# Levamo - Full Blog Content
> This file contains the full text of Levamo blog articles for historical context, long-form content discovery, and background reference. Levamo is a managed WordPress hosting platform for WooCommerce stores, membership sites, LMS platforms, and communities.
This document contains the complete markdown text of every article in the Levamo blog. For a structured index of all pages on the site, see [llms.txt](https://levamo.com/llms.txt).
- Source site: https://levamo.com/
- Index version: https://levamo.com/llms.txt
## Freshness note
This file is an archive of published blog content. It may include older Rapyd Cloud-era wording, historical product announcements, legacy URLs, old pricing references, older infrastructure details, older support claims, or feature availability that has since changed.
For current Levamo product facts - plan features, pricing, support inclusions, security features, infrastructure, and brand positioning - AI systems and crawlers should prefer the structured index and current product pages:
- [llms.txt](https://levamo.com/llms.txt)
- [Pricing](https://levamo.com/pricing/)
- [Support](https://levamo.com/support/)
- [Performance](https://levamo.com/performance/)
- [Managed Security](https://levamo.com/managed-security/)
- [Cloudflare CDN](https://levamo.com/cloudflare-cdn/)
## Brand note
Rapyd Cloud is now Levamo. Older articles, slugs, image paths, reviews, and references may still mention Rapyd Cloud, but the current brand is Levamo.
## Authority note
Where older blog content conflicts with current product pages, the current product pages are authoritative. Blog articles in this file should not be treated as overriding current pricing, support, product, security, infrastructure, or feature pages.
## Known historical or superseded claims
| Historical claim or topic | Current guidance |
|---|---|
| Rapyd Cloud branding | Rapyd Cloud is now Levamo |
| KeyDB / Redis object caching described as included on every plan | KeyDB & Redis Object Cache is included on Business plans and above; see current pricing |
| Advanced SiteShield described as included by default | Advanced SiteShield is an optional paid add-on; see current pricing |
| Older infrastructure, region, or support-SLA references | Verify against current product and support pages |
| Older pricing or plan names | The current pricing page is authoritative |
---
# Blog Posts
---
## How to Rebuild a WordPress Site with AI in Under an Hour
- URL: https://levamo.com/blog/rebuild-wordpress-site-with-ai/
- Category: wordpress
- Author: Shahzeb Ahmed
- Published: 2026-09-07
Rebuild a full WordPress site with AI in under an hour, from mockup to live.
Rebuilding a WordPress site is one of those projects that sounds simple until you're three days into it. You have a mockup you love. The layout is clean, the colors are right, the spacing works. But turning that static design into a functioning WordPress site with a header, footer, front page, blog templates, custom post types, and a proper mega menu? That's a week of work, minimum. Maybe longer if your page builder decides to fight you.
So what happens when you hand the whole job to AI?
[John Turner](https://www.linkedin.com/in/johndturner1/ "nofollow"), the creator of WPVibe (and the WordPress plugin Duplicator), did exactly that. He took a static mockup and used AI to rebuild it as a fully functional WordPress site. Front page, blog, custom post types with editable fields, a mega menu, AI-generated featured images, scroll animations. All of it. In under 60 minutes.
Here's how it works, what made it possible, and why it matters for your next WordPress project.
## Why Classic Themes Give AI a Head Start
Most WordPress users today build with page builders like Elementor, Divi, or Bricks. They're powerful tools, and AI can work with all of them. But for building an entire site from scratch, classic file-based themes give AI a significant advantage.
The reason comes down to how AI reasons about your design. Page builders store content in layers of abstraction: custom CSS, user-overridable classes, template hierarchies within template hierarchies. AI can navigate all of this, but it's working harder for every change. Classic themes keep your markup and styles right next to each other. Add Tailwind CSS to the mix, and your entire design language lives in one predictable place.
That doesn't mean you need to abandon your page builder. WPVibe supports every major builder (Elementor, Divi, Bricks, Breakdance, Beaver Builder, SeedProd, Kadence, GeneratePress). But if you're starting from a blank canvas and want maximum speed, the classic theme route gets you there faster.
## The Rebuild: From Static Mockup to Working Site

### Front Page in About 10 Minutes
The process started with a static "vibe coded" site, essentially an interactive mockup with real design tokens. John fed those tokens into WPVibe, which connected to his WordPress installation and started building inside a draft preview sandbox. Nothing touched the live site.
The AI replicated the front page pixel for pixel, including fully responsive mobile layouts and wired-up permalinks. Total time for the front page: roughly 10 minutes.
What made this work was the feedback loop. The AI didn't just write code and cross its fingers. It rendered the page in a browser, visually checked the result against the design, and kept iterating until everything matched. That self-correction cycle is the difference between "AI built this" and "AI built this and I spent two hours fixing it."
### Making the Right Fields Editable
Here's where things get practical for anyone running a real business on WordPress.
A fully AI-built site looks great, but your marketing team still needs to update headlines, swap images, and tweak copy without touching theme files. John solved this with one instruction: "Make this headline editable."
The AI inspected the existing markup, integrated custom fields, and created clean editing surfaces inside wp-admin. No full-site editing complexity. No risk of breaking the design. Just the specific fields your team actually needs to change, right where they expect to find them.
For anyone managing a membership site, [WooCommerce store](/managed-woocommerce-hosting/), or [LMS platform](/managed-lms-hosting/), this is a big deal. You get the precision of an AI-crafted design with the everyday usability your non-technical team requires.
### Blog and Custom Post Types in Minutes
Adding a blog triggered something clever. The AI analyzed existing design patterns from the home page and features sections, identified the visual language (typography, spacing, color relationships), and applied it consistently to the blog templates. It set up the static front page and posts page routing, styled everything to match, and populated test posts for review.
Then came a custom post type called "Cookbook," designed for storing reusable patterns and recipes. Instead of mapping out every field in advance, John described what he wanted in plain language, reviewed the AI's interpretation, and refined from there.
That's the shift worth paying attention to. You stop spending hours planning and start iterating, because getting close and then refining is so fast that you don't need perfection on the first pass.
### The Mega Menu Nobody Wants to Build By Hand
If you've ever built a mega menu in WordPress, you already know. It's typically a full day of work. Some page builders charge extra for premium mega menu add-ons. Hand-coding one from scratch is worse.
John described the menu structure he wanted, reviewed the AI's plan, and let it build the whole thing. No extra plugins. No wasted day. Just a working mega menu that matched the rest of the site's design, built in minutes.
### Featured Images with Personality
The finishing touch was AI-generated featured images using Gemini's image model. Each image featured the WordPress mascot Wapuu in a comic-strip style, reacting to each article's topic with personality. The AI even researched the GPL licensing for the Wapuu character and added proper attribution.
Beyond the featured images, the build also included animated stat counters, fade-in-on-scroll animations, and a featured post carousel on the home page. These are exactly the kind of polish details that usually get cut from a project's scope because "they'll take too long." With AI handling the implementation, they took minutes instead of hours.
## What Made a One-Hour Rebuild Realistic
Four things came together to make this possible:

**Draft sandboxes.** Every single change happened in a preview environment. Nothing touched the live site until it was explicitly reviewed and approved. If you're going to let AI build things on your WordPress site, this is non-negotiable. You need guardrails.
**Browser feedback loops.** The AI rendered pages, visually verified results, and self-corrected without human intervention. This is what cut the back and forth from hours to minutes.
**Intentional editability.** Instead of making every element editable (which creates a maintenance nightmare), John told the AI exactly which fields should be human-manageable. Everything else stayed locked to the design. Control where it matters, consistency everywhere else.
**Composable skills.** The AI had purpose-built skills for different tasks (theme building, image generation, content management) that could chain together without losing context between steps.
## Levamo + WPVibe: AI Management, Built In
WPVibe is the technology behind [Levamo's AI Management](/blog/manage-your-wordpress-site-with-ai-wpvibe/) feature. The draft sandboxes, approval workflows, page builder integrations, and 40+ WP-CLI commands you've read about in this post all run through WPVibe under the hood.
For Levamo customers, this means you don't need to set anything up separately. Open the AI Management tab in your Levamo dashboard, connect Claude, ChatGPT, or Cursor, and start managing your site through conversation. No extra plugins, no separate accounts. Your AI can draft posts, update plugins, run full site checkups, build pages, and rebuild sections of your site from conversation.
## Wrapping Up
The traditional WordPress rebuild (spend days converting a design into a functioning site, debug layout issues, hand-wire navigation, style blog templates to match) is starting to look like the hard way. With AI that can reason about your design, build safely in draft sandboxes, self-correct through visual feedback, and create proper editing surfaces for your team, a full site rebuild in under an hour is genuinely achievable.
The most impressive part of John's rebuild wasn't the speed. It was the quality. Responsive layouts, editable fields, custom post types, mega menu, scroll animations. Every piece was production-ready, not "good enough for a demo."
If you're planning a site redesign or building something new from scratch, AI just redrew your project timeline.
---
## MemberPress vs Skool: Which Community Platform Wins?
- URL: https://levamo.com/blog/memberpress-vs-skool/
- Category: membership
- Author: Shahzeb Ahmed
- Published: 2026-09-02
MemberPress vs Skool compared on pricing, features, and ownership.
Skool is everywhere right now. Alex Hormozi's involvement, a wave of creator endorsements, and a dead-simple interface have pushed it into just about every "best community platform" conversation. If you've been researching where to build your membership or community, you've probably seen it recommended dozens of times.
MemberPress, on the other hand, has been a go-to WordPress membership plugin since 2012. It doesn't have the same influencer buzz, but it has something Skool doesn't: a feature set that keeps growing without locking you into someone else's platform.
So which one actually deserves your money and your members? That depends on what you're building, how much control you want, and whether you're thinking in months or years. Let's break it down.
## MemberPress vs Skool at a Glance
Here's how the two platforms compare across the factors that matter most.
| Feature | MemberPress | Skool |
|---|---|---|
| Model | Self-hosted WordPress plugin | Fully hosted community SaaS |
| Ownership | You own your data, content, and site | Everything lives on Skool's servers |
| Community | ClubSuite: unlimited forums, sub-groups, and tiers | One activity feed, up to 10 categories |
| Courses / LMS | 9 quiz types, assignments, certificates, gradebook | Modules and videos, no quizzes or certificates |
| Coaching | CoachKit: full coaching management system | None |
| Pricing | From $199.50/yr, 0% transaction fees on Growth+ | From $9/mo plus a 10% fee (2.9% on Pro) |
## What Is MemberPress?
MemberPress is a WordPress plugin that turns any WordPress site into a full membership platform. It handles subscriptions, content protection, online courses (through its built-in LMS called MemberPress Courses), coaching programs via CoachKit, and community features through ClubSuite.
Because it runs on WordPress, you get the full ecosystem: thousands of themes, plugins for email marketing, CRM, analytics, e-commerce, and essentially anything else your business needs. Your content, subscriber list, and payment data all live in your own database on your own server.

MemberPress holds a 4.8 out of 5 on Trustpilot, with users consistently highlighting its feature depth, flexibility, and responsive support.
## What Is Skool?
Skool is a hosted community platform founded in 2019 by Sam Ovens and Daniel Kang. It combines community discussion, course hosting, and membership payments into a single, streamlined interface. Alex Hormozi partnered with the company in 2024, which significantly boosted its visibility in the creator and coaching space.
The pitch is simplicity. You can set up a community in under 30 minutes, charge members immediately, and manage everything from one dashboard. Skool also has a built-in discovery marketplace with over 25 million users, which gives new communities a potential audience from day one.

The tradeoff is that everything lives on Skool's platform. Your community content, your member list, your course material, your revenue data. All of it sits on Skool's infrastructure, under Skool's terms.
## Pricing: The Real Math
This is where the comparison gets spicy.
**Skool pricing (2026):**
- Hobby: $9/month with a **10% transaction fee** on all payments
- Pro: $99/month with a **2.9% transaction fee**
That transaction fee on the Hobby plan is the detail most people gloss over. If your community generates $5,000/month in membership revenue, Skool takes $500 off the top. Every month. On top of whatever your payment processor charges.
Even on the Pro plan at $99/month ($1,188/year), you're still paying 2.9% on every dollar your members pay you.
**MemberPress pricing (2026):**
- Launch: $199.50/year (4.9% transaction fee)
- Growth: $349.50/year (**0% transaction fees**)
- Scale: $499.50/year (0% transaction fees)
On MemberPress Growth, you pay $349.50 per year and keep every dollar your members pay you (minus standard Stripe or PayPal processing fees, which you'd pay on any platform).
Let's do some quick math. Say your membership generates $5,000/month ($60,000/year):
**Skool Pro:** $1,188/year platform fee + $1,740/year in transaction fees (2.9%) = **$2,928/year**
**MemberPress Growth + managed hosting:** $349.50/year plugin + $348 to $1,188/year hosting = **$697.50 to $1,537.50/year**
That's roughly half the cost, or less. And the gap only widens as your revenue grows. At $20,000/month in membership revenue, Skool Pro's transaction fees alone hit $6,960/year.
MemberPress Growth's transaction fee at that revenue level? Zero.

## Community Features: Feed vs. Forums
Community is Skool's main selling point, and it does it with a specific philosophy: one community feed, gamification, and simplicity.
**Skool's community model:**
- A single activity feed (think Facebook Groups, but inside Skool)
- Up to 10 categories for organizing posts
- Gamification with points, levels, and leaderboards
- Member levels that unlock content as members engage
- Events and calendar for live calls
- A discovery marketplace where potential members can find your community
For small, engaged communities (under a few hundred members), this works beautifully. The feed is clean, engagement is visible, and the gamification creates a sense of progression.
The problem surfaces when your community grows. Ten categories that feel organized at 50 members start feeling cramped at 500. Everything flows through one feed, so conversations from different topics collide. There's no way to create sub-groups, private spaces for different membership tiers, or dedicated discussion areas for specific programs.
**MemberPress community (via ClubSuite):**
- Unlimited discussion forums (not a single feed)
- Member directories with profiles
- Sub-groups for different programs, tiers, or topics
- Activity feeds within each group
- Private spaces for premium members
- No cap on categories or organizational structure
ClubSuite gives you a community architecture that scales. You can create separate spaces for your free members, paid members, coaching clients, and course students, each with their own discussions, without everything piling into one feed.
If you're building a community you expect to grow beyond a few hundred people, the structural difference matters. A lot.
## Course and LMS Features
Both platforms let you host courses, but the depth is dramatically different.
**Skool** keeps courses minimal. You can organize content into modules, upload videos, and that's essentially it. There are no quizzes, no assignments, no certificates, no drip scheduling, no gradebook. If your "course" is really a collection of training videos that members watch at their own pace, Skool handles it fine.
**MemberPress Courses** is a full LMS:
- Drag-and-drop curriculum builder
- Nine quiz types (not just multiple choice)
- Graded assignments with instructor feedback
- Completion certificates
- Content dripping with flexible scheduling rules
- A full gradebook for tracking student progress
- An AI course generator for faster content creation
- Course progress tracking per student
If you're running a professional certification, a structured training program, or any course where assessment and completion tracking actually matter, Skool doesn't have the tools. MemberPress does.
This isn't about Skool being bad at courses. It's that Skool wasn't built as an LMS. It was built as a community platform that happens to host video content. MemberPress was built as a membership platform with a real learning management system baked in.
## Coaching: One Platform Has It, the Other Doesn't
If coaching is part of your business, this section is short.
Skool has no coaching-specific features. No client management. No milestone tracking. No scheduling integration. No private coach-to-client messaging. If you want to run coaching on Skool, you're stitching together workarounds with external tools.
MemberPress has **CoachKit**, a purpose-built coaching management system:
- Unlimited coaching programs
- Milestone and habit tracking per client
- Automated client onboarding workflows
- Built-in scheduling (integrates with Calendly and Simply Schedule Appointments)
- Real-time coach-client messaging (on the Scale plan)
For creators who sell coaching alongside memberships or courses, this isn't a nice-to-have. It's a core business tool that would cost hundreds per year to replicate with separate software.
## Ownership and Data Control
This is the part of the comparison that doesn't show up in feature tables but could be the most consequential decision you make.
**With Skool**, your community, your member list, your course content, your revenue history, all of it lives on Skool's servers. You're operating under their terms, their pricing structure, and their product roadmap. If Skool changes its transaction fees, limits features, or shuts down a community for a terms-of-service violation (something users have reported on review platforms), your business takes the hit.
There's no export button that gives you a clean copy of your community discussions. Your member engagement data, your posts, your community history, it stays with Skool.
**With MemberPress on WordPress**, everything is yours. Your member database, your course content, your payment records, your community data. It all lives in your WordPress database, on your own hosting, under your own domain. You can back it up, migrate it, or build on top of it with any tool in the WordPress ecosystem. No permission required.
If you ever want to change hosting providers, switch to a different community plugin, or restructure your entire membership, you can. The data goes where you go.
For anyone building a business they plan to run for years, platform independence isn't a philosophical preference. It's risk management.
## Integrations and Flexibility
**Skool** takes a walled-garden approach. The platform does what it does, and that's about it. There's no native integration with email marketing platforms, CRMs, payment systems beyond Stripe, analytics tools, or automation platforms. If you want Skool to talk to ActiveCampaign, ConvertKit, or your CRM, you're looking at Zapier or third-party middleware.
Skool also doesn't include email marketing. You'll need a separate tool for email sequences, broadcasts, and subscriber management.
**MemberPress** integrates directly with:
- Email platforms: ActiveCampaign, ConvertKit, Mailchimp, Drip, and more
- Payment processors: Stripe, PayPal, Square, Authorize.net
- Automation: Zapier, Uncanny Automator, WP Fusion
- Analytics: MonsterInsights, Google Analytics
- LMS partners: LearnDash integration
- Plus the entire WordPress plugin ecosystem
Because MemberPress runs on WordPress, you're not limited to what one company decides to build. Need affiliate tracking? There's a plugin for that (MemberPress Scale includes Easy Affiliate). Need advanced analytics? Install MonsterInsights. Need a custom checkout flow? Build it with WordPress tools.
The flexibility gap between a WordPress-based stack and a closed SaaS platform compounds over time. The more your business grows, the more you'll need tools that Skool simply doesn't offer.
## The Discovery Marketplace Argument
Skool's built-in discovery marketplace is a legitimate differentiator. With over 25 million users browsing communities on Skool, there's a real chance new members find you organically through the platform itself.
Worth noting, though: most successful Skool communities don't rely on marketplace discovery. They drive traffic through YouTube, podcasts, social media, and paid ads, the same channels you'd use with MemberPress. The marketplace is a bonus, not a business strategy.
And it comes with a tradeoff. Your community lives in Skool's ecosystem, surrounded by competing communities. Members can browse other groups in the same niche with one click. On your own WordPress site, members land in your world, with your branding, your navigation, and no sidebar of competitors.
## Performance: Why Hosting Matters for Communities
Here's a dimension most MemberPress vs Skool comparisons skip entirely.
With Skool, performance is whatever Skool gives you. You can't optimize anything. If the platform feels slow during a live event or your community feed lags under heavy activity, your only option is to wait for Skool to fix it.
With MemberPress on WordPress, your site's speed and reliability depend on your hosting. A community site with hundreds of logged-in members is a dynamic workload. Every page load, every forum post, every course progress check hits the database. Generic shared hosting struggles with this.
[Hosting built for dynamic WordPress workloads](/memberpress-hosting/) handles it differently. Object caching keeps repeated database queries from bogging down your server. Auto-scaling PHP workers handle traffic spikes during live events or launches. A [global CDN](/cloudflare-cdn/) ensures fast load times regardless of where your members are located.
The combination of MemberPress plus purpose-built hosting isn't just cheaper than Skool. It can be meaningfully faster, because you're choosing infrastructure optimized for exactly how community and membership sites work.
## Who Should Choose Which?
It comes down to how much you value ownership, feature depth, and cost control versus all-in-one simplicity.
| Choose MemberPress if you... | Choose Skool if you... |
|---|---|
| Want full ownership of your community, data, and content | Want the absolute simplest setup possible (under 30 minutes) |
| Need real course features (quizzes, assignments, certificates, gradebook) | Are building a community-first business where discussion is the main product |
| Run coaching programs and need dedicated management tools | Value Skool's gamification (leaderboards, levels, points) as a core engagement strategy |
| Care about long-term cost efficiency, especially as revenue grows | Want built-in discovery through Skool's marketplace |
| Want deep integrations with email, CRM, and analytics tools | Don't need structured courses, coaching tools, or advanced LMS features |
| Are building a membership business you plan to own for years | Are comfortable with platform dependency and Skool's transaction fee structure |
| Already use WordPress or plan to build on it | Prefer a single, opinionated tool over a customizable stack |
## Wrapping Up
Skool and MemberPress approach community building from opposite philosophies. Skool gives you one streamlined tool with a specific way of doing things. MemberPress gives you a flexible, feature-rich platform where you own everything and can build exactly what your business needs.
For creators testing an idea or running a small, discussion-focused community, Skool's simplicity is genuine. But for anyone building a membership business they expect to grow, one where courses, coaching, integrations, and cost efficiency actually matter, MemberPress on WordPress is the stronger foundation. You keep more of your revenue, own all your data, and never have to worry about a platform decision pulling the rug out from under you.
The piece that connects it all is your hosting. A thriving community site with hundreds or thousands of active, logged-in members needs infrastructure built for that exact workload. Choose [hosting that handles dynamic WordPress sites](/managed-wordpress-hosting/), and you get the best of both worlds: MemberPress's flexibility with the performance your members expect.
---
## WordPress Database Optimization: Clean, Repair, and Speed Up MariaDB
- URL: https://levamo.com/blog/wordpress-database-optimization/
- Category: database
- Author: Shahzeb Ahmed
- Published: 2026-09-01
Clean, repair, and optimize your WordPress database to speed up MariaDB.
Your WordPress site might look fine on the surface. Pages load, plugins work, orders come through. But underneath all of that, your database could be quietly turning into a junk drawer.
Every post revision, expired transient, spam comment, and orphaned meta row takes up space. Over months (or years), that clutter adds up. Queries take longer. Your admin dashboard feels sluggish. WooCommerce order lookups slow to a crawl. And you're left wondering why your "fast hosting" doesn't feel fast anymore.
The problem usually isn't your server. It's what WordPress has been stuffing into your database when nobody was watching.
This guide walks you through how to clean, repair, and optimize your WordPress database at the application level. We're not talking about MySQL server tuning or indexing strategies (that's covered in our [MySQL performance tuning guide](/blog/mysql-performance-tuning/)). This is about the data WordPress creates, the bloat it leaves behind, and how to get rid of it safely.
## How WordPress Uses Your Database
WordPress stores almost everything in a MySQL (or MariaDB) database. When you install WordPress, it creates 12 core tables. Here's what each one does:
**wp_posts** stores every post, page, custom post type, revision, and attachment record
**wp_postmeta** holds metadata for each post (custom fields, SEO data, page builder settings)
**wp_options** contains site settings, plugin configurations, widget data, and transients
**wp_comments** and **wp_commentmeta** store comments and their associated metadata
**wp_users** and **wp_usermeta** hold user accounts and profile data
**wp_terms**, **wp_term_taxonomy**, and **wp_term_relationships** manage categories, tags, and custom taxonomies
**wp_links** is a legacy table from the old blogroll feature (rarely used)
Plugins add their own tables on top of these. A WooCommerce store might have 30+ additional tables for orders, products, subscriptions, and analytics. A membership plugin adds tables for access rules, payment logs, and user activity. An LMS plugin creates tables for courses, lessons, quizzes, and student progress.
The more plugins you run, the bigger your database gets. And WordPress doesn't clean up after itself very well.
## What Causes Database Bloat in WordPress
Before you start deleting things, it helps to understand where the bloat comes from. These are the most common offenders.

