WordPress guides

How to look after a WordPress site yourself: updates, backups, security, speed and the jobs that come up between them. Each guide says what to do, in what order, and what to check afterwards.

Looking at an error message? See the error fixes

admin-ajax.php high CPU usage in WordPress: how to find what is calling itadmin-ajax.php is the address WordPress, plugins and themes use for background requests. High CPU from it means something calls it too often, or one kind of call is slow. Find the action behind the requests, fix whatever sends it, and do not block the file.
AI bots slowing down your website: how to confirm it on WordPress and what to do, mildest firstCount the requests in the server's access log by user agent. If AI crawlers lead, ask them in robots.txt to stay out of the addresses that cost the most, answer named crawlers with 429 while the server is overloaded, and block one outright only if it keeps coming.
Bing Webmaster Tools for WordPress: setup, IndexNow, and what it means for ChatGPT and CopilotMicrosoft documents that Copilot rests on Bing's index. OpenAI documents its own crawler and does not say a site must be in Bing. Bing Webmaster Tools is free, a WordPress site is verified with one tag or one file, and its AI report shows phrases that Google's does not.
Business not showing on Google Maps: what to check, in orderSearch Google Maps for the business's exact name and town. If it is missing, the cause is one of a short list that Google's help names: no Business Profile, an unverified one, a suspension, another owner, a duplicate, or a business its guidelines do not cover.
Generative engine optimization (GEO): what is documented, what was studied and what is guessworkGenerative engine optimization (GEO, also sold as AEO or AI SEO) is the work of getting a site quoted in AI answers. What the engines document is short. Let their search crawlers in, keep pages indexable, put answers in visible text. The rest is a study or guesswork.
Google Business Profile suspended: what it means, why it happens and how to appealA suspended or disabled Business Profile is one Google has taken down for not following its guidelines. The public cannot open it and its owner cannot act on it. Check it against the guidelines, gather documents, then appeal once in Google's appeals tool from the account that manages it.
How long a new WordPress site takes to show up on Google, and what to do on day oneGoogle's help says crawling and indexing a new page takes from a day or two to a few weeks, typically, and to allow at least a week after you submit a sitemap or ask for indexing. Nothing shortens that. Day one is for making sure the wait is only a wait.
How long does SEO take? The times Google states, and the ones it does notNo single number answers it, and nobody who gives one is quoting Google. Google's page on hiring an SEO once said four months to a year and no longer does. What Google states today is how long crawling, indexing and a site move take, each as a range.
How often should you update WordPress, plugins and themes?Keep two clocks. A security release goes on as soon as you reasonably can, and WordPress installs its own in the background. Everything else waits for a regular round, weekly or monthly, set by how much on the site can break and what a break costs. Never leave it for months.
How to add local business schema to WordPress without a pluginSave one PHP file in wp-content/mu-plugins and WordPress prints a LocalBusiness block, as JSON-LD, on the page that shows your business details. Google requires a name and an address and recommends hours, a phone number, a URL, coordinates and a price range.
How to appear in Google AI Overviews: what Google requires and what keeps a WordPress page outGoogle says a page needs nothing extra to appear in AI Overviews or AI Mode. It has to be indexed and allowed a snippet. On WordPress the work is checking that nothing takes a page out, such as a noindex, a snippet rule or the Search generative AI control in Search Console.
How to audit a WordPress site for security weaknessesA security audit is a written inventory of a working site. It covers what is installed, who can log in, how the site is configured, what it shows from outside, whether a backup restores, and who holds the hosting and domain logins. Each finding gets a date to fix it or a reason to accept it.
How to block AI crawlers on WordPress, or let them in: robots.txt, Cloudflare, hosts and pluginsAI companies send different crawlers for training, for search and for fetching a page someone asked about. A WordPress site can refuse one kind and admit the others in robots.txt. A CDN, a host or a plugin can also block them where robots.txt does not show it.
How to change WordPress permalinks without breaking your old linksWordPress keeps no record of a permalink structure you leave. After a change, some old post addresses are forwarded by a guess and the rest answer 404. A move from a dated structure to Post name answers 404. Add one 301 rule for the old pattern, then check an old address.
