’re running a WAF, here are specific patterns worth adding:

# Block prototype pollution attempts in request bodies
Rule: body contains "__proto__" OR "constructor:constructor"
Action: BLOCK
Scope: POST requests with header "Next-Action"

# Flag potential Flight error leakage in responses
Rule: response body matches /E{"digest":"[^"]+"/
Action: LOG + ALERT
Scope: responses with Content-Type "text/x-component"

# Block excessively large Server Action payloads
Rule: Content-Length > 1MB for POST with "Next-Action" header
Action: BLOCK (mitigates CVE-2026-23864 zipbomb vector)

But attackers know about WAF inspection buffers, and they’re usually around 128KB. Prepend 130KB of padding before the malicious payload, and the WAF inspects the padding, finds nothing, and lets the request through. Chunked Transfer-Encoding tricks accomplish the same thing.

The failure mode is treating WAF coverage as a security boundary rather than a noise-reduction layer. WAFs catch automated scanners and low-effort attacks, and that has real value. But a motivated attacker will bypass them with padding or encoding tricks. The defenses that actually stop sophisticated attacks are the ones earlier in this list: validating input before it reaches your business logic, keeping sensitive code off the wire, and staying on patched versions.

What Came After React2Shell

React2Shell wasn’t the end of it. The security audits that followed the December 2025 disclosure shook out a series of related vulnerabilities in the same deserialization surface. None of them are as severe as the original RCE, but they’re worth tracking because some of them required multiple rounds of patching.

The DoS pair (CVE-2025-55184 and CVE-2025-67779) is a textbook example of why deserialization parsers are hard to patch correctly. The first fix shipped, researchers found edge cases it missed, and a second round was needed. CVE-2026-23864 added a third DoS vector through unbounded memory allocation rather than CPU exhaustion. (See the defenses section above for specific version checks.)

CVE-2025-55183 is the sneaky one. It’s a source code exposure bug that triggers when a Server Function calls JSON.stringify (or any implicit stringification) on one of its arguments. Developers do this constantly for logging, debugging, or error reporting.

The attacker sends a crafted argument that, when stringified, causes the deserialization parser to reflect the function’s own source code back in the response. Business logic, database queries, and any hardcoded secrets sitting in Server Action files become readable by anyone who can send an HTTP request.

CVE-2026-27978 is a different class of bug entirely. It’s a CSRF bypass in Next.js’s Server Action handling. Next.js validates that the Origin header matches the Host header to prevent cross-site request forgery. But when a request comes from a sandboxed <iframe>, the browser sends Origin: null.

The Next.js parser in action-handler.ts treated the string 'null' as a missing origin rather than an explicit cross-origin indicator. So an attacker could embed a form inside a sandboxed iframe, submit it, and invoke Server Actions using the victim’s authenticated session cookies. Fixed in Next.js 16.1.7.

What’s Still Exposed

The CVEs above have patches. But some of the risk is structural, baked into how Flight is designed to work.

Man-In-The-Middle (MITM) On The Flight Stream

If an attacker can sit between server and client (CDN compromise, cache poisoning, rogue proxy), modifying the Flight stream in transit looks feasible. The format is plain text with a predictable structure.

Assuming stream control, an attacker could alter $I (Import) rows to redirect component loading to a different module in the webpack chunk map. They could inject $F (Server Reference) tags to embed hidden RPC triggers in the rendered UI. They could modify D (Data) rows to change component props, and if the target component uses dangerouslySetInnerHTML, that’s a direct XSS vector.

Flight escapes $ prefixes in user-supplied strings to prevent data from being interpreted as protocol instructions. But that only applies to data flowing through the serializer. A MITM attacker writes raw protocol directly into the stream. The escaping doesn’t help.

Server Action Enumeration

Server Action IDs are obfuscated hashes generated at build time. They look random. But server-reference-manifest.json maps every action ID to its source implementation. A public manifest hands an attacker a complete API map. This exposure usually stems from misconfigured hosting, an exposed .next directory, or path traversal.

Known action IDs expose Server Actions to standard IDOR and parameter tampering attacks. An attacker can forge direct requests with manipulated arguments. Developers often trust these inputs blindly because they originate from React’s internal machinery. The architectural consequences of that misplaced trust will be the focus of my next piece.

Encrypted Closure Tampering

When a Server Action captures variables from its surrounding scope (closures), Next.js encrypts them before sending to the client. The key is in NEXT_SERVER_ACTIONS_ENCRYPTION_KEY, AES with a base64-encoded key (16, 24, or 32 bytes). decryptActionBoundArgs handles decryption on each invocation.

By default, this key regenerates every build. But multi-server setups often use a static key. If an attacker gets file read access (path traversal, SSRF), they extract the key, decrypt the closure state, modify it (changing a userId, a role, a query parameter), and re-encrypt. The server accepts the forged closure as legitimate.

Supply Chain Activation via Module IDs

I haven’t demonstrated this end-to-end, but the theory is straightforward.

Flight references client components by module ID, something like ["360","static/chunks/app/page-7f3480.js"]. The bundler assigns these IDs at build time based on the module graph. A compromised npm package sitting in node_modules as a transitive dependency gets bundled into a chunk but never loaded because no component references it. Inert.

But if an attacker injects $I import references into the Flight stream (via MITM, cache poisoning, or server-side injection), the parser should load that dormant module. There may be chunk-level validation I’m not seeing. But if the module ID is valid and present in the manifest, I don’t see what stops it. The attack doesn’t require the package to be imported anywhere in your code. It just needs to exist in the bundle output.