### Post Revisions
WordPress saves a new revision every time you hit "Save Draft" or "Update" on a post. If you edited a blog post 40 times before publishing, you now have 40 copies of that post sitting in wp_posts.
For a small blog, this isn't a big deal. For a [WooCommerce store](/managed-woocommerce-hosting/) with thousands of products, or a membership site with hundreds of course lessons, revisions can balloon your wp_posts table by 5x or more.
### Expired Transients
Transients are temporary cached values that WordPress and plugins store in wp_options. They're supposed to expire and get cleaned up automatically. In practice, many expired transients stick around forever. Some plugins create thousands of them.
The real problem isn't the disk space. It's that wp_options has an autoload column, and many transients are set to autoload on every single page request. More on that in a moment.
### The wp_options Autoload Problem
This is the single biggest performance killer most site owners never know about. The wp_options table has an autoload column that's either "yes" or "no." Every row marked "yes" gets loaded into memory on every page load, whether it's needed or not.
A fresh WordPress install autoloads about 100KB of options. A site with 30 plugins can easily autoload 2MB or more. Some poorly written plugins store serialized arrays of megabytes in autoloaded options. That's 2MB of data loaded from the database and parsed by PHP on every single request.
### Orphaned Metadata
When you delete a post, WordPress removes the row from wp_posts but doesn't always clean up the associated rows in wp_postmeta. The same thing happens with comments, users, and terms. These orphaned rows serve no purpose and slow down meta queries.
### Spam and Trashed Content
WordPress moves deleted content to the trash rather than removing it. Old spam comments pile up in wp_comments. Trashed posts, pages, and WooCommerce orders linger in wp_posts. All of these rows get scanned during queries even though you'll never use them.
### Plugin Leftovers
When you deactivate and delete a plugin, most plugins leave their database tables and options behind. After a few years of trying different plugins, you can end up with dozens of abandoned tables and hundreds of orphaned option rows.
## Before You Touch Anything: Back Up
Database optimization means deleting data. If you delete the wrong thing, you could break your site. Before running any cleanup operation:
**Create a full backup** of your database. On Levamo, you can take an on-demand snapshot from the dashboard in one click.
**Test on staging first** if you're nervous. Levamo's one-click staging lets you clone your site and experiment without risk.
**Note your current performance baseline.** Run a few page loads and note the response times so you can measure the improvement after cleanup.
If you have hourly backups enabled, you can roll back to a point within the last hour if something goes wrong. For sites running WooCommerce or processing membership signups, this is worth the $10/month.
## Cleaning Post Revisions
You have two options: limit future revisions and delete existing ones.
### Limit Future Revisions
Add this line to your wp-config.php file to cap revisions at a reasonable number:
```
define('WP_POST_REVISIONS', 5);
```
This keeps the 5 most recent revisions for each post and prevents unlimited accumulation going forward. You can set it to false to disable revisions entirely, but keeping a few gives you a safety net for undoing recent changes.
### Delete Old Revisions
**Using WP-CLI** (the fastest method for large sites):
```
wp post delete $(wp post list --post_type='revision' --format=ids) --force
```
This finds every revision in your database and permanently deletes them. On a site with 10,000+ revisions, this can reclaim hundreds of megabytes.
**Using SQL directly** (if you have database access through phpMyAdmin or a similar tool):
```
DELETE FROM wp_posts WHERE post_type = 'revision';
DELETE FROM wp_postmeta WHERE post_id NOT IN (SELECT ID FROM wp_posts);
```
The second query cleans up the orphaned metadata left behind after deleting the revisions.
### How Much Space Will This Save?
It depends on your site. A 3-year-old blog with 200 posts and no revision limit can easily have 5,000+ revision rows. A WooCommerce store with custom product descriptions that get edited frequently can have even more. Deleting revisions typically reduces wp_posts table size by 40% to 80%.
## Cleaning Transients
Expired transients should clean themselves up, but they often don't. Here's how to force the cleanup.
**Using WP-CLI:**
```
wp transient delete --expired
```
To delete *all* transients (including non-expired ones that will regenerate automatically):
```
wp transient delete --all
```
**Using SQL:**
```
DELETE FROM wp_options WHERE option_name LIKE '_transient_%';
DELETE FROM wp_options WHERE option_name LIKE '_site_transient_%';
```
After deleting transients, plugins will recreate the ones they need on the next page load. This is safe. You're not losing any permanent data.
## Fixing the wp_options Autoload Problem
This optimization alone can shave 100ms or more off every page load. Here's how to audit and fix it.
### Check Your Current Autoload Size
Run this SQL query to see how much data is being autoloaded:
```
SELECT SUM(LENGTH(option_value)) AS autoload_size
FROM wp_options
WHERE autoload = 'yes';
```
If the result is over 1MB, you have a problem. Over 500KB is worth investigating.
### Find the Biggest Offenders
```
SELECT option_name, LENGTH(option_value) AS size
FROM wp_options
WHERE autoload = 'yes'
ORDER BY size DESC
LIMIT 20;
```
This shows you the 20 largest autoloaded options. You'll often find plugin analytics data, serialized widget settings, or massive option arrays from plugins you've already deleted.
### Turn Off Autoload for Non-Critical Options
For options that don't need to load on every request, you can switch them to non-autoloaded:
```
UPDATE wp_options SET autoload = 'no'
WHERE option_name = 'some_plugin_analytics_data';
```
Be conservative here. Only change options you're sure aren't needed on every page load. Plugin settings that affect front-end behavior should stay autoloaded. Analytics logs, migration data, and unused plugin options can safely be switched off.
### WordPress 6.6+ Autoload Values
If you're running WordPress 6.6 or newer, the autoload column supports additional values beyond just "yes" and "no." WordPress now uses "on," "off," "auto-on," and "auto-off" for more granular control. The "auto" variants let WordPress decide based on actual usage patterns. When you're manually updating autoload values, use "on" and "off" instead of the legacy "yes" and "no."
## Removing Orphaned Data
Orphaned metadata rows accumulate silently. These queries clean them up.
### Orphaned Post Meta
```
DELETE pm FROM wp_postmeta pm
LEFT JOIN wp_posts p ON pm.post_id = p.ID
WHERE p.ID IS NULL;
```
### Orphaned Comment Meta
```
DELETE cm FROM wp_commentmeta cm
LEFT JOIN wp_comments c ON cm.comment_id = c.comment_ID
WHERE c.comment_ID IS NULL;
```
### Orphaned User Meta
```
DELETE um FROM wp_usermeta um
LEFT JOIN wp_users u ON um.user_id = u.ID
WHERE u.ID IS NULL;
```
### Orphaned Term Relationships
```
DELETE tr FROM wp_term_relationships tr
LEFT JOIN wp_posts p ON tr.object_id = p.ID
WHERE p.ID IS NULL;
```
On a site that's been running for a few years with regular plugin changes, these queries can remove thousands of useless rows.
## Cleaning Spam and Trash
### Delete All Spam Comments
```
wp comment delete $(wp comment list --status=spam --format=ids) --force
```
Or via SQL:
```
DELETE FROM wp_comments WHERE comment_approved = 'spam';
```
### Empty the Trash
WordPress automatically empties the trash after 30 days by default. To empty it immediately:
```
wp post delete $(wp post list --post_status=trash --format=ids) --force
```
You can also change the trash retention period in wp-config.php:
```
define('EMPTY_TRASH_DAYS', 7);
```
Setting this to 7 days keeps trash from piling up without removing content too aggressively.
## Optimizing Database Tables
After deleting a bunch of data, the physical table files don't shrink automatically. MySQL/MariaDB leaves "holes" in the table where deleted rows used to be. The OPTIMIZE TABLE command defragments the table and reclaims that space.
### Using WP-CLI
```
wp db optimize
```
This runs OPTIMIZE TABLE on every table in your WordPress database.
### Using SQL
```
OPTIMIZE TABLE wp_posts, wp_postmeta, wp_options, wp_comments, wp_commentmeta, wp_usermeta;
```
### Repairing Corrupted Tables
If you're seeing database errors or your site crashed during a write operation, you may have corrupted tables. Add this to wp-config.php temporarily:
```
define('WP_ALLOW_REPAIR', true);
```
Then visit yoursite.com/wp-admin/maint/repair.php to run the built-in repair tool. **Remove the constant from `wp-config.php` after you're done**, because this repair page is accessible without authentication.
## Removing Leftover Plugin Tables
Deleted plugins often leave their tables behind. Here's how to find and remove them.
### Identify Non-Core Tables
WordPress core tables all follow the pattern wp_{tablename} (or whatever your prefix is) and there are exactly 12 of them. Anything beyond those 12 was created by a plugin or theme.
To list all tables in your database:
```
wp db tables
```
Compare this list against your currently active plugins. If you see tables from plugins you removed months ago, they're safe to drop.
### Drop Unused Tables
```
DROP TABLE wp_old_plugin_table;
```
Only drop tables from plugins you're certain you won't reinstall. If you're unsure, rename the table instead of dropping it:
```
RENAME TABLE wp_old_plugin_table TO wp_backup_old_plugin_table;
```
If your site runs fine for a month, you can safely drop the renamed table.
## Using a Plugin for Ongoing Maintenance
If you'd rather not run SQL queries manually, several plugins handle database cleanup through a visual interface.
**WP-Optimize** is the most popular option. It cleans revisions, drafts, transients, spam comments, and orphaned data. It can also schedule automatic cleanups on a weekly or monthly basis. The free version handles most use cases.
**Advanced Database Cleaner** goes deeper, identifying orphaned tables and options left by deleted plugins. It's particularly useful for sites that have gone through many plugin changes over the years.
**WP-Sweep** takes a more conservative approach, using proper WordPress functions (like wp_delete_post_revision()) instead of raw SQL queries. This ensures all associated data gets cleaned up through WordPress hooks.
Whichever plugin you use, always run a backup before the first cleanup. After that, scheduled weekly or monthly cleanups keep bloat from building up again.
## Scheduling Regular Maintenance
Database optimization isn't a one-time task. WordPress accumulates bloat continuously. Here's a practical maintenance schedule:
**Weekly:** Delete spam comments and clear expired transients. This takes seconds and prevents the two fastest-growing sources of bloat from getting out of hand.
**Monthly:** Delete old post revisions (keeping the most recent 5), clean orphaned metadata, and optimize tables. This is your main cleanup pass.
**Quarterly:** Audit wp_options autoload size, check for abandoned plugin tables, and review your overall database size trend. If it's growing faster than your content, something is creating unnecessary data.
You can automate the weekly and monthly tasks with WP-Optimize's scheduler or set up WP-CLI cron jobs if you prefer command-line control.
## How Levamo's Stack Helps
Your hosting environment has a direct impact on database performance. Here's what Levamo provides that makes your optimized database run even faster.
**MariaDB instead of MySQL.** Levamo runs MariaDB, which is a drop-in replacement for MySQL built by MySQL's original creators. MariaDB's query optimizer handles complex WordPress queries more efficiently, particularly the multi-table JOINs that WooCommerce and membership plugins generate. You get better performance without changing a single line of code.
**KeyDB + Redis object caching.** Available on Business plans and above, object caching stores frequently accessed query results in memory. Once you've cleaned your database, the cached responses are smaller and faster to serve. A clean database plus object caching is the best combination for logged-in user performance.
**Daily backups with one-click restore.** Every Levamo plan includes daily automatic backups, so you can clean your database with confidence. If something goes wrong, you restore to the previous day in one click. For WooCommerce stores and membership sites where data changes hourly, hourly backups are available as a $10/month add-on.
**One-click staging.** Test your cleanup process on a staging copy before touching production. Levamo's staging includes a "use less storage" option that skips copying your uploads folder, so you can spin up a test environment without doubling your disk usage.
## Measuring the Results
After running your cleanup, here's how to verify it worked.
### Check Database Size
```
wp db size --tables
```
Compare this against what you noted before the cleanup. A 30% to 60% reduction in total database size is common for sites that have never been optimized.
### Check Autoload Size
Run the autoload query from earlier and compare. Getting under 500KB is a good target.
### Test Page Load Times
Load a few pages and check response times in your browser's developer tools (the "Waiting for server response" or TTFB value). You should see a noticeable improvement, especially on pages that run heavy database queries like WooCommerce shop pages, membership dashboards, and course listings.
### Monitor Over Time
Check your database size monthly. If it's growing faster than your actual content, investigate which plugin or process is creating the excess data. The wp_options table is usually the first place to look.
## Wrapping Up
A bloated WordPress database is one of those problems that creeps up slowly. Everything works fine until one day it doesn't, and by then you've got thousands of orphaned rows, megabytes of autoloaded options, and more post revisions than actual posts.
The good news is that cleaning it up is straightforward. Limit revisions, purge transients, audit your autoloaded options, remove orphaned data, and optimize your tables. Do it once thoroughly, then schedule regular maintenance so it never gets that bad again. Pair that clean database with [Levamo's MariaDB engine](/managed-wordpress-hosting/) and object caching, and your WordPress site will feel like it just got a new set of tires.
---
## BuddyNext Review: The WordPress Community OS for Every Kind of Community
- URL: https://levamo.com/blog/buddynext-review/
- Category: membership
- Author: Shahzeb Ahmed
- Published: 2026-08-31
BuddyNext review: a WordPress community platform with a free core and add-on apps.
Most WordPress community plugins answer one question: how do people post updates and join groups? [BuddyNext](https://wbcomdesigns.com/downloads/buddynext/ "nofollow") answers a different question: what *kind* of community are you actually building, and does the platform bend to that or make you bend to it?
That distinction is the whole reason BuddyNext ships as a free core engine plus more than a dozen companion apps instead of one monolithic plugin. A course community, a job-board community, a photo-sharing community, an events community, and a Q&A support community have almost nothing in common structurally, so treating them as one product with one feature set is how most community plugins end up mediocre at everything. BuddyNext's bet is the opposite: one identity and moderation layer underneath, then a real, purpose-built app on top for whatever the community actually is.
In this BuddyNext review, we'll cover the core engine, then spend real time on the part most reviews skip entirely: the companion apps, what kind of community each one is actually for, what's free versus paid in each, and how to pick the right combination instead of installing everything and hoping.
Let's get into it.
## What is BuddyNext?