How to clean up and optimize a WordPress database, and what it does for speedCleaning a WordPress database makes it smaller and its backups quicker. Do not count on it for faster pages. The database work that can affect speed is trimming autoloaded options and adding a persistent object cache. Back up first, because a delete cannot be undone.
How to deactivate WordPress plugins when you are locked out of the dashboardYou can switch plugins off without the dashboard. Use the recovery link WordPress emailed you, WP-CLI, a renamed plugin folder or, last, the list of active plugins in the database. Each keeps the plugins' settings. Then log in and activate them one at a time.
How to enable gzip and Brotli compression in WordPressText compression is switched on at the web server or at a CDN in front of it. Check first, with curl or the browser's network panel, because it may already be on. If it is not, turn it on at the host, in a caching plugin, in .htaccess on Apache, or in nginx's configuration.
How to fix Cumulative Layout Shift (CLS) in WordPress: find what moves and reserve its spaceCLS adds up how far visible content jumps without the visitor causing it. On WordPress the cause is nearly always an image, embed or ad with no space reserved, a web font swapping in, a notice added at the top, or an animation. Find what moves, then reserve its space.
How to fix Interaction to Next Paint (INP) on a WordPress siteINP is how long a page takes to show a response to a tap, a click or a key press, reported close to the worst one of a visit. A page that loads fast fails it when JavaScript keeps the browser busy. Find the slow interaction, then remove, delay or split the script behind it.
How to fix Largest Contentful Paint (LCP) in WordPress: find the slow part, then fix itLCP is the time until the largest image or block of text in the first screen is drawn. It is slow because the server answered late, the browser found the image late, the image downloaded slowly, or drawing was held up. Find which part it is, then fix that one.
How to fix render-blocking CSS and JavaScript in WordPressA render-blocking file is a stylesheet or script the browser must fetch and process before it draws the page. Find the files in the audit, defer the scripts that can wait, stop loading what a page does not use, and check the page after every change.
How to maintain a WooCommerce store: before every update, every week, every month and before a saleA store needs the upkeep of any WordPress site, plus what only a store has. Orders arrive all day, the checkout can fail while every page looks right, and WooCommerce has its own database update, templates and background jobs. This page gives a routine for each.
How to migrate a website without losing SEO: what Google and Bing documentRankings are lost in a move when addresses change and nothing tells search engines where each one went, or when a page's content does not arrive. Redirect every old address to its nearest equivalent with a 301, carry the content across, and expect a dip while the site is recrawled.
How to migrate a WordPress site to a new host without downtimeMoving WordPress to a new host is a copy of two things, the files and the database, a test of that copy before any visitor is sent to it, and one DNS change. The old site keeps serving visitors until the new one is proven.
How to migrate from Shopify to WooCommerceYes, you can do it yourself. Shopify exports products, customers and orders as CSV files, and WooCommerce imports them. Customer passwords do not move, the design is rebuilt, and nearly every address changes, so each old one needs a redirect before the domain is switched.
How to migrate from Squarespace to WordPressSquarespace exports layout pages, one blog with its posts, and text and image blocks as a file the WordPress importer reads. Products, further blogs, galleries, video and the design are left out and are rebuilt. Redirect each old address before you change the domain.
How to migrate from Webflow to WordPressWebflow exports each CMS Collection as a CSV file and, on a paid Workspace plan, the site's HTML, CSS and JavaScript. Neither is a site WordPress can import. The content is carried across, the design is rebuilt, and every old address is redirected.
How to move from WordPress.com to self-hosted WordPressWordPress.com is a hosting service that runs WordPress for you. Self-hosted WordPress is the same software on hosting you rent. Moving is an export, an import and a redirect of the old address. Paid WordPress.com plans now install plugins, so check first that you need to move.
How to move WordPress to a new domain and keep your links and search trafficA domain move is four jobs. Make the site answer at the new name, rewrite the old name wherever it is stored, redirect every old address to the same path with a 301, and tell search engines. Keep the old domain registered, because the redirect has to stay for a long time.
How to price WordPress care plans: find your floor, find the ceiling, then build tiersA care plan's price has a floor and a ceiling. The floor is what one site costs you each month, with the bad months counted. The ceiling is what the site's upkeep is worth to the client. Work out both from your own numbers, price between them, and check what is left.