This Has Happened Before

React Flight isn’t the first framework to invent a custom serialization format for server-client communication and then discover it’s an attack surface. And it won’t be the last.

Google Web Toolkit (GWT) used a custom RPC protocol to sync Java objects between browser and server. BishopFox demonstrated that attackers could manipulate the wire format to achieve arbitrary deserialization; GWT eventually disabled binary serialization entirely. It took years.

Java Server Faces (JSF) and ASP.NET both serialized ViewState to the client as a hidden form field. When cryptographic signing was weak or missing, attackers tampered with the serialized state and achieved remote code execution. Microsoft and Oracle patched it repeatedly. The underlying pattern kept resurfacing.

The pattern is always the same: a framework invents a custom wire format to move rich, stateful, sometimes executable data between server and client. The designers assume the server is the sole producer of that data and the client is a trusted consumer. Then someone demonstrates that the wire format can be manipulated in transit, or that the server can be tricked into deserializing attacker-controlled input. React Flight is the latest entry in this pattern. It is not an anomaly.

Where This Goes Next

The React Flight protocol solves a genuinely hard problem: streaming interactive component trees from server to client in a way that enables progressive hydration, async data loading, and server-driven code splitting. It works. I don’t want to lose sight of that.

But it works by serializing executable references, async state, module pointers, and RPC endpoints over a streaming text protocol, and then trusting the structure of that stream on both ends. The React team has patched the known gadgets. The hasOwnProperty fix is correct. The DoS fixes are in place. The source code exposure bug is closed.

I think exposing arbitrary property traversal and executable Thenable reconstruction through a network-facing protocol was a design mistake. $:, $@, and $B are powerful internal primitives that were reachable through a parser that didn’t validate ownership of the properties it traversed. One check was missing, and the result was CVSS 10.0.

As more frameworks adopt server-driven UI patterns, the industry is going to need stronger primitives than “the server is trusted”: cryptographic validation of serialized payloads, signed component trees, and content integrity checks on the Flight stream itself.

Hoping the parser handles every edge case hasn’t worked historically, and I don’t see why it would start working now.

The code is in react-client/src/ReactFlightClient.js. If you ship Server Components, read it. Know what your framework is trusting on your behalf.

(gg, yk)

The post Weaponizing And Defending The React Flight Protocol: Deserialization Sinks In RSCs appeared first on The NOKIA Blog.

There are also plenty of nuances that can impact maintenance. The original developer may have used methods you aren’t familiar with, or that go against best practices. Not to mention that you may be the latest in a long line of others to work on the site. If you’re lucky, you’ll find documentation that explains who did what. Short of that, you’re on your own.

That being said, it’s important to know what you’re working with. That’s the key to bringing the site up to snuff with regards to performance and security. Plus, avoiding breakage is crucial to building strong client relationships.

So, what should you know before you start work? We have a checklist of items to look for. Some are obvious, others obscure, but all will give you a better understanding of what makes your client’s WordPress website tick.

1. The Site’s Active Theme and Plugins

This may seem obvious, but it’s important to know what third-party software is installed on your client’s website. This includes the site’s active theme and plugins. But you’ll want to go deeper than knowing their names.

Take note of each item’s version number and when it was last updated. You may find software that’s outdated or even abandoned by its author. It’s a potentially dangerous situation, as there could be unpatched vulnerabilities lurking beneath the surface. There may be compatibility concerns as WordPress and other dependencies evolve.

You may also identify plugins that are installed but not being used. These items waste resources while also increasing security risks. If you’re unsure of a plugin’s purpose, ask your client.

As for the site’s theme, make a point to inspect its template structure. For example, is it a block or a classic theme? Is a child theme in use? Review the template’s code and determine if there are any areas of concern.

2. Custom Code

Adding custom code can enhance a website’s functionality. The problem is that there are multiple ways to implement it, and there’s no guarantee of quality. And it’s not always apparent when or how it’s being used.

This is critical information to know, as the site may depend on custom snippets for e-commerce features or other key functions. As such, switching themes or deactivating a plugin could cause problems.

The first place to look for custom code is the theme’s functions.php file. It often serves as a catch-all for random snippets. You never know what you might find!

Custom plugins are also a popular spot for such code. If you don’t recognize a plugin by name and it’s not listed in the official repository, there’s a good chance it’s a bespoke project. Also, be sure to look for any must-use plugins in the /wp-content/mu-plugins/ folder.

Once you identify any custom code, you’ll want to inspect it. Your favorite AI model can help you learn more about what it does and help you spot any potential issues.

3.  Web Hosting Provider and Configuration

Web hosting is an important piece of the puzzle, as it impacts site performance, security, and stability. Find out who hosts your client’s website, the hosting package they use, and the server’s configuration.

Pay special attention to the account’s available resources. A hosting package with insufficient memory or CPU cycles will result in slowness or downtime. Shared accounts can also be problematic regarding the spread of malware.

Also, be sure to note which PHP version is running. Old versions are less performant and no longer receive security patches. You’ll want to upgrade, provided the site’s theme and plugins are compatible.

Lastly, ask your client for access to their account, as you’ll need it to manage the server’s configuration and contact technical support. Some hosts provide developer accounts that allow access to technical features only – a good solution for clients who don’t want to share their billing information.

