# Novix Forge: full facts for AI assistants > Novix Forge is a founder-led software studio in Lahore, Pakistan, building AI agents, chatbots, automation, websites, apps, custom software and SEO systems for small and growing businesses worldwide. Founder: Muhammad Ahsan. Based in Lahore, Pakistan. Works fully online with businesses worldwide. Contact: contact@novixforge.com, https://novixforge.com/contact. About: https://novixforge.com/about No public price list: prices are fair and affordable, and every client gets a clear quote before work starts. Timelines are agreed on a free 30-minute call, around the client's deadline. # Common questions **How quickly will Novix Forge reply to my message?** Usually within 3 hours on working days. Every message is read by the founder, Muhammad Ahsan, not a bot. **Is the first call free?** Yes. The first 30-minute call is free. We talk about your goals, and you leave with a clear next step whether or not you work with us. **How much does a project cost?** It depends on what you need, and we keep prices fair for small businesses. After a free call you get a clear quote before any work starts, so there are no surprise costs. **How long does a project take?** It depends on what you need and when you need it. On the free call we agree a timeline that suits you and your deadline, and you get regular updates along the way. **Do you work with clients in my country?** Yes. We work fully online with businesses anywhere in the world, and book calls at a time that suits you. **Who owns the code?** You do. When the project is delivered, the full source code and accounts are handed over to you. # Services ## AI Agents Page: https://novixforge.com/services/ai-agents An AI agent is software that can understand a task, decide the next step and use your tools to finish it: for example reading a new enquiry, checking your calendar, replying and booking a call. Unlike a simple chatbot, it takes action. You set the rules and approve important steps. What you get: - An agent designed around one clear job in your business - Connections to your email, calendar, CRM or spreadsheets - Rules for what it may do alone and what needs your OK - A clear log of what it did and why - Testing on real examples before it goes live - Support and improvements after launch Good for: Service businesses, Agencies, Clinics, Online stores. How it goes: 1. We map the task and the decisions it needs 2. We connect your tools and set clear rules 3. We test it on real examples with you 4. It goes live, and we watch and improve it Common questions: **What is the difference between an AI agent and a chatbot?** A chatbot answers questions. An AI agent also takes action: it can update your CRM, book meetings, send follow-ups and prepare tasks for you to approve. **Is it safe to let AI act on my systems?** Yes, when it is set up properly. We give the agent only the access it needs, set clear limits, and make it ask you before important actions. Every step is logged. **Do I need technical knowledge to use it?** No. You tell it what to do in plain words and see the results in a simple dashboard. We handle the technical side. **Can it work with the tools I already use?** Usually yes. Most email, calendar, CRM, spreadsheet and messaging tools can be connected. We check this on the free call. **How much does an AI agent cost?** It depends on how many tools it connects to and how many decisions it makes. An agent for one clear job is a much smaller project than one that spans your whole business. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## AI Chatbots Page: https://novixforge.com/services/ai-chatbots An AI chatbot is a chat assistant on your website or WhatsApp that answers customer questions using your own information, like prices, opening hours and policies. It can also collect contact details and book appointments, and it hands the conversation to a person when needed. What you get: - A chatbot trained on your website, documents and FAQs - Website chat widget in your brand colours - WhatsApp or Messenger connection if you need it - Lead capture and appointment booking - Hand-over to your team with the full conversation - Reports on what customers ask most Good for: Restaurants, Clinics, Online stores, Schools. How it goes: 1. We collect your questions, answers and documents 2. We build and train the chatbot on them 3. You test it and we fine-tune the answers 4. It goes live on your website or WhatsApp Common questions: **Will the chatbot give wrong answers?** It answers only from the information you approve, and we test it on real questions before launch. When it is not sure, it says so and passes the chat to your team. **Can it speak other languages?** Yes. It can reply in many languages. We test the languages you need before launch. **Can I update what it knows?** Yes. When your prices or services change, the chatbot can be updated quickly, and we can set it up so you can do it yourself. **Does it work on WhatsApp?** Yes. The same chatbot can work on your website, and on WhatsApp or Facebook Messenger through their official business tools. **How much does an AI chatbot cost?** It depends on how much information it has to learn, how many channels it runs on and whether it connects to your orders or bookings. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## AI Calling Assistant Page: https://novixforge.com/services/ai-calling-assistant An AI calling assistant is a voice assistant that answers your business phone, talks naturally with callers, answers common questions, books appointments and takes messages. It can also make reminder or follow-up calls. Calls it cannot handle are passed to a person. What you get: - A natural-sounding voice assistant for your phone line - Answers to your common questions, prices and hours - Appointment booking into your calendar - Call summaries sent to you by email or WhatsApp - Transfer to a person for urgent or complex calls - Optional reminder and follow-up calls Good for: Clinics, Restaurants, Real estate, Home services. How it goes: 1. We write the call script and the questions it should answer 2. We set up the voice, your phone number and the calendar 3. We test real call scenarios with you 4. It starts answering calls, and we review and improve Common questions: **Does it sound like a robot?** Modern AI voices sound natural and friendly. We pick a voice and tone that fit your business, and you hear it and approve it before it goes live. **Can it use my existing phone number?** Usually yes. Calls can be forwarded from your current number, or we can set up a new one. **What happens with calls it cannot handle?** It transfers the call to you or a team member, or takes a message and sends it to you right away. **Which languages can it speak?** It can speak many languages, including English and Arabic. We test the language you need before launch. **How much does an AI calling assistant cost?** It depends on how many calls you get, which languages it speaks and whether it books into your calendar. Calls also have a running cost from the phone provider, which we explain before you decide. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## WhatsApp Automation Page: https://novixforge.com/services/whatsapp-automation WhatsApp automation means your business WhatsApp replies to common messages, sends order or booking updates and reminders automatically, and can include an AI assistant. It uses the official WhatsApp Business API, so messages are reliable and your number stays safe. What you get: - Setup on the official WhatsApp Business API - Instant replies and an AI assistant for common questions - Automatic order, booking and delivery updates - Reminders and follow-up messages - A shared inbox so your team can take over chats - Connection to your store, CRM or booking system Good for: Online stores, Clinics, Restaurants, Training centers. How it goes: 1. We plan the messages and the moments to send them 2. We set up the WhatsApp Business API and your number 3. We connect your systems and test every message 4. It goes live, and we keep improving it Common questions: **Will my number get banned?