Category: How-to Tutorials

A plugin updates overnight. In the morning the checkout buttons are in the wrong place, or the site shows a critical error. The obvious response is to switch off automatic updates and approve everything by hand from now on.

That works if you pick the right control, and if someone really does apply security fixes afterwards. WordPress has at least four separate update controls. Your host may run a fifth that ignores all of them. Most “I turned it off and it still updated” threads come from changing a setting that doesn’t govern the update the person wanted to stop. If an update has already failed or left the site half-updated, fix that first with our guide to failed WordPress updates. Then come back here and decide on a policy.

Which switch stops which update

Each control covers one kind of update. Pick the one that matches what you want to stop.

What you want to stop	Control	Where
One plugin or one theme	“Disable auto-updates” link	Plugins → Installed Plugins, or Appearance → Themes
Major core releases only	define( 'WP_AUTO_UPDATE_CORE', 'minor' );	wp-config.php
All core updates	define( 'WP_AUTO_UPDATE_CORE', false );	wp-config.php
All plugins or all themes	auto_update_plugin / auto_update_theme filters	A must-use plugin
The whole background updater	define( 'AUTOMATIC_UPDATER_DISABLED', true );	wp-config.php

Start at the top of the table. The further down you go, the more you switch off, and the more likely you are to block a security fix you would have wanted.

How to stop one plugin or theme from updating itself

If one plugin broke something, turn off auto-updates for that plugin and leave the rest alone. WordPress.org’s documentation says these per-item controls need WordPress 5.5 or later. If you aren’t sure which version you run, check your WordPress version first.

1. Go to Plugins → Installed Plugins.
2. In the Automatic Updates column, click Disable auto-updates next to the plugin.
3. For a theme, go to Appearance → Themes, open the theme’s details and click Disable auto-updates. If you use a child theme, the parent theme is the one that receives updates.

To bulk-change plugins, tick several and pick Disable Auto-updates from the Bulk actions menu. On the command line, WP-CLI does the same with wp plugin auto-updates disable plugin-slug (available since WP-CLI 2.5.0) and wp theme auto-updates disable theme-slug.

The link column should now say “Enable auto-updates” for that item. One limit to keep in mind: this toggle doesn’t stop your host’s updater, and it doesn’t stop a security update WordPress.org decides to push.

How to stop major core releases but keep security fixes

Core has its own constant. Open wp-config.php and add one of these lines above the line that reads /* That's all, stop editing! */:

// Keep minor and security releases, skip major versions
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

// Or: turn off all automatic core updates
define( 'WP_AUTO_UPDATE_CORE', false );

WordPress’s Developer Handbook says this constant overrides the core auto-update setting on the Updates screen. It has no effect on plugins or themes. People mix this up often enough that a WordPress.org moderator had to explain in a 2025 support thread that WP_AUTO_UPDATE_CORE covers core only, while AUTOMATIC_UPDATER_DISABLED covers everything.

The 'minor' value is the setting most sites should use. Minor releases carry the security and maintenance fixes, and they are the ones you least want waiting on someone’s calendar.

Edit this file carefully. A missing semicolon or a stray quote takes the whole site down. Keep a copy of the original file so you can put it back in seconds. Editing wp-config.php needs file access through your host’s file manager, SFTP or SSH.

How to switch off all automatic updates, and what that costs

One line turns off the whole background updater:

define( 'AUTOMATIC_UPDATER_DISABLED', true );

WordPress’s handbook calls this “generally discouraged”, because minor and security updates are what keep a site secure. Treat it as a policy decision, not a fix. The site stays exactly as it is until someone logs in and updates it. If nobody owns that job, the site falls further behind every week.

To turn off plugin or theme auto-updates across the site but leave core alone, use filters. The handbook says filters belong in a must-use plugin, not in wp-config.php, where they can conflict with WP-CLI. Create wp-content/mu-plugins/update-policy.php:

<?php
/**
 * Plugin Name: Update policy
 * Description: Site update rules. Owner and date: write them here.
 */

// Stop auto-updates for one plugin only
add_filter( 'auto_update_plugin', function ( $update, $item ) {
    if ( isset( $item->slug ) && 'woocommerce' === $item->slug ) {
        return false;
    }
    return $update;
}, 10, 2 );

// Or stop all theme auto-updates
// add_filter( 'auto_update_theme', '__return_false' );

Know what returning false does. The handbook says it also blocks plugin and theme updates pushed by the WordPress.org security team. Don’t put update rules in your theme’s functions.php either. A theme switch or update can remove them without anyone noticing.

Why updates still happen after you switched them off

Usually something other than your setting is in charge. Check these in order.

A forced security update

WordPress.org can push an update for a critical vulnerability even when your toggles are off. In a 2024 WordPress.org thread, a site owner reported plugins updating with auto-updates disabled. The replies explained that security updates can be forced, and a moderator advised against overriding them when a flaw is being actively exploited. If the surprise update was a security release, the system did what it was built to do.

Your host runs its own updater

Managed hosts often update plugins from their own dashboard, outside WordPress. Some do it with a must-use plugin, which keeps running when you deactivate everything else. A GitHub issue logged in October 2026 shows Hostinger’s Smart Auto Updates MU plugin (v1.0.8) registering automatic_updater_disabled as true and auto_update_plugin as false. That is the opposite problem: settings switched off by the host, not by you.