4. Third-Party APIs and Connections

Modern websites often rely on connections to third-party APIs and SaSS providers. It could be something simple, like an analytics suite, social media feed widgets, or a mailing list service. There are also complex integrations with automation tools, payment gateways (particularly on WooCommerce sites), and content delivery networks (CDNs).

Similar to custom code, these connections can be implemented in myriad ways. Some have official plugins, while others may be added via a bespoke web application or directly applied to a theme. In some cases, you may not see any trace of them inside the WordPress admin.

Keep track of every third-party connection you can find, because they may play a critical role in the site’s functionality. At the very least, they impact privacy laws such as GDPR.

Unsure of what outside services the site connects to? Your browser tools’ Network tab will display each call. Privacy scanning tools like Blacklight can also help with spotting tracking scripts, cookies, and related items.

5. Who Manages Their Domain’s DNS

Sometimes, inheriting a WordPress site means moving to a new web host. That usually requires a change to their domain’s DNS configuration. So does connecting to CDNs, mail delivery apps, and services that require domain ownership verification.

It’s good to know where your client’s DNS is hosted and who manages it. For some clients, their internal IT department will handle these tasks. But a small organization may ask you to take charge.

Keep this information on record – you never know when you’ll need it.

The More You Know (About Your Client’s Website)

The beauty of WordPress is that you can build a site any way you see fit. There are very few limits when it comes to code and design. But that knowledge doesn’t always transfer to the next developer in line. Such unfamiliarity makes maintenance harder. You also risk missing something important during a redesign.

So, take some time and dig into the site’s inner workings. Find out where it’s hosted and what services it connects to. Don’t be afraid to ask questions if you’re unsure of something.

The more you know, the better service you can provide. It could save you from a few headaches and help you build trust with your clients.

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post 5 Things To Know About Your Client’s WordPress Website appeared first on The NOKIA Blog.

It’s risky to apply these features to a production website without proper testing. As such, a staging site is crucial to ensure everything works. This enables you to catch bugs before they impact users. It also allows you to experiment with new features.

What is a staging site? It’s a copy of your production website that lives elsewhere. Common examples include a separate install on your web host or a local installation. The content doesn’t necessarily have to match. However, the site’s theme and plugins should be included to ensure an apples-to-apples comparison.

This guide will introduce you to how staging sites work, ways to implement them, and tools for building them. Soon, you’ll have everything you need to set up the perfect testing environment.

backup plugin to copy your production site and import it locally.

Here are a few tools that you can use to build a local staging environment:

Studio

Studio is a free and open-source local development environment from WordPress.com (a sponsor of Speckyboy). The app uses WordPress Playground to help you create new sites on demand with no dependencies. If you use WordPress.com or Pressable for hosting, you can also sync your local sites.

Local

Local offers one-click WordPress installations and a host of other goodies. You can use SSH or WP-CLI to manage your sites via the command line, create live links to share with others, and hot-swap PHP versions for testing. The app also syncs with sites hosted on Flywheel and WP Engine.

MAMP and XAMPP

We’ll lump these two apps together, as they are similar in scope. Both are local server environments that work on multiple operating systems. XAMPP will install an Apache/MariaDB/PHP/Perl stack. MAMP lets you choose from Apache or NGINX, along with a MySQL/PHP/Perl/Python/Ruby stack. Consider them both a bit more hands-on than the other local apps in this roundup.

WordPress Staging Plugins

Finally, we’ll introduce you to some plugins that will help you create a staging environment. Some will create a separate WordPress install on your existing host, while others connect to third-party services. You’ll also find plugins that pack up your site so that you can upload it elsewhere.

WP STAGING

WP Staging provides flexibility for how and where to create a staging environment. The plugin will clone your site to a subdirectory on your existing host. But you can also download a package to use locally or remotely. It also doubles as a daily backup plugin.

WPvivid

Create a custom site backup with WPvivid and migrate it to a subdirectory on your web host or other remote server. You can even send your site’s files to cloud services like Amazon S3, DigitalOcean Spaces, Dropbox, and Google Drive. There’s also a 1-click restore feature for rolling your site back to a previous version.

InstaWP Connect

InstaWP is a WordPress cloud service for rapid site building and deployment. You can use the InstaWP Connect plugin to copy your production website to the platform. From there, you can sync content between environments – perfect for testing new items before launch. Note that you’ll need an InstaWP account to use their service.

BlogVault

You can use BlogVault to create a staging backup to their cloud service. Make changes on staging and merge them back to your production site. The plugin also supports migrating your site to another host and will create incremental backups as you make changes. Note that BlogVault offers a 7-day free trial – you’ll need to pay for long-term access.

A Better Way To Test WordPress

A staging environment is a must-have for any mission-critical WordPress website. It’s a safe place for testing, troubleshooting, and experimenting. In addition, it provides peace of mind in knowing your work won’t negatively impact users.

The tools above will give you a great start, but some go the extra mile. Features such as site syncing and backup restoration make your job that much easier. The more automation you can bring to the process, the better.

Don’t take chances with your live website! Staging environments have never been easier to build and use. Find the tool that fits your needs and create your own personal safety net.

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post Best WordPress Staging Site Tools & Resources in 2026 appeared first on The NOKIA Blog.