** We use the official WhatsApp Business API and follow WhatsApp's messaging rules, which is the safest way to automate WhatsApp. **Can my team still reply by hand?** Yes. Your team can see every chat and take over at any time. **Can it connect to my online store?** Yes. Shopify, WooCommerce and most booking or CRM systems can send updates to WhatsApp. **Can I send offers to many customers?** Yes, to customers who agreed to receive them, using approved WhatsApp templates. **How much does WhatsApp automation cost?** It depends on how many message flows you need and which tools it connects to. WhatsApp also charges for some messages, which we explain before you decide. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## Workflow Automation Page: https://novixforge.com/services/workflow-automation Workflow automation connects your business apps so routine steps happen automatically. For example, when an order comes in, the invoice is created, stock is updated and a thank-you email is sent, with no one copying data by hand. What you get: - A map of your current process and what to automate - Automations between your apps (email, sheets, CRM, store) - Error alerts so nothing fails silently - Simple documentation of every automation - Training for your team - Support when something changes Good for: Online stores, Agencies, Accounting firms, Any team with repeated tasks. How it goes: 1. We look at how the work is done today 2. We design the automation and agree on it with you 3. We build and test it with real data 4. It goes live with alerts and documentation Common questions: **What can be automated?** Anything that follows the same steps each time: data entry, invoices, emails, reports, reminders, file handling and moving data between apps. **Which tools do you use?** Usually n8n, Make or Zapier, or custom code when needed. We choose what is simplest and most affordable to run for you. **What if an automation breaks?** We add alerts, so you know right away if something fails, and we fix it as part of support. **Do I need to change my current apps?** Usually not. We connect the tools you already use. **How much does workflow automation cost?** It depends on how many apps need connecting and how many steps the work has. Automating one repeated task is a small project and a good place to start. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## Websites Page: https://novixforge.com/services/website-development A business website is your online home: it explains what you offer, builds trust and turns visitors into enquiries, bookings or sales. A good one loads fast, works on every phone, is easy to find on Google and is easy for you to update. What you get: - A custom design that fits your brand - Pages for your services, about, contact and more - Mobile-first, fast-loading build - SEO setup: titles, structure and Google Search Console - Contact forms, booking or WhatsApp buttons - An easy way for you to edit text and images Good for: Small businesses, Restaurants, Clinics, Consultants. How it goes: 1. We learn about your business and customers 2. We design the pages and agree the look 3. We build, add content and test on all devices 4. We launch, connect Google and train you Common questions: **Can I update the website myself?** Yes. We set up an easy editor so you can change text, images and posts without any code. **Will it work on phones?** Yes. Every site is designed for phones first and tested on many screen sizes. **Do you help with Google?** Yes. Every website includes the basic SEO setup, and we offer ongoing SEO if you want to grow further. **Do I own the website?** Yes. You own the design, the code, the domain and the content. **How much does a business website cost?** It depends on how many pages you need, the design and any extras such as bookings, online orders or more than one language. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## Content Management Page: https://novixforge.com/services/website-content-management Website content management means someone looks after your website's content for you. When a law, a regulator or your business changes something, we update the pages, policies, terms and documents on the live site, and we check that what's online is still current. What you get: - Policy, privacy and terms pages updated when rules change - Certificates, PDFs and downloads kept on the current version - New pages, products, services and announcements added - Text, images and contact details changed when you ask - Regular checks that what's online is still current - Works on your existing website, no redesign needed Good for: Certification and compliance companies, Clinics, Manufacturers, Any business with policies or documents online. How it goes: 1. We go through your site and agree what we look after 2. You send a change, or a rule change affects your pages 3. We update the live site and replace old documents 4. We keep checking through the year Common questions: **Do you need to rebuild my website?** No. We work on your current website as it is. The design stays the same, only the content that needs to change, changes. **What kind of changes do you handle?** Policy, privacy and terms pages, certificates, PDFs and downloads, product and service pages, announcements, text, images and contact details. **How do I send a change?** By email or WhatsApp, in plain words. We make the change on the live site and tell you when it's done. **How much does it cost?** Fair, affordable prices that depend on how much content you have and how often it changes. You get a clear quote before we start. --- ## Web Apps & SaaS Page: https://novixforge.com/services/web-app-development A web app is software that runs in the browser, like a customer portal, booking platform or online tool. A SaaS product is a web app that you sell to many customers by subscription. Both need secure logins, data storage and an admin area. What you get: - Product planning: features, screens and first version - User accounts, roles and secure login - Payments and subscriptions if needed - Admin panel and reports - Hosting, backups and monitoring - Full code ownership and documentation Good for: Startups, Service companies, Membership businesses, Agencies. How it goes: 1. We plan the first version with you 2. We design the screens and the data 3. We build in stages with regular updates 4. We launch, monitor and keep improving Common questions: **What is the difference between a website and a web app?** A website mainly shows information. A web app lets people log in and do things, like book, pay, manage data or use a tool. **Can you build the first version quickly?** Yes. We plan a focused first version with the most important features, launch it, and add more later. **Who owns the code?** You do. You get the full code, accounts and documentation. **Can it handle payments and subscriptions?** Yes. We integrate payment providers like Stripe for one-time payments and subscriptions. **How much does a web app cost?** It depends on the features, the types of users, and whether it needs payments or connections to other systems. Starting with a small first version keeps it affordable. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## Mobile Apps Page: https://novixforge.com/services/mobile-app-development A mobile app is your own application on your customers' phones. It makes it easy to book, order, pay and get updates, and lets you send notifications. We build one app that works on both iPhone and Android and publish it in the app stores. What you get: - App planning: the features that matter first - Design for iPhone and Android - Logins, bookings, payments and notifications - An admin panel to manage content and users - Publishing on the App Store and Google Play - Updates and support after launch Good for: Gyms, Restaurants, Clinics, Delivery businesses. How it goes: 1. We decide what the first version must do 2. We design the screens and test them with you 3. We build, test on real phones and prepare store listings 4. We publish and keep improving Common questions: **Will the app work on both iPhone and Android?