In a 2023 WordPress.org case, Site Health warned that background updates weren’t working because the automatic_updater_disabled filter was enabled. The owner’s wp-config.php didn’t contain it. The source was a “Disable Auto Updates” MU plugin the host had installed. The owner waited days for it to be removed.

An update-management plugin

Plugins that manage updates keep their own rules. Running one next to a host updater gives you two policies that disagree. Choose one system and turn off the other.

To find which layer is in control:

1. Check the item’s toggle on the Plugins or Themes screen.
2. Look in your host’s control panel for anything labelled automatic or plugin updates.
3. Open wp-content/mu-plugins/, or Tools → Site Health → Info → Must Use Plugins.
4. Check for an update-management plugin in your plugin list.
5. Search wp-config.php for the two constants above. Old sites often still have them, and nobody remembers why.

If it’s still unclear, ask the host directly whether it updates plugins or core itself.

When updates aren’t running at all

Sometimes nobody switched anything off and updates still don’t happen. WordPress.org’s documentation says plugin and theme auto-updates rely on WP-Cron and run twice a day. If the scheduler or the file system is broken, no setting will help.

Open Tools → Site Health and read the Status tab. The WordPress.org Health Check handbook lists the checks that matter here: failed scheduled events, background updates and loopback requests. Then work through the causes:

• Cron. If DISABLE_WP_CRON is set in wp-config.php, a real server cron job has to replace it. Without one, scheduled updates never run.
• Permissions. If WordPress asks for FTP credentials, it can’t write files as the web server user. Ask the host to fix ownership. Don’t loosen permissions across the site.
• Disk space. A full disk stops updates from unpacking. Old backup archives are a common cause.
• A leftover .maintenance file. If the site says “Briefly unavailable for scheduled maintenance”, WordPress.org’s troubleshooting FAQ says to delete .maintenance from the WordPress root. Deleting it brings the site back. It doesn’t finish the update, so run the update again.

If an update broke the site, fix that one thing

Switching everything off hides the symptom and leaves the cause in place. Find the component first. WooCommerce’s self-service guide gives the standard routine: switch to a default theme, deactivate everything except WooCommerce and the extensions involved, then reactivate them one at a time.

Often the cause is narrow. In an October 2026 WordPress.org review, a site owner said a form plugin’s auto-update took their site down because the new version required PHP 8.3 and the server ran PHP 8.0. Turning off every update wouldn’t have fixed that. Upgrading PHP, or holding back that one plugin until the server could be upgraded, would have.

Roll back only the plugin that broke, and only until a fix ships. The Developer Handbook warns that older code can bring back security holes and cause database version problems. When a fixed version is out, turn that plugin’s auto-updates back on. Rolling back one plugin also keeps every order and edit made since your last backup. A full restore from backup throws those away.

Stores need extra care. WooCommerce’s update guide says some releases need a separate database update after the files update, and you can follow its progress under Scheduled Actions. The guide also says to back up the database and wp-content, test on staging, then check product pages, cart, checkout, payment, shipping, tax and email. It suggests a monthly cadence for most stores, with security fixes applied sooner.

The policy most practitioners settle on

WordPress.org threads and Reddit discussions keep landing on the same compromise:

• Keep minor core releases automatic, along with your security and backup plugins.
• Turn off auto-updates only for the plugins that can cost you money when they change: payments, checkout, page builders, heavily customised features.
• Update those by hand on a named day. Take a backup first, use staging if your host offers it, and update one at a time, never with “Update all”.
• After each update, load the homepage, submit a form and run a test checkout.
• Write down what is switched off, where, and who owns the manual updates.

WordPress.org has also started delaying some releases on its side. The Plugins Team’s phased release rollout, announced in August 2025, delays automatic updates by 24 hours for plugins that opt in. You can still update by hand during that window.

If nobody on your team wants to own the manual queue, SiteSelf handles plugin updates on request through chat, then reports what changed and what it checked.

Frequently asked questions

How do I turn automatic updates back on?

Reverse whatever you changed. Click “Enable auto-updates” on the item, delete the constant from wp-config.php, or delete the filter from your MU plugin. Then check Site Health. If it still says background updates are disabled, something else is setting the filter, usually a host MU plugin.

Why can’t I see the auto-update links on my Plugins screen?

Check that you run WordPress 5.5 or later. If you do, WordPress.org’s documentation says a host or a plugin may have turned the feature off. Look in wp-content/mu-plugins and in Site Health → Info → Must Use Plugins.

Why do update notices still show after I turned off auto-updates?

Stopping automatic installs and hiding update notices are separate things. Turning off auto-updates means WordPress waits for you to click Update. It still tells you an update exists, and you want it to.

How often do WordPress auto-updates run?

WordPress.org’s documentation says plugin and theme auto-updates run twice a day by default, through WP-Cron. If WP-Cron is disabled and no server cron replaces it, they don’t run at all.

Do premium plugins and WooCommerce extensions follow the same toggle?

The toggle only applies to updates WordPress can find. WooCommerce’s update guide says Marketplace extensions update only when the store is connected to a WooCommerce.com account. Third-party extensions follow their vendor’s own update method. Check those separately, because they fall behind without any warning.