How to remove malware from a hacked WordPress siteTake the site offline, keep a copy of it as it is, and change every password and the secret keys. Then restore a backup from before the break-in, or replace WordPress and every plugin with clean copies and check what is left. Finish by finding and closing the way in.
How to request ownership of a Google Business Profile that someone else controlsAsk whoever holds the profile to add you as an owner and make you primary owner. If they cannot or will not, use Google's Request Access form at business.google.com/add. The current owner gets 3 days to answer, and after that Google may let you claim and verify the profile yourself.
How to safely update WordPress, plugins and themesBack up the database and the files, check that the backup is usable, then apply one update at a time and look at the site after each. When something breaks you know which update did it, and you have a copy to go back to.
How to sell WordPress care plans: when to offer one, what to say and how to answer objectionsA care plan sells when it is offered at the right moment, described as outcomes the client already wants, and written so the client can see what is and is not included. The hardest moment to sell one is after launch, as an afterthought.
How to set up two-factor authentication in WordPressInstall the Two Factor plugin, turn on an authenticator app and backup codes in your profile, and test the login before you close the window you are in. Keep the backup codes away from your phone. They are how you get back in when the phone is lost.
How to set up WooCommerce email notificationsWooCommerce sends each order email when an order reaches a certain status, to the store or to the customer. Set the recipients and the sender under WooCommerce, then Settings, then Emails, send through a mail service that vouches for your domain, and read WooCommerce's email log when one is missing.
How to speed up a slow WordPress site, in the order that pays offMeasure the pages that matter first. Then work down the list in order. Check the PHP version and the hosting, add a page cache, fix the images, cut plugins, look at the theme, add a CDN, and tidy the database last. Change one thing at a time and measure again.
How to speed up a WooCommerce storeA store is harder to make fast than a blog because the cart, checkout and account pages are built fresh for every customer. Cache every page that can be cached, keep those three out, and make the rest cheap to build with suitable hosting, an object cache and a tidy database.
How to stop AI training on your WordPress content and stay in AI search answersYou can ask the crawlers that collect for AI training to stay out, one company at a time, and stay in most assistants' search answers. The request is a robots.txt group or, at Microsoft and Amazon, a noarchive tag. It is not a lock, and it does not take back what was already collected.
How to switch from Elementor to the WordPress block editor (Gutenberg)Neither Elementor nor WordPress has a converter that turns an Elementor page into equivalent blocks. With Elementor switched off, a page shows only a plain copy of its text and images. So the move is a rebuild, page by page, and it can be done gradually while the site stays live.
How to take over a WordPress site when your web developer has disappearedA website is three things with three owners of record. They are the domain name, the hosting account and the WordPress administrator account. Recover them in that order, through the registrar, the host and WordPress's documented reset methods, because each one unlocks the next.
How to update WooCommerce safely: before, on staging, on the live store, and if it breaksRead the release notes, check your extensions and template copies, and back up. Update a staging copy and place a test order there. On the live store, close the checkout, back up again, update, test, then reopen. With the checkout closed, going back costs no orders.
How to use WP-CLI to manage a WordPress siteWP-CLI runs WordPress jobs from the server's command line. Connect over SSH, run wp --info to see whether it is installed, and add it if it is not. Then update, back up, repair and inspect the site with short commands, even when the dashboard will not load.
llms.txt on WordPress: what it is, who reads it and whether your site needs onellms.txt is a proposed markdown file at /llms.txt that lists a site's main pages for AI agents. It is not a standard. Google says Search ignores it, and no AI company's crawler page says its crawler reads yours. An SEO plugin may already have made one, so check first.
Location pages for multiple cities in WordPress: where Google's spam policy puts the limitA real branch deserves a page of its own. A page for each town that differs only in the town's name is what Google's spam policies describe as doorway abuse. In WordPress, make each branch a child page of one Locations page, and compare any two pages with the place names removed.
Locked out of WordPress admin: find which lockout you have and get back inWhat the login screen shows tells you which lockout you have. A refused password, a missing reset email, a blocked address, a lost second step, a moved login page and a missing administrator account each have their own way back in. Find yours in the table, then follow that fix.