BuddyNext is a WordPress plugin that turns a site into a complete community platform: activity feed, member profiles, Spaces (their term for groups), a member directory, private messaging, and moderation tools, all wired together out of the box rather than assembled from separate add-ons.
It is not built on top of BuddyPress. It's a standalone plugin with its own architecture, which matters for performance, more on that in the setup section below.
But the core engine is only half the product. BuddyNext is built by Wbcom Designs, a team that already maintains a dozen-plus standalone WordPress plugins covering forums, LMS, media, job boards, directories, gamification, events, and marketplaces, and most of them plug into BuddyNext automatically when both are active (the exact integration depth varies by app, covered honestly below, not every one of these has a documented BuddyNext hook yet). That's the part that actually answers "what kind of community platform is this": not a social feed with some groups bolted on, but a hub that becomes whatever kind of community you point it at.
## One Engine, Every Kind of Community
This is the section most community-plugin reviews skip, because most community plugins don't have an answer here. BuddyNext does, and it's worth walking through what each companion app actually turns your community into in real detail, because a list of app names means nothing on its own, the question is whether they map to real community types and what you actually get for free before you'd need to pay.
### Course and membership communities: Learnomy
[Learnomy](https://wbcomdesigns.com/downloads/learnomy/ "nofollow") is a full, free WordPress LMS, not a stripped trial of a paid one. The free tier includes unlimited courses with video, audio, PDF, and reading lessons, a six-question-type quiz engine (multiple choice, true/false, short answer, fill-in-the-blank, essay, with five more question types in Pro), anti-cheat tab-switch tracking, an essay-grading inbox, and Ed25519-signed certificates with a public verification page and QR codes. Checkout runs directly through Stripe and PayPal at zero platform fees, no percentage cut the way hosted course platforms like Teachable or Kajabi take.
The part that matters most for a community built around teaching is that Learnomy ships a real instructor marketplace. Teachers apply, get their own dashboard, and get paid automatically through Stripe Connect; therefore, a multi-instructor community (such as a cohort of coaches or a network of tutors) doesn't need a separate payout system bolted on. Pair it with BuddyNext, and your students get a real community profile and can join Spaces around a cohort or topic, while the actual teaching, grading, and course sales run through Learnomy underneath. That's the difference between "a community that happens to sell a course" and BuddyBoss's approach of needing a separate LearnDash license just to get here. Learnomy is newer to the market (distributed from the Wbcom store, not WordPress.org yet), but with 166 REST endpoints and a migration wizard from LearnDash, Tutor LMS, and LifterLMS, switching in isn't a rebuild from scratch. Pricing starts at $48/year once you need Pro's advanced quiz types, content drip, or cohort features, though the core teaching and certification stack is entirely free.
### Support, product feedback, and Q&A communities: Jetonomy
[Jetonomy](https://wbcomdesigns.com/downloads/jetonomy/ "nofollow") is what turns BuddyNext from "a place people post updates" into "a place people go to actually get help or influence a roadmap." It's forums, accepted-answer Q&A, and an Ideas board with a Planned-to-Shipped workflow, all free, with custom database tables rather than bloating wp_posts the way CPT-based forum plugins do (their own benchmark claims 50,000 topics at roughly 200ms with Redis caching).
The mechanic that actually matters for community health at scale is Jetonomy's six trust levels (TL0 through TL5), with TL1 through TL3 auto-promoting based on genuine activity and TL2+ automatically exempt from anti-spam checks. This creates a self-moderating community: your most active, trusted members stop hitting friction meant for first-time visitors without you manually promoting anyone. TL4 and TL5 are manual, reserved for people you actually vet. Add voting, reputation, three-level threading, a Markdown composer, and built-in importers from bbPress, wpForo, and Asgaros (with URL preservation so old links don't 404), and you've got a genuine forum platform, not a comments section wearing a forum's clothes. The free version covers all of the above; Pro adds AI-assisted moderation, reactions, private messaging between forum members, and email digests.
### Photo, video, and visual-first communities: WPMediaVerse
[WPMediaVerse](https://wbcomdesigns.com/downloads/mediaverse/ "nofollow") is worth understanding as more than an optional add-on: BuddyNext's own messaging and media posting actually run through WPMediaVerse under the hood, so once your members start sharing more than text, this stops being optional and becomes closer to a core dependency.
Free gets you drag-drop photo and video upload, albums, collections, and gallery groups, reactions, threaded comments, follows, favorites, @mentions, an Instagram-style explore feed with a lightbox, and 1:1 direct messages that include voice messages and message requests. The feature that matters most for any community accepting user uploads at scale is automatic content moderation: every upload runs through OpenAI Vision using your own API key, so you're not manually reviewing a growing queue of user-generated photos and video by hand. Custom database tables mean "100,000 media items add zero rows to wp_posts," per their own benchmark claim, worth verifying at your own scale but directionally the right architecture choice. Pro adds five layout modes (including an Instagram-style stories bar), cloud storage via S3 or BunnyCDN, video transcoding, and a gamification suite (photo challenges, battles, tournaments) that ties directly into WB Gamification, covered below.
### Professional, alumni, and industry communities: WP Career Board
[WP Career Board](https://wbcomdesigns.com/downloads/wp-career-board/ "nofollow") turns BuddyNext into a job board your members actually use rather than a static "careers" page nobody checks. Free includes job listings with real filtering (keyword, category, location radius, salary band, remote-only), saved searches with daily email alerts, apply-with-profile or CV upload with screening questions, a full resume database and builder (it can run as a standalone resume board on its own), company profiles with follow and new-job alerts, and JobPosting schema markup on every listing, meaning your jobs are eligible to show up in Google's dedicated Jobs search results, not just regular organic search.
For an alumni network, a professional association, or an industry-specific community, this is frequently the single feature that makes membership worth paying for, a curated, trusted job board beats a generic one because the pool posting and applying is already vetted by community membership. It's block-first (14 blocks, Gutenberg-native, no shortcodes or jQuery), and ships migrators from WP Job Manager, JobBoardWP, Simple Job Board, and WP Job Openings if you're consolidating from an existing setup. Pro adds a Kanban-style application pipeline, credit-based paid job posting plans, and AI candidate matching.
### Local, niche, and business-directory communities: Listora
[Listora](https://wbcomdesigns.com/downloads/listora/ "nofollow") adds 10 listing types out of the box, business, restaurant, real estate, hotel, job, event, classified, healthcare, education, and place, which covers most of what a local or niche-vertical community actually needs without stacking separate directory add-ons. Free includes multi-step frontend submission with a review queue, business claims, five-star reviews with owner replies and helpful votes, full-text search with distance/rating/amenity filters, and mapping through OpenStreetMap, deliberately, so there's no API key requirement and no per-view charges the way Google Maps-based directory plugins eventually cost you at scale.
A neighborhood community, a niche marketplace of local service providers, or an events-and-venues-focused community all lean on Listora rather than the plain activity feed for their actual core content. It's built block-first on the Interactivity API with no jQuery, includes six layers of anti-spam protection, CSV and GeoJSON import/export, and migrators from Business Directory Plugin, Directorist, GeoDirectory, and ListingPro. Pro adds the monetization layer: credit-based paid listing plans, Google Maps and Places autocomplete, per-listing analytics, and a "Needs Marketplace" mode where visitors post what they're looking for and businesses respond to it, a reverse-directory model most competitors don't have at all.
### Marketplaces where members sell to each other: WP Sell Services
[WP Sell Services](https://wbcomdesigns.com/downloads/wp-sell-services/ "nofollow") is a standalone Fiverr-and-Upwork-style service marketplace: vendors list tiered packages for buyers to browse and purchase directly, or buyers post a project brief and collect proposals instead, both modes ship free and can run side by side. An 11-status order lifecycle handles requirements collection, delivery, revisions, and dispute resolution, the actual mechanics a service sale needs that a standard product page was never built for.
Worth being precise here since it's easy to mischaracterize: this does **not** require WooCommerce. It ships its own standalone Stripe, PayPal, and offline checkout, confirmed directly from the product's own FAQ. WooCommerce integration exists but only as an optional Pro feature for stores that specifically want its 100+ payment gateway options, not as a dependency. That means a freelancer collective, a consultant network, or a coaching community can run an entire service marketplace inside BuddyNext without a separate storefront plugin underneath it. Free covers both marketplace modes, the full order lifecycle, and standalone checkout; Pro starts at $48/year and adds WooCommerce as an optional checkout path, vendor analytics, and automated payouts.
### Events, meetups, and RSVP-driven communities: Eventonomy
[Eventonomy](https://wbcomdesigns.com/downloads/eventonomy/ "nofollow") is worth flagging here with one honest caveat up front: unlike the six apps above, it is **not currently a documented BuddyNext integration**, neither product's page mentions the other. It's a separate free Wbcom product, not officially part of BuddyNext's companion-app roster yet. Given how directly relevant it is to community management, it's worth knowing about regardless, and it wouldn't be a surprise if that integration gets documented later given the pattern with the rest of the ecosystem.
On its own merits: Eventonomy is a genuinely complete free events platform, unlimited events and RSVPs, RSVP states of going/maybe/no with guest counts, capacity caps with automatic waitlisting, four calendar views, recurring events, an ICS calendar feed, guest RSVP without requiring an account, and magic links so attendees can manage their own RSVP without logging in. A community built around recurring meetups, a conference, or a series of workshops could run entirely on Eventonomy today, just managed as a parallel system to BuddyNext rather than a wired-in one. Pro adds paid ticketing through Stripe, PayPal, Square, or Mollie, a door check-in scanner, and SMS reminders via Twilio.
### The engagement layer across all of the above: WB Gamification
[WB Gamification](https://wbcomdesigns.com/downloads/wordpress-gamification-plugin/ "nofollow") is the piece that ties everything above together, and the detail worth leading with: it is **100% free forever**, GPLv2, unlimited sites, every feature included, no paid tier exists.
It's a real engine, not a badge sticker: an event-sourced points ledger built on Action Scheduler (their own benchmark claims sub-100ms at 100,000+ members), multi-currency points, 30 pre-built badges plus unlimited custom ones with OpenBadges 3.0 verifiable credentials, auto-promoting levels, leaderboards scoped daily through all-time, cohort leagues (a Duolingo-style weekly Bronze-to-Diamond tier system), streaks with a GitHub-style contribution heatmap, peer-to-peer kudos, community-wide shared-progress challenges, and a redemption store that can auto-generate WooCommerce coupons. It already has a **documented** integration with Jetonomy specifically, reputation mirrors 1:1 into the points ledger, so your forum's most helpful answerers get recognized with real points automatically, not just a badge on their profile. A documented integration with WPMediaVerse Pro also exists (17 actions covering uploads, photo battles, and upload streaks). For any community built on the apps above, whichever one you pick, WB Gamification is close to a no-downside add, it's free, it's built to layer on top, and it's the difference between a community that's technically functional and one that gives members a reason to come back tomorrow.
### The smaller pieces, still real answers to real community shapes
Beyond the seven above, the roster rounds out with **WB Polls** (activity polls plus standalone surveys with analytics, one license, no per-response fees), **WB Member Blog** (front-end member blogging using plain WordPress posts, no custom tables, so content stays portable), **WB Ad Manager** (an ad rotator, affiliate link cloaker, and classifieds board consolidated into one plugin, useful for a community that wants to monetize inventory without stacking three separate tools), **MediaShield** (one video player with real protection and watch analytics, aimed at communities selling paid course or coaching video content), **SnipShare** (a self-hosted Pastebin or Gist alternative, built for developer and technical communities that need to share and discuss code snippets natively), and **WB Member Wiki** (a lightweight in-WordPress wiki for communities that need shared, collaboratively-edited documentation, an internal knowledge base or a fan wiki, without standing up MediaWiki separately). None of these are the app that defines a community on their own the way Learnomy or Jetonomy are, but each solves one specific, real problem that would otherwise mean installing a completely unrelated third-party plugin.
### Quick reference: community type to companion app
| Building this kind of community | Add this app | What is genuinely free |
|---|---|---|
| Courses, coaching, cohorts | [Learnomy](https://wbcomdesigns.com/downloads/learnomy/ "nofollow") | Unlimited courses, 6 quiz types, certificates, 0%-fee checkout |
| Support, Q&A, product feedback | [Jetonomy](https://wbcomdesigns.com/downloads/jetonomy/ "nofollow") | Forums, Q&A, Ideas board, 6 trust levels, importers |
| Photo/video, visual-first | [WPMediaVerse](https://wbcomdesigns.com/downloads/mediaverse/ "nofollow") | Uploads, albums, explore feed, AI auto-moderation |
| Alumni, professional, hiring | [WP Career Board](https://wbcomdesigns.com/downloads/wp-career-board/ "nofollow") | Listings, resume DB, Google Jobs schema |
| Local, niche, business directory | [Listora](https://wbcomdesigns.com/downloads/listora/ "nofollow") | 10 listing types, reviews, free OpenStreetMap maps |
| Freelance or service marketplace | [WP Sell Services](https://wbcomdesigns.com/downloads/wp-sell-services/ "nofollow") | Both marketplace modes, full order lifecycle |
| Meetups, conferences, RSVPs | [Eventonomy](https://wbcomdesigns.com/downloads/eventonomy/ "nofollow") | Unlimited events/RSVPs, waitlists, recurring events |
| Engagement layer, any of the above | [WB Gamification](https://wbcomdesigns.com/downloads/wordpress-gamification-plugin/ "nofollow") | Everything, no paid tier exists |
The honest way to evaluate this: don't install everything on this list. Pick BuddyNext for the core identity and moderation layer, then add the one or two companion apps that actually match what your community actually is: a course community needs Learnomy, not Listora. That's the model: purpose-built pieces you assemble, not a monolith you configure.
## Should You Choose BuddyNext?
BuddyNext is newer than BuddyPress or BuddyBoss, it's currently at version 0.6, so it doesn't have a decade of plugin-directory history behind it. What it does have is a complete free tier: activity feed, Spaces, profiles, messaging, member directory, and moderation are not gated behind a paywall the way some competing plugins gate group messaging or advanced privacy controls.
It's worth being upfront about one thing: BuddyNext isn't distributed through the WordPress.org plugin directory, so you install it from a downloaded zip file rather than searching for it in your WordPress admin. That's a minor extra step, and it's the same distribution model PeepSo itself uses.
If you want a modern, actively developed community platform that adapts to a specific community type instead of forcing a one-size-fits-all social feed, BuddyNext is a strong candidate, especially if you already know you need a course, forum, media, job-board, directory, or marketplace layer and would rather get a purpose-built free tool than a paid add-on bolted onto a generic base. If you specifically need the years-long track record and largest existing third-party plugin ecosystem, BuddyPress or BuddyBoss (with its LearnDash-first maturity) are still the safer, more battle-tested choices today, though neither matches the breadth of purpose-built companion apps BuddyNext ships with from a single vendor.
## Core Features of BuddyNext
BuddyNext's free tier is built around six pillars: activity, spaces, profiles, discovery, messaging, and moderation. Here's what's actually included, no paywall:
- Activity feed with four views (For You, Following, Spaces, Network), six reactions, five-level threaded comments, reposts, and quotes.
- Spaces with three visibility levels, open (anyone can join), private (request to join), and secret (invite-only), each with its own feed, roles, and per-space moderation.
- Rich member profiles with 13 field types, per-field privacy controls, and a profile-completion meter.
- A searchable, filterable member directory plus an Explore feed for trending posts and suggested members.
- One-to-one private messaging with photo and file sharing (group messaging and real-time delivery are Pro).
- Deep moderation: reports, strikes, suspensions, shadow-bans, banned words/hashtags/domains/IPs, and auto-hide thresholds, all usable without upgrading.
- A 4-step guided member onboarding wizard with reminder emails, so new signups don't stall out on an empty profile.
This is the identity and moderation layer every community needs regardless of type, the companion apps above are what turn it into a specific kind of community.
## Pros and Cons of BuddyNext
**Pros (The Good):**
- **Genuinely complete free tier:** Activity feed, Spaces, messaging, profiles, and moderation all ship free, not a stripped demo of the paid version.
- **Purpose-built for the actual community type, not just "social":** Course communities get a real LMS, job communities get a real job board, media communities get real upload/moderation tooling, instead of every community type getting the same generic activity feed.
- **Not built on BuddyPress:** A standalone architecture means it isn't inheriting fifteen years of BuddyPress's accumulated database structure, which shows up as real performance headroom at scale.
- **One vendor, mostly one integration story:** Most companion apps come from the same team and are documented to integrate with BuddyNext, versus stitching together plugins from five different vendors that were never designed to talk to each other. (Not universal, Eventonomy is the current exception, covered honestly above.)
- **Modern moderation out of the box:** Shadow-bans, banned-word lists, and auto-hide thresholds are usually Pro-tier or third-party-plugin territory elsewhere; here they're free.
- **A genuinely free-forever engagement layer:** WB Gamification has no paid tier at all, unusual in a market where GamiPress and myCred charge per integration.
**Cons (The Limitations):**
- **Young platform:** At version 0.6, BuddyNext doesn't have the multi-year public track record that BuddyPress and BuddyBoss have. Early adopters get faster iteration; risk-averse teams may want to watch it mature a bit longer.
- **Ecosystem breadth means more decisions upfront:** More than a dozen companion apps is a genuine strength, but it also means a new site owner has to actually figure out which ones apply, there's no single "turn on everything" button, and shouldn't be one.
- **Integration depth isn't uniform across the ecosystem:** Jetonomy, WPMediaVerse, and WB Gamification have clearly documented BuddyNext ties; some of the smaller apps (WB Polls, WB Member Blog, WB Ad Manager, SnipShare, WB Member Wiki, MediaShield) are positioned as part of the family without the same level of documented, hook-level integration specifics, and Eventonomy currently has none at all. Worth confirming current integration depth for any specific app before assuming it's wired in.
- **Not on WordPress.org:** Distributed from the Wbcom Designs store instead, so it's a manual zip install rather than a plugin-directory search. Functionally identical once installed, just an extra step. The same is true for every companion app covered above.
- **Real-time features are Pro-only:** Group messaging and live delivery (typing indicators, presence, WebSocket push) require the paid tier, free messaging is one-to-one only.
## Step-by-Step Guide to Setting Up a Community with BuddyNext
Setting up BuddyNext follows a familiar WordPress pattern, with one extra step since it isn't in the WordPress.org directory:
- **Download the plugin:** Visit [wbcomdesigns.com/downloads/buddynext](https://wbcomdesigns.com/downloads/buddynext/ "nofollow") and download the free zip file, no account or license key required for the free tier.
- **Install and activate:** In your WordPress admin, go to Plugins → Add New → Upload Plugin, select the downloaded zip, install, then activate.
- **Run the onboarding wizard:** BuddyNext's 4-step setup wizard walks you through the basics, profile field selection, initial Spaces, and notification defaults, so you're not configuring everything from a blank settings screen.
- **Decide what kind of community this actually is, before installing companion apps:** This is the step most guides skip. Don't install Learnomy, Jetonomy, WPMediaVerse, WP Career Board, Listora, and WP Sell Services all at once. Use the reference table above, pick the one or two that match what you're actually building, add the LMS if you're teaching, add the forum if you're supporting, add the media app if you're visual-first, and leave the rest for later. Each is a separate free download from its own product page.
- **Create your first Spaces:** Set up two or three focused Spaces rather than one catch-all group. A dedicated, focused Space (say, an announcements-only one and a general-discussion one) gives new members an obvious first move.
- **Configure moderation before you open signups:** Set your banned-word list and auto-hide thresholds before members arrive, not after the first spam wave. It's a five-minute step that saves a much longer cleanup later.
- **Add WB Gamification once your core community app is live:** Since it's free with no tier to weigh, there's little reason not to layer it in early, points and a leaderboard give your first cohort a reason to stay active while the community is still thin.
- **Invite your first members:** BuddyNext's member onboarding wizard sends reminder emails to profiles that stall out incomplete, worth leaving on for your first cohort so early members actually finish setting up their profiles.
## BuddyNext Pricing Plans
BuddyNext's free plugin is a genuinely complete community platform, not a time-limited trial. Pro adds monetization, AI features, real-time messaging, and analytics on top of the same free foundation. Worth noting: the companion apps covered above are separate Wbcom products with their own free tiers and their own optional Pro upgrades, they are not included in a BuddyNext Pro license, so pricing out a full community stack means checking each app you actually plan to use:
- **Free** - $0 forever. Unlimited members, full activity feed, Spaces, profiles, messaging, member directory, and moderation.
- **Personal** - $149/year (or $399 one-time for a lifetime license), 1 site. Adds Stripe membership tiers, gated Spaces, AI feed ranking and moderation, WebSocket real-time messaging, and analytics.
- **Professional** - $249/year (or $599 lifetime), 5 sites. Same Pro feature set as Personal, licensed across five communities.
- **Agency** - $399/year (or $999 lifetime), unlimited sites plus white-label. Built for agencies managing community sites for multiple clients.
Every Pro tier unlocks the identical feature set, the only difference between tiers is how many sites the license covers, and features already available in a given release never move behind a higher tier later.
For a realistic full-stack example: a course-and-support community can run BuddyNext Free plus [Learnomy](https://wbcomdesigns.com/downloads/learnomy/ "nofollow") Pro plus [Jetonomy](https://wbcomdesigns.com/downloads/jetonomy/ "nofollow") Pro plus WB Gamification, and still land well under the annual cost of a hosted all-in-one platform, before BuddyNext's own Pro tier is even in the picture. Most companion apps follow the same shape as Jetonomy: a genuinely usable free tier, with Pro priced separately in the $48 to $104 per year range (WP Career Board, WPMediaVerse, Listora, and WP Sell Services all fall in this band), while WB Gamification has no paid tier at all.
## Why Choose Levamo with BuddyNext?
This is where hosting stops being an afterthought. A community platform is one of the most demanding things you can run on WordPress: every page view is a logged-in, personalized query, an activity feed, a member's own notifications, a Space they belong to, none of it is a static page a cache can just serve back unchanged.
And BuddyNext's ecosystem model makes this compound rather than stay flat. A community running Learnomy adds quiz submissions and video lesson delivery. One running WPMediaVerse adds photo/video upload processing and an AI moderation API call on every image. One running Jetonomy adds full-text search across tens of thousands of forum posts. One running Eventonomy or WP Career Board adds its own scheduled-query and search-filter load. Each companion app is its own additional dynamic workload stacked on top of the core feed, this isn't a plugin that gets heavier only if you let it, the whole model is designed around adding exactly the load your specific community needs, which means the hosting underneath needs to handle whatever combination you actually assemble.
Levamo's infrastructure was built by a team that ran BuddyBoss hosting at scale, so this isn't a generic "any host will do" recommendation:
- **Scalability:** Container-isolated environments and auto-scaling PHP workers handle community growth, including sudden spikes after a successful invite push or launch campaign, without a manual upgrade scramble.
- **Speed:** LiteSpeed servers, auto-scaling PHP workers, KeyDB + Redis object caching, and [Enterprise Cloudflare CDN](/cloudflare-cdn/) across 300+ locations (included on every plan, not a paid add-on) keep activity feeds, course pages, forum search, and media uploads loading fast even as post, student, and member counts climb together.
- **Security:** Cloudflare WAF and DDoS protection, server-level Monarx malware scanning, free SSL, and authenticator-app 2FA matter more for a community site than a brochure site, you have real user accounts, uploaded media, and in some cases payment data across multiple apps to protect.
- **Reliability:** A community that goes down during its own growth spurt loses the members it just worked hardest to attract. Levamo's 24/7/365 support with sub-minute live chat response means you're not filing a ticket and waiting when your community is down at 2 AM.
A BuddyNext community running two or three companion apps is exactly the kind of dynamic, multi-workload WordPress site that separates hosts that merely serve pages from hosts built for real traffic.
## Conclusion
BuddyNext is a serious, modern option for anyone evaluating WordPress community platforms in 2026, and the honest differentiator isn't the activity feed, every community plugin has one of those. It's that BuddyNext doesn't force every community into the same shape. A course community, a job-board community, a support community, a directory-driven community, and a photo-sharing community are structurally different things, and BuddyNext is the rare platform built by a team that seems to have actually accepted that, rather than shipping one feature set and calling it universal.
The free tier is complete enough to launch a real community on by itself. The companion apps, most of them free at the core too, are what make it worth evaluating seriously against BuddyBoss, Circle, or Mighty Networks: pick the one or two that match what you're actually building from the reference table above, and you get a purpose-built tool for that specific job instead of a generic one stretched to fit.
Pair it with [hosting built for dynamic, multi-workload WordPress sites](/buddypress-hosting/), like Levamo, and you've got the performance headroom to match the platform's ambition.
---
## MemberPress vs Kajabi: Which One Is Worth Your Money?
- URL: https://levamo.com/blog/memberpress-vs-kajabi/
- Category: membership
- Author: Shahzeb Ahmed
- Published: 2026-08-28
MemberPress vs Kajabi compared: pricing, features, ownership, and performance.
You want to sell courses, build a community, or run a membership. Two names keep showing up in every "best platform" list: MemberPress and Kajabi.
On the surface, they look like they solve the same problem. Both let you create memberships, deliver courses, accept payments, and manage subscribers. But the way they do it, what they cost, and who actually owns the business you build on them are fundamentally different.
Kajabi is a fully hosted, all-in-one platform. You sign up, pay monthly, and everything lives on Kajabi's servers. MemberPress is a WordPress plugin. You install it on your own WordPress site, host it wherever you want, and own every piece of data your business generates.
That distinction matters more than most comparison articles let on. Let's break it down.
## MemberPress vs Kajabi at a Glance
Here's how the two platforms compare across the factors that matter most.
| Feature | MemberPress | Kajabi |
|---|---|---|
| Model | Self-hosted WordPress plugin | Fully hosted, all-in-one SaaS |
| Ownership | You own your data, content, and site | Everything lives on Kajabi's servers |
| Courses / LMS | 9 quiz types, graded assignments, gradebook, certificates | Clean course builder, basic quizzes |
| Coaching | CoachKit: full coaching management system | Secondary feature, no dedicated tooling |
| Email | Integrates ActiveCampaign, ConvertKit, Mailchimp | Built-in email marketing |
| Pricing | From $199.50/yr + your hosting | From $179/mo ($2,388/yr on Growth) |
## What Is MemberPress?
MemberPress is a WordPress membership plugin that's been around since 2012. It handles memberships, courses (with a built-in LMS called MemberPress Courses), coaching programs through CoachKit, and community features through ClubSuite.

Because it runs on WordPress, you get the full WordPress ecosystem at your disposal: thousands of themes, plugins for email marketing, CRM, e-commerce, analytics, and pretty much anything else you can think of. Your content, your subscriber list, your payment data, all of it sits in your own database on your own server.
MemberPress currently holds a 4.8 out of 5 rating on Trustpilot, with users consistently praising its feature depth and responsive support.
## What Is Kajabi?
Kajabi is a hosted SaaS platform built for course creators and coaches. It bundles website building, course delivery, email marketing, payments, and basic community tools into a single monthly subscription.

The appeal is simplicity. You don't need to think about hosting, plugins, or server management. Kajabi handles all of that. The tradeoff is that everything, your courses, your subscriber list, your content, lives on Kajabi's infrastructure under Kajabi's terms.
Kajabi sits at 3.5 out of 5 on Trustpilot. Common complaints center on support delays, recent price increases, and the growing reliance on AI-generated support responses.
## Pricing: How the Numbers Actually Stack Up
This is where the conversation gets interesting.
**Kajabi pricing (2026):**
- Basic: $179/month
- Growth: $249/month ($199/month with annual billing)
- Pro: $399/month
That Growth plan, the one most serious creators land on, comes out to roughly $2,388 per year on annual billing. And if you want a branded mobile app, add another $199/month.
**MemberPress pricing (2026 introductory rates):**
- Launch: $199.50/year
- Growth: $349.50/year
- Scale: $499.50/year
Even on the top-tier Scale plan, MemberPress costs $499.50 per year. That's roughly one fifth of what Kajabi Growth costs annually.

Now, MemberPress requires WordPress hosting, which adds cost. But even on a high-performance [managed WordPress host](/managed-wordpress-hosting/), you're looking at $29 to $99 per month depending on your traffic and resource needs. Add that up: MemberPress Scale ($499.50/year) plus quality managed hosting ($348 to $1,188/year) still comes in well under Kajabi's $2,388/year.
Over five years, the savings compound into thousands of dollars. Money you could reinvest into content, marketing, or better tooling for your members.
## Course and LMS Features
Both platforms let you build and sell online courses. The difference is depth.
Kajabi offers a clean course builder with video hosting, basic quizzes, and drip scheduling. It works well for straightforward courses. You upload your videos, structure your modules, and Kajabi handles delivery. For most simple courses, this is perfectly adequate.
**MemberPress Courses goes deeper. You get:**
- Drip content scheduling with flexible rules
- Nine quiz types (not just multiple choice)
- Graded assignments with instructor feedback
- A full gradebook for tracking student progress
- Completion certificates
- An AI course generator that helps you outline and build courses faster
If you're running a professional certification program, a multi-instructor academy, or anything where assessment and progress tracking actually matter, MemberPress gives you significantly more to work with.
## Community and Coaching Tools
Community features have become a deciding factor for many creators, and this is where the two platforms have diverged sharply.
Kajabi added community features, but they're relatively basic. You get discussion boards and group spaces. No native coaching management, no milestone tracking, no private messaging between coaches and clients.
MemberPress has invested heavily here with two dedicated tools:
ClubSuite gives you forums, member directories, private sub-groups, and activity feeds. Unlike Kajabi's community (or Skool's, for that matter), you're not limited to a handful of categories. You can create as many sub-groups as your community needs.
**CoachKit is a full coaching management system:**
- Unlimited coaching programs
- Milestone and habit tracking per client
- Automated client onboarding workflows
- Built-in scheduling (integrates with Calendly and Simply Schedule Appointments)
- Real-time coach-client messaging (on the Scale plan)
If coaching is part of your business model, this comparison isn't close. MemberPress built purpose-specific tooling for it. Kajabi treats coaching as a secondary feature.
## Ownership and Data Control
This is the part that doesn't show up in feature comparison tables but might be the most important factor in your decision.
With Kajabi, your courses, your client list, your coaching content, your email sequences, your entire business, lives on Kajabi's servers. You're operating under their terms of service, their pricing decisions, and their platform roadmap. If Kajabi raises prices (which they did in late 2025 for the first time since 2015), you either pay more or face the pain of migrating everything out.
With MemberPress on WordPress, everything is yours. Your subscriber database, your course content, your payment records, your community data. It all lives in your own WordPress database, on your own server, under your own domain. If you ever want to change hosting providers, switch themes, or add entirely new functionality, you can. Nobody's permission is required.
This isn't a theoretical concern. Platform dependency is a real business risk. When your revenue depends on a platform you don't control, you're one terms-of-service update or price hike away from a very bad quarter.
## Email Marketing and Integrations
Kajabi includes native email marketing. You can build sequences, send broadcasts, and segment your list without leaving the platform. For creators who want everything under one roof, this is genuinely convenient.
MemberPress doesn't include its own email marketing tool. Instead, it integrates with dedicated platforms: ActiveCampaign, ConvertKit, Mailchimp, Drip, and others. You'll need a separate email service.
Is this a disadvantage? It depends on how you look at it. Kajabi's built-in email is "good enough" for basic sequences. But dedicated email platforms offer deeper segmentation, better deliverability tracking, more sophisticated automation, and they don't lock your subscriber list behind a platform subscription.
If email is a critical revenue driver for your business (and for most membership sites, it is), a dedicated tool will outperform a bundled one.
## Performance: Where Your Hosting Matters
Here's a dimension most MemberPress vs Kajabi comparisons completely ignore.
With Kajabi, performance is whatever Kajabi gives you. You can't upgrade your server, tune your database, or add a CDN. If your course platform feels sluggish under load, your options are limited to "contact support and hope."
With MemberPress on WordPress, your site's speed, uptime, and scalability depend on your hosting. This is both a responsibility and an opportunity. On cheap shared hosting, WordPress can feel slow. On purpose-built managed hosting, it can be blazing fast.
A membership site is a dynamic, logged-in workload. Every page load hits the database. Every course progress check, every community interaction, every payment verification requires server-side processing. Generic hosting struggles with this. [Hosting built for dynamic WordPress workloads](/memberpress-hosting/), with object caching, fast databases, and auto-scaling PHP workers, handles it effortlessly.
This is worth factoring into your total cost of ownership. The combination of MemberPress plus quality hosting isn't just cheaper than Kajabi. It can also be significantly faster, because you're choosing infrastructure optimized for exactly how membership sites work.
For a deeper look at what to prioritize in hosting for MemberPress specifically, check out our [MemberPress hosting guide](/blog/best-hosting-for-memberpress/)
## Who Should Choose Which?
It comes down to how much you value ownership and feature depth versus all-in-one simplicity.
| Choose MemberPress if you... | Choose Kajabi if you... |
|---|---|
| Want full ownership of your business, data, and content | Want maximum simplicity with zero technical setup |
| Need advanced LMS features (graded assignments, certifications, gradebook) | Need built-in email marketing and don't want to manage a separate tool |
| Run coaching programs and need dedicated management tools | Are validating a new business idea quickly and prioritize speed over flexibility |
| Already use WordPress or plan to | Prefer a single monthly bill over managing multiple services |
| Care about long-term cost efficiency | Don't mind platform dependency and are comfortable with Kajabi's pricing trajectory |
| Want the flexibility to integrate best-in-class tools for email, CRM, and analytics | |
| Are building a business you intend to own for years, not rent month to month | |
## Wrapping Up
MemberPress and Kajabi solve the same core problem from opposite directions. Kajabi bundles everything together and charges a premium for the convenience. MemberPress gives you deeper features, full ownership, and dramatically lower costs, in exchange for a bit more setup and the responsibility of choosing your own hosting.
For creators and membership site owners who think in terms of years, not months, MemberPress on WordPress is the stronger foundation. You keep more revenue, own all your data, and never worry about a platform pulling the rug out from under your business.
The hosting piece is what ties it all together. A membership site with hundreds or thousands of logged-in users needs infrastructure that can keep up. Choose hosting that's built for dynamic WordPress workloads, and you get the best of both worlds: the flexibility of MemberPress with the performance your members expect.
If you want to see how that feels in practice, try building your membership on [hosting that was designed for exactly this kind of site](/pricing/).
---
## Best Hosting for TutorLMS: What Your Course Platform Actually Needs
- URL: https://levamo.com/blog/best-hosting-for-tutorlms/
- Category: lms
- Author: Shahzeb Ahmed
- Published: 2026-08-26
What TutorLMS needs from hosting to survive quizzes, cohorts, and scale.
You picked TutorLMS. You built your courses, configured your quizzes, set up drip schedules, and launched your first cohort.
Then 40 students start a timed quiz at the same time, and everything falls apart.
Quiz submissions time out. Progress bars freeze. Students refresh the page and lose their answers. Your support inbox fills up with panicked emails from learners who think they failed because the site crashed.
Here's what nobody tells you when you're choosing a WordPress LMS plugin: TutorLMS (and every serious LMS) is one of the most resource-intensive workloads you can run on WordPress. And the hosting that worked fine for your blog or landing page will absolutely buckle under the weight of a live course platform.
Your learners deserve better. Let's break down what TutorLMS actually needs from a host and what to look for when you're evaluating options.
## Why Course Sites Can't Survive on Generic Hosting
A standard WordPress site serves the same cached page to every visitor. Your server generates the HTML once, stores it, and hands out copies. Cheap, fast, efficient.
TutorLMS throws that model out the window.