WordPress has no landing-page content type. A landing page is an ordinary Page with one job: get a visitor from an ad, an email or a post to take one action. You don’t need a special plugin, and you shouldn’t use the special feature some older tutorials describe. Elementor’s separate Landing Page feature is deprecated as of Elementor Pro 3.27.

The build is the easy part. Practitioners on Reddit and the WordPress.org forums keep naming the same hard parts: the copy, the scope, mobile behaviour, testing the form, and keeping the page in step with the offer once it’s live. This guide covers the whole job, from the goal to the launch checks. If you’re still choosing a tool, our guide to building a landing page in WordPress compares the block editor with page builders.

What should you decide before opening the editor?

Decide on one action and write it down in a single sentence. For example: “This page helps homeowners in our area request an interior painting quote.” If you can’t write that sentence, the page will try to do three things and none of them well.

Add three facts to the sentence. Where do visitors come from? What does the ad or email promise? What does your team need from the visitor to reply properly? Those answers decide the headline, the form fields and the slug.

Also decide what counts as a good result. A quote request from outside your service area is still a completed form, but it isn’t work. Track qualified enquiries next to raw submissions. Otherwise a page can look successful while it fills your inbox with leads you can’t serve.

What do you need before you start?

• Access: an Editor or Administrator account. To set the page as the homepage, change a template or install a form plugin, you need Administrator.
• Copy: a headline, three or four benefits, one or two pieces of real proof, and answers to the questions that hold buyers back. Write the copy before you build. Writing it during the build is what turns a three-hour page into a three-day page.
• Images: one hero photo of real work, sized for the web.
• A form tool your site already uses, if it has one.

How to create the landing page

1. Create the page. Go to Pages, then Add New. Give the page a title and set a short slug that uses the words from the ad, such as interior-painting-quote. If you change the slug after the campaign starts, every link already sent out breaks unless you add a redirect.
2. Choose the layout for this page only. This is the setting behind most “my menu disappeared” and “why is the header still there” questions, and it depends on your theme:
   • In a block theme, assign a custom template (Learn WordPress builds one without header navigation).
   • In a classic theme, pick the blank or full-width template if the theme provides one.
   • In Elementor, open Page Settings, then Page Layout. Canvas removes the header, footer and sidebars. Full Width keeps the header and footer. Elementor’s Single Page templates apply only to pages on the Default layout.
   Don’t edit a shared template to change one page. The WordPress Theme Handbook warns that a template change affects every page that uses it.
3. Write the hero to match the ad. An ad about interior painting should land on a headline about interior painting, not “Transform your space.” Say who the page is for, what they get and what to do next. Put the button beside that text. Use the same button wording (“Get a quote”) here and on the form’s submit button.
4. Add benefits, proof and objections. The Learn WordPress landing page lesson lists a hero with a call to action, benefits and social proof as the core sections. Place proof near the button, not three screens below it. A named review that mentions the type of job beats an anonymous compliment. Add an FAQ only for real hesitations, and put another button after it.
5. Build a short, accessible form. For every field, ask whether it changes what your team does next. If it doesn’t, cut it. Give every field a visible label. Placeholder text alone disappears as soon as someone types. The W3C’s guidance on labeling form controls says an explicit label’s for value must match the input’s id. Error messages should say what to fix. Our guide to adding a contact form in WordPress covers the plugin side.
6. Prepare the images. Compress the hero and check how it crops on a phone. Give informative images short alt text that says what they show. Give decorative images an empty alt="". Don’t leave the attribute out.
7. Publish, then decide about the homepage. A campaign page can live at its own URL. If it really should replace the homepage, go to Settings, then Reading, choose “A static page” and select it as the Homepage. The Homepage and the Posts page can’t be the same page. In a block theme, check Appearance, then Editor, then Templates, because a Front Page template there can override the Reading setting.

Selling one product? On a WooCommerce store, add the Single Product block to the page and choose the product. WooCommerce’s documentation says the block displays the product’s image, title, price and add-to-cart controls. A page that only looks like a product page can’t take payment. Keep Cart, Checkout and My Account as separate assigned pages. WooCommerce warns that combining them breaks redirects and payment gateways.

What does a correct result look like?

Test the live URL, not the editor preview, while logged out and on a real phone. Logged-in views often skip the cache, so you may see a version your visitors don’t. The page passes when:

• The first screen shows the offer and the button without zooming, and no popup or cookie banner covers them.
• The button scrolls to the form, and nothing sticky, such as a header or chat widget, hides the form after the jump.
• A test submission shows a confirmation and arrives in the right inbox. A success message on screen isn’t proof the email was delivered.
• Submitting with a required field left empty shows an error that says what to fix.
• The browser tab shows your real site name, not the default “My WordPress Blog” that practitioners on X keep finding on launch day.
• The exact URL from the ad, tracking parameters included, opens the page.