Mismatched value (page crawl) for price in Merchant Center: finding the cause on a WooCommerce storeGoogle compares the price in your product data with the price in the HTML of the product's landing page and in its structured data, and can disapprove the item when they differ. On a WooCommerce store the usual causes are a variation's address, a sale that ended, tax, currency and a cached page.
Missing field "brand" and "No global identifier provided" in WooCommerce: what they mean, how to fix themBoth notices name properties Google lists as recommended for a merchant listing, not required, so the product stays valid. WooCommerce prints gtin from its "GTIN, UPC, EAN, or ISBN" field and brand from the brand assigned to the product. Fill both in. Where a product has no GTIN, leave it empty.
Missing field "hasMerchantReturnPolicy" and "shippingDetails" in WooCommerce: what they mean and three fixesBoth are recommended properties of a merchant listing, not required ones, so the product stays valid. WooCommerce prints neither. Settle them with shipping and return settings in Search Console or Merchant Center, with markup added through a WooCommerce filter, or with an extension.
NAP consistency: what Google says about name, address and phone, and one place to keep them in WordPressGoogle asks for a business's real-world name, an accurate address and a phone number the business controls. Its guidelines and its local ranking page say nothing about directory listings having to match. On your own WordPress site, keep the three in one place so no copy goes stale.
Questions to ask an SEO company before you hire one, and what a good answer sounds likeAsk an SEO company what it will do, in writing, what access it needs, what it promises, where links and reviews come from and what you keep when you leave. Google's own advice to buyers is the spine. Nobody can promise a ranking, and an audit needs only read access to Search Console.
Review stars not showing in Google for a local business: Google's rule, and what to do insteadGoogle does not show review stars for a rating of a business that sits on the business's own website, in its markup or in an embedded reviews widget. It has said so since September 16, 2019. A local business's stars appear on its Business Profile, from reviews people leave on Google.
Service area business SEO: Google's rules for the profile, and a website with no address to showA business that travels to its customers gets one Google Business Profile, with its address hidden and up to 20 service areas. Its website needs no street address. It should say who you are, what you do, the area you cover, your phone number and the hours you answer.
Should you outsource WordPress maintenance? A decision guide for agencies and freelancersOutsource WordPress maintenance when the work is routine, repeats across many client sites and does not need what you know about the client. Keep the relationship, the decisions about each site and anything the client expects from you in person.
Slow WordPress admin: how to find the cause and fix itThe dashboard is never served from a page cache, so every screen waits on PHP and the database. Time one slow screen, read it in Query Monitor, then check outside requests, database queries, the object cache, PHP, Heartbeat, WP-Cron and the host, in that order.
Staging site indexed by Google: how to remove it and keep the next copy outPut a password on the staging site, or a noindex that Google is allowed to read, then ask for removal in Search Console's Removals tool, which lasts about six months. Do not rely on Disallow in robots.txt. Google says not to, and it stops a noindex from being read.
Traffic dropped after a website redesign: what to check on a WordPress site, in orderA redesign cuts search traffic in four ways. The new site is closed to search engines, old addresses answer 404, old addresses redirect to the wrong page, or the pages that brought visitors are gone. Three can be read off the site in minutes. The fourth takes Search Console.
What "Discourage search engines from indexing this site" does in WordPress, and how to turn it offThe box under Settings, then Reading, puts a noindex, nofollow robots tag on every page and switches off the sitemap at /wp-sitemap.xml. It writes nothing into robots.txt. Untick it and save, or run wp option update blog_public 1, then read a page's source to confirm the tag is gone.
Why the WooCommerce dashboard is slow, and how to find the causeThe WooCommerce dashboard is built by the server on every click, with no page cache to help. Measure one slow screen with Query Monitor, then check order storage, the Scheduled Actions queue, the options table, Analytics, the object cache, plugins and the server, in that order.
WooCommerce category page SEO: what a product category tells Google, its pagination and its addressWith no SEO plugin, a WooCommerce category page prints its name as title and heading, your description and a breadcrumb trail, and no canonical link or meta description. Its pagination is set out as Google asks. What it lacks is words for the shopper and links from the rest of the store.