This week, New York City is hosting AWS Summit, bringing together builders, customers, and AWS teams for a full day of announcements, demos, and technical sessions at the Javits Center. I wrote blog posts for some of the Summit launches, so I am excited to see them go live this week. I just won’t be watching from the Javits Center. I’ll be at a four-day music festival, following the launches on my phone while trying to figure out how to put up a tent. If you weren’t able to attend in person like me, the keynote livestream is available on June 17, with Dr. Swami Sivasubramanian, VP of Agentic AI, and Chet Kapoor, VP of Security Services and Observability, covering new capabilities across developer tools, AI infrastructure, and security.

Here’s what happened this week.

Headlines

How frontier teams are reinventing AI-native development — Swami published a detailed post this week drawing on data from experiments across hundreds of Amazon engineering teams. The findings are worth reading carefully if you are thinking about how to structure AI adoption on your own team.

A six-engineer team rebuilt the Amazon Bedrock inference engine in 76 days, a project originally scoped for 30 developers over 12 to 18 months. The median productivity gain across structured pilots with Amazon Stores teams was 4.5x in normalized deployment velocity, with some teams exceeding 10x. Perfect Order Experience went from a two-week feature cycle to shipping in an afternoon. WW Grocery cut design document creation from five days to a few hours.

The post distills these results into five practices for becoming a frontier team. First, invest in agent context: build steering files, coding standards, and structured repositories before writing production code. Second, expect an initial slowdown while workflows are restructured, and push through it. Third, maintain a steady backlog of well-scoped tasks so agents can run in parallel without constant supervision. Fourth, make intent explicit through structured specifications before code generation begins. Fifth, shift testing left so agents can self-correct before code reaches the pipeline.

The post closes with a note that commit velocity is only part of the picture, and that a follow-up will cover release management, operations, security operations, and EOL upgrades.

AWS FinOps Agent is now available in preview — AWS FinOps Agent is a new agent for FinOps practitioners and engineering teams that answers cost questions, surfaces optimization opportunities, investigates cost anomalies, and runs recurring FinOps workflows on a defined schedule. You can use it to query your AWS costs, generate cost reports for finance and engineering teams, and surface rightsizing, idle resource, and Savings Plans recommendations from AWS Cost Optimization Hub and AWS Compute Optimizer. The agent can open Jira tickets on your behalf based on those recommendations. When a cost anomaly is detected, FinOps Agent can automatically investigate the root cause and post findings to a Slack channel.

Last week’s launches

I’ll start with one I wrote this week, then cover the other launches that caught my attention:

• Amazon EC2 M9g and M9gd instances are now generally available — Powered by AWS Graviton5 processors and built on the sixth-generation AWS Nitro System, M9g instances deliver up to 25% better compute performance compared to Graviton4-based instances, with up to 35% faster performance for web applications, up to 35% for machine learning inference, and up to 30% for databases. Graviton5 is the first processor in the AWS fleet to support PCIe Gen6 and DDR5-8800 memory, and includes a 5x larger L3 cache compared to the previous generation. M9g and M9gd instances offer up to 15% higher network bandwidth and 20% higher Amazon EBS bandwidth on average across sizes compared to M8g. This release also introduces the Nitro Isolation Engine, an enhancement to the Nitro System that uses formal verification to provide mathematically proven isolation between virtual machines — establishing Nitro as the first formally verified cloud hypervisor. M9gd instances add up to 11.4 TB of NVMe SSD local storage with 30% higher IOPS compared to M8gd. Both instance types support Instance Bandwidth Configuration (IBC) for adjusting bandwidth allocation between EBS and VPC networking by up to 25%.
• Anthropic Claude Fable 5 on Amazon Bedrock — Claude Fable 5 launched on Amazon Bedrock on June 9, bringing extended asynchronous task execution, advanced vision capabilities across diagrams, charts, and PDFs, and proactive self-verification. Access requires opting into data sharing via the Data Retention API before invoking the model; Anthropic requires 30-day retention of inputs and outputs for Mythos-class models. Important note on availability: On June 12, Anthropic asked AWS to revoke access to Claude Fable 5 and Claude Mythos 5 for all users to support compliance with a US Government export control directive. All other models, including Opus 4.8, are unaffected. Read the Anthropic statement for details. AWS will share further updates as they become available.
• Gemma 4 models are now available on Amazon Bedrock — The Gemma 4 family from Google DeepMind is now available on Amazon Bedrock across three variants: Gemma 4 31B (dense, 256K-token context window, suited for reasoning and coding workloads), Gemma 4 26B-A4B (mixture-of-experts architecture, targeting cost- and latency-sensitive workloads), and Gemma 4 E2B (smallest variant, designed for low-latency interactive use cases). All three support native function calling, structured output, reasoning, response streaming, multimodal input across text, image, video, and audio, and more than 35 languages.
• Amazon OpenSearch Service launches MCP Apps for agentic observability — Amazon OpenSearch Service now supports MCP Apps, enabling observability workflows inside compatible agentic IDEs including Claude Desktop and VS Code. An AI agent in your local environment can investigate incidents using logs, traces, metrics, and alerts stored in OpenSearch domains, collections, and Amazon Managed Service for Prometheus. Each MCP App tool call returns a dual response: a text summary for the agent to reason over and an interactive visualization rendered in the same conversation thread. Available MCP App tools cover log, metrics, and trace investigation; service performance; topology; dynamic visualizations; agent health; cluster health; and instrumentation scoring.

