Running LearnDash and Breakdance Builder together on WordPress 6.7 or later? You may have already hit the wall: a white screen, a PHP fatal error in your logs, or course list shortcodes silently breaking inside Breakdance-built pages. This plugin fixes that.

What it solves

When WordPress 6.7 tightened strict type enforcement, it exposed a long-standing bug in LearnDash: shortcodes like [ld_course_list] pass comma-separated strings to WP_Query arguments that expect proper PHP arrays. The result is a fatal TypeError in class-wp-query.php that can take your entire site down. On top of that, when Breakdance renders pages server-side, any fatal error inside a LearnDash shortcode crashes the whole page render rather than failing gracefully.

Three targeted fixes, zero configuration required

• WP_Query normalization — Intercepts malformed array arguments via pre_get_posts and converts them to properly typed integer or string arrays before WordPress processes them.
• LearnDash filter normalization — Hooks directly into LearnDash’s own query filters to correct the data at the source, before it ever reaches WP_Query.
• Breakdance SSR guard — Wraps all LearnDash shortcode callbacks in a safe error-recovery buffer so a crash inside [ld_course_list] returns a placeholder instead of killing the page.

Activate it and all three fixes are live immediately — no setup, no API keys, no configuration needed. Each fix can be individually toggled from the settings page if you need to isolate behaviour.

Who it’s for

Any WordPress site running LearnDash (sfwd-lms) and Breakdance Builder together, particularly after upgrading to WordPress 6.7+. The plugin is safe to install even if only one of the two plugins is active — all fixes check for the relevant plugin before hooking in.

Built by Web321 Marketing Ltd. — WordPress specialists, working on the Internet from Vancouver Island since 1996.

The post Learndash + Breakdance Connector appeared first on Web321: Your Best WordPress Support.

WooCommerce reCAPTCHA Checkout adds two independent layers of Google reCAPTCHA to your checkout page simultaneously:

v2 (checkbox) asks the customer to tick “I’m not a robot” — simple, familiar, and effective.
v3 (invisible) silently scores every checkout attempt in the background. Requests below your threshold never reach WooCommerce.

Both layers must pass for an order to go through. Either failure blocks the submission and shows a clear error message to the customer.

Don’t have both key pairs yet? No problem. The plugin detects what’s configured and runs the strongest available mode automatically — v2 only, v3 only, or both.

A built-in key testing tool lets you verify your Google API credentials right from the Settings page — instant pass/fail feedback, no guesswork.

Free, no subscription, no upsell. Built by Web321 Marketing Ltd. in Saanichton, BC to WordPress coding standards.

• Dual-layer protection — v2 checkbox + v3 invisible score, both verified server-side
• Automatic mode detection — works with v2-only, v3-only, or dual key pairs
• Built-in key tester — validate your Google credentials before going live
• Adjustable v3 score threshold — raise or lower sensitivity to match your store’s needs
• Auto-created documentation page — a setup guide published on your site at activation
• WooCommerce HPOS compatible — tested with Custom Order Tables
• WordPress nonce protection — CSRF layer on top of reCAPTCHA
• No third-party dependencies — pure WordPress + Google APIs, nothing else
• Free, no subscription — donate if you love it, that’s all we ask

The post WooCommerce reCAPTCHA Checkout appeared first on Web321: Your Best WordPress Support.

It happens to everyone. You install a plugin, it solves a problem, you move on. Then a year later, $89 appears on your credit card statement. Then another $49. Then $119. You try to remember what each one was for. Half the time you can’t.

WordPress site owners routinely spend $50–$300+ per year on plugin and theme subscriptions with zero consolidated view of what they’re paying. There’s no built-in dashboard. No renewal calendar. No total. Just a growing pile of charges and a credit card statement that doesn’t care whether you’re still using the software.

WP Subscription Tracker fixes that.

Install it once and it automatically scans your WordPress site, identifies your paid plugins and themes, and builds you a single dashboard showing what everything costs, when it renews, and what your WordPress subscriptions total per month and per year.