WooCommerce coming soon mode: how to check it, launch your store, and what Google is sent meanwhileComing soon mode shows a placeholder in place of a WooCommerce store, or the whole site, to everyone except a signed-in administrator or shop manager. A new store starts in it. To launch, choose Live under WooCommerce, Settings, Site visibility, or run wp option update woocommerce_coming_soon no.
WooCommerce database update required: what the notice means and how to finish it safelyWooCommerce's files were updated and its tables and stored settings have to be brought to the same version. Back up the database, start the update once and let it finish in the background. Since WooCommerce 9.9 it starts by itself, so the backup belongs before the plugin update.
WooCommerce filter URLs indexed in Google: ?orderby, ?filter_ and add-to-cart addresses, and what to doA WooCommerce store answers at extra addresses for one list of products, such as ?orderby=, ?filter_, ?min_price=, /page/2/ and ?add-to-cart=. Each returns the page with no canonical link and no noindex. A small store can leave them. To stop the crawling, add robots.txt rules for the parameters.
WooCommerce out of stock and discontinued products and SEO: leave, hide, delete or redirectAn out-of-stock WooCommerce product keeps its page. The address still answers 200 and its structured data changes to OutOfStock, so a product that is coming back needs nothing done. One that is gone for good is redirected to a true replacement or left to answer 404, never sent to the home page.
WooCommerce products not showing on Google: what to check, in orderFirst settle where the products are missing. Ordinary results need a product page Google can index, rich product results need product data on that page, and the Shopping tab needs the product in a Merchant Center account. Then check the store in that order.
WooCommerce variations and SEO: variation URLs, canonical links and the price in structured dataA WooCommerce variable product has one address. Each variation is that address with attribute parameters added, and it carries a canonical link back to the product, so it is not a duplicate to fix. The product's markup gives a price range. A variation's address gives that variation's price.
WordPress attachment pages indexed in Google: why they exist and how to switch them offWordPress gives every uploaded file a page of its own, and Google can list those thin pages. Since WordPress 6.4 one option, wp_attachment_pages_enabled, turns them into redirects to the file. A new site has them off. A site upgraded from an older version still has them on.
WordPress coming soon page and SEO: what Google is given, and what to answer while a site is closedA coming soon page that answers 200 is an ordinary page, and Google may index it as the site. For a live site closed for a day or two, Google says to answer 503. WordPress's own maintenance mode does, with Retry-After set to 600. One curl command shows what yours answers.
WordPress maintenance checklist: what to do every week, month, quarter and yearLooking after a WordPress site is a short weekly round of updates, a look at the site and a check that backups ran, plus slower checks every month, quarter and year. For each task, this page says where it is in WordPress and what fine looks like.
WordPress robots.txt: where it is, what it says by default and how to edit itA fresh WordPress has no robots.txt file. WordPress answers the address itself, with three lines about /wp-admin/ and a Sitemap line. Change it with a real file in the site's root, which replaces that answer, or with the robots_txt filter, which adds to it.
WordPress search results pages (/?s=) in Google and Search Console: what they are and what to doAn address with ?s= or /search/ in it is your site's own search page, asked for with someone else's words. WordPress puts noindex on every search page, so Google reads it and leaves it out. Check that your site prints the tag. Nothing was added to the site.
WordPress SEO without a plugin: what WordPress already does and what it leaves outWith no SEO plugin, WordPress still prints a title, a robots tag and a canonical link, serves a sitemap and a robots.txt, and redirects duplicate addresses. It prints no meta description, no sharing tags and no structured data. Google's documentation calls none of those three required.
WordPress site not showing up on Google: what to check, in orderSearch Google for site:yourdomain.com first. If nothing comes back, the site is either new or keeping Google out, through the "Discourage search engines" box, another noindex, a robots.txt rule, or a home page that does not answer with a 200. Check them in that order.
wp-sitemap.xml: the sitemap WordPress makes, why it answers 404, and which one to submitWordPress has made its own sitemap at /wp-sitemap.xml since version 5.5. It answers 404 while search engines are discouraged or a filter has switched it off, and it redirects when an SEO plugin has replaced it. Submit one sitemap, the one on the Sitemap line of your robots.txt.
www vs non-www for a WordPress site: which to choose, and how to make every other form redirect to itGoogle's documentation prefers https over http and states no preference between www and the bare domain. It says to pick one address and redirect the others. WordPress redirects www against non-www for its own pages and nothing more. The rest is a rule on the server.