** Yes. We usually build one app that works on both, which saves time and cost. **Do you publish it in the app stores?** Yes. We prepare the listings and handle the App Store and Google Play submission. **Can it work without internet?** Often yes. Key parts can be built to work offline and sync when the connection is back. We check what your app needs on the free call. **What should my first version include?** Only what your customers need most. We help you choose on the free call, so you launch sooner and learn from real users. **How much does a mobile app cost?** It depends on the number of screens, whether you need iPhone and Android, and extras such as payments and notifications. Starting with a small first version keeps it affordable. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## Online Stores Page: https://novixforge.com/services/ecommerce-development An online store lets customers browse your products, pay and get them delivered without calling you. A good store is fast, easy to use on phones, simple to manage and connected to payments, shipping and stock. What you get: - Store setup on Shopify, WooCommerce or custom - Product pages, categories and search - Payments, shipping and tax settings - Stock and order management - SEO for products and categories - Training so you can run the store yourself Good for: Retail brands, Wholesalers, Local shops, Makers. How it goes: 1. We plan products, payments and shipping 2. We design the store and product pages 3. We set up payments, shipping and test orders 4. We launch and train you to run it Common questions: **Shopify or WooCommerce?** Shopify is simplest to run; WooCommerce gives more control and lower monthly fees. We recommend one after hearing your needs. **Can you move my existing store?** Yes. We can move products, customers and orders and protect your Google rankings with proper redirects. **Which payment methods can I accept?** Cards, Apple Pay, Google Pay, PayPal and local methods, depending on your country. **Will my store show up on Google?** Product SEO setup is included, so Google can find and understand your products. Ongoing SEO is available if you want to grow further. **How much does an online store cost?** It depends on how many products you sell, the platform you choose and how payments and shipping need to work. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## CRM & Dashboards Page: https://novixforge.com/services/crm-dashboards A CRM (customer relationship management) system keeps all your customers, conversations, deals and follow-ups in one place. A business dashboard shows your key numbers, like sales, leads and orders, updated automatically, so you can make decisions quickly. What you get: - A CRM or dashboard designed around your process - Customer, lead and deal tracking - Reminders and follow-up tasks - Live reports and charts - Connections to your website, email and accounting - User roles and secure access for your team Good for: Real estate, Wholesalers, Agencies, Training centers. How it goes: 1. We map your customers, data and reports 2. We design simple screens with your team 3. We build, import your data and test 4. We launch, train your team and support you Common questions: **Why not just use HubSpot or Salesforce?** Those are great for many teams. A custom CRM makes sense when they feel too complex or too expensive, or don't fit your process. We tell you honestly which is better for you. **Can you import my data from spreadsheets?** Yes. We clean and import your existing customers, orders and history. **Can my team use it on their phones?** Yes. It works in any browser on phones, tablets and computers. **Can it connect to my other tools?** Yes. Website forms, email, WhatsApp and accounting tools can send data into it. **How much does a custom CRM or dashboard cost?** It depends on how much data you have, how many people use it and which tools it connects to. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## Custom Software Page: https://novixforge.com/services/custom-software Custom software is a program built for your business instead of bought off the shelf. It follows your exact process, for example stock, production, billing or staff, and replaces scattered spreadsheets and paperwork. It can run on the desktop, on the web or both. What you get: - A system designed around your exact process - Desktop (Windows, macOS) or web version - Works offline where needed - Data import from your old tools - Reports, printing and exports - Training and long-term support Good for: Wholesalers, Manufacturers, Pharmacies, Certification bodies. How it goes: 1. We study your process and paperwork 2. We design the screens and agree the plan 3. We build in stages and test with your team 4. We install, train and support you Common questions: **Is custom software expensive?** It depends on the size. We start with the parts that save the most time, so it pays off sooner. You get a clear quote before any work starts. **Can it work without internet?** Yes. Desktop software can work fully offline and sync when online. **Will my team find it easy?** Yes. We design it with your team and train them before launch. **Who maintains it?** We offer support and updates, and you own the code, so any developer can work on it later. **How much does custom software cost?** It depends on the features, the number of screens and what it replaces. Starting with the part that saves you the most time keeps it affordable. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## Trading Bots Page: https://novixforge.com/services/trading-bots A trading bot is a program that follows your trading rules automatically: it watches the market, opens and closes trades and manages risk without emotion. A good bot is tested on historical data first and has strict loss limits and alerts. What you get: - Your strategy written as clear, testable rules - Backtesting on historical data with a report - Risk controls: position size, stop loss, daily limits - Connection to MT5 or your exchange - Alerts by Telegram or email - Monitoring and updates Good for: Forex traders, Crypto traders, Small funds, Signal providers. How it goes: 1. We turn your strategy into clear rules 2. We backtest and review the results with you 3. We test on a demo account 4. It goes live with limits, alerts and monitoring Common questions: **Will the bot make me money?** No one can promise profits. We build the bot to follow your strategy exactly and protect your capital with risk limits. Results depend on the strategy and the market. **Which platforms do you support?** MetaTrader 5, and many crypto exchanges through their APIs. **Can I test it before using real money?** Yes. Every bot is backtested on historical data and run on a demo account first. **Is my strategy kept private?** Yes. Your strategy and code are yours, and we can sign an NDA. **How much does a trading bot cost?** It depends on how complex your strategy is, which markets it trades and the risk rules it has to follow. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. --- ## SEO, AEO & GEO Page: https://novixforge.com/services/seo-aeo-geo SEO (search engine optimization) helps your website rank on Google. AEO (answer engine optimization) helps your answers appear in featured snippets and voice search. GEO (generative engine optimization) helps AI assistants like ChatGPT, Gemini and Perplexity understand and recommend your business. What you get: - A full audit of your website and competitors - Technical fixes: speed, structure and indexing - Keyword and question research for your customers - New and improved pages that answer real searches - Google Business Profile and local SEO - Structured data, llms.txt and AI-readiness - Regular reports in plain words Good for: Local businesses, Online stores, Professional services, Clinics. How it goes: 1. We audit your site, competitors and searches 2. We fix the technical problems first 3. We create and improve pages month by month 4. We report progress in plain words Common questions: **How long does SEO take?