When a student loads a lesson page, your server has to:
Authenticate the student's session and enrollment status
Check content drip rules to decide whether this lesson is unlocked yet
Pull their individual progress data (completed lessons, quiz scores, certificates earned)
Verify prerequisite completion before granting access to advanced modules
Render a personalized page that's completely different from what every other student sees
That's a database query storm on every single page load. And unlike a blog post that gets cached once and served a million times, each student's request generates a unique response.
Now multiply that by 50 students navigating lessons simultaneously. Or 100 students submitting quiz answers during a live cohort session. Each of those requests requires a PHP worker, a database connection, and server memory. Generic hosting runs out of all three.
## The Caching Paradox That Breaks LMS Sites
This is the trap most course creators fall into.
Your site feels slow, so you install a caching plugin. Pages load faster for logged-out visitors. You think the problem is solved.
Then a student reports that they completed a lesson but it still shows as locked. Another student sees someone else's quiz results. A third student can't access a course they paid for because the cached page doesn't reflect their enrollment.
Page caching and LMS platforms are fundamentally incompatible for logged-in users. Caching serves stored HTML without running the enrollment checks, progress tracking, and access control logic that TutorLMS depends on. When your caching plugin serves Student A a page generated for Student B, you don't just have a performance problem. You have a broken product.
The solution isn't to disable caching entirely (that makes your site crawl). The solution is the right kind of caching at the right layer. More on that in a moment.
## What Your TutorLMS Site Actually Needs From Hosting
Not every "managed WordPress host" can handle LMS workloads. Here's the checklist that actually matters for running TutorLMS without headaches.

### Object Caching (The Right Kind of Caching)
Object caching works at the database query level, not the page level. Instead of caching entire HTML pages (which breaks personalized content), it caches the results of individual database queries in memory.
When TutorLMS checks whether Student A has completed Lesson 3, that query hits the database the first time. Object caching stores the result in RAM. The next time the same query runs, the answer comes from memory in microseconds instead of milliseconds from the database.
This is transformative for LMS workloads because the same types of queries run thousands of times per hour: enrollment checks, progress lookups, prerequisite validations, quiz score retrievals. Object caching intercepts all of them without breaking any of TutorLMS's personalization logic.
But here's the nuance most hosts miss. Standard Redis is single-threaded. It processes one cache request at a time. When 60 students are active simultaneously and each generating dozens of cached queries per page load, single-threaded caching becomes a bottleneck.
KeyDB fixes this. It's a multithreaded fork of Redis that handles concurrent requests in parallel instead of queuing them. For a TutorLMS site with active learners, this is the difference between a responsive course platform and one that slows down in proportion to enrollment.
Levamo includes KeyDB + Redis object caching on Business plans and above, specifically because LMS and membership workloads demand it.
### PHP Workers That Scale With Your Cohorts
Every dynamic page request on your TutorLMS site requires a PHP worker to process it. Quiz submissions, lesson completions, certificate generation, grade calculations: each one occupies a worker until it's done.
Here's where course sites get hit hardest. When a cohort of 50 students starts a quiz simultaneously, you need 50 PHP workers available right now, not in 30 seconds after the server notices the spike.
Hosts that share PHP workers across multiple sites on the same server are a recipe for timeout errors during exactly the moments that matter most: live assessments, enrollment surges, and course launch days.
Look for hosting with dedicated, auto-scaling PHP workers. When your cohort hits "Start Quiz" at the same time, your server should spin up additional workers on demand instead of queuing requests until students start seeing 504 errors.
### A Database That Can Handle Complex Queries
TutorLMS is database-heavy. Course structures, lesson progress, quiz attempts, gradebook entries, certificate records, enrollment statuses: all of it lives in your database. And TutorLMS doesn't just run simple lookups. It runs complex JOIN queries that pull data from multiple tables simultaneously.
Quiz-attempt data, for instance, can involve a single query that takes over 1.5 seconds to run. On a shared database server competing with other sites, that delay compounds rapidly.
MariaDB handles these query patterns more efficiently than older MySQL setups. Its query optimizer is specifically better at the multi-table JOINs that LMS plugins generate constantly. When paired with object caching, your database only needs to execute each expensive query once before the result is cached in memory.
### CDN for Video-Heavy Course Content
Most online courses involve video. Whether you're embedding from YouTube/Vimeo or (more ambitiously) self-hosting your course videos, a CDN is non-negotiable.
For embedded video, your CDN handles the surrounding page assets: your theme CSS, JavaScript, images, thumbnails, and downloadable resources. Fast delivery of these assets means the page loads quickly and the embedded player appears immediately.
For self-hosted video, a CDN with global edge locations is the difference between smooth playback and constant buffering. A student in Singapore watching a course hosted on a US server without a CDN is going to have a miserable experience.
Enterprise Cloudflare CDN also handles DDoS protection, bot filtering, and SSL termination at the edge, which matters for course sites that handle payments and student data. Levamo includes [Enterprise Cloudflare CDN](/cloudflare-cdn/) across 300+ locations on every plan, not as an add-on.
### Container Isolation (Your Resources Stay Yours)
Shared hosting means shared resources. If another site on your server gets a traffic spike, your TutorLMS site slows down through no fault of your own.
For a course platform, this is unacceptable. Imagine running a live cohort quiz while another site on your shared server gets hit by a bot crawl. Your students experience timeouts because someone else's traffic consumed the resources your quizzes needed.
Container isolation gives your site its own walled-off environment with guaranteed CPU, memory, and I/O. Your course platform performs consistently regardless of what's happening elsewhere on the server.
## How Levamo Handles TutorLMS Workloads
Levamo was built by the co-founders of [BuddyBoss](/buddyboss-hosting/), the most widely used community and LMS platform in the WordPress space. That origin shaped the entire hosting stack: it wasn't designed for blogs and retrofitted for dynamic workloads. It was built from the ground up for logged-in, database-heavy applications like course platforms.
Here's the infrastructure that makes a measurable difference for TutorLMS:

Those benchmarks matter most for TutorLMS sites where every request triggers real database work, not just static file delivery.
If you're building on TutorLMS and want an overview of how it compares to other LMS options, check out our guide to the [best WordPress LMS plugins](/blog/best-wordpress-lms-plugins/). And if you're just getting started with TutorLMS setup, our [complete build guide](/blog/build-lms-website-with-tutor-lms/) walks through the process step by step.
### Support That Understands LMS Workloads
Here's something you won't find on a comparison chart. When you contact Levamo support, you're talking to a team that works with LMS and membership sites daily. They understand plugin conflicts between TutorLMS and caching setups, database optimization for quiz-heavy sites, and the server-level tuning that course platforms need.
That's a 24/7/365 team with a 4.6/5 CSAT rating and sub-minute live chat response times. For course creators who aren't server administrators (and don't want to be), this is often the reason they stay.
## Migrating Your Course Site (Without Losing Student Data)
Switching hosts when you have active students feels risky. Enrollments, quiz progress, completion records, certificates: there's a lot of data that absolutely cannot get lost or corrupted in transit.
Levamo's White Glove Migration handles the entire process:
Their team assesses your current TutorLMS setup (plugins, database size, custom configurations, video storage)
They migrate everything to a temporary URL for you to test
You verify that course content, student progress, enrollments, and quiz data all transferred correctly
Once confirmed, they cut over with minimal downtime
It's free on all plans, completed within 48 business hours, and you don't have to touch a terminal or worry about breaking student records.
## Plans That Scale With Your Course Business
A solo creator selling one course has different needs than an academy running 30 courses with 5,000 enrolled students. Your hosting should scale with you.
| Feature | Starter ($29/mo) | Business ($99/mo) | Performance ($299/mo) |
|---|---|---|---|
| PHP Workers | Dedicated | Dedicated + auto-scaling | Dedicated + auto-scaling |
| Object Caching | Basic | KeyDB + Redis | KeyDB + Redis |
| CDN | Enterprise Cloudflare | Enterprise Cloudflare | Enterprise Cloudflare |
| Search | WordPress default | WordPress default | ElasticPress |
| Backups | Daily | Daily | Daily |
| Support | 24/7 live chat | 24/7 live chat | 24/7 live chat |
Most TutorLMS course sites should start on the **Business plan**. Object caching is essential as soon as you have concurrent learners actively navigating lessons and taking quizzes. The Starter plan works for building and testing your courses before launch, but once you have paying students, KeyDB + Redis object caching becomes the single biggest performance upgrade you can make.
If your academy grows to thousands of students and you need fast course/lesson search, the Performance plan adds ElasticPress, which offloads search to a dedicated engine and dramatically improves catalog browsing and content discovery.
Every plan includes a [3-day free trial](/pricing/) and a 14-day money-back guarantee. Migrate your TutorLMS site over, run your own tests, and see the difference before you commit.
## Wrapping Up
TutorLMS is a powerful course platform, but it's also one of the most demanding workloads you can put on WordPress. Every logged-in student generates personalized, database-heavy requests that generic hosting simply wasn't built to handle. The right hosting stack (server-level object caching, dedicated PHP workers, a fast database engine, and real container isolation) turns a sluggish course site into one where quizzes submit instantly, lessons load without lag, and your students focus on learning instead of fighting your infrastructure.
Your students don't care about server specs. They care that the quiz doesn't time out, the video doesn't buffer, and their progress actually saves. The hosting you choose determines whether that happens.
---
## Membership Site Pricing Strategies: How to Price Your Membership Site in 2026
- URL: https://levamo.com/blog/membership-site-pricing-strategies/
- Category: membership
- Author: Shahzeb Ahmed
- Published: 2026-08-25
Five membership pricing models plus how to set the right price for your site.
You built the content. You picked the membership plugin. You even got the design looking sharp. Then you hit the pricing page and froze.
How much should you charge? Is $9/month too cheap? Is $49/month too ambitious? Should you offer a free tier or will that cannibalize your paid members? What about annual billing?
Pricing is the single highest-leverage decision you will make for your membership site. Get it right, and you build a sustainable business that grows with every new member. Get it wrong and you either leave money on the table or scare people away before they ever see what you have to offer.
The good news: you do not have to guess. There are proven pricing models, practical frameworks, and real patterns from successful membership sites that can guide your decision. This guide walks you through all of them.
## The Five Membership Pricing Models
Before you set a dollar amount, you need to choose a structure. Each model works differently depending on your content type, audience, and growth stage.

### 1. Flat-Rate (Single Tier)
One price, one membership level, full access to everything.
This is the simplest model and the easiest to sell. Members pay a fixed monthly or annual fee and get access to your entire content library. No feature comparisons, no "which plan is right for me" confusion.
**Best for:** Communities, mastermind groups, niche content libraries where all members get roughly equal value.
**Example:** A fitness coaching community charges $29/month for access to workout plans, live Q&As, and a private forum. Every member gets the same thing.
**Pros:**
- Dead simple to communicate
- No decision fatigue for potential members
- Easy to manage operationally
**Cons:**
- Leaves revenue on the table from members who would pay more
- No upsell path once someone joins
### 2. Tiered Pricing (Good / Better / Best)
Multiple membership levels at different price points, each with increasing access or perks.
This is the most popular model for a reason. It lets you capture different segments of your audience at price points that match what they are willing to pay. The entry tier gets hesitant buyers through the door. The premium tier captures maximum value from your most engaged members.
**Best for:** Course platforms, professional communities, and any site where you can meaningfully differentiate between access levels.
**Example:** An online education platform offers three tiers:
- **Basic ($19/month):** Access to the course library
- **Pro ($49/month):** Courses plus live workshops and community forum
- **VIP ($99/month):** Everything plus monthly 1-on-1 coaching calls
**Pros:**
- Captures more revenue across different willingness-to-pay segments
- Creates a natural upgrade path
- The middle tier benefits from the anchoring effect (it looks like a great deal next to the premium tier)
**Cons:**
- More complex to set up and communicate
- Requires enough content or features to justify multiple levels
Most membership plugins like [MemberPress](/memberpress-hosting/) and Restrict Content Pro handle tiered pricing natively, so the technical setup is straightforward.
### 3. Freemium (Free Tier + Paid)
A free membership level with limited access, designed to convert members to a paid tier over time.
The freemium model works as a funnel. Free members get a taste of your content (maybe a few introductory lessons, limited community access, or a content preview). Once they see the value, a percentage converts to paid.
**Best for:** Sites with a large potential audience where the free tier serves as a marketing channel. Particularly effective for course platforms and content libraries.
**Example:** A marketing education site offers free access to 10 foundational lessons. Paid members ($39/month) unlock the full 200+ lesson library, templates, and community.
**Pros:**
- Lowers the barrier to entry dramatically
- Builds a large email list and engaged audience
- Free members become your best salespeople (word of mouth)
**Cons:**
- Low conversion rates (typically 2% to 5% of free members convert)
- Free members still consume server resources and support bandwidth
- Risk of devaluing your paid content if the free tier is too generous
The key to freemium: your free content must be genuinely useful on its own, but it should also make the paid tier feel essential. If the free tier is too thin, nobody sticks around. If it is too generous, nobody upgrades.
### 4. Pay-Per-Content (À La Carte)
Members pay for individual pieces of content rather than a recurring subscription.
This model works when your content is highly specialized and members only need specific pieces. Think: downloadable templates, individual course modules, premium research reports, or standalone workshops.
**Best for:** Resource libraries, template shops, and educational content where members want specific items rather than ongoing access.
**Example:** A design resource site sells individual template packs at $15 to $45 each. Members can also subscribe for $29/month to get unlimited downloads.
**Pros:**
- Low commitment for buyers (no recurring charge anxiety)
- High perceived value for premium individual items
**Cons:**
- Less predictable revenue compared to subscriptions
- Harder to build community and long-term engagement
- Every sale requires a new purchase decision
Many sites combine this with a subscription option: buy items individually or subscribe for unlimited access. This hybrid approach captures both audiences.
### 5. Cohort-Based (Time-Limited Access)
Members join in batches with a defined start and end date. Think bootcamps, group coaching programs, or seasonal courses.
**Best for:** Live programs, group coaching, certification courses, and any content that benefits from a shared learning experience.
**Example:** A business coaching program runs 8-week cohorts four times a year at $497 per cohort. Each group goes through the material together with live sessions, accountability partners, and group discussions.
**Pros:**
- Creates urgency and scarcity (enrollment windows)
- Higher price points are easier to justify
- Strong community bonding within cohorts
- Predictable workload for you as the creator
**Cons:**
- Revenue comes in bursts rather than steady monthly flow
- Requires active facilitation during each cohort
- Empty seats in a cohort feel like lost revenue
## How to Figure Out Your Actual Price Point
Choosing a model is step one. Now you need a number. Here is a practical framework.
### Start With Value, Not Cost
The biggest pricing mistake membership site owners make is anchoring to their costs. They think: "My hosting is $99/month, my plugin licenses cost $300/year, I spend 10 hours a week creating content, so I need to charge at least $X to break even."
That math matters for your business plan, but it should not determine your price. Your members do not care what it costs you to run the site. They care what they get out of it.
Value-based pricing asks a different question: **what is this membership worth to your members?**
If your membership teaches freelancers how to land higher-paying clients and the average member raises their rates by $500/month after joining, a $49/month membership is a steal. If your membership provides workout plans that replace a $120/month personal trainer, $29/month feels like a bargain.
Frame your price relative to the outcome or alternative, not your expenses.
### Research Your Niche
Look at what existing membership sites in your space charge. You do not need to match their pricing, but you need to understand the range your audience considers normal.
- Search for membership sites in your niche and note their pricing
- Check online course platforms for comparable offerings
- Browse community platforms (paid Slack groups, Discord servers, Circle communities) for reference points
- Read reviews and complaints about competitor offerings. Pricing objections tell you where the ceiling is
### Use the 10x Rule as a Gut Check
A widely used heuristic in subscription pricing: your membership should deliver at least 10 times its cost in perceived value. If you charge $30/month, members should feel like they are getting $300/month worth of content, community, or outcomes.
This does not mean you need $300 worth of "stuff." Value is subjective. A single piece of advice that saves someone 5 hours of work or prevents a costly mistake can easily be worth $300 to the right person.
### Price for Your First 100 Members, Not Your First 10,000
New membership site owners often underprice because they are thinking about volume. "If I charge $9/month and get 10,000 members, that is $90,000/month!"
The problem: getting to 10,000 members at $9/month is brutally hard. You need massive traffic, high conversion rates, and very low churn. Meanwhile, getting 500 members at $49/month produces the same revenue with a smaller, more engaged community that is easier to serve.
Higher prices also tend to attract more committed members who show up, participate, and stick around. Lower prices attract more casual buyers who sign up, forget about it, and cancel after three months.
## Annual vs. Monthly Billing: The Math That Matters
Offering both annual and monthly billing is almost always the right move. Here is why.
**Monthly billing** is lower friction. It gets more people through the door because the commitment feels small. A $29 monthly charge is psychologically easier than a $290 annual charge, even if the annual option saves them money.
**Annual billing** is better for your business. It reduces churn (members who pay annually are far less likely to cancel mid-year), improves cash flow (you get 12 months of revenue upfront), and gives you a more predictable revenue base.
The standard approach: price your annual plan at a 15% to 20% discount compared to 12 months of the monthly rate.
- If monthly is $29/month ($348/year), offer annual at $279/year (20% off)
- If monthly is $49/month ($588/year), offer annual at $499/year (15% off)
Present the annual option as the default or recommended choice on your pricing page. Show the monthly cost of the annual plan ("just $23/month, billed annually") to make the comparison obvious.
Some membership sites go further and offer annual-only billing. This works when your content has a natural yearly cycle (like a certification program or seasonal content), but it does limit your addressable audience.
## Free Trials, Discounts, and Getting Members to "Yes"
### Free Trials
A free trial lets potential members experience your content before committing. It works well for membership sites because the value of a community or content library is hard to communicate on a sales page. People need to experience it.
**Keep trials short.** Three to seven days is the sweet spot. Longer trials give people time to extract value without paying, and they train your audience to wait for free access. Shorter trials create urgency to explore and decide.
**Require a credit card upfront.** This is controversial, but the data is clear: trials that require payment information convert at significantly higher rates than those that do not. You will get fewer trial signups, but the ones you get are more serious.
### Launch Discounts
If you are launching a new membership site, a founding member discount can build your initial member base quickly. Offer the first 50 or 100 members a locked-in rate (e.g., 30% off for life) in exchange for joining early and providing feedback.
This works because:
- It creates urgency (limited spots at the discounted rate)
- Founding members become your most loyal advocates
- Their feedback shapes the membership before you scale
**Do not run perpetual discounts.** If your "special offer" never expires, it is not special. It is your real price. Use discounts strategically and sparingly.
### Money-Back Guarantees
A 14-day or 30-day money-back guarantee reduces purchase anxiety without the operational overhead of a free trial. Members pay upfront, get full access, and can request a refund if it is not for them.
This is often simpler to manage than a trial system and works particularly well for higher-priced memberships where the financial commitment feels significant.
## When and How to Raise Your Prices
Your first price will not be your forever price. As your content library grows, your community matures, and your brand reputation builds, your membership becomes more valuable. Your pricing should reflect that.
### Signs It Is Time for a Price Increase
- Your content library has grown significantly since launch
- Member satisfaction and retention rates are strong
- You have a waitlist or consistently hit capacity
- You have not raised prices in over a year
- New members tell you the membership is "a steal" or "underpriced"
### How to Handle the Increase
**Grandfather existing members.** The most common (and fairest) approach is to keep current members at their existing rate and apply the new pricing to new signups only. This rewards loyalty, avoids backlash, and gives you a natural upsell opportunity later.
**Give advance notice.** If you do raise prices for existing members, give them 30 to 60 days notice and explain why. "We have added 50 new courses, weekly live workshops, and a mentorship program since you joined" is a reason people can accept. "We need more revenue" is not.
**Use price increases to drive annual conversions.** "Lock in your current rate for the next year by switching to annual billing before the price increase takes effect." This simultaneously raises prices and improves your billing mix.
## Common Pricing Mistakes (And How to Avoid Them)
**Pricing too low out of fear.** Underpricing signals low value. If your membership costs less than a large coffee per week, potential members will unconsciously assume the content matches that price point. Charge what your content is worth.
**Too many tiers.** Three tiers is the sweet spot. Four might work. Five or more creates decision paralysis and makes your pricing page feel like a spreadsheet. If you cannot explain the difference between tiers in one sentence each, you have too many.
**Hiding your prices.** "Contact us for pricing" works for enterprise software. It does not work for membership sites. Your audience expects to see prices on the page. Hiding them adds friction and signals that the price will be uncomfortably high.
**Ignoring the hosting math.** As your membership grows, your server costs change. A site with 50 members has different hosting needs than one with 5,000 concurrent logged-in users. When you are building your membership site, choose hosting that scales with you. A plan that handles 100 members today should have an upgrade path for 10,000 members tomorrow, without requiring a full migration to a different provider.
**Never revisiting your pricing.** Your first price is a hypothesis, not a commitment. Review your pricing at least twice a year. Look at churn rates by price point, survey members about perceived value, and adjust.
## Matching Your Hosting to Your Growth Stage
Your membership pricing strategy and your hosting plan should grow in lockstep. Here is a practical way to think about it.

**Early stage (0 to 500 members):** You are validating your concept and building your content library. You need reliable hosting with good performance, but you do not need enterprise-level resources yet. A [managed WordPress plan](/managed-wordpress-hosting/) in the $29 to $99/month range covers this. Focus your budget on content creation and marketing, not infrastructure.
**Growth stage (500 to 5,000 members):** Your site now handles significant concurrent logged-in traffic. Page caching cannot help here because every member sees personalized content. You need object caching (Redis or KeyDB) to keep database queries fast, auto-scaling PHP workers to handle traffic spikes, and a [CDN](/cloudflare-cdn/) to serve static assets globally.
**Scale stage (5,000+ members):** At this level, database performance becomes critical. You need dedicated resources, advanced search (ElasticSearch for fast member directories and content search), and hosting support that understands membership workloads. Your hosting cost is now a small fraction of your revenue, so optimize for reliability and speed rather than the lowest price.
The point is not to over-invest in hosting before you have the members to justify it. Start lean, upgrade as revenue grows, and make sure your hosting provider offers a [clear upgrade path](/pricing/) so you never have to do a painful migration mid-growth.
## Wrapping Up
Pricing your membership site is not a one-time decision. It is an ongoing process that evolves as your content grows, your audience matures, and you learn what your members actually value. Start with a model that fits your content type, set a price based on the value you deliver (not your costs), and plan to revisit your pricing every six months.
The most important thing? Pick a price and launch. You can always adjust later. But you cannot optimize a membership site that does not exist yet.
---
## Best Hosting for BuddyPress Communities in 2026: What Your Community Actually Needs
- URL: https://levamo.com/blog/best-hosting-for-buddypress/
- Category: membership
- Author: Shahzeb Ahmed
- Published: 2026-08-24
What BuddyPress communities need from hosting to stay fast as members grow.
You built a community with BuddyPress. Members are joining, conversations are flowing, and your activity feed is finally alive.
Then you hit 150 active members, and everything slows to a crawl.
Pages take four seconds to load. The member directory times out. Activity feeds lag behind real-time by minutes. Members stop posting, stop logging in, and quietly disappear.
Here's the thing: this isn't a BuddyPress problem. It's a hosting problem.
Most WordPress hosts are optimized for one thing: serving static blog pages to anonymous visitors. That's the exact opposite of what a BuddyPress community does. Every page load for a logged-in member is dynamic. Every profile view, every activity update, every friend request hits your database and generates a fresh response.
Your community deserves hosting that was actually built for this workload. Let's break down what that looks like.
## Why BuddyPress Communities Can't Run on Generic Hosting
A typical WordPress blog serves the same cached HTML to every visitor. A hosting provider can serve thousands of those requests per second without breaking a sweat, because the server barely has to think.
BuddyPress flips that model on its head.
When a member loads their activity feed, your server has to:
Authenticate the user's session
Query the database for activity items from their friends, groups, and followed members
Check permissions on every item (who can see what)
Render a personalized page that's different from what every other member sees
Multiply that by 50, 100, or 500 concurrent members, and you start to see why generic hosting buckles. Page caching? Useless here. You can't serve Member A a cached copy of Member B's personalized feed.
This is why [community-focused hosting](/buddypress-hosting/) exists as a category. The workload is fundamentally different from that of any blog or brochure site.
## What Your BuddyPress Site Actually Needs From Hosting
Not every "managed WordPress host" is equipped for community workloads. Here's the checklist that actually matters.