What to do if it did not work

Most broken landing pages are a setting, not a bug. Start with the symptom:

Symptom	Usual cause	Fix
New page shows a 404	A cached 404, or rewrite rules that need refreshing	Purge every cache layer: plugin, host and CDN. If all pages 404 but the homepage loads, open Settings, then Permalinks, and click Save Changes without changing anything.
Visitors see an old version	Only one cache layer was cleared	Purge every layer and check in a private window. See why a WordPress page isn’t updating.
Menu missing, or header still showing	Wrong layout (Canvas or Full Width)	Change the layout on this page only.
Homepage still shows posts	Reading setting not saved, or a block theme Front Page template	Check both.
Page missing from the Homepage dropdown	It was built with Elementor’s legacy Landing Page type	Save the design as a template, insert it into a regular Page, then assign that Page.
Elementor editor won’t load	Plugin conflict or PHP memory	Try Elementor’s Safe Mode, deactivate plugins one at a time, and check the memory limit (Elementor recommends at least 256 MB).

Don’t change the site-wide permalink structure to fix one page. WP Engine’s support docs warn that this can cause 404s across an established site. If the editor error is misleading, check the PHP error log as well as the browser console. In one WordPress.org support thread, “elementor is not defined” turned out to be the host’s 128 MB memory cap. When a fix needs server access or the cause stays hidden after these steps, ask your host or a developer.

Should you make a version for every city or keyword?

Only if each version has something real to offer that the others don’t. Google’s spam policies describe doorway abuse as pages that are substantially similar, target similar queries or locations, and funnel users to one destination. Swapping the city name in an otherwise identical page fits that description. One commenter on r/marketing gave a sensible rule: reuse a template when the use cases really are alike, and write separate pages when they differ.

Paid-traffic variants are different. Pages for an ad test are usually kept out of search anyway. If you run two near-copies, point a rel="canonical" at the main one or redirect the loser when the test ends.

How do you tell if the page is working?

Use your own numbers first. Unbounce reports a 6.6% median conversion rate from its Q4 2024 data across about 41,000 pages. That covers many industries and builders, and none of the data is specific to WordPress. A quote request, a sign-up and a purchase are different decisions, so a benchmark is context, not a target.

Record visits, form starts, submissions and qualified enquiries, split by device and by traffic source. Mobile falling while desktop holds points to layout, overlays or loading. People starting the form and not finishing points to fields or errors. Lots of traffic from one source with weak leads points to the ad’s promise. Change one thing at a time. On a low-traffic site, fix confirmed faults and clear confusing copy, and call untested tweaks guesses.

Then keep the page current. Practitioners on X describe the same decline: the demo gets imported and the text swapped, and then the price goes stale, nobody tests the form again, and the mobile layout slowly breaks as people add sections. Put a date in the calendar to re-test the form and check the offer. If you’d rather describe each change in chat and have it made and checked on your existing site, that’s what SiteSelf’s page and copy edits cover, though pages owned by Elementor, Divi or Beaver Builder are refused, with the reason.

Frequently asked questions

Can I create a landing page without a plugin?

Yes. A regular Page, the block editor and a blank or custom template are enough. Builders save time with templates and ready-made widgets. They also add weight and make it harder to switch tools later.

Should a landing page hide the site navigation?

No controlled evidence settles this. A page for paid traffic with one action usually works best without the menu. A page that people find through search, or that needs to build trust, often benefits from keeping it. Match the page to the traffic source and test.

How long does creating a landing page take?

Reports on r/Wordpress range from an hour or two to several days. One developer estimated three to four hours for a simple one-pager. Having the copy and images ready matters more than which tool you pick.

Does a fast landing page rank better?

Speed helps visitors, especially on phones, but it is one consideration among many. A well-built page still competes with established pages that have links and history. Treat speed as a requirement for the people who arrive, not as a ranking strategy.

Can I keep my old Elementor landing pages?

Elementor says existing landing pages are not affected, but it recommends against using the feature going forward. There’s no rush to migrate. Rebuild a legacy page as a regular Page when you next need to change it, or when it has to become the homepage.

The usual complaint is “it looks fine on desktop and awful on my phone.” The usual fix is smaller than people expect. Most themes made in the last several years are already responsive. One element, plugin setting or stale cache is breaking them.

Google indexes and ranks the mobile version of your pages. Its mobile-first indexing guide calls responsive design the easiest setup to build and maintain: one site and one URL, with the layout adapting to the screen. Everything below works toward that. If you already know which CSS rule you need, our guide to CSS media queries for mobile goes deeper.

What you need before you start

You need an admin login and a phone. Most fixes can be made in the block editor or with Additional CSS. Classic themes have Additional CSS under Appearance → Customize. Block themes have it in the Styles panel of the Site Editor. Editing theme files needs a child theme or hosting access. Take a backup first, and try larger changes on a staging copy if your host provides one.

Step by step: making the site work on phones

1. Write down what is actually broken

Open your most important pages on a real phone. That means the homepage, a service or product page, the contact form and, for stores, cart and checkout. For each problem, note the page, the screen width and the symptom, for example: “Contact page, 390px, submit button hidden behind sticky bar.” Then open Chrome DevTools, turn on the device toolbar and set the width to 320px. That is the width WCAG 2.2 Reflow uses. Content should read at that width without scrolling in two directions.

Google retired the Mobile-Friendly Test and the Search Console Mobile Usability report in December 2023. Older guides still send people to them. Use URL Inspection in Search Console to see how Google renders a page.

2. Confirm the theme is responsive and the viewport tag is there

View the page source and look for this line in the <head>:

<meta name="viewport" content="width=device-width, initial-scale=1">

Current themes almost always include it. Without it, phones draw a desktop-width page and shrink it. With it, fixed-width elements still overflow, so the tag alone isn’t enough. Don’t add maximum-scale=1 or user-scalable=no. W3C mobile accessibility guidance says to avoid them, because they stop people from zooming.