You’ll get reminder emails before renewals hit. You’ll be able to see at a glance which subscriptions are worth keeping and which ones you’ve been paying for on autopilot. You can add manual subscriptions for anything the auto-detector misses, export the whole list to CSV, and finally have an honest answer to the question every site owner eventually asks: “How much is this WordPress site actually costing me?”

It’s completely free. No account. No data sent off your server. Built in Canada by the team at Web321 Marketing, with privacy and PIPEDA compliance baked in from the start.

Take back control of your WordPress spending.

The post License Tracker for WordPress appeared first on Web321: Your Best WordPress Support.

You know that sinking feeling.

You open your email and see a message from Google: “Warning: This site may be hacked.” Or worse—you try to log into your WordPress dashboard and you’re locked out. Your site displays a cryptic message in a language you don’t speak, or your homepage has been replaced with something you definitely didn’t put there.

Your heart races. Your palms sweat. And the questions flood in: How did this happen? What did I do wrong? How much is this going to cost to fix?

Take a deep breath. You’re not alone, and this isn’t your fault.

The Reality Check: Why WordPress Gets Targeted (And Why That’s Actually Good News)

Here’s the truth: WordPress isn’t inherently insecure. In fact, it’s one of the most scrutinized and frequently updated platforms on the planet.

The problem? WordPress powers over 43% of all websites on the internet. That’s not a typo—nearly half of the web runs on WordPress.

For hackers, that’s like a burglar discovering that 43% of houses in the world use the same type of lock. They don’t care about you specifically. They don’t even know who you are. They’re just running automated scripts that try to break into every WordPress site they can find, hoping that enough doors are left unlocked.

You’re not being personally targeted—you’re being automatically scanned.

The good news? Because the attacks are automated and follow predictable patterns, the defenses are simple, straightforward, and don’t require a computer science degree.

In fact, there’s one setting—just one—that stops about 90% of WordPress hacks before they even start.

The “Open Door” Problem: Why Your Site Is Getting Hacked

Imagine a burglar standing at your front door with a key ring containing one million keys. Now imagine they have all day—actually, all year—to stand there and try every single key until one of them works.

Eventually, they’ll get in. It’s just a matter of time.

This is exactly how most WordPress sites get hacked.

By default, WordPress allows anyone, anywhere, to try guessing your password as many times as they want. There’s no limit. No lockout. No consequences for getting it wrong 100 times, 1,000 times, or 10,000 times.

This attack method is called “Brute Force,” and it’s devastatingly simple:

1. A hacker’s automated script finds your login page (usually `yoursite.com/wp-login.php`)
2. The script tries common username/password combinations
3. It keeps trying, thousands of times per hour, 24/7
4. Eventually—unless you have a strong password and some protection—it gets in

The “Admin” Mistake

Quick side note: If your WordPress username is “admin,” you’ve just made the hacker’s job 50% easier. They already know half of your credentials—now they only need to guess the password.

But even if you’re using a unique username, the real problem remains: unlimited login attempts. That’s the open door you need to close.

The “One Setting” Solution: Limiting Login Attempts

Here’s the fix that stops 90% of brute force attacks cold:

Limit the number of times someone can try to log into your site.

That’s it. That’s the whole game.

Instead of allowing infinite password guessing, you set a limit: 3 wrong attempts, and you’re locked out for 24 hours.

How It Works

Think of it like this:

• Before: Hacker tries 10,000 password combinations in one hour. Eventually, they might get lucky.
• After: Hacker tries 3 passwords, gets blocked, can’t try again for 24 hours. They move on to an easier target.

The automated script breaks. The attack fails. Your site stays secure.

Why It Works

Brute force attacks rely on volume. They need to make thousands—sometimes millions—of guesses. When you cap attempts at 3 or 5, the math stops working in their favor.

They can’t brute-force their way in if they can’t keep guessing.

It’s the digital equivalent of a deadbolt that freezes solid after 3 wrong key attempts. The burglar gives up and moves to the next house.

How to Implement This (Step-by-Step)

WordPress doesn’t have this protection built in (which is baffling, honestly), so you’ll need to add it via a plugin or server-level security.

Don’t worry—this isn’t complicated. Pick the option that fits your comfort level:

Option A: The Dedicated Specialist (Limit Login Attempts Reloaded)

Best for: People who want a lightweight, “set it and forget it” solution.