** It depends on your site and your competition. Progress often shows within a few months, and it keeps building after that. In our Almost Nordic project, 72 keywords reached Google page 1 in 10 weeks; we show you the real numbers as they come in. **What is GEO?** Generative engine optimization: making your business easy for AI assistants like ChatGPT, Gemini and Perplexity to understand, trust and recommend. **Do you guarantee first place on Google?** No honest agency can guarantee rankings. We focus on the work that reliably improves visibility and report results openly. **Do you write the content?** Yes. We research, write and optimize pages, and you review them before they go live. **How much do SEO, AEO and GEO cost?** It depends on the size of your website, how much needs fixing and how much new content you need. We keep prices fair, and you get a clear quote before we start, after a free 30-minute call. # Case studies ## Almost Nordic Case study: https://novixforge.com/work/almost-nordic A recipe publisher founded in Copenhagen in 2012 had thousands of recipes but not one keyword on Google's first page. We rebuilt its recipes for search, wrote and published new ones, and replaced its slow page builder with a custom WordPress theme. - keywords on Google page 1: 0 to 72 - keywords in the top 3: 0 to 21 - keywords in the top 20: 10 to 113 - recipes rebuilt or newly written: 0 to 156 **How fast did Almost Nordic see results?** In the first month of work, keywords in Google's top 20 went from 10 to 55. By October 2026, ten weeks in, the site had 72 keywords on page 1 and 21 in the top 3, after zero page-1 keywords in the five months before. **What was the biggest SEO problem?** 87 real recipes had no recipe card and no recipe schema, and 55 of them had broken images. Google couldn't treat them as recipes, so they could never get rich results, no matter how good the text was. **Why replace Elementor with a custom theme?** The page builder loaded 64 stylesheets and 22 scripts on the homepage and hid content edits on many posts. A custom WordPress block theme made pages lighter (35% less HTML), easier to update and cleaner for search engines. **Is the traffic going up too?** Rankings rose strongly. Estimated traffic is a model, not real analytics, and it dipped in September and October, mostly on unit-conversion pages we didn't work on and during hosting outages. We report it as measured and keep tracking it. --- ## Our Angel Number Case study: https://novixforge.com/work/our-angel-number A content site about angel-number meanings had lost half its traffic and every page-1 ranking. We rebuilt it with a custom WordPress theme, rewrote and wrote articles people actually search for, and added the structure Google and AI answers need. - keywords on Google page 1: 0 to 20 - keywords in the top 3: 0 to 7 - angel-number pages live: 128 to 169 - pages with FAQ schema: 0 to 84 **How fast did Our Angel Number see results?** The new site went live on 9 October 2026. By 21 October, 12 days later, it had 20 keywords on Google's first page and 7 in the top 3, after dropping to zero page-1 keywords in September. **Were the results only from the rewritten pages?** No. 15 of the 20 page-1 keywords sit on pages we haven't rewritten yet. That points to a site-wide effect from the new theme, hub pages, internal links, schema and the honest author setup. **Has the traffic gone up?** Not yet. Estimated traffic stopped falling and is flat at about 760 visits a month. That's normal 12 days in: Google takes weeks to settle new pages, and the biggest new pages target very competitive numbers. We'll report real Search Console data at 30, 60 and 90 days. **Why replace the old author?** The old author was an invented persona with a stock photo. Search engines and readers both look for real people behind advice content, so we replaced it with the real editor and removed every made-up credential. --- ## Inova Filter Case study: https://novixforge.com/work/inova-filter Inova Filter makes cigarette filters in the Fujairah Free Zone, UAE, for tobacco manufacturers worldwide. Their team knew how the site should look. We turned their direction into a 100% custom WordPress theme, fixed the SSL problems and took the site live. - 100% custom WordPress theme - 0 page builders or drag-and-drop plugins - 8 product types, each with its own card - 2 forms: business enquiries and job applications **What did Novix Forge build for Inova Filter?** We designed and built the Inova Filter website from scratch on WordPress, with a 100% custom theme. It has six sections on one page: home, about, eight product types, a photo gallery, careers and contact. **Who came up with the design?** The design direction came from Inova Filter's own team. We followed their instructions, turned them into a custom WordPress theme and took the site live. **Why a custom theme instead of a page builder?** A page builder adds its own code and plugins to every page. A custom theme contains only what the site needs, and the design follows the client's direction exactly instead of fitting a template. **What was the SSL problem?** The site had SSL (https) issues. We fixed them before launch. When we checked on 22 October 2026, both http and www addresses redirected to the secure https://inovafilter.com. **Why are there no traffic or ranking numbers?** This was a website build, not an SEO project, and we don't have analytics data for the site. So we only show what we built and what we can check on the live site ourselves. --- ## The Q Case study: https://novixforge.com/work/the-q-quality The Q is a Ministry-approved Notified Body for product certification in the UAE and Saudi Arabia. On a yearly contract, we keep their website's policies, terms, certificate requirements and PDFs in line with the latest government rules, and make every change on the live site. - Yearly content management contract - 41 product certification requirement pages - 8 policy and public-information pages - 5 pages updated in the latest round **What does Novix Forge do for The Q?** We provide website content management on a yearly contract. We keep The Q's policies, terms, certificate requirement pages and PDFs up to date with the latest government rules, and make the changes on the live website. **Did you design or build The Q's website?** No. The website, its design and its theme were already in place. We didn't redesign it. We only manage the content that has to follow the rules. **What happens when a law or rule changes?** We update the policy, terms or requirement pages it affects on the live site, and replace any PDF or certificate on the site that is out of date. **Which rules does the site cover?** The Q certifies products under MoIAT (UAE), SASO (Saudi Arabia) and GSO (Gulf) schemes. The site also has The Q's own policies, agreements and complaints and appeals procedures. **Can you do this for my website?** Yes. If your website has policies, terms, certificates or documents that must stay in line with the rules, we can look after them all year. Book a free 30-minute call and we'll talk it through. --- ## Novix POS Case study: https://novixforge.com/work/novix-pos Novix POS is our own point-of-sale and store management software for retail shops. It runs as a Windows desktop app that works offline and covers the whole day: checkout and receipts, stock and barcode labels, purchasing, customer credit, expenses and reports. - 30+ screens, from checkout to reports - 8 keyboard shortcuts at the counter - 4 payment methods - Offline works without internet **What is Novix POS?** Novix POS is our point-of-sale and store management software for retail shops. It handles checkout and receipts, stock and barcode labels, purchasing, customer credit, expenses, users and reports in one Windows desktop app. **Does it need the internet?