If the theme has no mobile layout at all, it’s a theme decision. See the section on rebuilding below.

3. Find the element that is wider than the screen

Sideways scrolling, or a white strip down the right side, almost always comes from a single element. Paste this into the DevTools console at phone width:

document.querySelectorAll('*').forEach(el => {
  if (el.offsetWidth > document.documentElement.clientWidth) console.log(el);
});

The usual suspects are a logo with a pixel width, a header split into fixed columns, an image or embed with inline sizes, and an animation that slides in from off-screen. Remove the fixed width, or override it at narrow widths:

img, video { max-width: 100%; height: auto; }

@media (max-width: 600px) {
  .site-logo img { width: 160px; }
  .wide-box { width: auto; }
}

Don’t reach for overflow: hidden on the body. In one WordPress.org support thread about an Elementor header, that rule removed the side margin but clipped the mobile menu down to one visible item. If custom CSS has piled up, remove it and add it back one rule at a time until the problem returns.

4. Use the responsive controls WordPress already has

In the block editor, select a Columns block and check that “Stack on mobile” is on. WordPress 7.1 adds responsive styles to block themes. You can set a block’s font size, padding and other settings separately for mobile and tablet. Set them per block type under Appearance → Editor → Styles → Blocks, or per block in its Responsive styles view.

The limits trip people up. Responsive styles only work in block themes. Tablet values don’t carry over to mobile, so set mobile on its own. Some toolbar controls, such as text alignment, still apply at every size. Your theme’s breakpoints may also differ from the defaults. Page builders keep their own per-device settings, and a margin set on desktop may need changing again on mobile.

5. Check embeds, tables and text inside images

A responsive page can still hold a video that doesn’t resize. If you control the theme, opt in with add_theme_support( 'responsive-embeds' );. The Block Editor Handbook lists this as an opt-in feature, so it is off by default. Wide tables are one of the exceptions in the Reflow guidance. They can scroll inside their own box while the page stays put:

.wp-block-table { overflow-x: auto; }

Text baked into an image shrinks with the image until nobody can read it. Put the words in a Cover block or a heading instead.

6. Make menus, buttons and forms work with a thumb

WCAG 2.2 Target Size (Minimum) sets 24 by 24 CSS pixels as the AA minimum for anything people tap, with some exceptions. Treat that as the floor. Bigger and better-spaced is easier. Open and close the menu, then fill in each form with your thumb. Watch for a keyboard or sticky bar covering the submit button, labels that vanish once you start typing, and error messages that appear off-screen. Use type="email" and type="tel" on fields so phones bring up the right keyboard.

7. Keep the mobile content the same as desktop

Hiding blocks on mobile is tempting. Google warns that primary content missing from the mobile version, or loaded only after a tap or swipe, may not be indexed. Titles, meta descriptions and structured data should match desktop too. Hide decoration, not prices, contact details or copy. Accordions and tabs are fine as long as the content is in the page.

Don’t force the desktop layout onto phones either. A WordPress.org volunteer explained the reason to an owner who wanted exactly that: visitors end up zooming and scrolling sideways. Mobile-specific CSS is the better fix.

8. Test the store pages separately

A theme can handle blog posts well and still struggle with WooCommerce. WooCommerce’s guide to choosing the right theme says to check every store page, including My Account, cart and checkout. On a phone, choose a product option, change the quantity and get as far as payment.

9. Clear every cache layer

“My fix didn’t work” often means “I’m looking at old CSS.” Purge your caching plugin, then your host’s cache, then the CDN, then your browser. Clearing one layer can leave another serving the old version. Our guide on a WordPress page not updating walks through the order.

10. Treat speed as its own job

A layout can fit perfectly and still be slow on mobile data. HTTP Archive’s 2025 Web Almanac found that 45% of WordPress sites passed all Core Web Vitals on mobile. Google’s “good” thresholds are LCP within 2.5 seconds, INP below 200 milliseconds and CLS below 0.1.

Start with images. Resize them to the size they actually display at, use WebP and lazy-load images below the fold. Don’t lazy-load the hero image, because that delays LCP. Then look at third-party scripts and heavy plugins. Our guide to optimizing pictures in WordPress covers the image side.

What a correct result looks like

At 320px and on your own phone, nothing scrolls sideways. Text reads without pinching. The menu opens, closes and shows every link. Forms submit and show their errors next to the right field. The store pages work through to payment. URL Inspection shows Google the same content as desktop. A good PageSpeed score doesn’t prove the menu works, and a poor one doesn’t mean the layout is broken. Check both.

If it still breaks after the fix

Suspect an optimisation or plugin setting before you suspect the theme. In one TablePress support thread, horizontal scrolling on mobile stopped working because of SiteGround Optimizer’s “Combine JavaScript Data” setting. Turning it off fixed the problem. On a staging copy, turn off one suspect at a time, such as JS combining, CSS combining or animations, and retest after each. Turning an optimisation off can lower your speed score. Keep that tradeoff in mind instead of switching everything off.