How to do it:

1. Go to your WordPress dashboard → Plugins → Add New
2. Search for “Limit Login Attempts Reloaded”
3. Click “Install Now,” then “Activate”
4. Go to Settings → Limit Login Attempts
5. Set “Max Login Attempts” to 3
6. Set “Lockout Duration” to 24 hours
7. Save changes

Done. You’re now protected.

This plugin is simple, lightweight, and does exactly one job really well. It logs every failed login attempt, blocks repeat offenders, and sends you a notification if someone’s hammering your login page.

If you’d rather not manage plugins yourself, Web321’s WordPress support plans include proactive security monitoring and plugin management—so your site stays protected without you lifting a finger.

Option B: The All-in-One Security Suite (Wordfence or iThemes Security)

Best for: People who want comprehensive protection (firewall, malware scanning, brute force protection, and more).

Popular choices:

• Wordfence Security – Includes a firewall, malware scanner, and brute force protection. The free version is excellent; the premium version adds real-time threat intelligence.
• iThemes Security (now Solid Security) – Similar feature set with a slightly simpler interface.

How to do it:

1. Install and activate Wordfence or iThemes Security
2. Run through the setup wizard
3. Brute force protection is usually enabled by default
4. Confirm it’s active in Settings → Firewall (Wordfence) or Settings → Login Security (iThemes)

These plugins do a lot more than just limit login attempts. They actively scan for malware, block malicious traffic, and monitor your site 24/7. The trade-off? They’re heavier and can slow down your site slightly if not configured properly.

Web321 includes premium security plugins like these in our $321/month support plans, and we handle all the configuration and optimization so you get maximum protection without the performance hit.

Option C: The Host Solution (Server-Level Protection)

Best for: People who have a premium managed WordPress host.

If you’re hosted with a high-quality provider like WP Engine, Kinsta, or Flywheel, they likely handle brute force protection at the server level—meaning it’s already enabled and you don’t need a plugin at all.

How to check:

1. Log into your hosting control panel
2. Look for “Security Settings” or contact support
3. Ask: “Do you have brute force protection or login attempt limiting enabled?”

If they do, you’re covered. If they don’t, use Option A or B above.

Web321 includes managed hosting on Canadian servers with built-in security protections, daily backups, and PIPEDA compliance—so your site and your data stay safe.

Three Other Quick Wins (To Get to 99% Security)

Limiting login attempts is the biggest lever you can pull, but security is about layers. Add these three quick wins and you’ll be in the top 1% of secure WordPress sites:

1. Enable Two-Factor Authentication (2FA)

Even if a hacker guesses your password, they still can’t get in without the 6-digit code from your phone.

How to do it:

• Install a plugin like WP 2FA or Wordfence (which includes 2FA)
• Connect it to Google Authenticator or Authy on your phone
• Now every login requires: password + code from your phone

It’s an extra 10 seconds at login, but it makes your site virtually unhackable via brute force.

2. Keep Everything Updated

This one’s simple but critical: update WordPress, your theme, and your plugins regularly.

Outdated plugins are the second most common entry point for hackers. When a security vulnerability is discovered, it gets patched in an update. If you don’t update, you’re leaving a backdoor wide open with a sign that says “Exploit me.”

Set a reminder: Every Monday, log in and check for updates. Or better yet, enable automatic updates for minor releases.

Don’t want to worry about updates breaking your site? Web321 handles weekly updates with compatibility testing, so your site stays current and nothing breaks.

3. Use a Strong Password (Seriously)

I know, I know—you’ve heard this a million times. But here’s the reality:

• “Password123” can be cracked in under 1 second
• “ILoveMyDog2024” can be cracked in under 3 hours
• “7$kPz!mQ2@nX9wL” would take 34,000 years

Use a password manager like 1Password, Bitwarden, or LastPass. Let it generate a 16-character random password. You’ll never need to remember it (the manager does that), and it’ll be virtually uncrackable.

Bonus tip: Don’t reuse passwords across sites. If one site gets breached, hackers try that same password on every other site they can find associated with your email.