"Deceptive site ahead" on a WordPress site: what the red warning means and how to get it liftedThe red full-page warning comes from Google Safe Browsing, which most browsers consult. Google found phishing, malware or unwanted software on your site or loaded by it. The warning goes only after the cause is removed and Google has reviewed the site.
Does your web host maintain your WordPress site? What hosting covers and what is left to youA host is responsible for the server. What happens inside WordPress is mostly yours unless your plan says otherwise. Managed WordPress hosting covers more than shared hosting, but rarely everything. Your host's own support scope page settles it in about ten minutes.
GDPR and WordPress: what the site collects and what to set upA WordPress site collects personal data through comments, forms, accounts, orders, tags from other companies and its server logs. WordPress has a privacy policy page, an export tool and an erase tool. The rest is an inventory, a reason for each thing kept, consent and retention.
Hosting account suspended for malware: how to get your WordPress site backA host suspends an account to stop a hacked site harming others, and restores it when you show the cause is gone. Ask the host for three things. They are the list of what it found, access to the files and the database, and the steps of its review.
How to add security headers to a WordPress siteSecurity headers are lines a server sends with each page that tell the browser how to treat it. Add X-Content-Type-Options, Referrer-Policy and a frame rule first, then HSTS with a short max-age, and Content-Security-Policy last, in report-only mode.
How to change the WordPress login URL, and what it does and does not protectWordPress has no setting for its login address, so a plugin moves it. That cuts down automated requests to wp-login.php. It does not make a password harder to guess, and xmlrpc.php stays where it is. Save the new address before you log out.
How to check whether your WordPress site has been hackedCheck from outside first, with Google's Security issues report, its Safe Browsing page, a site search and the page as Google is served it. Then check inside, from administrators and checksums to uploads and the access log. Clean results lower the odds and do not prove the site is clean.
How to choose a WordPress maintenance service: what to compare and what to askPut the same written questions to each service, then check the answers against what you can see yourself. What separates one from another is what happens after an update, whether a restore is included, the hours a person replies in, and what you keep when you leave.
How to choose a WordPress plugin, and try it without risking your siteRead the plugin's WordPress.org listing for signs that someone still looks after it, and for the WordPress and PHP versions it supports. Then install it on a staging copy, one plugin at a time, and check the site before it goes anywhere near the live one.
How to disable XML-RPC in WordPress, and when to leave it onxmlrpc.php lets outside programs reach WordPress, and Jetpack and the mobile apps still use it. If nothing on your site does, switch off its login methods with a filter, remove its pingback methods, or refuse the file at the web server. Check the access log first.
How to install a free SSL certificate on WordPress and move the site to HTTPSGet a free certificate from your host's control panel, or with Certbot on a server you run yourself. Check that the https address works, change WordPress's two addresses to https, redirect http with a 301, then clear what is left over.
How to lazy load images and videos in WordPressWordPress already lazy-loads images and iframes with the browser's own loading attribute, so images need no plugin for it. The work is checking that it runs, keeping the main image at the top of the page out of it, and handling background images and video.
How to minify CSS and JavaScript in WordPress, and when it is worth doingMinifying strips comments and spacing from CSS and JavaScript files so they download smaller. Switch it on in an optimization plugin, one setting at a time, on a staging copy. WordPress already ships its own files minified, so measure what is left to gain first.
How to move WordPress from a subdirectory to the root of your domainTwo jobs share this name. To show the site at the root while its files stay in the folder, change "Site Address (URL)" and copy index.php and .htaccess to the root. To remove the folder, change both addresses, move the files, replace the old address in the database and redirect the old folder.
How to reduce server response time (TTFB) in WordPressTime to First Byte is the wait before a page's answer starts to arrive. Time it in phases, with and without the cache, to see whether the connection or WordPress is slow. Then fix that part, starting with a page cache, an object cache and the PHP version.
How to schedule automatic WordPress backupsA backup schedule can live at your host, in a backup plugin or in a cron job on the server. Whichever you use, it has to copy the database and the files, send them off the server, and be restored once to a staging copy as proof.