When the theme isn’t worth retrofitting

Sometimes the theme stacks everything into one column that looks wrong, or it has no mobile layout at all. At that point you are fighting the theme with overrides. Nobody has good data on when rebuilding beats retrofitting. A useful test: if most of your fix list is “override the theme’s layout,” the theme is the problem. If it’s a handful of elements, fix the elements.

When to stop and get help

Stop if the fix needs theme files and you have no backup, if checkout is affected, or if you have been turning plugins on and off on the live site for an hour. If you’d rather describe the problem, for example “the menu on the contact page is cut off on phones,” and have someone make the edit and check it, SiteSelf handles website edits through chat. Pages owned by Elementor, Divi or Beaver Builder are refused, and you are told why.

Frequently asked questions

Is there a plugin that makes WordPress mobile friendly?

Not in the sense people hope for. Your theme and CSS decide whether the site is responsive. Plugins like WPtouch serve a separate mobile theme to phones. That is the opposite of the responsive approach Google recommends, and it needs careful cache setup. Mobile menu plugins can fix the menu, but nothing else on the page.

Do I need a separate mobile version of my site?

Generally no. Google recommends responsive design because separate mobile setups add ways to fail: redirects to the wrong page, missing content and metadata that doesn’t match. Edits made on desktop also get missed on the mobile copy.

Is a resized desktop browser good enough for testing?

It’s good for finding layout overflow quickly. It won’t show the keyboard covering a button, how a tap feels or how the page behaves on mobile data. Check the important pages on at least one real phone before calling them done.

What text size should I use on mobile?

No standard sets a single number. Many themes use 16px body text as a sensible default. The test that matters is whether text reflows at 320px and when zoomed without forcing sideways scrolling.

Will fixing mobile break my desktop layout?

Not if you put the changes inside media queries for narrow widths, or use the mobile settings in your blocks. Changes made outside a media query apply everywhere. That’s why you should check desktop again after each fix.

A common snippet for mobile CSS is @media (max-width: 767px) { ... }. It applies its rules when the viewport is 767 CSS pixels wide or narrower. That includes a phone, and it also includes a laptop browser window dragged narrow. The number is a convention, not a standard.

On WordPress sites, people usually notice this when a mobile fix looks right in the editor and wrong on their phone. Most of the time the media query is fine. Something else wins: a cached stylesheet, a builder setting, or a more specific selector. This guide covers how to write the query, where to put it, and how to find the actual cause when it doesn’t apply.

What a mobile media query actually tests

A media query is a condition. The browser checks it and applies the rules inside only when it is true. For layout, that condition is almost always the viewport width in CSS pixels. Elementor’s responsive editing docs make the same point: a breakpoint applies to any screen at that width, whatever the device.

You can write the condition in two directions:

/* Desktop-first: base styles are for wide screens, this overrides them on narrow ones */
@media (max-width: 767px) {
  .site-columns { flex-direction: column; }
}

/* Mobile-first: base styles are for phones, this adds layout on wider screens */
.site-columns { display: flex; flex-direction: column; }
@media (min-width: 768px) {
  .site-columns { flex-direction: row; }
}

Use width, max-width and min-width. Avoid max-device-width. It measures the physical screen rather than the viewport the page is laid out in, so it can disagree with what visitors actually see. If you want the bigger picture of how themes and builders split layout control, start with how layout works on WordPress.

Which breakpoint should you use for mobile?

No single number is correct. Media queries test conditions, and the familiar values come from tool defaults:

Source	Mobile	Tablet
WordPress responsive styles (block themes, WordPress 7.1+)	480px and below	Up to 782px
Elementor defaults	767px	1024px
Common desktop-first CSS	max-width: 767px	Varies by theme

MDN recommends adding a breakpoint where the layout starts to fail, not at a device size. Drag the browser narrower until something looks cramped, overlaps or overflows, and put the breakpoint just above that width. WordPress’s CSS Coding Standards say to test above and below every breakpoint you add.

There is one practical exception. If the page is built in Elementor, or a block theme uses responsive styles, use that tool’s breakpoint for your custom CSS too. If your CSS switches at 600px and the builder switches at 767px, the layout spends 167 pixels half-converted.

Check the viewport tag before anything else

Without a viewport meta tag, mobile browsers can lay the page out on a wider virtual viewport and then shrink it to fit. The W3C CSS Viewport spec describes this older behaviour. When it happens, your max-width: 767px query never matches, and changing the number won’t fix it.

Open the live page, view the source, and search for viewport. You want something like:

<meta name="viewport" content="width=device-width, initial-scale=1">

Almost every current theme outputs this already, so check before you add one. A duplicate tag won’t help. If the existing tag contains user-scalable=no or maximum-scale=1, it is stopping visitors from zooming. Fixing that belongs in the theme or a child theme, not in Additional CSS.

How to add a mobile media query in WordPress

You need an administrator login and a desktop browser with developer tools. Chrome, Firefox and Edge all work.

1. Find the element and the rule that currently wins. Right-click the element and choose Inspect. Turn on the device toolbar (Ctrl+Shift+M, or Cmd+Shift+M on a Mac) and set a phone width. Note the element’s class and which rule is applied. Crossed-out rules have been overridden.
2. Look for a setting before writing code. In a block theme on WordPress 7.1 or later, responsive styles let you set mobile and tablet values for a block. In Elementor, use the device switcher in the editor or Advanced > Responsive. If a setting does what you need, use it.
3. Open the site-wide Additional CSS. On a classic theme it is under Appearance > Customize > Additional CSS. On a block theme, go to Appearance > Editor > Styles and open Additional CSS from the Styles panel’s menu.
4. Write the rule using the selector you found. Put your override after any rule it needs to beat.
5. Save, clear caches, and test at several widths. The test is described in the next section.