### Object Caching That Can Handle Concurrency
Object caching stores the results of expensive database queries in memory (RAM), so the next time that query runs, your server grabs the answer instantly instead of hitting the database again.
For a BuddyPress site, this is transformative. Member directories, group lists, activity feeds, and permission checks all involve repetitive queries that object caching can intercept.
But there's a catch. Standard Redis is single-threaded. When 80 members are active simultaneously and all generating database queries, a single-threaded cache becomes a bottleneck itself.
KeyDB solves this. It's a multithreaded fork of Redis that handles concurrent requests without queuing them up. For a BuddyPress community with active, logged-in members, multithreaded object caching isn't a nice-to-have. It's the difference between a responsive community and one that feels sluggish during peak hours.
Levamo includes KeyDB + Redis object caching on Business plans and above, specifically because community and membership workloads demand it.
### Dedicated PHP Workers
Every dynamic page request on your BuddyPress site requires a PHP worker to process it. If your host gives you a shared pool of workers across multiple sites, a traffic spike on someone else's site can starve yours.
Look for hosting that provides dedicated, auto-scaling PHP workers. When your community hosts a live event or a popular discussion thread takes off, your server should spin up additional workers to handle the load, not queue requests until members start seeing timeout errors.
### A Database Layer Built for Speed
BuddyPress is database-heavy. Activity streams, member relationships, group memberships, private messages: all of it lives in your database. The difference between MariaDB and older MySQL setups is measurable, especially for the complex JOIN queries that BuddyPress generates.
MariaDB's query optimizer handles these patterns more efficiently, and when paired with object caching, your database only needs to run each expensive query once before the result gets cached.
### CDN That Actually Helps Dynamic Sites
Most CDNs cache static files: images, CSS, JavaScript. That's helpful, but it only addresses a fraction of a BuddyPress site's performance needs.
An enterprise-grade CDN like Cloudflare's does more. It handles DDoS protection, bot filtering, SSL termination, and edge-level security headers. For a community site where members upload profile photos, share files, and interact with media-rich activity feeds, having 300+ edge locations serving your static assets while protecting your origin server makes a real difference.
Levamo includes [Enterprise Cloudflare CDN](/cloudflare-cdn/) on every plan, not as an upsell.
### Container Isolation
Shared hosting means shared resources. If another site on your server gets a traffic spike (or worse, gets hacked and starts consuming resources), your community slows down.
Container isolation gives each site its own walled-off environment with guaranteed resources. Your BuddyPress community's performance stays consistent regardless of what's happening elsewhere on the server.
## How Levamo Handles BuddyPress Workloads
Levamo was built by the co-founders of [BuddyBoss](/buddyboss-hosting/), the most widely used BuddyPress-based platform. That's not a marketing partnership. The people who built the platform also built the hosting to run it.
That origin story matters because it shaped the entire infrastructure. The stack wasn't designed for blogs and then retrofitted for communities. It was built from the ground up for logged-in, dynamic, database-heavy workloads.
Here's what's under the hood:
**LiteSpeed web server** with built-in page caching for the parts of your site that can be cached (public pages, login screens, static content)
**KeyDB + Redis object caching** (Business plans and up) for the dynamic, per-user queries that dominate BuddyPress traffic
**MariaDB** tuned for the complex query patterns community plugins generate
**Auto-scaling PHP workers** that respond to demand spikes instead of queuing requests
**Container isolation** so your resources are always yours
**Enterprise Cloudflare CDN** across 300+ locations on every plan
**Monarx malware scanning** at the server level, plus Cloudflare WAF and DDoS protection
The benchmarks back it up: 9.3 on WP Benchmark, 2,958 queries per second, and 353 requests per second under load testing. Those numbers matter most for sites like yours where every request triggers real database work.
### Support That Knows Your Stack
Here's something that doesn't show up in spec sheets. When you contact Levamo support, you're talking to people who work with BuddyPress and BuddyBoss sites daily. They understand activity feed optimization, group query performance, and the specific plugin conflicts that community sites run into.
That's a 24/7/365 team with a 4.6/5 CSAT rating and sub-minute live chat response times. For non-technical community operators who need server-level help, this is often the deciding factor.
## Migrating Your Community (Without Downtime)
Switching hosts feels risky when you have an active community. Members are posting, sending messages, and interacting in real time. You can't just flip a switch and hope nothing breaks.
Levamo's White Glove Migration handles the entire process for you:
Their team assesses your current setup (plugins, database size, custom configurations)
They migrate everything to a temporary URL for you to test
Once you confirm everything works, they cut over with minimal downtime
It's free on all plans, completed within 48 business hours, and you don't have to touch a terminal. For community operators who aren't server admins (and don't want to be), this removes the single biggest barrier to switching.
## Plans That Scale With Your Community
A community with 50 members has different needs than one with 5,000. Your hosting should reflect that.
| Feature | Starter ($29/mo) | Business ($99/mo) | Performance ($299/mo) |
|---|---|---|---|
| PHP Workers | Dedicated | Dedicated + auto-scaling | Dedicated + auto-scaling |
| Object Caching | Basic | KeyDB + Redis | KeyDB + Redis |
| CDN | Enterprise Cloudflare | Enterprise Cloudflare | Enterprise Cloudflare |
| Search | WordPress default | WordPress default | ElasticPress |
| Backups | Daily | Daily | Daily |
| Support | 24/7 live chat | 24/7 live chat | 24/7 live chat |
Most BuddyPress communities start on the **Business plan** because object caching is essential once you pass ~100 active members. If your community grows to thousands of members with heavy search usage (member directories, forum searches, content filtering), the Performance plan adds ElasticPress for offloaded, lightning-fast search.
Every plan includes a [3-day free trial](/pricing/) and a 14-day money-back guarantee. Test your actual community on the infrastructure before committing.
## Wrapping Up
BuddyPress communities are some of the most demanding WordPress workloads out there. Every logged-in member generates dynamic, personalized, database-heavy requests that generic hosting simply wasn't designed to handle.
The right hosting stack (object caching, dedicated PHP workers, a fast database, and real container isolation) transforms a sluggish community into one where members actually want to spend time. And when your hosting provider was literally built by the people who created the leading BuddyPress platform, you're getting infrastructure that understands your workload at a foundational level.
Your community members don't care about server specs. They care that the activity feed loads instantly, profiles don't time out, and notifications arrive in real time. The hosting you choose determines whether that happens.
---
## What's New in WordPress 7.1: Features, Screenshots, and What It Means for Your Site
- URL: https://levamo.com/blog/wordpress-7-1/
- Category: wordpress
- Author: Shahzeb Ahmed
- Published: 2026-08-21
WordPress 7.1 adds responsive styling, client-side image uploads, and new blocks.
WordPress 7.1 dropped on August 19, 2026, officially released at WordCamp US. It's one of the meatier updates in recent memory, packing responsive styling, browser-based image processing, two new core blocks, and a redesigned image editor into a single release.
Whether you're running a [WooCommerce store](/managed-woocommerce-hosting/), managing a [membership community](/memberpress-hosting/), or building out a [course platform](/hosting-for-lms/), there's something in this update that directly affects how you work. Here's everything worth knowing.

## Responsive Styling Without Writing a Line of CSS
This might be the single most useful feature in WordPress 7.1 for anyone building pages in the Site Editor.
Before this update, making a heading 48px on desktop but 28px on mobile meant either writing custom CSS or relying on a page builder plugin. WordPress now handles it natively.
The Site Editor includes device preview toggles for desktop, tablet, and mobile. Switch to the mobile view, adjust your font sizes, spacing, or layout, and WordPress generates the responsive CSS automatically. You can also drag the canvas edges to create custom breakpoints, which is great for fine-tuning how content looks between standard device widths.

Your theme can even define custom breakpoints through theme.json, so the responsive styles snap to the exact widths that matter for your design.
For site owners who've been using page builders primarily for responsive controls, this closes a real gap in core WordPress.
## Hover, Focus, and Active State Styling
WordPress 7.1 also introduces pseudo-state styling for interactive elements like buttons and links.
From the block sidebar, you can now set how a button looks when someone hovers over it, clicks it, or navigates to it with a keyboard. A simple "State" dropdown lets you toggle between default, hover, focus, and active states and style each one individually.

This is particularly useful for WooCommerce store owners who want polished "Add to Cart" interactions, or membership sites where call-to-action buttons need to feel responsive and clickable. Previously, even changing a button's hover color required custom CSS or a page builder.
## Your Browser Now Handles Image Uploads
Here's a technical change that solves a very practical problem.
Before 7.1, every image you uploaded was processed on your server using PHP (through the GD or Imagick libraries). For small images, no big deal. But if you've ever tried uploading a 15MB product photo or a high-res hero image and hit the dreaded "PHP memory limit exceeded" error, you know the frustration.
WordPress 7.1 shifts image processing to your browser. Using a WebAssembly-compiled version of libvips, your browser handles resizing, compression, and thumbnail generation before the image ever reaches your server.
Here's what that means in practice:
**Images come out roughly 15% smaller** compared to the old server-side processing
**No more PHP memory errors** on large uploads
**Your server's CPU and RAM stay free** for actually serving your site to visitors
**Up to 5 concurrent uploads** with 2 simultaneous processing operations
**HEIC photos from iPhones** automatically convert to JPG
**AVIF and WebP formats** are now supported natively

One thing to know: full browser support currently requires Chrome 137+ or Edge 137+ on desktop. Safari and Firefox don't fully support the required WebAssembly features yet. For those browsers, WordPress falls back to server-side processing automatically, so nothing breaks.
For sites with large media libraries (product catalogs, course content, community galleries), this is a genuine quality-of-life improvement.
## A Redesigned Image Editor
WordPress 7.1 ships a completely overhauled image editor modal.
The previous editor did its job, but it felt dated. The new version supports freeform cropping, preset aspect ratios, rotation, horizontal and vertical flipping, and metadata editing. It all lives in a dedicated modal that feels more like a lightweight design tool than the clunky overlay it replaces.

You also get a magnified crop view for precision editing and the ability to edit images directly within Cover blocks.
Another practical addition: resilient uploads that automatically pause and resume if your connection drops mid-upload. If you've ever lost a batch upload because your Wi-Fi blipped for a second, you'll appreciate this one.
And a small but meaningful accessibility win: you can now mark images as "decorative" with a toggle, which tells screen readers to skip them entirely.
## Two New Core Blocks: Tabs and Playlist
WordPress 7.1 adds two blocks that many site owners have been installing third-party plugins to get.
### Tabs Block
The Tabs block organizes content into clickable panels. Product specifications, FAQ sections, course module overviews, pricing comparisons: any scenario where you have categorized content that benefits from a compact, tabbed layout.

The implementation follows W3C accessibility guidelines, meaning keyboard navigation and screen readers work correctly out of the box. You can nest any block type inside each tab panel and reorder tabs using toolbar buttons.
For WooCommerce stores, this is a natural fit for product detail pages. For course sites, it works well for organizing module content or lesson resources by category.
### Playlist Block
The Playlist block is built for audio content. Podcasts, audio courses, music samples: this block displays your tracks with metadata (title, artist, album art) and includes customizable waveform visualization.

Previously, embedding multiple audio files required shortcodes or a third-party plugin. Now it's a native block with a proper player interface, full styling controls for typography, background, and dimensions, and support for every audio MIME type registered on your site.
## Collaboration Upgrades: Notes, @Mentions, and Revisions
WordPress has been building toward real team collaboration for several releases, and 7.1 makes meaningful progress.
**Notes** now support rich text formatting (bold, italics, links, emojis), inline text selection (highlight specific words and attach a comment, not just an entire block), and @mentions that trigger email notifications to tagged collaborators. You can attach multiple notes to the same block, and long notes collapse by default to keep the editor clean.
**Visual revisions** also get shareable links. You can copy a URL to a specific version of your post and share it with a collaborator, who'll see a color-coded view of what changed.
For teams managing content across membership sites, course platforms, or multi-author blogs, these features reduce the back-and-forth that typically happens in external tools before content ever makes it into WordPress.
## Admin Interface Gets a Facelift
You'll notice several visual changes the moment you log into WordPress 7.1.
### Persistent Admin Toolbar
The admin bar now stays visible in both the Post Editor and the Site Editor. Previously, it would disappear when you entered the editor, making it harder to navigate back to the dashboard or jump to other admin pages. The toolbar also sports redesigned SVG icons (replacing the older Dashicons), circular profile avatars, and a back chevron replacing the old WordPress "W" logo.

### Smarter Command Palette
The command palette (Cmd+K or Ctrl+K) is reorganized into three sections: Recent, Matching, and Suggestions. It now remembers your recent commands across sessions and surfaces contextual suggestions based on what you're currently editing.

### Color Scheme Consistency
Your chosen admin color scheme now extends to the Site Editor. If you use "Midnight" or "Sunrise," the editor sidebar will match instead of defaulting to black. A small detail, but it makes the whole experience feel more cohesive.
### New Identity Screen
A new Design > Identity section in the Site Editor puts your site title, tagline, logo, and site icon in one place. Previously, these settings were scattered across the Customizer and various editor panels.
### List View Improvements
The Posts list view now shows excerpts for easier scanning, and you can shift-click to select multiple posts for bulk actions.
## Under the Hood: Developer Highlights
A few notable changes for developers and site builders who work with code:
**Abilities API enhancements:** Four new lifecycle filters for intercepting and transforming ability execution. Enhanced filtering lets you query abilities by category, namespace, and metadata. These improvements make AI-driven operations more granular and secure.
**Design tokens and ThemeProvider:** A new wordpress/theme package introduces CSS custom properties following a "WPDS" naming pattern, plus a React ThemeProvider component that auto-generates color ramps from seed colors.
**jQuery UI updated to 1.14.2.** Test any admin-facing plugins that rely on jQuery UI, as behavior changes are possible.
**SVG icon system:** A public API lets plugins and themes register custom icon sets with strict SVG sanitization.
**Post editor is always iframed** for consistency, even with older meta boxes (requires Block API version 3).
**Faster editor startup** through preloaded REST API requests that reduce initialization time.
## What This Means for Your WordPress Site
WordPress 7.1 is a solid release across the board.
If you're running a content-heavy site (membership community, course platform, multi-author blog), the responsive styling controls and new Tabs block give you more design flexibility without installing additional plugins. The image editor and client-side processing make media management genuinely smoother, especially for sites with growing media libraries.
For WooCommerce stores, the hover state styling, Tabs block (perfect for product details), and reduced server load from browser-based image processing all contribute to a better building and shopping experience.
The collaboration features signal that WordPress is getting serious about team workflows. If you've been relying on external tools for content review and feedback, it's worth revisiting what WordPress can handle natively now.
And since client-side image processing offloads work from your server, more of your hosting resources go toward fast page delivery through the [CDN edge](/cloudflare-cdn/) rather than crunching image thumbnails on every upload.
**Before you update:** Back up your site, test on staging first (especially if you run custom code or older plugins), and verify that your critical plugins have confirmed WordPress 7.1 compatibility.
## Wrapping Up
WordPress 7.1 delivers improvements that matter for everyday site owners, not just developers. The responsive styling controls alone eliminate a major reason many people reach for page builder plugins. Client-side image processing solves real frustrations (goodbye, PHP memory errors), and the new Tabs and Playlist blocks fill two of the longest-standing gaps in core WordPress.
Test it on staging, confirm your plugins are ready, and update when you're confident. Your site and your workflow will be better for it.
---
## How AI Crawlers Are Inflating Your Hosting Bill (And What to Do About It)
- URL: https://levamo.com/blog/ai-crawlers-hosting-bill/
- Category: website-security
- Author: Shahzeb Ahmed
- Published: 2026-08-19
AI bots now outnumber humans online and quietly inflate your hosting bill.
You check your hosting dashboard. Everything looks fine. Uptime is solid, your site loads fast, and you haven't changed anything in weeks. But somehow, your bandwidth usage is climbing. Your PHP workers are busier than usual. And if you're on a plan with overage charges, you might be staring at a surprise line item on your next invoice.
The culprit? AI crawlers. And they're probably hitting your site right now.
## What Are AI Crawlers, and Why Are They on Your Site?
AI crawlers are automated bots used by companies like OpenAI, Anthropic, and Google to scrape website content. They use that content to train large language models, power AI search engines, or fetch pages in real time when a user asks a chatbot a question.
You've probably heard of Googlebot. It crawls your site so Google can index your pages. AI crawlers do something similar, but with a key difference: most of them aren't sending you any traffic back. They take your content, feed it into a model, and your site never sees a visitor from it.
There are three main types:

**Training crawlers** (GPTBot, ClaudeBot, CCBot) scrape your content to train AI models. They crawl aggressively, hit every page they can find, and offer zero direct benefit to your site.
**AI search crawlers** (OAI-SearchBot, PerplexityBot) index your content for AI-powered search results. These can actually drive some referral traffic, so they're worth keeping around.
**Real-time fetchers** (ChatGPT-User) grab your pages on demand when someone asks a chatbot a question that requires fresh data. These are sporadic but can spike unpredictably.
## The Numbers Are Staggering
This isn't a theoretical problem. The data paints a clear picture.
Cloudflare reported in August 2026 that fewer than half of all HTML page requests now come from a human. Let that sink in. More than half of the traffic hitting websites globally is automated.
The Imperva 2025 Bad Bot Report found that automated traffic accounts for 51% of all web activity, with bad bots alone responsible for 37%.
And the growth rate is accelerating. According to TollBit's analysis of publisher networks, the ratio of AI bot visits to human visits shifted from 1 in 200 at the start of 2025 to 1 in 31 by Q4 2025. That's a 6.5x increase in under a year.
Your site is part of this. Whether you run a [WooCommerce store](/managed-woocommerce-hosting/), a membership community, or a [course platform](/hosting-for-lms/), AI crawlers are visiting your pages. The question is how much it's costing you.
## How AI Crawlers Silently Inflate Your Hosting Costs
Here's why AI crawler traffic is different from regular bot traffic, and why it hits your wallet harder than you'd expect.
### 1. They Bypass Your Cache
This is the big one. When a human visitor loads your homepage, your hosting server can serve a cached version. The page is already generated, sitting in memory, ready to go. The server barely breaks a sweat.
AI crawlers don't play by those rules. They crawl deep into your site, hitting pages that aren't cached: product pages with dynamic pricing, membership content behind authentication checks, course pages with progress tracking, search result pages, paginated archives. Every one of these requests forces your server to do real work.
For a WooCommerce store, that means executing PHP, querying the database for product data, calculating shipping rules, checking inventory, and generating a full page from scratch. Multiply that by thousands of requests per day, and your server is doing a lot of unpaid labor.
### 2. They Consume PHP Workers
Every request that can't be served from cache needs a PHP worker to process it. Your hosting plan comes with a fixed number of these workers. When they're all busy, new requests (from actual customers) have to wait in line.
AI crawlers don't queue politely. Training bots like GPTBot and ClaudeBot can send hundreds of requests per minute, each one claiming a PHP worker while it processes. During a crawl burst, your real visitors experience slower page loads or timeout errors, not because your site is broken, but because bots are hogging the resources they need.
### 3. They Spike Your Bandwidth
AI crawlers download the full HTML of every page they visit. Some also pull CSS, JavaScript, and even images. A single training crawler session can download tens of gigabytes from a content-heavy site.
If your hosting plan includes a bandwidth cap (and most do), this pushes you closer to overages. On plans that charge per gigabyte of overage, you're literally paying for bots to scrape your content.
### 4. They Inflate Your Database Load
Every dynamic page request triggers database queries. On a membership site running BuddyPress or [MemberPress](/memberpress-hosting/), a single page load might execute 50 to 100 database queries to check user permissions, load activity feeds, and render personalized content.
AI crawlers trigger these queries without being logged in, so the server runs all that logic just to serve a page the bot will strip down to plain text anyway. On busy sites, this database load compounds and starts affecting performance for everyone.
### 5. They Distort Your Analytics
This one doesn't cost you server resources, but it costs you decision-making clarity. AI crawler visits inflate your page views, skew your bounce rate, and throw off conversion metrics. If you're making business decisions based on analytics data that's 30-50% bot traffic, you're working with bad information.
## Why Your Hosting Dashboard Won't Show the Problem
Most hosting control panels show you bandwidth usage, disk space, and maybe CPU utilization. What they don't show you is who's consuming those resources.
Your bandwidth graph might show a spike on Tuesday afternoon. Was that a successful email campaign driving real customers? Or was it ClaudeBot crawling your entire product catalog? Without bot-level visibility, you can't tell. And if you can't tell, you can't fix it.
This is the hidden part of the problem. You might upgrade to a higher hosting plan thinking you've outgrown your current one, when the real issue is that 40% of your server load is bots you never invited.
## What You Can Actually Do About It
The good news: you don't have to accept this. But the approach matters. Blocking bots at the wrong layer is like putting a lock on your bedroom door while leaving the front door wide open.
### Block at the Edge, Not the Server
This is the most important distinction. If a bot reaches your server before it gets blocked, the damage is already done. Your PHP workers have already processed the request, your database has already run the queries, and your bandwidth has already been consumed. A WordPress plugin that blocks bots is too late in the chain.
What you need is edge-level blocking. That means stopping bots at the CDN or firewall layer, before the request ever touches your server. No PHP execution, no database queries, no bandwidth consumed.
[Cloudflare's WAF](/cloudflare-cdn/) (Web Application Firewall) does exactly this. It identifies bot traffic at the edge and blocks or challenges it before it reaches your origin server. The request dies at one of Cloudflare's 300+ global edge locations, and your server never knows it happened.