How to set up redirects in WordPress: plugin, server or codeUse a 301 redirect when an address has changed for good. Set it in one of three places, a redirect plugin, the web server's configuration or a few lines of code, then check that the old address reaches the new one in a single hop.
How to turn on WordPress debug mode, read the log and turn it offPut three lines in wp-config.php that set WP_DEBUG to true, WP_DEBUG_LOG to true and WP_DEBUG_DISPLAY to false. Errors then go to wp-content/debug.log and stay off the page. Read the newest lines, set WP_DEBUG back to false and delete the log.
Is WordPress maintenance worth it? When a plan earns its fee and when it does notIt depends on what the site earns or would cost you while down or defaced, how much on it can break, and whether someone already does the upkeep. A small brochure site with a careful owner does not need a paid plan. A store, or a site nobody looks after, usually does.
The EU Cyber Resilience Act and WordPress: who it applies to and whenThe Cyber Resilience Act puts its duties on those who supply software on the EU market in the course of a commercial activity, not on a site owner who only uses WordPress. Reporting duties for manufacturers began on 11 September 2026. The rest applies from 11 December 2027.
The Japanese keyword hack on WordPress: spam pages in Google and how to get them outSomeone has added pages to your site, or made it answer Google differently than it answers people, to sell links and traffic. Clean the site until every spam address answers 404. Then clear Google's index with the Removals tool, a clean sitemap and a review. They are two separate jobs.
Unknown admin user in WordPress: what it means and how to remove it properlyAn administrator nobody created means someone had the power to make one. Deleting it removes the symptom and leaves the way in. Rule out the innocent explanations, list every account from the database, record what you find, then remove it while you close the hole.
What WordPress maintenance includes, and how to check that it was doneWordPress maintenance is five jobs. Updates with a look at the site afterward, backups kept off the server and proven by a restore, uptime monitoring, security scanning, and a report. Each leaves a trace you can check yourself. Hosting, redesigns, new features, writing and SEO are separate work.
Why your WordPress site keeps getting hacked, and what finally stops itA WordPress site that is reinfected was either never fully cleaned or is still open the way it was first entered. There are eight reasons, and each one can be checked. A rebuild from clean sources, then new credentials, then updates, deals with them in order.
WooCommerce schema markup: what your store outputs and how to fill the gapsWooCommerce prints product structured data on its own, with the name, price, stock status and rating. Test a product page with Google's Rich Results Test, fix any error, then add what is missing, such as a GTIN, a brand, and shipping and return details. Markup does not guarantee a rich result.
WordPress file permissions: what the numbers mean and what to setWordPress's own guidance is 755 for folders, 644 for files and 440 or 400 for wp-config.php, with every file owned by your hosting account. Nothing should be 777. Who owns the files matters as much as the numbers.
WordPress hosting problems: how to tell whether the fault is the host or the siteA fault is the host's when it sits in the account, the server, the plan's limits, the mail program or the firewall. It is the site's when it follows a change you made or clears with plugins off. The message on the screen usually says which, and one check settles the rest.
WordPress image optimization plugins compared: what each one does and how to chooseAn image optimization plugin compresses images, converts them to WebP or AVIF and decides how they are served. Seven compared on where the work is done, what happens to your originals, what the free version stops at and what is left if you remove the plugin.
WordPress site redirecting to another site: how to tell a hack from a setting, and what to do firstA redirect to a site you did not choose is a sign of a hacked WordPress, but a redirect rule, the site address settings, an expired domain or the visitor's own device can look the same. Check what a visitor is served, look where redirects are planted, and delete nothing until you have a copy.
How to add custom CSS to WordPressFor a few rules, use the "Additional CSS" box that WordPress provides, in the Customizer on a classic theme or in the Site Editor's Styles panel on a block theme. For a long stylesheet, use a child theme. Never edit the theme's own files, because its next update overwrites them.
How to change your WordPress URL without locking yourself outChange "WordPress Address (URL)" and "Site Address (URL)" under Settings, then General, or set them in wp-config.php or with WP-CLI. Then replace the old address stored in your content, redirect the old address to the new one, and tell search engines if the domain changed.
How to create a WordPress child themeA child theme takes its design and features from another theme, its parent, and holds your changes to it, so the parent can be updated without losing them. It needs a folder and one file, style.css, whose Template line names the parent theme's folder.