Here is a real case. In a WooCommerce support thread, a store owner’s Add to Cart button looked fine on a laptop and wrong on phones. The fix was to wrap the button styles in a 600px query, which made the button full width with a smaller font. The owner replied “It worked perfectly.” The pattern looks like this:

@media (max-width: 600px) {
  .single_add_to_cart_button.button.alt {
    display: block;
    width: 100%;
    font-size: 14px;
  }
}

Watch out for the second CSS field. Each block type in the Styles panel also has its own Additional CSS box, and WordPress’s Styles documentation says it takes declarations only, with no selectors and no braces. A full @media rule pasted there will not work. Also note that Additional CSS survives theme updates but is cleared when you switch themes. Keep a copy, and move anything substantial into a child theme. The guide to theme customization that survives updates covers which layer to choose.

Patterns that cut down on breakpoints

Many mobile problems are overflow, not layout. These rules fix a lot of them without a breakpoint:

img, video, iframe { max-width: 100%; height: auto; }
.entry-content { overflow-wrap: break-word; } /* long URLs */
h1 { font-size: clamp(1.75rem, 5vw, 3rem); }  /* fluid heading */
.card-grid {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(min(100%, 16rem), 1fr));
}

Keep media queries for changes that are real layout shifts: switching the menu, stacking columns, reflowing a table, showing or hiding a secondary element. Use fluid sizing for everything else.

What a correct result looks like

The rule should apply at every width below your breakpoint and at none above it. Check it in the device toolbar at 320, 375 and 414 pixels, then just above and just below the breakpoint. At 320 CSS pixels, nothing should scroll sideways and nothing should be cut off. That width comes from WCAG 1.4.10 Reflow, which asks that vertically scrolling content keep all its information and functions at that width without two-dimensional scrolling.

Then open the page on a real phone in a private tab. Builder device previews are not always a real viewport. A Stack Exchange question about Gutenberg’s preview describes it narrowing the container instead, so a rule can pass in preview and fail on the phone.

Why mobile CSS works in preview but not on your phone

These causes come up again and again in WordPress support threads. They are listed roughly from most to least often reported. This order comes from reading the threads, not from a survey.

1. The phone is getting old CSS

Page builders write CSS to files, and caching or optimization plugins combine and minify those files. Your edit saves, but the phone receives the previous version. In Elementor, go to Elementor > Editor > Tools and run Clear Files & Data. Then clear the caching plugin, then the host or CDN cache, then the browser cache. In one resolved LiteSpeed Cache thread, GeneratePress’s dynamic CSS kept being served stale on mobile until the affected files were excluded from CSS optimization. If a purge doesn’t stick, the guide to pages that won’t update walks through each cache layer.

2. A builder or theme setting overrides it

Elementor’s mobile troubleshooting guide lists the usual suspects. They are Advanced > Responsive > Hide On, widget-level Custom CSS, site-wide custom code, and theme or plugin conflicts. Some older themes and plugins also serve a separate mobile theme. Turn it off before you debug CSS that the phone never loads.

3. The selector doesn’t match or loses

Builders wrap each widget in several divs, so a selector copied from a tutorial often matches nothing. Copy the class from the live page in DevTools. If the selector matches but loses, put your rule after the base rule, or make it a little more specific. Add !important only when the rule you are overriding already uses it. If you add !important to everything, the next fix gets harder.

4. The syntax is broken and fails silently

CSS doesn’t show errors. A missing closing brace can swallow every rule after it. In one WordPress.com forum case, the query said screen2 instead of screen. Sydney theme support told another user that an invalid line in Additional CSS can stop the lines after it from working. Paste your CSS into a validator, or check that DevTools lists your rule at all.

5. The CSS is in the wrong field or never loads

Media queries in the per-block field, CSS inside a page’s content, or a stylesheet that isn’t enqueued on that template all look like “mobile CSS not working”. In DevTools, check that your rule is present in the Styles panel at a phone width.

When to stop and get help

Get help if you have ruled out all five and the rule still doesn’t apply. Builder plugins have their own bugs. Elementor Pro 3.24.5, for example, fixed responsive styles not loading in Apple’s WebKit. Some threads never find a root cause. Gather the page URL, the width where it breaks, the element and the winning rule from DevTools, and send them to the theme or plugin’s support. If you would rather describe the problem than track it down, SiteSelf can make theme-level design and mobile styling changes on request from chat, with hosting access. Pages owned by Elementor, Divi or Beaver Builder are refused, and you are told why.

Be careful what you hide on mobile

The easy mobile fix is display: none. It also removes the element for screen readers. Google indexes and ranks the mobile version of a page and advises against removing primary content there. Accordions and tabs are fine. Hiding a decorative image or a duplicate call to action is fine. Hiding prices, product details or the text that explains your offer is not.

Frequently asked questions

Should I use max-width or min-width?