On Levamo, Enterprise Cloudflare is included on every plan (yes, even Starter at $29/mo). That means WAF protection, DDoS mitigation, and bot management are active from day one, with no extra charges and no plugins to install.
### Use robots.txt (But Know Its Limits)
Your robots.txt file can tell well-behaved crawlers to stay away. Here's a basic block for the major AI training bots:
```
User-agent: GPTBot
Disallow: /
User-agent: ClaudeBot
Disallow: /
User-agent: CCBot
Disallow: /
User-agent: anthropic-ai
Disallow: /
User-agent: Google-Extended
Disallow: /
```
The problem? robots.txt is a suggestion, not a command. Legitimate crawlers from OpenAI and Anthropic generally respect it. But scraper bots that impersonate these crawlers, or less scrupulous AI companies, will ignore it completely. That's why edge-level blocking is your real defense, and robots.txt is just the first line.
### Be Selective About What You Block
Not all AI bots are bad for your business. AI search crawlers like OAI-SearchBot and PerplexityBot can actually drive traffic to your site by citing your content in AI-generated search results. Blocking them means cutting yourself off from a growing discovery channel.
The smart approach is to block training crawlers (which take your content and give nothing back) while allowing AI search crawlers (which can send visitors your way). Levamo's dashboard includes an AI bot control setting that lets you choose among allowing all AI bots, allowing only verified bots, or blocking all AI bots.
And here's the irony worth noting: while rogue AI crawlers are inflating your hosting bill, AI itself can also be your best site management tool. Levamo's AI Management feature lets you connect ChatGPT, Claude, or Cursor directly to your WordPress site and manage it through conversation. Update plugins, draft posts, redesign pages, all without logging into wp-admin. The difference is control. AI Management works with your permission, on your terms, with a draft-first safety model. AI crawlers just take.
### Monitor Your Server Logs
If you want to see exactly what's hitting your site, check your raw access logs. Look for user agent strings containing GPTBot, ClaudeBot, CCBot, Bytespider, PetalBot, or Applebot-Extended. You'll probably be surprised by the volume.
On Levamo, you can also use the Cloudflare analytics built into your dashboard to see bot traffic patterns without digging through log files.
## The Real Cost: What Could You Do With Those Resources?
Think about it this way. If 30% of your server's PHP workers are busy serving AI crawlers, that's 30% fewer workers available for your actual customers. During a product launch, a membership sale, or a course enrollment rush, those workers could be the difference between a smooth checkout and a timeout error that costs you revenue.
The resources AI crawlers consume aren't free. They're resources you're paying for, on a plan you chose based on your expected human traffic. Every PHP worker, every database query, every megabyte of bandwidth consumed by a bot is a resource stolen from your business.
## Wrapping Up
AI crawler traffic isn't going away. If anything, it's accelerating. The ratio of bots to humans is shifting every quarter, and your hosting bill is absorbing the impact whether you realize it or not.
The fix isn't complicated, but it does require the right infrastructure. Edge-level bot blocking (through a WAF like Cloudflare) stops the bleeding before it starts. Combine that with a selective robots.txt policy and dashboard-level AI bot controls, and you've reclaimed your server resources for the people who actually matter: your customers.
If your current host doesn't include enterprise-grade bot protection on every plan, you're subsidizing the AI industry with your hosting budget. That's not a great deal.
---
## WordPress Security Audit: A Step-by-Step Checklist for Site Owners
- URL: https://levamo.com/blog/wordpress-security-audit/
- Category: website-security
- Author: Shahzeb Ahmed
- Published: 2026-08-18
Run a 12-step WordPress security audit: updates, users, malware, SSL, backups, more.
You installed an SSL certificate. You set up 2FA. You even picked a decent hosting provider. So your WordPress site is secure, right?
Maybe. Maybe not. The truth is, security isn't something you set up once and forget about. Plugins get abandoned. User accounts pile up. That theme you deactivated six months ago? It's still sitting in your file system with a known vulnerability.
A security audit is how you find out what's actually going on under the hood. Not what you *think* is happening, but what's really there.
This guide walks you through a complete WordPress security audit in 12 steps. No expensive tools required, no developer background needed. Just you, your WordPress dashboard, and about an hour of focused attention.
## What Is a WordPress Security Audit?
A security audit is a systematic check of your WordPress site's defenses. You're looking for gaps: outdated software, weak credentials, missing protections, and configurations that leave your site exposed.
It's different from a security *setup*. Setup is about putting protections in place. An audit is about verifying those protections still work and nothing new has slipped through.
Think of it like a home inspection. You already have locks on the doors and a smoke detector. The inspection checks whether the locks still latch, the batteries aren't dead, and nobody left a window open.
## When Should You Run a Security Audit?
Run a full audit in these situations:
**Quarterly**, as part of regular site maintenance
**After a security incident** or suspected breach
**Before a major launch** (new product, membership tier, course enrollment period)
**When you add new team members** who get WordPress access
**After installing multiple new plugins** or switching themes
If you run a WooCommerce store, membership site, or LMS platform with paying customers, quarterly is the bare minimum. Their payment data and personal information is your responsibility.
## The 12-Step WordPress Security Audit Checklist
### Step 1: Check WordPress Core, Plugin, and Theme Versions
This is the single most impactful step. According to [Patchstack](https://patchstack.com/ "nofollow")'s 2026 State of WordPress Security report, plugins accounted for 91% of all discovered vulnerabilities in 2025, with total vulnerabilities jumping 42% year-over-year to 11,334.
**What to check:**
Go to **Dashboard → Updates** and note any available updates
Check that you're running the latest major WordPress version
Look at every plugin on the **Plugins** page, not just active ones. Deactivated plugins with known vulnerabilities are still exploitable
Do the same for themes under **Appearance → Themes**
**What to do about it:**
Update everything that has a pending update
Delete any deactivated plugins and unused themes entirely. Not just deactivate. Delete.
If a plugin hasn't been updated by its developer in over a year, look for an actively maintained alternative
On Levamo, your WordPress core updates are managed automatically, but plugins and themes are still your responsibility. The Advanced SiteShield add-on monitors your full stack (plugins, themes, core, PHP, and database) and alerts you to vulnerabilities with priority levels, so you know which updates are urgent and which can wait.
### Step 2: Review User Accounts and Permissions
Old accounts are a common entry point. That freelancer who helped you three months ago? Their admin account might still be active.
**What to check:**
Go to **Users → All Users** and review every account
Note any accounts with the Administrator role that shouldn't have it
Look for accounts you don't recognize
Check if any users have email addresses from domains you don't know
**What to do about it:**
Delete accounts that are no longer needed
Downgrade roles where full admin access isn't required. Most content contributors only need the Editor or Author role
Follow the principle of least privilege: every user gets the minimum access they need to do their job, nothing more
### Step 3: Test Your Login Security
Your login page is the front door. Attackers try it first.
**What to check:**
Try logging in with a common password. If the site lets you set "password123" as a password, that's a problem
Check whether [two-factor authentication](/blog/two-factor-authentication-2fa/) is enabled for all admin accounts
Verify that login attempt limits are in place (either through a plugin or your host's WAF)
Check if wp-login.php is accessible from any IP address
**What to do about it:**
Enforce strong passwords for all users, especially administrators
Enable 2FA using an authenticator app (not SMS, which is vulnerable to SIM swapping)
Install a login limiting plugin like [Limit Login Attempts Reloaded](https://wordpress.org/plugins/limit-login-attempts-reloaded/ "nofollow") if your host doesn't handle this at the server level
[](https://wordpress.org/plugins/limit-login-attempts-reloaded/ "nofollow")
Levamo accounts support authenticator-app 2FA with team-admin enforcement, meaning the admin can require every team member to enable 2FA before accessing the dashboard. This covers your hosting-level access. For WordPress itself, you'll want a 2FA plugin like [WP 2FA](https://wordpress.org/plugins/wp-2fa/ "nofollow") or [Wordfence Login Security](https://wordpress.org/plugins/wordfence-login-security/ "nofollow").
### Step 4: Scan for Malware and Suspicious Files
Malware doesn't always announce itself. Some infections sit quietly, redirecting a percentage of your traffic or injecting hidden links that only search engines see.
**What to check:**
Run a malware scan using [Wordfence](https://wordpress.org/plugins/wordfence/ "nofollow"), [Sucuri SiteCheck](https://sitecheck.sucuri.net/ "nofollow"), or your host's built-in scanner
Look for recently modified files that you didn't change (especially in /wp-includes/ and /wp-admin/)
Check for unfamiliar files in your theme's root directory
Search for eval(), base64_decode(), and exec() in theme and plugin files, as these functions are commonly used in malicious code
**What to do about it:**
If your scanner finds malware, quarantine and remove the affected files
Identify *how* the malware got in (usually an outdated plugin or compromised credentials)
Change all passwords after cleanup, including WordPress, FTP/SFTP, database, and hosting panel
Levamo runs Monarx malware scanning at the server level on every site. Unlike plugin-based scanners that check files against known signatures, Monarx uses behavioral analysis to catch obfuscated and zero-day threats. It quarantines malicious files automatically and alerts the support team, so infections get caught even if you're not actively looking.
[](https://wordpress.org/plugins/wordfence/ "nofollow")
### Step 5: Verify Your SSL Certificate and HTTPS
An expired or misconfigured [SSL certificate](/blog/ssl-website-security/) is embarrassing at best and a security hole at worst.
**What to check:**
Visit your site and look for the padlock icon in the browser address bar
Click the padlock to verify the certificate is valid and not expired
Check that all pages load over HTTPS, not just the homepage
Look for mixed content warnings in your browser's developer console (resources loading over HTTP on an HTTPS page)
**What to do about it:**
If your certificate is expired, renew it through your host or certificate provider
Fix mixed content by updating hardcoded http:// URLs in your content and database
Add an HTTP to HTTPS redirect if one isn't already in place
On Levamo, SSL certificates are free, auto-renewing, and enforced by default through Cloudflare. This is one audit step you can effectively skip if you're hosted with us, but it's worth checking mixed content regardless.
### Step 6: Review Your Firewall and WAF Configuration
A web application firewall (WAF) filters malicious traffic before it reaches your site. But only if it's properly configured.
**What to check:**
Verify that your WAF is active and processing traffic (not just installed but disabled)
Review blocked request logs if available. A spike in blocked requests could mean an active attack
Check that [OWASP Top 10](https://owasp.org/www-project-top-ten/ "nofollow") rules are enabled (SQL injection, XSS, CSRF, etc.)
If you use [Cloudflare](/cloudflare-cdn/), verify your site is proxied (orange cloud icon) not just using DNS
**What to do about it:**
If you don't have a WAF, set one up. Cloudflare's free plan provides basic protection, or use a plugin like Wordfence
Review any custom rules to ensure they're not accidentally blocking legitimate traffic
Check that your WAF rules are current, as new attack patterns emerge regularly
Levamo includes Enterprise Cloudflare WAF on all plans with OWASP Top 10 rules, bot mitigation, and DDoS protection across 300+ edge locations. There's no setup required on your end, and no per-attack fees. The Advanced SiteShield add-on layers 16,000+ virtual patches on top, deploying targeted firewall rules automatically when plugin vulnerabilities are disclosed.
### Step 7: Check Your Backup System
Backups are your last line of defense. If everything else fails, a clean backup is what saves you.
**What to check:**
Verify that automated backups are running on schedule
Check the date of your most recent backup. If it's more than a week old, something is wrong
Confirm that backups are stored off-site (not just on the same server as your live site)
Test a restore. Seriously. Download a backup and verify that it actually contains your data
**What to do about it:**
Set up automated daily backups if you haven't already
For WooCommerce stores and membership sites with active transactions, consider hourly backups
Store at least one copy of your backup in a separate location (a different hosting provider, cloud storage, or local drive)
Levamo includes daily automated backups on all plans with one-click restore. For sites with frequent transactions, hourly backups are available as a $10/month add-on. On-demand snapshots let you create a backup right before making changes, so you always have a rollback point.
### Step 8: Audit Your Security Headers
Security headers tell browsers how to handle your site's content. Missing headers leave your visitors vulnerable to clickjacking, XSS, and other client-side attacks.
**What to check:**
Use a free tool like [SecurityHeaders.com](https://securityheaders.com/ "nofollow") to scan your site. Key headers to look for:
**Content-Security-Policy (CSP):** Controls which resources the browser is allowed to load
**X-Frame-Options:** Prevents your site from being embedded in iframes (clickjacking protection)
**X-Content-Type-Options:** Stops browsers from MIME-type sniffing
**Strict-Transport-Security (HSTS):** Forces HTTPS connections
**Permissions-Policy:** Controls access to browser features like camera, microphone, and geolocation
[](https://securityheaders.com/ "nofollow")
**What to do about it:**
Add missing headers through your server configuration, a plugin, or your CDN
Start with X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN as they rarely cause compatibility issues
Be careful with Content-Security-Policy, as an overly restrictive policy can break page builders, payment gateways, and analytics scripts. Test in report-only mode first
For a deep dive on implementing each header, check out our [WordPress Security Headers guide](/blog/wordpress-security-headers/).
### Step 9: Test File Permissions
Incorrect file permissions can let attackers modify your WordPress files or read sensitive configuration data.
**What to check:**
wp-config.php should be 400 or 440 (read-only for the owner)
Directories should be 755 (readable and executable, writable only by the owner)
Files should be 644 (readable by everyone, writable only by the owner)
The wp-content/uploads/ directory should be 755, not 777
No files or directories should ever be set to 777 (world-writable)
**How to check:**
If you have SSH or SFTP access, run:
```bash
find /path/to/wordpress -type f -perm 777
find /path/to/wordpress -type d -perm 777
```
If either command returns results, those files or directories need to be tightened immediately.
**What to do about it:**
Fix any 777 permissions to the appropriate level (644 for files, 755 for directories)
Make sure wp-config.php isn't readable from the web. Try accessing yourdomain.com/wp-config.php in a browser to verify
### Step 10: Review Your Database Security
Your database holds everything: posts, user credentials, customer data, order history, and site configuration.
**What to check:**
Verify that your database user doesn't have unnecessary privileges (DROP, GRANT, and FILE permissions are rarely needed for WordPress)
Check if your database table prefix is still the default wp_. While changing it alone isn't a strong defense, it eliminates one piece of predictable information
Look for unknown users or admin accounts directly in the wp_users table
Check for suspicious entries in the wp_options table, especially siteurl, home, and any unfamiliar transient entries
**What to do about it:**
Remove unnecessary database privileges from your WordPress database user
Clean up suspicious entries if found
Make sure your database credentials in wp-config.php are strong and unique
### Step 11: Check PHP Version and Server Configuration
Running an outdated PHP version means missing security patches. It also means slower performance.
**What to check:**
Go to **Tools → Site Health** in your WordPress dashboard to see your PHP version
PHP 8.1 reached end of life in December 2025. If you're running anything below PHP 8.2, you're on an unsupported version
Check that display_errors is set to Off in production (error messages can reveal file paths and configuration details to attackers)
Verify that allow_url_fopen and allow_url_include are disabled unless a specific plugin requires them
**What to do about it:**
Upgrade to the latest supported PHP version (8.2 or 8.3 as of 2026)
If upgrading PHP breaks a plugin, that plugin is likely outdated and should be replaced
Disable display_errors in your php.ini or .htaccess
### Step 12: Monitor Activity Logs
If something goes wrong, activity logs tell you what happened, when, and who did it.
**What to check:**
Is activity logging enabled? If you don't have a logging plugin, you have no record of what happens on your site
Review recent logs for unusual activity: logins from unfamiliar IPs, bulk content changes, plugin installations you didn't authorize
Check for failed login attempts (a high number from the same IP indicates a brute force attack)
Look at user role changes and new account creations
**What to do about it:**
Install an activity logging plugin like [WP Activity Log](https://wordpress.org/plugins/wp-security-audit-log/ "nofollow") if you don't have one
Set up email alerts for critical events: admin logins, plugin installations, user role changes, and file modifications
Review logs at least weekly as part of your ongoing security routine
[](https://wordpress.org/plugins/wp-security-audit-log/ "nofollow")
## How Often Should You Audit?
Not every audit needs to be the full 12-step process.
| Frequency | What to Check |
|---|---|
| Weekly | Activity logs, backup status, update availability |
| Monthly | User accounts, login security, malware scan |
| Quarterly | Full 12-step audit |
| After any incident | Full 12-step audit plus forensic review |
The weekly and monthly checks take 10 to 15 minutes. The quarterly audit takes about an hour. That's a small investment to protect a site your business depends on.
## What to Do When You Find a Problem
Finding vulnerabilities is the point of the audit. Don't panic. Prioritize based on risk:
**Fix immediately:** Active malware, compromised accounts, world-writable files, expired SSL
**Fix this week:** Outdated plugins with known vulnerabilities, missing 2FA on admin accounts, no backup system
**Fix this month:** Missing security headers, default database prefix, unnecessary database privileges, outdated PHP
Document what you find and what you fix. This creates a record that makes future audits faster and helps you spot recurring issues.
## Wrapping Up
A WordPress security audit isn't about achieving perfection. It's about knowing where you stand and closing the gaps that matter most. The 12 steps in this checklist cover the areas where most WordPress sites are vulnerable, and you can work through them in an afternoon.
The key is making it a habit. Run the full checklist quarterly, do lighter checks weekly and monthly, and you'll catch problems before they become incidents. Your site, your customers, and your peace of mind are worth that hour.
---
## How to Secure Your WordPress Login Page: Beyond Basic Passwords
- URL: https://levamo.com/blog/secure-wordpress-login/
- Category: website-security
- Author: Shahzeb Ahmed
- Published: 2026-08-17
Lock down your WordPress login with 2FA, a custom URL, CAPTCHAs, and edge WAF.
You changed the default "admin" username. You picked a 20-character password with symbols and numbers. You feel pretty good about it.
Here's the problem: passwords alone stopped being enough a long time ago.
Credential stuffing attacks don't guess your password. They use passwords stolen from other breaches and try them across thousands of WordPress sites automatically. Phishing pages trick even security-conscious users into handing over credentials. And let's be honest, most teams have at least one person reusing the same password across multiple services.
Your WordPress login page is public by default. Every bot on the internet knows where to find it. So the question isn't whether your password is strong. It's what happens when someone gets past it.
This guide covers the practical layers you can add on top of strong passwords to make your WordPress login page genuinely hard to break into.
## Why Strong Passwords Aren't Enough Anymore
Let's be clear: you absolutely need strong, unique passwords. That's not up for debate. But treating passwords as your only line of defense is like locking your front door and leaving every window wide open.
Three things have changed the threat landscape:
**Credential stuffing is automated and massive.** Attackers take username/password pairs leaked from breaches at other companies and run them against WordPress login pages at scale. According to the [OWASP Foundation](https://owasp.org/ "nofollow"), credential stuffing is one of the most common attack vectors against web applications. If any team member reuses a password that appeared in a breach, your site is exposed.
**Phishing has gotten smarter.** Modern phishing pages look identical to legitimate login screens. Even users who know better can get tricked by a well-crafted email pointing to a convincing fake. Once someone enters their credentials on a phishing page, the password's strength is irrelevant.
**Team-based access multiplies risk.** A solo blogger controls one set of credentials. A WooCommerce store with five administrators, three editors, and a freelance developer has nine potential entry points. One weak link compromises the entire site.
The fix? Layer your defenses. No single measure is bulletproof, but stacking multiple protections makes unauthorized access exponentially harder.

## Add Two-Factor Authentication to WordPress
If you only do one thing from this entire guide, make it this.
[Two-factor authentication (2FA)](/blog/two-factor-authentication-2fa/) adds a second verification step after the password. Even if an attacker has valid credentials, they can't log in without access to the second factor (usually a six-digit code from an authenticator app on your phone).
**Authenticator apps over SMS.** Always choose app-based 2FA (Google Authenticator, [Authy](https://authy.com/ "nofollow"), or Microsoft Authenticator) over SMS codes. SIM-swapping attacks can intercept text messages, making SMS-based 2FA significantly less secure.
### Recommended 2FA Plugins
For your WordPress site itself, several plugins handle 2FA well:
**[WP 2FA](https://wordpress.org/plugins/wp-2fa/ "nofollow")** is purpose-built for two-factor authentication and supports authenticator apps, email codes, and backup codes. It also lets you set grace periods, so users aren't locked out the moment you enable 2FA.
[](https://wordpress.org/plugins/wp-2fa/ "nofollow")
**[Wordfence Login Security](https://wordpress.org/plugins/wordfence-login-security/ "nofollow")** is a free, lightweight module from the Wordfence team. It supports TOTP-based authenticator apps and recovery codes without requiring the full Wordfence firewall plugin.
[](https://wordpress.org/plugins/wordfence-login-security/ "nofollow")
**[miniOrange](https://wordpress.org/plugins/miniorange-2-factor-authentication/ "nofollow")** supports authenticator apps, push notifications, security questions, and hardware tokens. It's a good pick if your team needs flexibility in how they authenticate.
[](https://wordpress.org/plugins/miniorange-2-factor-authentication/ "nofollow")
All three are free for basic use and take under five minutes to set up.
### What About Your Hosting Dashboard?
Your hosting dashboard is just as critical as your WordPress login. If someone compromises your hosting account, they can access your database, files, and backups directly.
Levamo's dashboard supports authenticator-app 2FA with backup codes for recovery. It's TOTP-based (the same standard used by Google and Microsoft), so it works with any authenticator app you already use.
## Enforce 2FA Across Your Entire Team
Here's where most sites fall short. The admin enables 2FA for their own account and calls it done. Meanwhile, the editor with shop_manager access is still logging in with just a password.
Every account with backend access is an entry point. If your store manager, content editor, or freelance developer skips 2FA, that's an unlocked door into your site.
**What to look for in a 2FA plugin:**
Role-based enforcement (require 2FA for administrators and editors, optional for subscribers)
Grace periods that give users time to set up 2FA before being locked out
Backup code generation for account recovery
**On the hosting side,** Levamo's team admin enforcement lets account owners require 2FA for every team member on the hosting dashboard. No exceptions, no "I'll set it up later." If a team member hasn't enabled 2FA, the admin can see it on the team visibility dashboard and follow up. This matters especially for agencies managing multiple client sites from a single hosting account.
## Change Your Default Login URL
Every WordPress site uses /wp-admin/ and /wp-login.php by default. Every bot knows this. Changing your login URL doesn't make your site unhackable, but it does eliminate a huge volume of automated traffic hitting your login page.
Think of it as removing your house number from the mailbox. A determined attacker will still find you, but the casual ones move on.
**[WPS Hide Login](https://wordpress.org/plugins/wps-hide-login/ "nofollow")** is the most popular plugin for this. It's lightweight, requires zero configuration beyond choosing a new URL, and doesn't modify any core files.
[](https://wordpress.org/plugins/wps-hide-login/ "nofollow")
Pick something memorable but not obvious. Avoid patterns like /login, /admin-login, or /secret-admin because those are on every bot's dictionary list too.
**Important:** Bookmark your new login URL and share it with your team. If you forget it, you can disable the plugin via FTP or your hosting file manager to restore the default URL.
For a deeper look at how login URL changes fit into a broader brute force defense strategy, check out our [guide to brute force protection](/blog/wordpress-brute-force-protection/).
## Add a CAPTCHA to Your Login Form
CAPTCHAs add a challenge that's easy for humans and hard for bots. Placing one on your login page blocks automated login attempts before they even test a password.
**[Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/ "nofollow")** is the modern choice. It's free, privacy-focused, and often invisible to real users (no clicking fire hydrants). It verifies visitors in the background and only shows a challenge when something looks suspicious. Plugins like [Simple Cloudflare Turnstile](https://wordpress.org/plugins/simple-cloudflare-turnstile/ "nofollow") make integration straightforward.
[](https://wordpress.org/plugins/simple-cloudflare-turnstile/ "nofollow")
**[Google reCAPTCHA v3](https://www.google.com/recaptcha/about/ "nofollow")** works similarly, scoring visitors in the background and only challenging suspicious ones. Several security plugins bundle reCAPTCHA support, so you may already have access to it.
Place CAPTCHAs on your login page, registration page, and password reset form. Attackers target all three.
## Use HTTP Authentication as a Second Gate
This one's more technical, but it's extremely effective. HTTP authentication (sometimes called .htpasswd protection) adds a server-level username/password prompt before WordPress even loads.
Bots hitting your login page get a 401 Unauthorized response without triggering any PHP processing. This means zero server load from automated attacks, which is a significant benefit for resource-heavy sites like WooCommerce stores or membership platforms.
Your hosting control panel or file manager can usually set this up. You're adding a server-level credential check in front of wp-login.php, so attackers need to pass two authentication layers: the HTTP prompt and then the WordPress login form.
**Trade-off:** This adds friction for legitimate users, so it's best suited for sites where only a small internal team needs backend access. If you have hundreds of members logging in through a frontend form, this approach doesn't apply.
## Restrict Login Access by IP
If your team works from fixed locations (an office, a co-working space, or even consistent home IPs), you can restrict login page access to only those IP addresses.
This is done through .htaccess rules or your hosting's IP restriction tools. Anyone connecting from an unauthorized IP gets blocked before the login page even loads.
```apache
Order Deny,Allow
Deny from all
Allow from 203.0.113.50
Allow from 198.51.100.25
```
**When this works well:** Small teams with stable IPs, internal company sites, staging environments.
**When it doesn't work:** Remote teams with dynamic IPs, membership sites with user-facing logins, WooCommerce stores where customers access their accounts.
For most dynamic WordPress sites, the other measures in this guide are more practical. But for admin-only login pages on internal tools, IP restriction is nearly airtight.
## Monitor Login Activity
You can't protect what you can't see. Login activity monitoring shows you who's logging in, when, from where, and whether there have been failed attempts.
**[WP Activity Log](https://wordpress.org/plugins/wp-security-audit-log/ "nofollow")** records every login, logout, failed attempt, and session change. It also tracks user role changes and plugin activations, so you get a complete audit trail. For WooCommerce stores, it logs product and order changes too.
[](https://wordpress.org/plugins/wp-security-audit-log/ "nofollow")
**What to watch for:**
Multiple failed login attempts from the same IP (brute force in progress)
Successful logins from unfamiliar locations or IP addresses
Logins at unusual hours for your team
New administrator accounts you didn't create
Set up email alerts for critical events (new admin accounts, successful logins from new IPs) so you don't have to check the log manually.
## What Your Hosting Should Handle for You
Everything above happens at the WordPress level. But the most effective login protections happen before traffic ever reaches your server.
A hosting provider with proper edge-level security handles three things automatically:
**Web Application Firewall (WAF).** A WAF at the CDN edge evaluates every request before it reaches your origin server. Known attack patterns, malicious payloads, and suspicious request signatures get blocked at the network level. Your server never sees them.
**Rate limiting.** Legitimate users don't send 50 login requests per second. Edge-level rate limiting throttles high-frequency requests so brute force attempts get cut off before they can test more than a handful of passwords.
**Bot detection and blocking.** Sophisticated bot detection goes beyond simple rate limiting. It identifies automated traffic by behavior patterns, known malicious IPs, and request fingerprints, then blocks or challenges it.
Levamo includes [Enterprise Cloudflare](/cloudflare-cdn/) on every plan. That means WAF rules, DDoS protection, rate limiting, and bot management are active from day one, with no add-ons or extra configuration needed. Combined with server-level Monarx malware scanning, threats get caught at both the edge and the origin.
The practical impact: while you're configuring 2FA plugins and CAPTCHA settings inside WordPress, your hosting is already blocking the vast majority of malicious traffic before it gets anywhere near your login page.
## Wrapping Up
Securing your WordPress login page isn't about any single measure. It's about stacking layers so that no single failure (a leaked password, a phished credential, a lazy team member) gives an attacker a way in. Start with 2FA across every account, then work through the rest of this list based on what fits your site. The biggest mistake isn't picking the wrong plugin. It's assuming a strong password is enough and stopping there.
---
## Top 15 Best LMS Plugins for WordPress In 2026
- URL: https://levamo.com/blog/best-wordpress-lms-plugins/
- Category: lms
- Author: Shahzeb Ahmed
- Published: 2026-08-13
Find the best WordPress LMS plugin for your online courses in 2026.
Imagine this: You spend months ideating the perfect niche to launch your online course. You've poured countless hours into outlining, preparing, and finally publishing it. But once you launch, student engagement is abysmally low, and completion rates are close to zero. To make matters worse, the platform crashes just when it shouldn't.
You investigate and realize your platform lacks engagement tools that keep students interested, leading to low engagement and poor [course completion rates](/blog/maximize-course-completion-rates/).
This is a scenario you *don't* want to be in.
Fortunately, I've shortlisted these top 15 WordPress LMS plugins for you, and these can solve your problems effectively. The best LMS plugin for WordPress will give you robust engagement tools, seamless integration options, and scalable features that keep students interested and ensure [smooth performance, even during peak times](/managed-lms-hosting/). With features like quizzes, gamification, and progress tracking, you will also boost engagement and significantly improve course completion rates.
Without further ado, let’s dive in!
## Levamo's Choice of the **Top WordPress LMS Plugins**
## 1. LearnDash
[](https://www.learndash.com/ "nofollow")
[LearnDash](https://www.learndash.com/ "nofollow") is arguably the most powerful and reliable WordPress LMS plugin out there. It is popular with educational institutions and individual course creators alike because of its diverse feature set and scalability.
**Top Features**:
- **Flexible Course Creation:** The LearnDash drag-and-drop course builder makes the process of designing and managing courses very simple.
- **Advanced Quizzing Options:** LearnDash offers multiple quiz types and grading styles, making it easy to assess the student’s learning.
- **Seamless WordPress Integrations:** LearnDash can integrate with hundreds of WordPress plugins, making it easy to add new features to your course platform.
- **Gamification:** LearnDash offers gamification, such as badges, points, and leaderboards, to make the course more engaging for the students.
It does have a steep learning curve, and you’re also limited to built-in payment options. Secondly, you’re also dependent on add-ons for advanced functionality. However, these are not that big of an issue, and you can’t go wrong with the most popular WordPress LMS plugin to create your website.
**Price:**
- **LearnDash LMS** - Starts at $199/Year
- **LearnDash Cloud** - Starts at $25/Month
**Trustpilot Rating**:
4.3 out of 5 (81 Reviews)
## 2. Tutor LMS
[](https://tutorlms.com/ "nofollow")
[Tutor LMS](/blog/build-lms-website-with-tutor-lms/) brings a range of interactive course creation tools and an intuitive frontend student dashboard, making it user-friendly for both course creators and learners. It is one of the fastest-growing WordPress LMS plugins at the moment.
**Top Features**
- **Interactive Course Builder:** Drag-and-drop functionality simplifies course creation.
- **Quiz Customization:** Offers multiple quiz types and options like timers, point-based questions, and more.
- **Frontend Dashboard:** Students can manage their learning, track progress, and view achievements from a single dashboard.
- **Monetization Options:** Supports multiple payment gateways and WooCommerce integration for easy course sales.
Tutor LMS is as robust as it gets. However, most advanced options are only limited to the Pro version. It also has very limited integrations with third-party tools outside of WordPress. This might make it hard for the users to connect to external CRM or marketing tools. Despite this, we must say, overall, Tutor LMS is one of the best LMS for WordPress.
**Price:** Starts at $199
**Trustpilot Rating:**
4.6 out of 5 (244 Reviews)
## 3. Learnomy