How to find and fix a WordPress plugin conflictSwitch every plugin off and check that the fault is gone. Then switch them back on in halves until it returns. The plugin whose return brings the fault back is the cause. Update it, go back a version or replace it, and report the fault to its author.
How to migrate from Wix to WordPressWix has no export for a whole site, so a move to WordPress is part import and part rebuild. Products, contacts and orders leave Wix as CSV files. Pages, most blog posts and the design are rebuilt by hand, and every old address is redirected.
How to migrate from WooCommerce to ShopifyProducts and customers move from WooCommerce to Shopify as CSV files. Past orders need a migration app or Shopify's API. Passwords, your theme and what your plugins did do not move, and every old address needs a redirect because Shopify's address patterns are fixed.
How to optimize WordPress images without losing qualityUpload each image at the size it is shown and in the format that suits it. WordPress then makes several sizes, lets the browser pick one and lazy-loads the rest. Add one plugin to compress and convert, back up before running it over old uploads, and check a real page.
How to protect WordPress from brute force attacksA brute force attack is a program trying one password after another on your login page or on xmlrpc.php. Strong unique passwords and two-factor login make the guessing fail. Login limits, a firewall and server rules cut down how much of it reaches the site.
How to remove the OBJ box from a WordPress title or postThe "OBJ" in a dotted box is an invisible Unicode character, the object replacement character, that came in with pasted or dictated text. Delete it in the editor, check the title and the SEO fields, and paste as plain text from then on.
How to set up a CDN for WordPressA CDN keeps copies of your site's static files on servers near your visitors. Put one in front of the whole site through DNS, as Cloudflare works, or serve only static files from a second hostname with a plugin. Then check HTTPS, the response headers and the checkout.
How to set up a WordPress staging siteA staging site is a private copy of your site at its own address, for trying changes before visitors see them. Use your host's staging tool if there is one, a plugin if not, or copy the site to a subdomain by hand. Then stop the copy from emailing customers or taking payments.
WooCommerce vs Shopify: when to switch, and when to staySwitch when you need something the other platform does by design and yours does not. Shopify runs the hosting for you and fixes parts of the store. WooCommerce leaves both the upkeep and the control with you. Slow pages, plugin conflicts and update work can be fixed without moving.
WordPress backup plugins compared: what each one does and how to chooseA backup is worth having when it is kept off the server, holds the database and the files, runs on a schedule and has been restored once as a test. Five plugins compared on those points, with what each gives free and what it charges for.
WordPress caching plugins compared: what each one does and how to chooseA page cache saves each finished page and serves that copy, so WordPress does not rebuild it for every visitor. Check whether your host already runs one before you add a plugin. Five caching plugins compared on how they cache, what is free and what each one needs.
WordPress Core Web Vitals: what LCP, INP and CLS measure and how to improve themCore Web Vitals are three figures from real visits. LCP is how soon the main content appears, INP is how fast the page reacts, and CLS is how much it shifts. Find the one that fails in field data, then fix its usual cause, such as a slow server, a late image, missing dimensions or heavy scripts.
WordPress firewalls compared: plugin, DNS-level or host, and how to chooseA WordPress firewall is a plugin on your server, a service that sits in front of your site, or a filter your host runs. Where it sits decides what it can stop and what it costs to set up. Choose the place first, then the product.
WordPress security plugins compared: what each one does and how to chooseA security plugin scans for malware, guards the login page, switches on hardening settings, filters requests and keeps a log. It does not replace updates, backups or good passwords. Choose by where it does its work and by what its free version leaves out, and run only one.
WordPress security: what to do, in order of what matters mostKeep WordPress, plugins and themes updated, give every account a strong unique password and two-factor login, and keep a backup you have restored at least once. Those three do most of the work. Roles, HTTPS, file hardening and a firewall come after them.
WordPress vs Shopify for SEO: what each one lets you controlNeither platform ranks better by itself. Google's requirements are about the page, not the software behind it. WordPress and Shopify differ in how much of a page's address, markup and speed you control, and in who does the upkeep.

Would you rather not do it yourself?

Tell us what the site needs. We reply with what we found and a fixed quote, and the diagnosis is free.

Get a free diagnosis