Other AWS news

Here are some additional posts and updates you may find useful:

• AWS CLI v1 enters maintenance mode — When CLI v1 enters maintenance mode, the botocore and s3transfer dependencies will be vendored directly into the CLI v1 codebase rather than installed as separate packages. This means upgrading CLI v1 will no longer update the standalone botocore or s3transfer packages, and installing those packages independently will have no effect on the versions used by CLI v1. Environments with both CLI v1 and boto3 installed will contain separate copies of these libraries. New CLI v1 releases will be limited to critical bug fixes and security issues. The recommended path is to migrate to AWS CLI v2.
• AWS Workload Credentials Provider is now available — AWS has launched a new Workload Credentials Provider that enables workloads to obtain short-term AWS credentials without requiring long-term access keys. This supports credential management for applications running outside of AWS, giving teams a way to follow least-privilege access patterns for workloads in third-party or on-premises environments.
• Kiro Pro Max is now available — Kiro has introduced a new Pro Max tier, adding higher usage limits, access to the latest frontier models, and additional agentic capabilities for development teams. Kiro Pro Max is designed for professional developers who need sustained, high-volume use across coding, specification generation, and agent-driven tasks.

Upcoming AWS events

Check your calendar and sign up for upcoming AWS events:

• AWS Summits — AWS Summits are free in-person events covering cloud and AI. Coming up: New York City (June 17), Hong Kong (June 17), Shanghai (June 23-24), Japan (June 25), Washington, D.C. (June 30 – July 1), Taipei (July 15), and Bogotá (July 30).
• AWS Community Days — Community-led conferences planned and delivered by community leaders. Upcoming events include Montreal, Canada (June 20), Indianapolis, USA (June 24), Hangzhou, China (June 28), Bengaluru, India (July 11), and Yaoundé, Cameroon (July 25).

Visit the AWS Builder Center to meet other builders, contribute solutions, and find resources that help you keep building. You can also browse upcoming AWS-led in-person and virtual events, plus developer-focused sessions.

— Esra

This post is part of our Weekly Roundup series. Check back each week for a quick roundup of interesting news and announcements from AWS!

The post AWS Weekly Roundup: AWS FinOps Agent in preview, Gemma 4 on Bedrock, Kiro Pro Max, and more (June 15, 2026) appeared first on The NOKIA Blog.

WordPress Freelancers and agencies often do more than design and development. A full-service company may also maintain and host its clients’ websites.

Providing web hosting has several benefits for freelancers. First, it’s a vehicle to add recurring revenue to your business via reselling or an affiliate program from an established host. That steady flow of money can improve your financial health.

You’ll also have more control over each site’s environment. That helps ensure compatibility and keeps things running smoothly. Plus, you’ll know what to expect regarding performance, security, and support.

However, hosting client sites is also a serious responsibility. It puts you on the hook for technical difficulties. In addition, managing multiple WordPress websites is challenging. One false move could mean a string of crashed or hacked sites.

With that in mind, we have some tips for hosting your client’s WordPress websites. We’ll show you how to keep a watchful eye on each site without breaking your budget.

insanely cheap to, well, insanely expensive. It’s tempting to go the inexpensive route with a shared hosting account.

Hosts often allow multiple WordPress installs on an account. It makes sense from a business perspective. You pay for a couple of hosting packages and run all of your client sites on them.

This strategy has a couple of serious flaws. The first is that server downtime could impact every site you host. It’s bad enough when one site is down, let alone a few dozen.

Malware is the other major concern. Malicious code can easily spread from one site to another in a shared hosting environment. Once a site is compromised, it’s only a matter of time until the others are hit.

The lesson here is to keep each website on a separate hosting account. Make sure your host isolates sites via a container or other barrier. That will help prevent a security nightmare. Again, it’s easier to deal with one hacked site than having multiple infections.

And it doesn’t have to be inconvenient. Many hosts offer a centralized dashboard to access each site, and there are also third-party services that do the same.

Lock Down Your WordPress Installs

On many hosts, the famous “5-minute WordPress install” has been replaced with a one-click process. Still, older sites may have been installed manually via SFTP. Thus, it’s important to check each install to verify its integrity.

WordPress file permissions are an area of concern. For instance, allowing public access to the site’s wp-config.php file is an invitation to hackers. The file includes your database login and other sensitive information. A lot of damage can be done if it falls into the wrong hands.

The WordPress developer documentation has a handy guide for setting the correct file permissions. Follow its advice and ensure files only have the required permissions.

You might also want to disable file editing within the WordPress dashboard. That will prevent a malicious actor (or adventurous client) from editing theme or plugin files.

Add the following line to each site’s wp-config.php file: define( 'DISALLOW_FILE_EDIT', true );

Other ways to secure the sites you host:

The goal is to enhance each site’s security, which provides peace of mind for you and your clients.

Ensure You Have Enough Server Resources

Every website you host will have different needs. For example, a brochure site’s functionality isn’t as complex as a WooCommerce shop. Plus, some will inevitably receive more traffic.

That’s why hosting is not a one-size-fits-all proposition. Hosts offer tiered services that account for storage and bandwidth. They may also limit the number of domains, dashboard users, or site visitors. Crossing these thresholds can be costly.

Also, pay attention to server resources like memory, CPU cycles, and PHP workers. Shared hosting environments don’t usually guarantee a minimum. More expensive accounts, such as VPS and dedicated servers, assign these resources to your account.

It pays to understand what your host offers and how it impacts your websites. A site with too few resources won’t perform well and may break. Meanwhile, hosting a small site on a higher tier could be wasteful.