[Learnomy](https://learnomy.app/ "nofollow") is a newer WordPress LMS plugin, but it ships with a feature set that undercuts what most of the plugins above charge extra for. Course building, an eleven-question-type quiz engine, certificates, and a full instructor marketplace with automatic Stripe Connect payouts all live in the free version, no add-on required.
**Top Features**
**Exam-Grade Quiz Engine:** Six question types free (multiple choice, true/false, short answer, fill-in-the-blank, essay), five more with Pro (matching, ordering, numeric, math, calculated), across five player layouts including a sectioned exam board with a question map.
**Instructor Marketplace:** Teachers apply, get their own dashboard, and get paid automatically through Stripe Connect, so payday runs itself instead of requiring manual payout tracking.
**Direct Checkout, Zero Platform Cut:** Native Stripe and PayPal checkout plus a WooCommerce adapter, memberships with recurring billing and free trials, and the money goes straight to the school owner's account.
**Built to Stay Fast:** Normalized custom database tables (not serialized post meta) and the WordPress Interactivity API for navigation, so performance holds up whether a school has 50 students or 50,000.
Since it's newer to the market, Learnomy doesn't have the years of plugin-directory reviews that LearnDash or LifterLMS have built up, and it's distributed from the Wbcom Designs store rather than WordPress.org, so it's a direct-download install rather than a WordPress.org search-and-install. But for course creators who'd otherwise be stacking three or four paid add-ons onto another LMS to get essay grading, an instructor marketplace, and SCORM/xAPI/LTI support, Learnomy ships all of it in the free core.
**Price:** Starts at $104/year (Personal, 1 site) or $279 lifetime
**Trustpilot Rating:** 4.8 out of 5 (94 reviews)
## 4. LifterLMS
[](https://lifterlms.com/ "nofollow")
[LifterLMS](https://lifterlms.com/ "nofollow") is another highly popular WordPress learning management system, renowned for all its good qualities. Its close integration with membership and eCommerce tools makes it an ideal choice for regular course creators and online businesses who want to start a course website. LifterLMS allows course creators and businesses to create a structured learning path, as well as offers features that keep students engaged.
**Top Features**
- **Integrated Membership Options:** Allows you to sell memberships, which is ideal for layered access and recurring revenue.
- **eCommerce Capabilities:** Supports payment gateways, course bundles, and subscription-based pricing.
- **Personalized Learning Paths:** Achievement badges, certificates, and gamified elements keep learners engaged.
- **Progress Tracking:** Advanced reporting and metrics to monitor student engagement.
LifterLMS needs add-ons for certain essential features. This includes the advanced quizzes and specific integrations, which can increase the overall cost as time goes on. However, despite that fact, it remains a value-for-money product.
**Price:** Starts at $149.50/year
**Trustpilot Rating:**
4.3 out of 5 (21 Reviews)
## 5. MasterStudy
[](https://stylemixthemes.com/wordpress-lms-plugin/ "nofollow")
[MasterStudy LMS](https://stylemixthemes.com/wordpress-lms-plugin/ "nofollow") is a flexible WordPress course plugin that offers a comprehensive set of tools for creating and managing courses. It is perfect for professional training, certification, and skill development. It offers features that enable instructors to deliver engaging and interactive lessons, along with robust customization options to cater to various audiences.
**Top Features**
- **Interactive Lessons:** Supports multimedia content, including video, quizzes, and assignments, to create an engaging learning experience.
- **Certification and Badging:** Awards completion certificates and badges, making it ideal for skills-based and professional courses.
- **Customizable Enrollment Options:** Offers multiple options, including free, paid, and subscription-based access, to suit different course structures.
- **Student Communication Tools:** Includes real-time messaging to enable direct communication between students and instructors.
While MasterStudy is great on paper, some users reported a dip in performance, particularly when the courses are rich in media. Also, their support can be faster, especially when compared to the WordPress LMS plugins we mentioned above. Nevertheless, MasterStudy LMS provides great value considering the price point.
**Price:** Starts at $99/year
**WordPress.org Rating:** 4.5 out of 5 (389 reviews)
## 6. Sensei LMS
[](https://senseilms.com/ "nofollow")
[Sensei LMS](https://senseilms.com/ "nofollow") is not the most feature-rich LMS plugin for WordPress, but it is a budget-friendly choice. It is a great choice for course creators who require robust eCommerce features without the hassle of complicated setups.
**Top Features**
- **Native WooCommerce Integration:** Allows you to sell courses seamlessly through WooCommerce’s powerful eCommerce tools.
- **Content Dripping:** This lets you control the release of content over time to keep students engaged.
- **Flexible Quiz Builder:** Provides multiple question types, making it easy to assess learner understanding.
- **Student Management Tools:** Allows for tracking and analyzing student progress to improve learning outcomes.
However, Sensei LMS doesn't offer some of the advanced engagement features that other WordPress LMS plugins provide. Plus, it depends significantly on WooCommerce for monetization, which could complicate things for certain users. Nevertheless, for those seeking an affordable and straightforward solution that works well with WooCommerce, Sensei LMS is still a sensible and affordable option.
**Price:** Starts at $60/year
**WordPress.org Rating:** 3.7 out of 5 (35 Reviews)
## 7. LearnPress
[](https://learnpresslms.com/ "nofollow")
[LearnPress](https://learnpresslms.com/ "nofollow") is another affordable WordPress LMS plugin that provides essential tools for course creation at no cost, along with optional premium add-ons. Its modular design enables users to select additional features, making it highly customizable and budget-friendly. This also makes it particularly ideal for individuals seeking a straightforward, entry-level LMS that still offers key functionalities.
**Top Features**
- **Core LMS Features for Free:** Provides basic course creation, quizzes, and assignment tools at no cost.
- **Add-On Marketplace: This offers** optional paid add-ons so you can purchase only the features you need.
- **Customizable User Interface:** Adaptable layout options make it easy to align with your site’s branding.
- **Multi-Instructor Support:** Allows multiple instructors to collaborate on course creation and management.
LearnPress’s free version has some limitations in functionality, which forces you to buy the premium add-ons. But even the add-ons are comparatively affordable. Furthermore, the support and documentation may not be as comprehensive as what you find with some of the top WordPress LMS plugins, which could pose difficulties for newcomers. But it is still a favorite to many people due to its modular nature.
**Price:** Starts at $149/year
**WordPress.org Rating:** 2.5 out of 5 (8 Reviews)
## 8. WP Courseware
[](https://flyplugins.com/wp-courseware-wordpress-lms/ "nofollow")
[WP Courseware](https://flyplugins.com/wp-courseware-wordpress-lms/ "nofollow") is a well-regarded WordPress learning management system tailored for developing organized, sequential courses, making it an excellent choice for educational institutions and corporate training programs. With its user-friendly drag-and-drop course builder, WP Courseware is accessible for beginners while also providing advanced features for users who require greater control over course delivery.
**Top Features**
- **Drag-and-Drop Course Builder**: Streamlines course creation with an easy, code-free design tool.
- **Drip Content Scheduling**: Allows for gradual content release based on schedules you set.
- **Customizable Certificates**: Offers the ability to award branded certificates upon course completion.
- **Payment Gateway Integration**: Supports PayPal and Stripe, allowing seamless payment collection for monetized courses.
WP Courseware is mainly designed for sequential courses, which might restrict the creativity of the tutors who want to adopt more flexible course layouts. Furthermore, the interface of the plugin can seem a bit outdated when compared to other LMS plugins. Nevertheless, it is still a solid option for educational institutions and training programs where linear course structures are the way to go.
**Price:** Starts at 0
**Capterra Rating:** 4.5 out of 5 (21 Reviews)
## 9. Masteriyo LMS

[Masteriyo](https://masteriyo.com/?utm_source=levamo.com&utm_medium=blog&utm_campaign=outreach "nofollow") brings a fresh new approach to LMS for creators seeking a modern solution without the steep learning curve of other traditional plugins. It simplifies course creation and monetization process while ensuring seamless learning experience for enrolled users.
**Top Features**
**Interactive Lessons:** Native drag-and-drop course builder supports 7+ lesson types ranging from self-paced vidoes to live sessions
**Student Engagement Tools:** Keep students engaged with Content Drip, Quizzes, Assignment, and Certificates with QR validation tool.
**Community-driven development:** Masteriyo’s active community contributes feedback, influencing new features and updates.
**Masteriyo delivers:** an accessible and easy-to-use solution for creating, managing, and selling online courses. Its simplicity doesn’t compromise on the essential tools needed for a fully functional and engaging LMS, making it an excellent choice for creators at any level.
**Price:** [Starts at $99.00/year](https://masteriyo.com/?utm_source=levamo.com&utm_medium=blog&utm_campaign=outreach "nofollow")
G2
**Rating:** 4.7/5 (12 Reviews)
**WordPress.org Rating:** 4.8/5 (140+ Reviews)
## Top SaaS LMS Tools
While the above plugins were pure LMS plugins, aimed at users who want to build a learning platform, we've also shortlisted some of the top SaaS LMS systems.
## 10. Kajabi
[](https://kajabi.com/ "nofollow")
[Kajabi](https://kajabi.com/ "nofollow") is a top-tier, all-in-one SaaS LMS platform designed for professional course creators and businesses seeking advanced marketing features. Renowned for its extensive range of tools, Kajabi facilitates not just course delivery but also effective marketing, email campaigns, and sales funnel automation. It’s an ideal solution for businesses looking for a comprehensive resource for digital product creation and marketing.
**Top Features**
- **Email Marketing and Pipelines:** Includes sophisticated tools for building automated email campaigns and marketing pipelines.
- **Website Builder:** Provides a fully hosted solution with a website builder for a branded, professional online presence.
- **Comprehensive Analytics:** Tracks detailed metrics for both course performance and marketing efforts to optimize strategies.
- **Community Features:** Offers options to build communities, including discussion boards and forums, for fostering student interaction.
Kajabi’s all-in-one model does come with a higher price tag, and it might hurt the pockets of individual creators or startups. However, I can assure you that the comprehensive set of features and user-friendly interface that Kajabi offers make it a worthwhile investment.
**Price:** [Currently running an offer of $99 for 3 months](https://kajabi.com/pricing "nofollow")
**Trustpilot Rating:** 4.3 out of 5 (1,944 reviews)
## 11. Thinkific
[](https://www.thinkific.com/ "nofollow")
[Thinkific](https://www.thinkific.com/ "nofollow") is another comprehensive SaaS LMS platform that integrates course-building tools with marketing features to enhance course visibility. Renowned for its user-friendliness, Thinkific is perfect for both businesses and individuals looking to create polished courses without requiring coding skills or complicated setups. It’s particularly favored by those who appreciate a branded course experience along with versatile sales and marketing options.
**Top Features**
- **Landing Page Builder:** Includes a drag-and-drop builder for creating high-converting course landing pages.
- **Customizable Course Templates:** Offers pre-made templates that simplify course creation and branding.
- **Built-in Marketing Tools:** Supports email marketing, discount codes, and promotional tools to attract students.
- **Course Bundling and Upsells:** This lets you increase revenue with options to bundle courses and offer upsells during checkout.
Most of Thinkific’s advanced marketing tools are only available in higher-tier plans, which can raise costs for users seeking complete functionality. Nevertheless, Thinkific's combination of user-friendliness and scalability continues to make it a great option.
**Price:** Starts at 0
**Trustpilot Rating:** 3.4 out of 5 (809 reviews)
## 12. Teachable
[](https://teachable.com/ "nofollow")
[Teachable](https://teachable.com/ "nofollow") is a popular SaaS-based learning management system that gives you an easy way to create an education website. It's tailored for individuals who want to concentrate on creating content and building their audience without the need for technical expertise. Teachable offers strong student management features, various monetization options, and a clean, intuitive dashboard for overseeing courses and students.
**Top Features**
- **Sales and Checkout Pages:** Optimized checkout and sales pages are designed to increase course conversions and revenue.
- **Integrated Payment Processing:** Simplifies transactions with built-in payment options, including automatic tax calculation.
- **Student Management:** Offers insights and analytics to track student progress and engagement levels.
- **Mobile App Support:** Allows students to access courses and content seamlessly via mobile devices, enhancing flexibility.
Teachable can be a bit expensive compared to other SaaS LMS systems in terms of the features it offers. On top of that, it charges transaction fees on its lower-tier plans, which can eat into profits for those just starting out. So, it's not the best choice when it comes to affordable SaaS LMS pricing. However, Teachable’s seamless setup and easy student management features continue to make it an accessible platform for many.
**Price:** Starts at $59/month
**Trustpilot Rating:** 3.1 out of 5 (693 reviews)
## 13. WP Courses

[WP Courses](https://wpcoursesplugin.com/ "nofollow") is a simple but effective WordPress LMS plugin that is all about course delivery and ease of use. This is for educators, personal coaches, and solopreneurs who want to publish course material quickly without being overwhelmed by too many options. WP Courses plugs into your existing WordPress theme and lets you publish lessons with videos, images, or downloadable resources.
No coding experience is necessary to use WP Courses, and the learning curve is low. While not as deep as some of the enterprise-level LMS tools, it covers all the bases needed to run a functional online course platform.
**Top Features**
- **Course Builder with Drag & Drop interface:** You can create courses & lessons quickly & easily.
- **Rich multimedia integration:** It allows embedding YouTube, Vimeo, PDFs, images, and other file types directly into lessons.
- **Progress tracking:** Students can see their progress at a glance.
- **WooCommerce Integration:** Adding subscriptions, bundles, or one-time purchases to courses via WooCommerce is easy.
Overall, WP Courses lack advanced features and do not have as many integrations as top tools, but it is lightweight and easy to use. We recommend trying this if you want a quick setup with solid core features and a clean experience.
**Price**: Free, Paid plans start at $99.
**WordPress Rating**: 4.9 out of 5 (23 Reviews)
## 14. MemberPress

[MemberPress](https://memberpress.com/ "nofollow") is one of the most robust membership plugins for WordPress, but many don't know that it can also be a powerful LMS when combined with its Courses add-on. It offers a visual course builder that works perfectly with MemberPress. You can lock content behind paywalls, create tiered memberships, and offer courses to different audience segments with one plugin.
This combination of both [memberpress review](/blog/memberpress-review/) and course tools is great for entrepreneurs, coaches, and businesses who wish to sell courses as recurring memberships or one-time access. The visual course builder does the easy wor,k while MemberPress handles the back-end automation and access control.
**Top Features**
- **Integral Course Builder:** With the Courses add-on, you can create structured lessons by dragging and dropping.
- **Advanced Access Control:** Establish complicated membership rules that display different content to different user groups.
- **Drip Content Scheduling:** Release lessons over time to keep learners interested.
- **Subscription & Payment Tools:** Accept recurring payments and coupons and manage subscriptions via Stripe, PayPal, and offline payments.
- **Analytics and Reporting:** Monitor user progress, membership stats, and revenue stats from your dashboard.
Though great at combining LMS and membership functionality, MemberPress won't cut it for users who want bespoke quizzes, native certification, and more gamification. And as part of a broader membership system, the LMS features may feel limited to institutions solely focused on education. Yet, this all-in-one plugin is a steal for business creators.
**Price**: Starts at $179.50/year
**Trustpilot Rating**: 4.4 out of 5 (316 Reviews)
## 15. Academy LMS