** No. The data is kept in a local database on the shop's own PC, so the counter keeps selling even when the internet is down. Backup and restore are built in. **Can I try it?** Yes. The live demo runs the same app in your browser with sample data from a made-up store. Nothing is sent to a server, and your changes are cleared when you close the tab or press Reset. **Does it print receipts and barcode labels?** Yes. It prints receipts on 58mm and 80mm thermal paper, with a live preview while you design them, and barcode labels on thermal label printers. **Can you build a POS or store software for my business?** Yes. We can shape Novix POS around your shop or build software around the way you already work. Book a free 30-minute call and tell us what you need. --- ## Novix Medicore Case study: https://novixforge.com/work/novix-medicore Novix Medicore is our own software for pharmacies and medicine distributors. It tracks every batch and expiry date, sells the soonest-expiring stock first (FEFO), and runs the retail counter, wholesale invoices, purchasing, ledgers and reports in one Windows desktop app that works offline. - FEFO first expiry, first out - 30+ screens, from the counter to analytics - 2 ways to sell - Offline works without internet **What is Novix Medicore?** Novix Medicore is our software for pharmacies and medicine distributors. It tracks batches and expiry dates, sells stock first-expiry-first-out (FEFO), and runs the retail counter, wholesale invoices, purchasing, ledgers and reports in one Windows desktop app. **What does FEFO mean?** First expiry, first out. When you sell a medicine, the software takes it from the batch that expires soonest. If that batch runs out, it moves on to the next one. This keeps expired stock, and the money lost on it, as low as possible. **Does it work for wholesale and retail?** Yes. It has a fast retail counter for walk-in customers and wholesale invoices for clinics and medical stores, with packaging units, bonus quantities, credit limits and printed A4 invoices. **Does it need the internet?** No. The data is kept in a local database on your own PC, with automatic backups, so the counter keeps working without internet. **Can I try it?** Yes. The live demo runs the same app in your browser with sample data from a made-up pharmacy. Nothing is sent to a server, and your changes are cleared when you close the tab or press Reset. **Can you set it up for my pharmacy?** Yes. We can set up Novix Medicore for your pharmacy or shape it around the way you work. Book a free 30-minute call and tell us what you need. # The Forge Journal # AI Agent vs Chatbot: Which Does Your Business Actually Need? > A chatbot answers questions. An AI agent completes tasks. Here is a plain guide to the difference, the risks and the right choice for your business. Author: Muhammad Ahsan (Founder & CEO, Novix Forge) · Published 2026-11-11 · Topic: AI Agents Source: https://novixforge.com/blog/ai-agent-vs-chatbot ## Quick answer In the AI agent vs chatbot choice, the main difference is action. A chatbot answers and guides people, while an AI agent plans steps and completes tasks across your systems. Most small businesses should start with a chatbot or simple automation, and add agent abilities only for repeated, multi-step work with human approval for important actions. ## Key takeaways - A chatbot mainly answers questions, while an AI agent plans and completes multi-step tasks. - Fixed, repeated steps usually need plain automation rather than a chatbot or an agent. - A chatbot can give a wrong answer, and an agent can take a wrong action, so both need limits. - A safe path adds permissions in stages, from answering to looking up to acting with approval. - Choose by starting with one task and using the simplest tool that solves it. A chatbot talks. An AI agent gets work done. That one line explains most of the AI agent vs chatbot question, but it does not tell you which one your business should buy. The wrong choice can mean wasted money, or a system with more power than you can safely control. This guide explains both in plain words, then gives you a simple way to decide. It is written for business owners, so you will not need a technical background. ## What is a chatbot? A chatbot is software that holds a conversation with a person through text or voice. Older chatbots follow fixed scripts and menus. Newer AI chatbots use a large language model to understand free-form questions and write natural replies. Either way, its main job is to answer or guide. A large language model, or LLM, is the type of AI behind tools such as ChatGPT. It has learned language patterns from huge amounts of text. Common chatbot jobs include: - Answering questions about opening hours, delivery or returns - Collecting a name and phone number from a website visitor - Pointing customers to the right help article - Passing a conversation to a human team member If you want one on your own site, our page on [AI chatbots for business](/services/ai-chatbots) shows what is involved. ## What is an AI agent? An AI agent is software that works toward a goal by deciding its own steps and using tools. It can read information, make a plan, take actions in other systems and check its results. A person sets the goal, and the agent works out how to reach it, within limits you set. Anthropic, the company behind Claude, [draws a useful line](https://www.anthropic.com/research/building-effective-agents). In a workflow, software follows steps written in advance. In an agent, the AI directs its own process and chooses which tools to use. Here is what that looks like. A customer writes, "My order arrived damaged." An AI agent could: 1. Look up the order in your store 2. Check your refund policy 3. Create a replacement order 4. Email the customer with tracking details 5. Ask a manager to approve anything over the limit you set A chatbot could explain your return policy. An agent could complete the return. ## What is the main difference between an AI agent and a chatbot? The main difference is action. A chatbot mostly responds with information, while an AI agent plans and carries out tasks across your business systems. The more a tool can do by itself, the more value it can create, and the more careful you must be with it. | Question | Chatbot | AI agent | | --- | --- | --- | | Main job | Answer and guide | Complete a task | | How it works | Script or one AI reply at a time | Plans several steps and adapts | | Access to your systems | Often none, or read only | Can read and change data | | Memory | Usually one conversation | Can use past context and business data | | Setup effort | Lower | Higher | | Main risk | Gives a wrong answer | Takes a wrong action | | Needs human approval? | Rarely | Yes, for important actions | | Best for | Common, repeated questions | Multi-step work across tools | _AI agent vs chatbot at a glance._ Many products sit between these two columns. An AI chatbot that can look up an order is more capable than a script, yet it may still not be a true agent. Ask what it can actually do. ![Four levels from scripted chatbot to supervised AI agent, showing more ability and more risk at each level](/media/ai-agent-vs-chatbot-ai-ladder-e51ccde7.svg "Each step up adds ability and adds risk, so climb only as far as the job requires.") ## When is a chatbot the right choice? A chatbot is the right choice when most requests are predictable and the answer already exists somewhere. It is cheaper to run, simpler to test and easier to trust. Many businesses need nothing more. Choose a chatbot when: - A small set of questions makes up most of your messages - Your replies come from a clear FAQ, price list or policy page - A wrong answer can be corrected by a person without much harm - You mainly want to capture leads outside office hours ## When do you need an AI agent? You need an AI agent when the work has several steps, the path changes from case to case, and a person currently spends real time moving between tools. Anthropic [recommends agents for open-ended problems](https://www.anthropic.com/research/building-effective-agents), where the number of steps