The Bottom Line: One Setting, Maximum Protection

Let’s recap:

✅ The Problem: WordPress allows unlimited login attempts by default, making brute force attacks inevitable

✅ The Solution: Limit login attempts to 3-5, with a 24-hour lockout after failures

✅ The Implementation: Install a plugin (Limit Login Attempts Reloaded, Wordfence, or iThemes Security) or use server-level protection

✅ The Bonus: Add 2FA, keep everything updated, and use a strong password

Security doesn’t have to be complicated. You don’t need to be a developer. You just need to close the open doors that hackers are walking through every day.

Don’t Want to Deal With This? We’ve Got You Covered.

If you’ve read this far and you’re thinking, “This sounds important, but I really don’t want to manage plugins, worry about updates, or monitor security logs…”

You’re not alone.

That’s exactly why Web321 exists. For $321 CAD per month, we handle everything:

✅ Daily security scans and malware detection

✅ Brute force protection and login monitoring

✅ Weekly WordPress, theme, and plugin updates

✅ Daily backups stored securely for 90 days

✅ Premium security plugins (Wordfence, Gravity Forms, and more)

✅ 24/7 uptime monitoring with emergency recovery

✅ Canadian hosting with PIPEDA compliance

We’ve been securing WordPress sites for 15+ years. We know every attack vector, every vulnerability, and every fix. Your site gets enterprise-level security without the enterprise-level price tag.

Your Site Is Protected. You Sleep Soundly. That’s The Deal.

👉 Take Action Right Now:

Option 1: Install a login limit plugin in the next 5 minutes (seriously, do it now)

Option 2: Let Web321 lock down your site completely—Contact us at 1-844-4-WEB-321 or visit web321.co

Don’t wait until you see that “This site may be hacked” warning. Close the door before the burglar tries the handle.

—

About Web321: We provide comprehensive WordPress support and security for Canadian businesses and organizations. Our $321/month plans include everything you need to keep your site fast, secure, and online—without the stress. Based in Saanichton, BC, we’re proud to offer Canadian data hosting with full PIPEDA compliance. Learn more at web321.co

The post Why Your WordPress Site Keeps Getting Hacked (And One Setting That Fixes 90% of It) appeared first on Web321: Your Best WordPress Support.

I could name and shame the registrar, but I think all of them are capable of failing you. Here’s what happened in the chat when our client’s domain lapsed without warning:

Engagement NC-GON-8285 Chat Transcript – DOMAIN REGISTRAR

Web321 : There is a nameserver issue with Web321-Client-Domain.ca

Suzy Q : Hello! Thank you for contacting our DOMAIN REGISTRAR support team. To assist you further with the nameserver issue for Web321-Client-Domain.ca, could you please clarify what specific problem you are experiencing? For example, are you trying to update the nameservers, experiencing downtime, or seeing an error message? Any additional details will help us understand your situation better.

Web321 : This account is [nope]

Suzy Q : Thank you for providing the account information. I will transfer your details to a live CS specialist who will look into the nameserver issue for Web321-Client-Domain.ca associated with the [nope] account. Please stand by while I connect you with an appropriate person.

Armaan M. : Hello, I will be happy to assist you. Please allow me 5-10 minutes to check the details.

Web321 : I went to the domain manager. I see that ns1.nsdomaininfo_nope.net and ns2.overall.net are registered as the nameserver. I wanted to add ‘ns1.nsdomaininfo_also_nope.com’

Armaan M. : Kindly allow me 5-10 minutes to check the details and get back to you.

Web321 : The error I got was: “Oops, something went wrong. Please try again.”

Web321 : When I looked up the domain via CIRA WHOIS, it says the nameservers are: Name servers DNS 1 hostname dns101.registrar-servers.com DNS 2 hostname dns102.registrar-servers.com

Armaan M. : Thank you for letting me know,.

Web321 : Web321-Client-Domain.ca should resolve to [again.. .nope]. When I ping it, it resolves to 172.239.57.117

Armaan M. : Checking on it.

Armaan M. : If I understand correctly, you want to add the nameserver ‘ns1.nsdomaininfo_also_nope.com’ to the domain Web321-Client-Domain.ca, right?