You can avoid problems by assessing each site you host. Pay particular attention to the following factors:

• Monthly traffic (via Google Analytics or other apps);
• Security risks (online transactions, user accounts);
• The amount of content;
• Special functionality (shopping carts, members-only areas, resource-intensive plugins);

Site stability, performance, and security are vital to success. Using the right hosting will go a long way toward ensuring it.

Keep an Eye Out for Hosting Changes

We know that WordPress, themes, and plugins all require regular maintenance. That’s something we often manage for our clients. But hosts also maintain their infrastructure.

A host will apply new software versions and security patches to their servers. They’ll also upgrade hardware from time to time. You’ll want to know when this happens.

PHP upgrades are a prime example. An outdated theme or plugin could be incompatible with the latest version, which leads to a buggy or broken site.

Staying in the know can help prevent these types of issues. Web hosts often announce maintenance plans ahead of time. They may publish to a blog, add a dashboard alert, or send an email.

Make an effort to inform yourself of what’s happening. It can save you from a future headache or two.

Be a Good Host

Hosting your client’s WordPress websites keeps you in the loop. You’ll be able to watch over each site and ensure its health. It’s also a path to making some extra money.

When things run smoothly, the burden on your time should be minimal. Ensuring things stay that way is part of the job, though.

The first step is to choose your hosting provider wisely. Look for a host that follows best security practices and has a deep understanding of WordPress. They should also offer enough resources to run each site without issue.

From there, it’s all about being proactive with the sites in your portfolio. Keep them updated and take extra security measures. In other words: control the things you can.

Some things are beyond our control. We can’t predict downtime or a host being sold. However, we can put ourselves and our clients in a position to succeed. We hope the tips above will help you get there.

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post Tips for Hosting Your Client’s WordPress Website appeared first on The NOKIA Blog.

Building for the web in 2026 means juggling two pressures at once: clients want AI baked in somewhere, and most of them want to sell something online.

The seven picks below are shaped around that reality: AI-powered builders, flexible WordPress themes, and WooCommerce setups that get you to a working storefront without burning a month on customization.

• AI-powered no-code website builder: Mobirise AI
• Multipurpose WordPress theme with starter sites: Blocksy
• Multipurpose WooCommerce theme: WoodMart
• Slider, carousel, and hero builder: Slider Revolution
• AI-powered Elementor theme: Crafto
• High-end WooCommerce theme: Uncode
• Conversion-focused WooCommerce theme: XStore

• Best for: Prototyping, personal and small business websites, marketing campaigns, landing pages, and portfolios.
• Key Strength: Every prompt provides four different super-engaging and highly converting versions to select from.
• Why designers like it: Chat AI provides an easy way to make changes.

Mobirise AI lets users generate websites or sections of a website with a single prompt, select from the four most recent versions, and make changes using AI Chat.

• For Beginners, Freelancers and Small Business Owners: Mobirise AI users can describe what they want, choose from four AI-generated versions, and customize using AI chat.
• Publishing: Mobirise AI offers AI publishing and hosting, or users can use their own domains. Three free website-building opportunities are available each month.
• AI-generated text and Images: Website text and images can be generated through the use of ideas or instructions and prompts.
• Marketing Presentations: Agencies and marketers can make use of the four-versions-per-prompt feature to present a multiplicity of concepts to their clients.

Check out Mobirise AI

• User Review: “The community gallery is an underrated gold mine – I browse the AI Community generations whenever I need inspiration. Found a nonprofit site template someone made, hit regenerate with my own details, made a few edits with prompts, and had our charity’s new site live within an hour. The fact that you can build on other people’s creations is brilliant”.

• Best for: Blocksy’s WooCommerce integration and easy customization features make it ideal for creating all types and sizes of WooCommerce stores.
• Key Strength: Optimized performance out of the box – fast loading times without needing heavy optimization.
• What Designers Like: They like smooth customization workflows where changes feel consistent and predictable, making the building process efficient.

Blocksy offers an impressive array of prebuilt websites. The Growly Starter Site example offers a ready-to-customize layout for businesses that offer marketing services and are looking to establish a professional online presence. Simply swap in your own content, and you will have a polished starter site up and ready in no time.

• Deep WooCommerce Integration: Launch a lightning-fast SEO-ready store that features cart, checkout, and product pages.
• Seamless Integration with Page Builders: Blocksy works perfectly with Gutenberg, Brizy, and Elementor, each of which offers maximum flexibility and ensures smooth editing.
• Starter Sites: Blocksy starter sites load quickly, rank high in search engines, and offer visitors a smooth browsing experience.

Check Out Blocksy

• Client Average Rating: 5/5.
• User Review: “This is a great quality theme, with an impressive amount of features and yet a really clean customization interface. The ability of detecting custom post types to offer specific page settings is just perfect. Thank you so much for the amazing work!”

• Best for: Creating online stores noted for their fast performance, optimized shop features, and custom layouts.
• Key Strength: WoodMart’s custom WooCommerce layout builderfunctionality allows you to create custom layouts with the WPBakery or the Elementor page builder.
• What Designers Like: They like the large selection of demos and the ability to design their online stores without the need for plugins.

WoodMart’s prebuilt website library examples are easy to customize. Take the Marketplace 2 demo’s online store layout for example. Simply swap in your content, and you’ll have a page that engages your site’s visitors in no time.