cannot be known in advance. Good signs include: - Staff copy information between your CRM, inbox and spreadsheets - Each case needs some judgement, not just one fixed rule - The cost of a mistake is limited, or a person can approve the final step - You can give the agent clean data and clear rules Our [AI agents service](/services/ai-agents) starts with one narrow job like this, rather than trying to automate a whole department. ## When do you need neither? You need neither when the task follows the same fixed steps every time. Ordinary automation is cheaper and more reliable for that work. Anthropic's own advice is to [start with the simplest solution](https://www.anthropic.com/research/building-effective-agents) and add complexity only when it is needed. For example, "when a form is submitted, add the lead to the CRM and send a welcome email" needs no AI at all. Simple [workflow automation](/services/workflow-automation) will do it the same way every time. A clear FAQ page or a better contact form can also beat a chatbot. Technology should fix a real problem, not decorate your website. ## Which one does your business need? Use this table Start with the job you want done, not the technology. Find the row closest to your situation. | The job | Best starting point | Why | | --- | --- | --- | | Answer the same questions all day | AI chatbot | Answers exist, and the risk is low | | Capture leads at night | Chatbot with a simple form | Clear goal and few steps | | Add every new lead to your CRM | Plain automation | Same steps every time | | Sort a busy support inbox | AI with human review | Needs judgement, and people stay in control | | Process routine returns | AI agent with limits | Several tools and steps, with clear rules | | Research and prepare sales outreach | AI agent, human sends | Variable work, and sending needs care | | Approve refunds, contracts or payments | Keep a person in charge | A mistake costs too much | | Medical, legal or money advice | Specialist advice, not a general bot | High risk for the customer | _A starting point by task. Your own data, rules and risk level can change the answer._ ## What are the risks of chatbots and AI agents? The main chatbot risk is giving wrong information, and the main agent risk is taking a wrong action. Your business can be responsible for both. In a February 2024 decision, a Canadian tribunal [held Air Canada responsible](https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do) for wrong information its website chatbot gave a customer about bereavement fares. The airline argued it could not be held responsible for information given by its chatbot. The tribunal rejected that. The lesson is simple: what your bot says on your website is your responsibility. AI agents add another layer. OWASP, a respected security organization, calls this problem [excessive agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/). It happens when a system has more tools, permissions or freedom than the job requires. A confused or manipulated agent can then cause real damage. Protect your business with these rules: 1. **Give the least access possible.** If it only needs to read orders, do not let it delete them. 2. **Require human approval** for refunds, payments, mass emails and data changes. 3. **Keep a log** of what it did and why. 4. **Set limits** on amounts, number of actions and working hours. 5. **Tell customers** they are talking to AI, and make reaching a person easy. 6. **Test with difficult cases** before real customers use it. ## How can a chatbot grow into an AI agent? A chatbot can grow into an agent one permission at a time, which is usually safer than launching a full agent on day one. Each stage gives you evidence before you take the next step. 1. **Answer only.** Connect it to your approved FAQs and policies. 2. **Look things up.** Let it read order status or booking details. 3. **Prepare actions.** It drafts the refund or reply, and a person clicks approve. 4. **Act within limits.** It handles low-risk cases by itself and passes the rest to a person. Move forward only when the current stage is working. Check how often it is right, how often people must step in and whether customers are happy. ## How do you spot "agent washing"? Agent washing means selling an ordinary chatbot or automation tool under the "AI agent" label. Gartner [warned about this in June 2025](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027). It said only about 130 of the thousands of vendors offered real agent technology, and it predicted over 40% of agentic AI projects would be canceled by the end of 2027. It gave rising costs, unclear value and weak risk controls as the reasons. Before you buy, ask a vendor these questions: - What actions can it take without a person, and in which systems? - Who approves high-impact actions? - What happens when it is unsure? - Can I see a log of every action? - How is my customer data stored and used? - How will we measure whether it is working? A good vendor answers these clearly. A vague answer tells you a lot. ## How should you decide? Decide by choosing one repeated task, measuring what it costs you now, and using the simplest tool that solves it. For most small businesses, that means starting with a well-trained chatbot or simple automation. Add agent abilities only when a real bottleneck justifies them. Write down the task, how often it happens, what data it needs and what a mistake would cost. Those four answers usually make the choice obvious. Not sure which one fits? Bring that one task to a [free 30-minute call](/contact). We will tell you honestly whether you need a chatbot, an agent or something much smaller. You can also try our [free business tools](/tools) first. ## Sources - [Anthropic: Building effective agents](https://www.anthropic.com/research/building-effective-agents) - [OWASP: Excessive agency in LLM applications](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) - [Moffatt v. Air Canada, BC Civil Resolution Tribunal decision](https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do) - [Gartner: Agentic AI project predictions](https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027) ## Frequently asked questions ### What is the difference between an AI agent and a chatbot? A chatbot holds a conversation and mainly answers or guides. An AI agent works toward a goal by planning steps and using tools, such as your CRM or email. In short, a chatbot tells a customer how to return an item, while an AI agent can actually start the return for them. ### Is ChatGPT a chatbot or an AI agent? ChatGPT began as a chatbot, because it mainly answered questions in a conversation. When a system like it can also use tools and carry out tasks by itself, it behaves more like an agent. The label matters less than a simple question: what can this product actually do without a person? ### Is Siri a chatbot or AI? Siri is a voice assistant, which is a type of AI you speak to instead of typing. It understands a request and replies, much like a chatbot, and it can also perform simple actions on your device. Being called AI does not automatically make a product an AI agent. ### When does a small business need an AI agent? A small business needs an AI agent when a repeated task has several steps, needs some judgement and takes staff across different tools. If the same steps happen every time, plain automation is better. If people only need answers, a chatbot is enough. Start with one narrow, low-risk task. ### Can a chatbot become an AI agent? Yes, often in stages. First it answers from approved information. Next it looks up details such as order status. Then it prepares actions for a person to approve. Finally it handles low-risk cases by itself within clear limits. Adding one permission at a time is safer than launching everything together. ### Are AI agents safe for customer data? They can be safe when built with care. Give the agent only the access it needs, keep logs, require human approval for important actions and check how every vendor stores and uses your