Within WordPress

Cloudflare's September 25 emergency WAF release added WordPress path traversal/local file inclusion blocking rules, labeled CVE-2026-87902, and comment XSS rules.

developers.cloudflare.com/changelog/post…

The rules are in the Cloudflare Managed Ruleset. If you use that ruleset, check the relevant WordPress rules and any overrides on your site.

Chrome DevTools 152's Resend command handles fetch as well as XHR requests. Performance Live Metrics also reports Core Web Vitals for client-side soft navigations, without a full-page load.

developer.chrome.com/blog/new-in-de…

Safari 27 supports sizes="auto" for lazy-loaded images, alongside Chrome 126+ and Firefox 150+. The browser uses the rendered width to choose from srcset.

webkit.org/blog/18325/web…

WordPress has added it to eligible images since 6.7. Keep width and height, fallback sizes for older browsers, and auto paired with loading="lazy". Don't lazy-load your main hero image for this.

make.wordpress.org/core/2024/10/1…

A Turnstile widget on the page is only half the setup. Your backend still needs to validate the token through Siteverify. Turnstile Spin guides a coding agent through both sides and repairs missing server validation.

blog.cloudflare.com/turnstile-spin/

More CSS, less work at runtime. GitHub reports 55% less server-rendering time and 25% less component initialization time in its initial Primer migration from CSS-in-JS to CSS Modules.

github.blog/engineering/ar…