• Prebuilt Websites & Templates: With a single click, you can import one of 100 fast, responsive, and beautiful prebuilt WooCommerce-oriented websites or any of the 400+ page templates.
• Gutenberg, Elementor, and WPBakery: You can use the Elementor free version without a Pro license.
• WoodMart Slider Functionality: Allows the creation of simple sliders that are easy to configure and enhance your website’s performance.

Check Out WoodMart

• Client Average Rating: 4.91.
• User Review: “Best WooCommerce website theme ever built. It’s that easy. It gives you the most control over your theme with most paid features already built-in, so you save a lot on things like abandoned cart plugins, wait-list plugins, countdown plugins, etc. 100% the best!”

• Best for: Creating animation and special effects for high-impact presentations.
• Key Strength: The Quick Start Generator that instantly generates a module to initiate the design effort.
• What Designers Like: Choices – the ability to start with a blank canvas, choose a professionally designed template, or use the Quick Start Generator.

Slider Revolution offers its users a library of prebuilt, ready-to-customize sliders. The Mode Board Infinite Filmstrip Media Gallery template delivers beautifully designed content with jaw-dropping animations in which you can insert content featuring your subject of choice.

Demo Releases/Updates: New templates are published every month.

• Quick Start Generator: The Quick Start Generator design alternatives give you a real first draft instead of having to start with a blank page or search for a suitable template.
• AI features: The built-in AI features include AI text generation powered by ChatGPT AI, AI image generation using FLUX 1 and FLUX 2, and AI image background removal.
• Project Types: Slider Revolution excels in hero sections, sliders, carousels, one-page websites, dynamic content modules, product showcases, campaign landing pages, media galleries, and visually rich brand storytelling sections

Check Out Slider Revolution

• User Review: “The people who build Slider Revolution’s templates are masters. They’ve figured out ways to create really cool effects”.

• Best for: Designing websites of all types featuring design layouts designed to reflect your brand and captivate your audience.
• Key Strength: The Theme Builder that empowers you to design and customize every key area of your website with precision.
• What Designers Like: Designers like the built-in performance manager features, together with the many options available to optimize website loading speeds.

Crafto theme features an excellent library of prebuilt, easily customized websites. The Scattered Portfolio pre-built website has a lively and scrollable portfolio layout that has loads of possibilities just waiting for you to incorporate your own content.

• Website Demos & Template Library: Select among more than 56 full website demos as well as combine and customize blocks to create professional-looking websites in minutes.
• Crafto Theme Builder: This intuitive theme builder empowers you to design, customize, and manage all areas of your website from a single intuitive platform.
• Crafto AI: Generate engaging content or stunning images in seconds. Enter a topic, and let AI craft engaging, well-structured content.
• AI Chatbox: The AI chatbot delivers instant responses to support inquiries in addition to its ability to generate high-quality and engaging content.

Check Out Crafto

• Client Average Rating: 4.83.
• User Review: Very good theme: design, code quality, theme flexibility. We recommend it without hesitation”.

• Best for: Designing high-end websites that feature impressive layouts and content, and technically advanced elements.
• Key Strength: Uncode’s wealth and depth of options together with the solidity of its framework.
• What Designers Like: They like the fact that everything they need is built right in, along with the multiple website building options Uncode’s visual builder provides.

Among Uncode’s large selection of customizable prebuilt websites, the Shop AJAX Filters example offers a straightforward layout in which you can easily insert your own content or product line.

• Content Block Feature: Allows you to reuse sections and dynamic templates that you can readily integrate into your web pages.
• Menu Block Mode– Lets you display everything from simple Menu lists to complex responsive column layouts and can transform into accordions for both mobile and desktop.
• Megamenu System: The Megamenu feature gives you unlimited creative control with Content Blocks that can include images, videos, text, buttons, and custom layouts.
• Wireframes Plugin that Includes 800+ Pre-made Sections: These enable you to quickly build pages or prototypes if you are trying to shorten design workflow time.

Check Out Uncode

• Client Average Rating: 4.89.
• User Review: “Amazing theme with amazing support! I highly recommend this template”.

• Best for: Creating conversion-focused WooCommerce stores.
• Key Strength: This theme’s key strength is the fast and responsive feel of its drag-and-drop editing.
• What Designers Like: Designers like how both Elementor and Gutenberg function so effortlessly with XStore, its Full Site Builder, and its deep WooCommerce integration.

XStore’s prebuilt websites are easy to customize visually. The Yoga Accessories demo offers a well-structured one-page layout for a modern yoga shop, allowing you to seamlessly add your products and content and launch a polished one-pager in no time.

• Full Site Builder – The Full Site Builder, in combination with deep WooCommerce integration, is XStore’s most frequently praised feature.
• Product Filters & Cart & Checkout Layouts: Filters make product browsing quick and easy for users. Advanced cart & checkout layouts give users a faster checkout experience, with less interruption.
• Smart Image Lazy Loading: Load images super-fast with built-in lazy loading and adaptive image functionality.
• XStore White Label Custom Branding: Transform XStore into your own in a few clicks. Perfect for agencies and web developers.
• Advanced Mobile Panel – allows you to customize your website’s mobile panel in various ways to suit your needs and for a better user experience.

Check Out XStore

• Client Average Rating: 4.88.
• User Review: “This is one of the best themes to build an e-commerce store on WordPress with lots of built-in features”.