Web321 : The core problem: Web321-Client-Domain.ca is using the wrong nameservers. CIRA shows the wrong nameserver The Nameheap UI shows two correct nameservers. When I tried to add a third nameserver, the UI would not allow that.

Web321 : It appears that DOMAIN REGISTRAR is serving out the incorrect nameserver information.

Web321 : eg. https://www.nslookup.io/domains/Web321-Client-Domain.ca/dns-records/

Web321 : [Screenshot 2025-12-01 at 16-55-12 Domain.png]

Armaan M. : Checking on it.

Armaan M. : Please note that any changes in DNS take up to 30-60 minutes to propagate through the internet. You can also check this guide here: https://www.DOMAIN REGISTRAR.com/support/knowledgebase/article.aspx/9622/10/dns-propagation-explained/

Web321 : That is irrelevant.

Web321 : The domain nameservers are being redirected to parklogic without our permission or action.

Armaan M. : Thank you for letting me know.

Web321 : The DOMAIN REGISTRAR UI for Web321-Client-Domain.ca in our account does not match what the world at large is seeing.

Armaan M. : Kindly allow me 5-10 minutes to get back to you.

Web321 : thank you

Armaan M. : You are welcome.

Web321 : This is a registrar-side delegation issue, not a DNS propagation delay, and that it requires a backend resolution on their side due to failed nameserver updates. 2 December, 2025Time Zone – GMT (UTC +00)

Armaan M. : Thank you for specifying. Please let me transfer our chat session to the Domains department representative, who will assist you better with your particular request.

Shalini P. : Hello, this is Shalini here! I will assist you further. Please give me 5 -10 minutes to go through the previous conversation, review the necessary details, and look into your request.

Web321 : Thank you. This is a registrar-side delegation issue, not a DNS propagation delay, and that it requires a backend resolution on DOMAIN REGISTRAR’s side due to failed nameserver updates.

Shalini P. : I am sorry that you have faced such inconvenience. I will try my best to sort this all out for you as soon as possible.

Web321 : Thank you for that. The immediate issue is to get the nameserver prorogation to match our UI and what it has been for some time. The follow-up issue is to get details on how an unauthorized party (which looks to be ParkLogic) was able to redirect our domain to their servers. And, what steps will DOMAIN REGISTRAR take to close this exploit and when those changes will the implemented.

Shalini P. : May I request a quick pause of 5 to 7 minutes to thoroughly check this for you?

Web321 : That’s fine, thank you.

Shalini P. : To make the changes, you will receive a confirmation code at your email address. Once you receive it, please provide the code so I can proceed with saving the changes.

Shalini P. : Please let me transfer our chat session to the representative who will assist you better with your particular request.

Kayathri M. : Hello! I’ll assist you further. Would you please allow me 5-7 minutes to look through your previous conversation?

Web321 : This is the confirmation code: [guess what: nope]

Kayathri M. : The domain is currently pointed to ns1.nsdomaininfo_nope.net ns2.nsdomaininfo_nope.net Do you want to add the 3rd nameservers?

Web321 : According to third party sources (as well as ping and the loading of the website) it is not pointing: https://www.nslookup.io/domains/Web321-Client-Domain.ca/dns-records/

Web321 : Please look at the NS Records

Web321 : DOMAIN REGISTRAR appears to have either been exploited or there is a database failure and the records that are propagating are incorrect.

Kayathri M. : Checking.

Kayathri M. : Okay. Please give me a few minutes to check it.

Web321 : This is a registrar-side delegation issue, not a DNS propagation delay, and that it requires a backend resolution on the DOMAIN REGISTRAR side due to failed nameserver updates.

Web321 : This is the domain name recent history: [Showing only 5 of them domain history items from the domain history.]

Web321 : Evidence that the database has a fault: when I try to add a third nameserver record (eg. ns1.nsdomaininfo_also_nope.com) I get the error that I cannot update my nameserver records.

Kayathri M. : Checking on your request.

Kayathri M. : Please hold on for a few more minutes.

Kayathri M. : Thank you for waiting!