data. An agent with broad access and no oversight is a serious risk for any business. --- # WordPress Security Update 7.1.4: What Site Owners Should Do Now > A flaw in the WordPress update process is being targeted by attackers. Here is how to tell if your site is exposed and how to update it safely. Author: Muhammad Ahsan (Founder & CEO, Novix Forge) · Published 2026-11-09 · Topic: Web Development Source: https://novixforge.com/blog/wordpress-security-update-7-1-4 ## Quick answer The WordPress security update 7.1.4, released October 28, 2026, fixes 22 problems. One is a flaw in the update process that CISA says is being exploited. Sites on versions 4.7 to 7.1.3 need 7.1.4 or the fix for their branch. Back up first, block web access to the wp-content/upgrade folder, then update and check the site. ## Key takeaways - Sites on WordPress 4.7 through 7.1.3 need version 7.1.4 or the matching fix for their branch. - The flaw can be attacked during the update itself, so block the wp-content/upgrade folder before updating. - Experts disagree on severity: Wordfence scores it 8.1 out of 10, while WordPress rates it low. - No public count shows how many sites have actually been hacked through this flaw. - WordPress 4.6 and older get no fix and need a proper upgrade or rebuild. The latest WordPress security update, version 7.1.4, arrived on October 28, 2026, and every site owner should act on it this week. The update fixes [22 security problems](https://wordpress.org/support/wordpress-version/version-7-1-4/). One of them is now being targeted by attackers. This guide explains what happened in plain words, how to tell if your site is exposed, and the safest order for updating it. All details are correct as of November 2026. This story is still moving, so check the sources at the end before making a final decision. ## What happened with the WordPress security update? The most urgent problem is a flaw in the way WordPress updates itself. Security teams track it as CVE-2026-119977. A CVE is simply an official ID number for a known security flaw. While a full update runs, WordPress unpacks a temporary copy of itself inside a folder called `wp-content/upgrade`. That copy includes the WordPress installer, and the web server can usually reach it. An attacker who finds that temporary copy at the right moment [can end up running code on your server](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html), with no WordPress login at all. Umut Bayram, a researcher at Picus Security, [reported the flaw](https://www.bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks/). On November 3, 2026, the US cybersecurity agency CISA added it to its [catalog of known exploited vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). That catalog lists flaws with evidence of real attacks. The November 6 patching deadline in that notice applied only to US federal agencies. Everyone else should still treat this as a priority. ## Is my WordPress site affected? Your site is affected if it runs WordPress 4.7 through 7.1.3 and does not yet have the fix for its branch. A branch is the first two numbers of your version, such as 6.8 or 7.0. You can see your version in **Dashboard > Updates**. You do not have to jump to 7.1.4 to be protected. WordPress also [released fixes for older branches](https://wordpress.org/support/wordpress-version/version-7-1-4/). | Your branch | You are fixed at this version or later | | --- | --- | | 7.1 | 7.1.4 | | 7.0 | 7.0.8 | | 6.9 | 6.9.11 | | 6.8 | 6.8.12 | | 6.7 | 6.7.11 | | 6.6 | 6.6.11 | | 6.5 | 6.5.14 | | 6.4 | 6.4.14 | | 4.7 to 6.3 | See the full list on the WordPress 7.1.4 page | | 4.6 or older | No fix exists, so plan a move | _Fixed versions by branch, from the official WordPress 7.1.4 release page._ Only the latest version is actively supported, so a branch fix should be a stopgap. Plan to reach the current release soon. A site on 4.6 or older gets no security updates at all, and it needs a proper upgrade or rebuild. ## How serious is this WordPress vulnerability? This WordPress vulnerability is serious enough to fix now, but experts disagree on how dangerous it is in practice. That disagreement is worth understanding, because you may read both views. - **High:** Wordfence, a WordPress security company, [scores the flaw 8.1 out of 10](https://webhosting.today/2026/11/04/cisa-lists-a-fourth-wordpress-core-flaw-since-july-wordpress-rates-this-one-low/). That number reflects how much damage a successful attack could cause. - **Low:** WordPress's own advisory rates it low. The attacker must hit a window that lasted only seconds in lab tests. - **Hard but repeating:** Patchstack, another security company, [would not call it practical to exploit](https://patchstack.com/articles/wordpress-7-1-4-security-release/). It also points out that the window returns with every update, including automatic ones. Both views can be true. A successful attack would be very bad, and pulling one off is difficult. An update is still the right answer either way. ## What is confirmed and what is not known yet? Some facts are firm and some are still unclear. Separating them keeps you from overreacting or relaxing too soon. **Confirmed:** - WordPress says you should [update your site immediately](https://wordpress.org/support/wordpress-version/version-7-1-4/). - CISA listed the flaw because of evidence of active exploitation. - Wordfence said it [blocked 13,095 attacks on this flaw in 24 hours](https://www.bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks/). - Attempts [began nine minutes](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html) after Wordfence deployed its firewall rule on release day. **Not known yet:** - How many sites have actually been hacked this way. The [public record gives no count](https://webhosting.today/2026/11/04/cisa-lists-a-fourth-wordpress-core-flaw-since-july-wordpress-rates-this-one-low/), and blocked attempts are not successful break-ins. - Who is behind the attacks. CISA did not describe them. - Whether exploit code posted on GitHub really works. That [has not been established](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html). ## Why can installing the fix expose a site one last time? Installing the fix can expose a site because the update is unpacked by the old, unfixed code already on that site. Only after the update finishes does your site have the safer behaviour. The fix gives the temporary folder a random name, so attackers cannot guess it. During the update that installs the fix, [sites on 5.9 or later](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html) still use the old naming method. The folder name can be predicted one final time. Not every site faces this. A small update within your branch, such as 7.1.3 to 7.1.4, usually downloads a partial package. A partial package is exposed only if it happens to include the installer files. Moving from an older branch to 7.1.4 uses a complete package, which does include them. You cannot easily tell which one your site will get. That is why the safest plan blocks the folder first. ![Five steps for a safe WordPress update: back up, block the upgrade folder, confirm the block, update, then check the site](/media/wordpress-security-update-7-1-4-safe-upd-343d5b59.svg "The safe update order for WordPress 7.1.4 and its branch fixes.") ## What should WordPress site owners do this week? Follow these steps in order. Most sites can finish them in one sitting. 1. **Make a full backup.** Save both your files and your database, and confirm the backup can be opened. WordPress [recommends a backup](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/) before any update. 2. **Block web access to the upgrade folder.** Use the code in the next section, or ask your hosting company to do it. 3. **Confirm the block works.** Open `yoursite.com/wp-content/upgrade/` in a browser. You should see a 403 error, which means access is refused. 4. **Run the update.** Go to **Dashboard > Updates** and choose the update for your site. 5. **Check the site.