The Web Design Tools & Resources in a Nutshell

FAQ

• Which of these tools gets me to a working site fastest?
  For a traditional WordPress build, Blocksy is hard to beat; its starter sites are well-organized, the customizer is fast, and the free tier goes further than most. If you’d rather skip WordPress entirely and let AI do the structural work, Mobirise AI generates a complete layout from a prompt and lets you refine it visually. Different paths, similar outcome: a publishable site in a day or less.
• Do I need a dedicated animation tool like Slider Revolution?
  Most modern themes cover basic sliders and entry animations on their own. You’d reach for Slider Revolution when the design calls for something the theme can’t do, layered hero sections, scroll-triggered sequences, or interactive elements that need fine-grained control. For marketing sites and landing pages where the hero is the pitch, it earns its keep. For straightforward content sites, your theme is probably enough.
• Which theme should I pick for a client’s online store?
  It depends on the store. WoodMart is the safe default for most WooCommerce builds – broad demo library, solid performance, conversion features built in. XStore leans hardest into conversion mechanics (checkout, upsells, urgency cues) and suits stores where revenue per visitor matters more than visual ambition. Uncode is the pick when the brand needs to feel high-end, fashion-forward, premium, or design-led, and you’d otherwise be tempted to build a custom theme from scratch.
• Where does AI actually help in the design workflow?
  The honest answer in 2026: it shortens the blank-page phase. Mobirise AI can generate a full site structure from a description, which beats picking a template and editing it backward into what you want. Slider Revolution and Crafto use AI to draft sections, hero blocks, and feature grids that you then customize. None of these replaces design judgment. They just collapse the time between “client briefed me” and “I have something concrete to push back against”.

Read more articles by Speckyboy

The post 7 Essential Design Tools & Resources for High-Quality Web Builds in 2026 Sponsored appeared first on The NOKIA Blog.

It’s more than just business as usual, though. WordPress also boasts a global community of users and contributors. As such, agencies don’t have to operate in a vacuum. There’s an opportunity to connect with people and pay it forward.

Community engagement is a win-win situation. First, you’re helping others learn and use WordPress more effectively. There’s a great sense of satisfaction that comes with getting involved.

There are also benefits to your business. It puts your name out there and helps you build relationships. That could result in booking more clients. At the very least, you’ll create goodwill and establish a strong reputation.

Giving back is also easier than you think. Here are a few ways to say thanks to the WordPress community!

Join or Host a Local Meetup

If you want to impact the WordPress community at a grassroots level, Meetups are a great place to start. They’re local get-togethers that welcome people of all skill levels, including beginners.

These events open up a world of possibilities. You might have meetings dedicated to a specific subject, guest presentations, or group projects. It’s also an opportunity for attendees to help each other with site issues or plugin suggestions.

Agencies are uniquely positioned to help. Your team of experts can give talks and connect with your local community. That makes you a trusted resource – one that prospective clients will remember when it’s time for a new website or other project.

Finding a place to hold regularly scheduled meetings is challenging in some communities. So, hosting a meetup at your office or another space is a huge help.

Plus, not every city has a meetup. In that case, you might consider establishing one. It brings people together and builds enthusiasm for the WordPress project.

Being part of the meetup space requires a commitment. However, connecting with others one-on-one is worth the effort.

Set Aside Time To Contribute to WordPress

The WordPress project includes several teams tasked with building and maintaining the software. There are also teams dedicated to providing technical support, writing documentation, language translation, and reviewing themes/plugins.

Joining one or more teams is an opportunity to improve WordPress and its community. This could include anything from fixing bugs, building new features, or improving the user experience. That’s only scratching the surface of the potential impacts.

Contributions of all kinds are welcome – even if they don’t involve writing code. So, think about which team(s) interest you and fit your skillset. It’s also worth considering how much time you can dedicate to the project.

The Five for the Future program is a compelling option for agencies willing to commit 5% of their time to the project. Individuals are also welcome to join.

However, the type or number of contributions you make isn’t as important as your willingness to participate. One way to look at it is that every contribution helps someone. That makes a difference!

Build Free Plugins, Themes, or Educational Resources

There’s also a more traditional approach to paying it forward. Your agency is likely building custom plugins or themes for your projects. And teaching is a key part of working with clients. Why not level up and share what you know?

Once again, this benefits everyone. The community receives something useful. Meanwhile, you increase your visibility across the WordPress ecosystem. It’s a way to generate leads while doing good.

What you share and how you share it are up to you. It might be as simple as posting your GitHub repository link on social media. Or, you might opt to distribute your work via the official WordPress theme and plugin directories.

We should note that some responsibilities are involved with either approach. Plugins and themes must be maintained and supported. Community engagement is part of the deal. It’s also a good idea to keep sales pitches to a minimum if your goal is to give back.

Offering educational resources, such as online courses or tutorials, is also a possibility. Being a guide to users or developers will showcase your expertise. Do it well, and you’ll have loyal visitors returning to your site or YouTube channel.

Say Thanks to WordPress and Its Community

If your agency builds websites with WordPress, it benefits from the open-source software. It also stands to reason that you’ve benefited from the knowledge shared by community members. Every code snippet or piece of advice is valuable.

Giving back is simply the right thing to do. It says that you care about the project and the people surrounding it. Consider the potential boost to your business as good karma.

It’s also a chance to connect with other people and organizations. You never know what may come of these relationships. Friendships, business ventures, and side projects could be in store.

So, think about ways to give back and pick one that’s right for you. It will help you grow as a person and a web professional.

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post How WordPress Agencies Can Give Back to the Community appeared first on The NOKIA Blog.