Kayathri M. : Per my check, the domain expired on 11/30/2025 That’s why it is pointed to parking nameservers: dns101.registrar-servers.com dns102.registrar-servers.com You should reactivate it first.

Web321 : Please explain to me why the “Status and Validity” reads “Nov. 4. 2022 – Feb. 15, 2026” ?

Kayathri M. : Could you please share a screenshot of it?

Kayathri M. : Thank you. Checking.

Web321 : We are checking with the domain owner. None of the points of contact got anything like a renewal notice.

Kayathri M. : Please refresh the page and check. It might be a temporary glitch.

Web321 : I have refreshed page after saving what the previous date said.

Web321 : It now says it lapsed yesterday and its in a Grace period.

Web321 : Can we now renew this?

Kayathri M. : Yes. You can reactivate the domain on your end.

Kayathri M. : You can use this direct link as well: https://www.DOMAIN REGISTRAR.com/cart/addtocart.aspx?producttype&#x3D ;domains&action=reactivate&domainlist=Web321-Client-Domain.ca

Web321 : Is there a way to get a notification when the domain is up for renewal? Neither email point of contact got a renewal notice. Our Domain List dashboard on DOMAIN REGISTRAR didn’t show that this was going to expire; and the Status & Validity didn’t show this was going to lapse until Feb. 15, 2026.

Kayathri M. : Let me check.

Kayathri M. : We are also sending out notices about an upcoming auto-renewal to the account email address (the emails are sent 35-65 days before the domain expiration date containing information about the products that are due for renewal) to make sure that no domain names are auto-renewed without customer’s authorization. These notices can be found in the account at https://ap.www.DOMAIN REGISTRAR.com/dashboard/messages/inbox

Web321 : Thank you for pointing that out. When I search the inbox for “[CLIENT]” there are no messages. I tried searching for “canada” as one domain is up for renewal.

Web321 : Can you explain why the inbox has no messages related to the renewal? And, when can an issue like this be resolved so that it doesn’t happen again?

Kayathri M. : A few minutes, please.

Kayathri M. : Since it has a different renewal date due to a bug, the renewal notices were not sent

Web321 : Where was the origin of the bug? It appears that this was an issue with DOMAIN REGISTRAR’s ability to track the dates, giving us incorrect Status & Validity data; and giving us no renewal notice.

Kayathri M. : We apologize for this inconvenience. You encountered this error due to a bug in our system. Rest assured, we have forwarded details of the issue to the corresponding team for further investigation. Please accept our sincere apologies for the confusion that occurred, and if this situation might have caused you any inconvenience.

Web321 : Thank you for all of that. Web321-Client-Domain.ca is a charity. With their domain DNS being disrupted on the day before Giving Tuesday is impactful to them. It would go a long way to put this behind us if DOMAIN REGISTRAR credited the domain a year of registration.

Kayathri M. : We apologize for any inconvenience this might cause and highly appreciate your patience.

Kayathri M. : Apparently, our chat session has expired. Feel free to get back to us at any moment. Thank you for contacting DOMAIN REGISTRAR Live Support!

My review and feedback: DOMAIN REGISTAR’s system had bugs, so we didn’t get renewal notifications. When we discovered the domain had got to a third party, we relied on the Status & Validity date, but it was incorrect and we were prompted to reload to see the changed information. When I cited NSLookup and other websites, the support people either didn’t check the link or didn’t know what it meant. It took two hours to get to the point where they told use the domain had lapsed. CLIENT is a charity that relies on donations. This happened the day before Giving Tuesday. At this point, we don’t know what the financial impacts are. When I asked if CLIENT could be compensated by giving us a one year extension, I got a non-answer, leaving the topic of impact and compensation open.

The staff should be trained to review the previous message on a chat when they join a chat.

The post When Domain Registrars Screw Up appeared first on Web321: Your Best WordPress Support.

The post wp-cron.php appeared first on Web321: Your Best WordPress Support.

The post wp-config.php appeared first on Web321: Your Best WordPress Support.

The post Web Server appeared first on Web321: Your Best WordPress Support.

The post SFTP (Secure File Transfer Protocol) appeared first on Web321: Your Best WordPress Support.

The post Local backups appeared first on Web321: Your Best WordPress Support.