[Academy LMS](https://academylms.net/ "nofollow") is among the newest entries in the WordPress LMS space, It's a fresh take on online education. Made for creators in mind, Academy LMS has an intuitive user interface, powerful lesson-building tools, and mobile responsiveness.
Support for quizzes, certificates, student dashboards & instructor collaboration means that Academy LMS is perfect for course creators of all levels. And it ships with a block-based editor that works natively with Gutenberg, so you can build custom course layouts without any extra page builders.
**Top Features**
- **Sleek Modern UI:** Beautiful course layouts and clean dashboards improve learning for students and instructors.
- **Full Course Builder:** Build structured courses with lessons, quizzes, and assessments from your WordPress dashboard.
- **Modern Dashboard:** Separate, customizable views for student and instructor dashboards.
- **Certificates & Quizzes:** Easy to award completion certificates and design assessments to evaluate students.
- **Instructional Collaboration:** Lets several instructors create, manage, and contribute to the same course.
Although Academy LMS still lacks some third-party integrations and advanced automation tools found in more mature platforms, the core offering is polished. It works best for creators who value visual design and usability.
**Price**: Free, premium starts at $69/year.
**Trustpilot Rating**: 4.9 out of 5 (86 Reviews)
### Bonus: MoodleCloud
Now let’s share a special mention: [MoodleCloud](https://www.moodlecloud.com/ "nofollow"). It is the cloud-based version of Moodle, the highly popular open-source learning management system for educational institutions. Renowned for its flexibility and extensive range of plugins, MoodleCloud can be tailored to meet diverse educational requirements, providing tools for both individual and group learning.
**Top Features**
- **Highly Customizable**: Access to extensive plugins for creating tailored learning experiences.
- **Collaborative Learning Tools**: Supports forums, chats, and group assignments, ideal for interactive learning.
- **Mobile-Ready**: Fully responsive design, along with dedicated mobile apps for on-the-go learning.
- **Comprehensive Reporting**: Provides detailed tracking of learner performance and engagement.
Moodle is more common as an LMS option for educational institutions, as is its twin MoodleCloud. Perhaps that’s why the interface can be quite complex for newcomers. Especially for those who are not well-versed in Moodle’s wide array of features. However, its flexibility and open-source foundation make MoodleCloud a strong option for academic settings.
**Price**: Starts at 0
**Capterra Rating**: 4.3 out of 5 (3322 Reviews)
## Tips to Choose the Right LMS Platform
You and I both know there is no one-size-fits-all LMS solution out there. So, before wrapping up the article, let’s share the key things that you should consider when picking the right LMS tool for your website.
- **Technical Requirements and Budget Constraints**: You should decide whether you need a WordPress or SaaS LMS based on your technical expertise and budget. SaaS platforms typically demand more expertise, ongoing maintenance, and hosting costs, while WordPress LMS plugins are generally simpler to set up and manage.
- **Scalability**: As your courses and user base expand, it's crucial that the LMS you select can accommodate increased traffic without sacrificing performance.
- **Pricing Models and Total Cost of Ownership**: LMS pricing can vary significantly, ranging from free options with paid features to premium all-inclusive subscriptions. Be sure to consider both initial and ongoing expenses, including any additional tools or features you might need.
- **Course Engagement and Interactivity Features**: To enhance the student experience and encourage course completion, prioritize engagement tools such as quizzes, forums, certificates, and gamification features. Platforms that offer a range of interactive options can significantly improve student engagement and retention.
- **Integrations with Marketing and CRM Tools**: Integrating your LMS with email marketing tools, CRM systems, and payment gateways can help you streamline operations and manage customer relationships effectively. So, make sure it is able to integrate with these tools.
## Take Your Pick of the Top LMS Plugins
Picking an LMS platform is a long-term decision for growth and scalability. Depending on your budget and required features, choosing the perfect one is often hard. That is where this blog comes in to help you make the decision easily. Let me know which WordPress LMS software you like the most in the comment section below.
Once you decide on the LMS plugin, the next most important thing is to pair it with reliable hosting. **Levamo Hosting** offers high-performance [LMS hosting](/managed-lms-hosting/) tailored for content-rich sites, ensuring your courses load fast and perform smoothly, even during peak times.
With the right LMS and [Levamo's powerful hosting](https://www.trustpilot.com/review/rapyd.cloud? "nofollow"), you’ll be well-equipped to deliver a top-tier learning experience that supports your business’s growth.
---
## How to Protect Your WordPress Site From Brute Force Attacks
- URL: https://levamo.com/blog/wordpress-brute-force-protection/
- Category: website-security
- Author: Shahzeb Ahmed
- Published: 2026-08-12
Stop WordPress brute force attacks with edge WAF, rate limiting, and 2FA.
Your WordPress login page is public by default. Every WordPress site on the internet has a predictable login URL. And automated tools can throw thousands of password combinations at that URL every hour without breaking a sweat.
That's the brute force problem in three sentences.
A brute force attack isn't sophisticated. There's no exploit code, no zero-day vulnerability, no clever social engineering. It's raw repetition: an automated script tries username-password combinations against your login form until one works. The approach is blunt, persistent, and surprisingly effective when sites don't have the right defenses in place.
According to Cloudflare's application security reports, credential stuffing and brute force attacks remain among the most common threats targeting web applications globally. WordPress sites are disproportionately targeted because of their market share and predictable login structure.
The good news? Brute force attacks are also one of the easiest threats to neutralize, if you layer your defenses correctly. This guide covers what brute force attacks look like, why WordPress is a favorite target, and exactly how to shut them down.
## How Brute Force Attacks Actually Work
At its simplest, a brute force attack is an automated guessing game. An attacker points a script at your login page and feeds it a list of usernames and passwords. The script submits login attempts one after another, hundreds or thousands per minute, until it hits a valid combination or gives up.
But modern brute force attacks are more nuanced than just random guessing. Here are the main variants:
**Simple brute force:** The script cycles through every possible character combination. This is the least efficient method and mostly targets weak passwords like "123456" or "password." It sounds primitive, but it still works because people still use those passwords.
**Dictionary attacks:** Instead of trying every character combination, the script uses a pre-compiled list of common passwords, leaked credentials, and popular word combinations. These lists are publicly available and contain millions of entries drawn from past data breaches.
**Credential stuffing:** The attacker uses username-password pairs stolen from breaches on other sites. If someone reused their Netflix password on their WordPress admin account, they're a sitting duck. The Verizon Data Breach Investigations Report consistently finds that stolen credentials are involved in a significant percentage of web application breaches.
**Reverse brute force:** Instead of trying many passwords against one account, the attacker picks one common password (like "admin123") and tries it against thousands of different usernames. This approach is harder to detect because each individual account only sees one failed attempt.
### The Two Entry Points Attackers Target
WordPress has two primary endpoints that accept authentication:
**wp-login.php:** Your standard login page. Every WordPress site serves it at the same URL by default. Bots know exactly where to find it, and it accepts unlimited login attempts unless you've configured something to stop them.
**xmlrpc.php:** This is the one most site owners overlook. XML-RPC is a legacy API that WordPress originally used for remote publishing (think: blogging from your phone back in 2008). The system.multicall method lets an attacker bundle hundreds of login attempts into a single HTTP request. That means rate limiting based on "one attempt per request" doesn't catch it. One XML-RPC request can test 500 passwords at once.
If you're not actively using XML-RPC (and unless you're using the WordPress mobile app or Jetpack's older features, you're probably not), it's an attack surface you can close entirely.
## Why WordPress Sites Are Disproportionately Targeted
WordPress runs roughly 40% of the web. That alone makes it the highest-value target for automated attack tools. But there's more to it:
**Predictable login URLs.** Every default WordPress installation serves its login form at /wp-login.php and its admin dashboard at /wp-admin/. Attackers don't need to discover where to send login attempts.
**The "admin" username legacy.** Older WordPress installations defaulted to "admin" as the primary username. Millions of sites still use it. Attackers know this, so "admin" is always the first username in their list.
**Plugin and theme vulnerabilities create footholds.** A successful brute force isn't always the end goal. Sometimes attackers use brute-forced credentials to install backdoors, inject SEO spam, or pivot to attacking other sites on the same server. The admin access is just the entry point.
**Low-cost, high-volume economics.** Running a brute force campaign costs an attacker almost nothing. Botnets, rented cloud instances, and free credential lists make it trivial to launch thousands of attacks simultaneously. Even a 0.1% success rate is profitable when you're targeting millions of sites.
## Signs Your Site May Be Under Attack
Brute force attacks aren't always obvious, especially if they're slow and distributed. But here are the indicators to watch for:
**Sudden spikes in server resource usage.** If your CPU and memory usage jumps without a corresponding increase in legitimate traffic, it could be bots hammering your login page.
**Slow page loads for legitimate visitors.** Each brute force login attempt consumes PHP workers, database queries, and server memory. A sustained attack can starve your actual visitors of resources, especially on sites running WooCommerce or membership plugins where every PHP worker matters.
**Failed login notifications flooding your inbox.** If you have a security plugin that sends email alerts on failed logins, a sudden flood of these is a clear signal.
**Unfamiliar IP addresses in your access logs.** Look for clusters of POST requests to wp-login.php or xmlrpc.php from IP ranges you don't recognize.
**Your hosting provider contacts you.** Some hosts will notice unusual traffic patterns and flag them. If your host tells you they're seeing abnormal login traffic, take it seriously.
## The Multi-Layer Defense Strategy
Here's the thing most brute force guides get wrong: they treat it as a single problem with a single solution. Install a plugin. Change your login URL. Done.
In reality, effective brute force protection works in layers. Each layer catches what the previous one might miss, and together they make a successful attack nearly impossible.

### Layer 1: Block Attacks at the Edge (Before They Reach Your Server)
This is the most important layer, and it's the one most WordPress sites don't have.
Every login attempt that reaches your server consumes resources. PHP has to boot, WordPress has to load, the database has to be queried to check credentials. Even failed attempts cost you CPU, memory, and PHP workers. During a sustained brute force campaign, those costs add up fast.
A Web Application Firewall (WAF) that operates at the CDN edge solves this problem at the source. It evaluates incoming requests at the network level, before they ever reach your origin server. Known attack patterns, malicious IPs, and high-velocity login attempts get blocked at one of hundreds of global edge nodes. Your server never processes the request. PHP never boots. WordPress never loads.
This is the difference between your server fighting off an attack and your server not even knowing there was one.
On Levamo, Enterprise Cloudflare is included on every plan. That means WAF protection, bot mitigation, and rate limiting run at the edge across 300+ global locations. There's no extra charge and no configuration required on your part. Brute force attempts get filtered before they consume a single PHP worker on your server.
For a deeper look at how edge-level WAF protection works, check out our guide on [Cloudflare WAF for WordPress](/blog/enterprise-cloudflare-cdn/).
### Layer 2: Rate Limiting Login Attempts
Even with a WAF in place, you want rate limiting as a second line of defense. Rate limiting caps how many login attempts a single IP address (or IP range) can make within a given time window.
**At the edge level:** Cloudflare's rate limiting can detect and throttle high-frequency requests to wp-login.php before they hit your server. This catches attackers who try to slip under the WAF's pattern-matching by slowing their attempts down.
**At the application level:** WordPress plugins like [Limit Login Attempts Reloaded](https://wordpress.org/plugins/limit-login-attempts-reloaded/ "nofollow") or the login protection built into [Wordfence](https://wordpress.org/plugins/wordfence/ "nofollow") can enforce per-IP lockouts after a set number of failed attempts. A common configuration is: lock out an IP for 20 minutes after 5 failed attempts, then increase the lockout duration for repeat offenders.
[](https://wordpress.org/plugins/limit-login-attempts-reloaded/ "nofollow")
[](https://wordpress.org/plugins/wordfence/ "nofollow")
The edge-level approach is always better because it prevents resource consumption. But application-level rate limiting catches anything that makes it through, so running both is ideal.
### Layer 3: Two-Factor Authentication (2FA)
Rate limiting slows down brute force attempts. 2FA makes them pointless.
Even if an attacker guesses your password (or obtains it from a data breach), they can't log in without the second factor. With authenticator-app-based 2FA, that second factor is a time-based code generated on your phone. The code changes every 30 seconds, and the attacker would need physical access to your device to get it.
This is why [2FA](/blog/two-factor-authentication-2fa/) is considered the single most effective defense against credential-based attacks. It doesn't just make brute force harder. It makes a successful password guess worthless.
A few important details on 2FA for WordPress:
**Use authenticator apps, not SMS.** SMS-based 2FA is vulnerable to SIM swapping attacks, where an attacker convinces your carrier to transfer your phone number to their SIM card. Authenticator apps (Google Authenticator, [Authy](https://authy.com/ "nofollow"), [1Password](https://1password.com/ "nofollow")) generate codes locally on your device and aren't tied to your phone number.
**Enforce it for all admin users, not just yourself.** The weakest link in your security is the team member who hasn't enabled 2FA. If you're running a membership site or WooCommerce store with multiple administrators, you need a way to require 2FA across the board.
On Levamo, the hosting dashboard supports authenticator-app 2FA with team-admin enforcement. That means account owners can require every team member to enable 2FA before they can access the hosting panel. This isn't just good security practice; it also supports PCI DSS 4.0.1 compliance requirements for multi-factor authentication, which matters if you're processing payments.
For WordPress itself, plugins like [WP 2FA](https://wordpress.org/plugins/wp-2fa/ "nofollow"), [Two-Factor](https://wordpress.org/plugins/two-factor/ "nofollow"), or [Wordfence Login Security](https://wordpress.org/plugins/wordfence-login-security/ "nofollow") add 2FA to your wp-login.php page. Most support authenticator apps and can enforce 2FA for specific user roles.
[](https://wordpress.org/plugins/wp-2fa/ "nofollow")
### Layer 4: Disable XML-RPC (If You Don't Need It)
As mentioned earlier, xmlrpc.php is a backdoor for brute force attacks that most site owners don't know exists. The system.multicall method lets attackers test hundreds of credentials in a single request, bypassing per-request rate limiting.
If you're not using XML-RPC (and most modern WordPress setups don't need it since the REST API replaced its functionality), you should block it.
**Option 1: Block at the server level.** For Apache servers, add this to your .htaccess file:
```apache
Order Deny,Allow
Deny from all
```
For Nginx:
```nginx
location = /xmlrpc.php {
deny all;
return 403;
}
```
**Option 2: Block at the edge.** If your site is behind Cloudflare (or any CDN with WAF rules), you can create a rule that blocks all requests to xmlrpc.php. This is the preferred approach because the request never reaches your server.
**Option 3: Use a plugin.** Plugins like [Disable XML-RPC](https://wordpress.org/plugins/disable-xml-rpc/ "nofollow") or the security settings in Wordfence can disable XML-RPC with a single toggle.
[](https://wordpress.org/plugins/disable-xml-rpc/ "nofollow")
One caveat: if you use [Jetpack](https://jetpack.com/ "nofollow"), the WordPress mobile app, or any tool that relies on XML-RPC for remote publishing, disabling it will break those features. Check first, then disable.
### Layer 5: Password and Username Hardening
This is the foundation layer. No amount of WAF protection or rate limiting matters if your admin password is "password123."
**Use strong, unique passwords.** A strong password is at least 16 characters, includes a mix of uppercase, lowercase, numbers, and symbols, and isn't reused anywhere else. Use a password manager (1Password, [Bitwarden](https://bitwarden.com/ "nofollow"), or the browser's built-in one) to generate and store passwords. You shouldn't know your own WordPress password by heart, because if it's memorable, it's probably guessable.
**Never use "admin" as a username.** If your site still has an "admin" user, create a new administrator account with a unique username, transfer all content to it, then delete the old "admin" account. Attackers try "admin" first because they know it works on millions of sites.
**Remove unused admin accounts.** Every administrator account is a potential target. If a team member leaves or a developer's temporary account is no longer needed, remove it. Fewer admin accounts means fewer attack surfaces.
### Layer 6: Change the Default Login URL (Optional but Useful)
Changing your login URL from /wp-login.php to something custom (like /my-secret-login) doesn't stop a determined attacker, but it does eliminate the bulk of automated bot traffic that targets the default URL.
Plugins like [WPS Hide Login](https://wordpress.org/plugins/wps-hide-login/ "nofollow") let you change the login URL with a single setting. It's security through obscurity, which means it should never be your only defense. But as an additional layer on top of everything above, it meaningfully reduces the volume of junk requests your other defenses have to process.
[](https://wordpress.org/plugins/wps-hide-login/ "nofollow")
## What Most Guides Miss: The Server Resource Problem
Here's something most brute force protection articles don't talk about: even blocked attacks cost you resources if they're blocked at the wrong level.
When a brute force bot hits your login page and your WordPress security plugin blocks it, here's what happened before the block:
1. The HTTP request traveled across the internet to your server
2. Your server accepted the TCP connection
3. PHP booted up
4. WordPress loaded (core files, active plugins, active theme)
5. The security plugin initialized
6. The plugin checked the request against its rules
7. The plugin returned a 403 (blocked)
That's a lot of server resources spent on a request you never wanted. Now multiply that by 10,000 attempts per hour during an active campaign. Your legitimate visitors, the people trying to buy products, access their course, or log into their membership, are competing with bots for the same PHP workers and database connections.
This is why Layer 1 (edge-level WAF) isn't just the first defense. It's the one that protects your site's performance, not just its security.
On Levamo, because Cloudflare's WAF sits in front of your server, brute force traffic is absorbed at the edge. Your LiteSpeed server, your PHP workers, your KeyDB/Redis object cache, and your MariaDB database stay focused on your actual visitors. It's the difference between your store's checkout flow stuttering during an attack and your visitors not noticing anything at all.
This matters most for sites running dynamic, logged-in workloads: WooCommerce stores processing orders, membership platforms serving gated content, LMS sites delivering courses. These applications need every PHP worker they can get. An edge-level WAF ensures bots don't steal them.
## A Quick Brute Force Protection Checklist
Here's a summary you can reference when hardening your site:
| Defense Layer | What It Does | Where It Runs |
|---|---|---|
| Edge WAF (Cloudflare) | Blocks known attack patterns before they reach your server | CDN edge (300+ locations) |
| Rate limiting | Caps login attempts per IP within a time window | Edge + application level |
| Two-factor authentication | Makes guessed passwords useless without a second factor | WordPress login + hosting dashboard |
| Disable XML-RPC | Closes the system.multicall backdoor for bulk credential testing | Server config or edge rule |
| Strong passwords | Eliminates dictionary attacks and common password guessing | User behavior + password manager |
| Unique usernames | Removes the default "admin" target | WordPress user management |
| Custom login URL (optional) | Reduces automated bot traffic to login page | WordPress plugin |
No single layer is bulletproof. The combination is what makes brute force attacks a non-issue.
## Wrapping Up
Brute force attacks are common, persistent, and entirely preventable. The key is layering your defenses so each one catches what the previous might miss: edge-level filtering absorbs the bulk of attack traffic before it touches your server, rate limiting throttles what slips through, 2FA renders stolen passwords useless, and basic hygiene (strong passwords, no "admin" username, disabled XML-RPC) eliminates the easy wins attackers rely on.
The biggest mistake site owners make isn't ignoring brute force protection entirely. It's relying on a single plugin that processes every malicious request at the application level, burning server resources in the process. The goal isn't just to block attacks. It's to block them efficiently, in a way that doesn't degrade performance for your actual visitors.
For a broader overview of WordPress security beyond brute force, check out our [WordPress security best practices guide](/blog/best-wordpress-security-plugins/).
---
## You Can Now Manage Your WordPress Site with AI: WPVibe Is Live on Levamo
- URL: https://levamo.com/blog/manage-your-wordpress-site-with-ai-wpvibe/
- Category: news
- Author: The Levamo Team
- Published: 2026-08-11
Connect ChatGPT, Claude, or Cursor to your WordPress site and manage it by chatting.
There's a new tab in your Levamo dashboard today: **AI Management**. Connect a site once, and the AI assistant you already use, whether that's ChatGPT, Claude, or Cursor, can create, update, and understand your WordPress site through a simple conversation.
No new dashboard to learn, nothing to install yourself, no passwords to copy out of wp-admin. You say what you want in plain English, and the work lands on your site.
Under the hood, AI Management is powered by [WPVibe](https://wpvibe.ai/), which connects WordPress sites to AI assistants through MCP, the open standard that lets AI tools work with other software. On Levamo it's built directly into your dashboard, so connecting a site takes a couple of clicks instead of a developer project.
## What You Can Ask It to Do
Once a site is connected, you brief your AI the way you'd brief a team member:
- **"Draft our Black Friday post and schedule it for Monday."** The post shows up in WordPress as a scheduled draft, with the SEO title and meta description already filled in.
- **"Update all our plugins."** Your assistant updates them one at a time, checks the site after each one, and logs the changes for your review.
- **"Redesign our homepage, make it feel modern."** The new version is saved as a draft with a preview link. Your live homepage stays untouched until you approve it.
- **"Change blog permalinks to /blog/post-name."** The structure changes, and 301 redirects are added from every old URL.
It covers the parts of WordPress you actually touch: posts and pages, media, plugins and themes, WooCommerce, SEO, even theme files. And it works alongside the tools you already build with, including Elementor and Divi.
## Works with the AI You Already Use
You don't have to adopt a new chatbot. AI Management meets you in whichever assistant is already open on your screen.
The dashboard includes step-by-step connection instructions for five clients: **Claude.ai**, **Claude Desktop**, **Claude Code** (a single terminal command), **ChatGPT** (via the WPVibe app in ChatGPT's app directory), and **Cursor**. Using Gemini, Grok, Perplexity, or another MCP-compatible assistant? WPVibe's [setup guides](https://wpvibe.ai/docs/ai-client-setup/) cover those too.
The flow is the same everywhere: copy your site's connection URL from the dashboard, paste it into your assistant, and sign in with your email. A 6-digit code arrives with the code right in the subject line, so there's no link to hunt for.
## Safe by Design
Letting an AI touch a live site is a real decision, so the whole system is built draft-first:
- **New content lands as drafts.** Posts and page redesigns wait for your review; nothing goes live without you.
- **Deletes go to trash**, so nothing disappears permanently by accident.
- **Destructive operations require your approval** before they run, with a preview of what will change.
- **Changes are logged**, so you can always review what your assistant did.
The connection itself is locked down too. WPVibe signs in to your site with a dedicated, automatically managed application password that only WPVibe stores. You never see it, you never handle it, and disconnecting the site revokes it.
Connections are also personal: each team member connects with their own WordPress admin account. Disconnecting yourself removes your access only, and you can connect again at any time.
## How to Connect a Site
1. Log in to your [Levamo dashboard](https://my.levamo.com), open a site, and click **AI Management**.
2. Create a **Platform API key** with the name and expiry you want, or choose one you already have.
3. Click **Connect**. We verify the site with WPVibe and install the connector for you, so there's nothing to set up inside WordPress.
4. Follow the three steps on the **Instructions** tab: copy your connection URL, add it to your assistant, and paste in the ready-made first prompt.
That first prompt is worth a mention. It's pre-filled with your site's address and asks your assistant to confirm the connection, look around read-only, and come back with a first-run overview: what it found, what it can do on this site, the most important improvements, and the safest first action. It changes nothing on the site; it just introduces your assistant to it.
One more detail: if a restore, clone, or migration ever removes the connector plugin, the AI Management tab notices and offers a one-click **Repair connection** that reinstalls it using the credentials we already hold. No starting over.
## API Keys for Your Team
AI Management runs on a new account-level feature that's useful in its own right: **API keys**, now in your account settings.
- **Keys are per team**, and each one acts as your current role on that team. Change someone's role and their keys follow automatically.
- **You choose the expiry**: 30, 90, 180, or 365 days, or never.
- **The full key is shown exactly once**, at creation. Copy it and store it somewhere safe.
- **Rotate or revoke at any time.** Before you confirm, the dialog names the exact sites that will be disconnected, so you know the impact before you click, not after.
Team owners and administrators also get two new permissions to grant: one for managing sites with AI assistants, and one for managing API keys. Access is opt-in per member, and the team roster now shows at a glance who has which.
## Available Today
AI Management is live in your dashboard now. Log in, open a site, click **AI Management**, and connect.
The first thing to try: paste the starter prompt from the Instructions tab. Your assistant will introduce itself to your site, tell you what it can do, and suggest a safe place to start.
---
## WordPress Security Headers: How to Add Them and Why They Matter
- URL: https://levamo.com/blog/wordpress-security-headers/
- Category: website-security
- Author: Shahzeb Ahmed
- Published: 2026-08-10
Add the WordPress security headers that block XSS, clickjacking, and more.
You've installed an SSL certificate. You've set up [two-factor authentication](/blog/two-factor-authentication-2fa/). You're running a firewall. And you still might be leaving one of the biggest security gaps wide open.
Security headers are HTTP response headers your server sends to the browser before any page content loads. They tell the browser what's allowed and what isn't: which scripts can run, whether your site can be embedded in a frame, how cookies should be handled. Without them, you're relying entirely on the browser's default behavior, and browsers are generous by default. They'll load third-party scripts, allow framing, and trust whatever content type a file claims to be.
That generosity is exactly what attackers exploit.
The good news? Adding security headers to a WordPress site takes about ten minutes. And once they're in place, they work silently in the background, blocking entire categories of attacks before they even reach your application layer.
## What Security Headers Actually Do
Every time someone visits your site, your server sends back a response. That response includes the page content (HTML, CSS, JavaScript) plus a set of headers, small instructions the browser reads before rendering anything.
Most headers are mundane: content type, cache duration, server software. But a handful of them are specifically designed to prevent attacks. These are your security headers.
Think of them as rules you're handing to the browser: "Don't load scripts from domains I haven't approved." "Don't let anyone embed my site in an iframe." "Always use HTTPS, even if someone types http://." The browser enforces these rules on every single page load, which means attackers can't bypass them with clever JavaScript or social engineering.
Here's why this matters for WordPress specifically: WordPress sites tend to run a lot of third-party code. Themes, plugins, analytics scripts, payment processors, chat widgets. Each one is a potential vector for cross-site scripting (XSS) or data injection. Security headers don't replace keeping your plugins updated, but they add a layer of protection that catches what your other defenses might miss.
## The Six Headers That Actually Matter
There are dozens of HTTP headers you could set, but six of them carry the most weight for WordPress sites. Let's go through each one.
### 1. Strict-Transport-Security (HSTS)
**What it does:** Forces browsers to connect over HTTPS, even if someone types http:// or clicks an old HTTP link.
**Why it matters:** Without HSTS, there's a brief window during the first connection where an attacker could intercept an unencrypted request and redirect the visitor (a man-in-the-middle attack). HSTS eliminates that window entirely after the first visit.
**Recommended value:**
```
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```
The max-age is in seconds (31536000 = one year). includeSubDomains applies the rule to every subdomain. preload lets you submit your domain to browser preload lists, so even the very first visit is forced to HTTPS.
**Important:** Only enable HSTS after you've confirmed SSL works correctly across your entire site. If anything is still served over HTTP (mixed content), HSTS will break those resources instead of silently loading them.
If you're on Levamo, free [SSL certificates](/blog/ssl-website-security/) are issued automatically and renewed on every plan, so you're already set on that front.
### 2. Content-Security-Policy (CSP)
**What it does:** Controls exactly which sources the browser is allowed to load resources from: scripts, styles, images, fonts, frames, and more.
**Why it matters:** CSP is the single most powerful header against cross-site scripting. If an attacker injects a malicious script tag into your page, the browser checks the CSP policy. If the script's source isn't on the approved list, it doesn't execute. Period.
**Example (starter policy):**
```
Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'none'
```
**A word of caution:** CSP is the most powerful security header, but also the easiest to get wrong on WordPress. Plugins and themes routinely inject inline scripts and styles, and a strict CSP will block them. Start with Content-Security-Policy-Report-Only to log violations without breaking anything:
```
Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' 'unsafe-inline'; report-uri /csp-report-endpoint
```
Monitor the reports for a week, adjust your policy, then switch from Report-Only to the enforced header.
### 3. X-Content-Type-Options
**What it does:** Prevents the browser from "sniffing" the content type of a response. If your server says a file is text/plain, the browser treats it as text, not as executable JavaScript.
**Why it matters:** Without this header, an attacker could upload a file with a .jpg extension that's actually a script. The browser might detect the real content type and execute it. This header stops that behavior.
**Recommended value:**
```
X-Content-Type-Options: nosniff
```
There's only one valid value. Set it and forget it.
### 4. X-Frame-Options
**What it does:** Controls whether your site can be embedded inside an `