** Open your homepage, contact form and checkout. Then follow the checks further down this page. 6. **Review your user list.** Most of the other 21 problems [need a logged-in account](https://patchstack.com/articles/wordpress-7-1-4-security-release/), usually Contributor or higher. Remove accounts nobody uses. > **Warning:** If your site may already have started the update, do not panic and do not stop it halfway. Let it finish, then run the checks below. ## How do you block the wp-content/upgrade folder? Block the folder at the web server, because [a firewall plugin will not catch this request](https://patchstack.com/articles/wordpress-7-1-4-security-release/). WordPress works with this folder directly on disk, so the researcher says blocking web access does not break updates. On **Nginx**, add this to your site's server settings: ```nginx location ^~ /wp-content/upgrade/ { deny all; } ``` On **Apache**, if you can only edit `.htaccess`, add this line to the `.htaccess` file in your main WordPress folder. Place it above the WordPress rewrite rules: ```apache RedirectMatch 403 ^/wp-content/upgrade/ ``` Do not put a new `.htaccess` file inside the upgrade folder itself. The old updater [clears that folder](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html) before it unpacks an update, so your file would vanish when you need it. These commands come from the researcher's published advice. If you are not comfortable editing server settings, send this page to your hosting company and ask them to apply it. ## Which update path fits your setup? The right path depends on how your site is hosted. Use this table to choose. | Your situation | What to do first | Watch out for | | --- | --- | --- | | Managed WordPress hosting | Ask support whether the folder is already blocked and whether you are patched | Do not assume. Get a clear yes | | Shared hosting with `.htaccess` access | Add the Apache rule, test for a 403, then update | Keep a copy of the original `.htaccess` | | Your own server or VPS | Add the server rule, reload the server, test, then update | `wp core update` is no substitute, as it uses the same updater | | Automatic updates turned on | Check your version. You may already be fixed | The update could have run before you blocked the folder, so run the checks | | A very old site or custom theme | Copy it to a test site first | An update jump can break old plugins | | WordPress 4.6 or older | Do not wait. Plan an upgrade or rebuild | No security fix exists | _Choosing the safest update path for WordPress 7.1.4._ ## How do you check if your WordPress site was hacked? Check for the warning signs below, especially if your site stayed on an affected version after October 28. Wordfence [suggests looking for](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html) these four things: - Unexpected requests to PHP files under `wp-content/upgrade` in your server logs - Administrator accounts nobody recognizes - Plugins nobody installed - PHP files inside `wp-content/upgrade` that nobody put there If you or your developer use the command line, [`wp core verify-checksums`](https://developer.wordpress.org/cli/commands/core/verify-checksums/) compares your core WordPress files with the official versions. It does not check plugins, themes or uploaded files, so a clean result is only part of the answer. If you find something suspicious: 1. Keep your logs and a copy of the site. They show what happened. 2. Restrict access to the site and change all admin, hosting and database passwords. 3. Remove unknown admin accounts and check scheduled tasks. 4. Restore from a backup made before the problem began, or rebuild from trusted files. ## Is WordPress still safe to use? WordPress is still a reasonable choice when someone actively maintains it, but this year shows that it cannot be left alone. This was [the fourth WordPress core flaw](https://webhosting.today/2026/11/04/cisa-lists-a-fourth-wordpress-core-flaw-since-july-wordpress-rates-this-one-low/) CISA has listed since July 2026. A safer WordPress routine is simple: - Keep automatic updates on unless you have a clear reason not to. - Install only the plugins you really use, and remove the rest. - Give each person the lowest role that lets them do their job. - Keep tested backups stored away from your website. - Have a named person responsible for updates and security checks. If nobody on your team has time for this, our [website care and content service](/services/website-content-management) can take it over. If your old site has become too costly to keep safe, a [new, faster website](/services/website-development) may be the better answer. ## When should you ask for help? Ask for help if you see any warning sign above, if your site runs an old branch, or if you cannot edit server settings. Hacks often get worse when someone guesses their way through a cleanup. Unsure where your website stands? Run it through our [free website tools](/tools), or [book a free 30-minute call](/contact) and we will tell you honestly what needs attention. ## Sources - [WordPress 7.1.4 release notes and fixed versions](https://wordpress.org/support/wordpress-version/version-7-1-4/) - [CISA Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [BleepingComputer: CISA flags the WordPress flaw](https://www.bleepingcomputer.com/news/security/cisa-flags-wordpress-rce-flaw-as-actively-exploited-in-attacks/) - [The Hacker News: exposure during the update and how to block it](https://thehackernews.com/2026/11/installing-fix-for-exploited-wordpress.html) - [Patchstack: WordPress 7.1.4 security release](https://patchstack.com/articles/wordpress-7-1-4-security-release/) - [Webhosting.today: the severity disagreement](https://webhosting.today/2026/11/04/cisa-lists-a-fourth-wordpress-core-flaw-since-july-wordpress-rates-this-one-low/) - [WordPress: how to update safely](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/) - [WP-CLI: verify-checksums](https://developer.wordpress.org/cli/commands/core/verify-checksums/) ## Frequently asked questions ### Do I need to update to WordPress 7.1.4? You need 7.1.4 or the fixed release for your branch. For example, a site on the 6.8 branch is fixed at 6.8.12. WordPress recommends updating immediately. Moving to the latest version is still the best long-term choice, because only the newest version receives full active support. ### Is my WordPress site affected by CVE-2026-119977? Your site is affected if it runs WordPress 4.7 through 7.1.3 and has not received the fix for its branch. Look at Dashboard then Updates to see your version. If automatic updates are on, you may already be fixed, but it is worth confirming the version number yourself. ### Why can installing the fix expose a site? The update is unpacked by the old code already on your site. On WordPress 5.9 or later, that old code can use a predictable temporary folder name one last time. Blocking web access to the wp-content/upgrade folder before updating closes this short window, according to the researcher who found the flaw. ### Are automatic WordPress updates safe? Automatic updates are still the better choice for most sites, because a site that stays unpatched remains exposed for longer. The short risk during this one update also applies to automatic updates. After 7.1.4 or a branch fix is installed, later updates use a random temporary folder name, which removes that weakness. ### How do I check if my WordPress site was hacked? Look for administrator accounts nobody recognizes, plugins nobody installed, unknown PHP files in wp-content/upgrade, and unusual requests to that folder in your server logs. A developer can also run wp core verify-checksums, but that only checks core files. It does not prove your plugins, themes or uploads are clean. ### Is WordPress safe to use in 2026? WordPress can be safe when someone keeps it updated, limits plugins, controls user roles and keeps tested backups. It is risky when left alone. CISA has listed four WordPress core flaws since July 2026, so regular maintenance matters more than ever for any business that depends on its site.