Follow the theme you have. Most themes are written desktop-first, so small fixes are easiest as max-width overrides. If you are building a new section from scratch, mobile-first with min-width keeps phone styles simple. The cost is resetting some of them on wider screens.

Do I still need media queries if I use clamp() and CSS Grid?

Fewer of them. Fluid type and auto-fit grids handle much of the resizing that used to need breakpoints. You still need queries for real layout changes, such as switching to a mobile menu or reflowing a table.

How do I change the width where my mobile menu appears?

It depends on the theme. Some themes have a setting for it. Others hard-code the breakpoint in their navigation CSS, so you have to override those rules at the width you want. Check your theme’s documentation or support forum before writing an override.

What about container queries?

Container queries style an element based on the size of its parent rather than the viewport. That suits blocks that appear in both sidebars and full-width areas. They are a reasonable choice for custom components you write yourself, but most WordPress themes still use viewport media queries.

Why did my mobile fix also change the desktop layout?

The rule probably sits outside any media query, or inside the wrong one. Wrap the declarations in the mobile query and check the closing braces. A rule with no query applies at every width.

A plugin update went through, and now the site shows “There has been a critical error on this website.” Your host’s panel has a backup from last night, and the Restore button is right there. That button can get you back online in minutes. It can also delete this morning’s orders and bring back a version of the site that breaks in a new way.

Restoring is not an undo. It is a deliberate overwrite, and it works when three things are true. The backup is complete. The route you use still works with the site down. You check the result afterwards. This guide covers all three, using host tools, backup plugins and a manual restore.

Should you restore at all, or fix what broke?

If one change broke the site, undo that change first. When an update causes a fatal error, WordPress usually sends a recovery-mode email that names the plugin. If wp-admin is down, connect over SFTP and rename the plugin’s folder, for example plugin-name to plugin-name-off. WordPress deactivates a plugin when it can’t find its files. Our guide to fixing a WordPress fatal error covers this step by step.

This matters because a full restore replaces everything after the restore point: posts, comments, form entries, users, settings and orders. If someone just overwrote a paragraph, use that post’s revision history. Save the restore for damage that is spread across the site, or for when you can’t find the cause.

What a usable backup has to contain

A working restore needs files and a database taken at the same moment. WordPress’s Advanced Administration Handbook on backups treats them as two separate parts:

• Files: WordPress core, themes, plugins, uploads, wp-config.php and .htaccess.
• Database: posts, pages, users, settings, menus, orders and plugin data, usually saved as a .sql, .sql.gz or .zip file.

If you restore only the files, you get the theme back but no content. If you restore only the database, you get pages and text without the theme, plugins or images. That second case comes up a lot in support threads: someone restores a database-only set and wonders why the design is gone. Mixing a database from one day with files from another causes quieter problems, such as missing images or settings pointing at plugins that aren’t there.

Before you rely on a backup, open the archive and look inside. Check that a database file is there and isn’t 0 KB, and that wp-content includes plugins and themes, not only uploads. A file named “full-backup” proves nothing. Our explainer on what a backup plugin leaves out covers the common gaps.

What to do before you press Restore

1. Back up the broken site. Copy the current files and export the current database, and keep them apart from the backup you plan to restore. If the restore goes wrong, this is how you get back to where you started. It may also hold the only copy of today’s orders or uploads.
2. Check what the host’s snapshot includes. Host tools vary. Kinsta’s documentation says its snapshots include files, the database, redirects, Nginx configuration and MyKinsta settings. It also says restoring an earlier backup can remove domains you added later. Read your host’s page before you confirm.
3. Export anything newer than the restore point. That means orders, customers, form entries, new users and new posts, plus the media files they use. Plan how you’ll bring each one back, because a CSV export isn’t always ready to import.
4. Treat subscription stores as a separate problem. WooCommerce’s guide to restoring backups with Subscriptions calls the time between the backup and the restore a “gap period.” Renewals already processed in that window can come back as Pending, and if they run again, customers get charged twice. WooCommerce describes the cleanup as developer-level work.
5. Keep a copy off the server. Download the backup to your computer or to external storage. A backup kept on the same server is gone if the server or account is lost.
6. Stop new changes. Turn on maintenance mode, tell editors to stop working, and pause checkout. Orders placed during a database restore create one more thing to sort out afterwards.

How to restore with a host tool or backup plugin

On most sites, the host panel is the quickest route. Open the backup list, check that you’re on the right site (agency accounts often list staging and production with similar names), pick the restore point and choose the scope. Pick files and database together unless you’re sure the current files match the older database. A plugin update can change database tables as well as files. Then let the restore finish without making other changes.

Backup plugins work the same way while wp-admin is up. If the dashboard is down, you can’t reach a restore screen inside it. The usual workaround is to install a fresh copy of WordPress, install the same backup plugin, and point it at your remote storage or upload the archives. For UpdraftPlus, put the archive files in wp-content/updraft, then click Rescan local folder so the plugin finds them.

If you can, restore into a fresh install or a staging copy rather than over the broken site. Restoring over an existing install can leave stray files and data behind. A staging copy also lets you test before you send live traffic to it.

How to restore manually with SFTP and phpMyAdmin

A manual restore needs file access (SFTP or the host’s file manager) and database access (phpMyAdmin, or SSH for the command line). Follow the handbook’s order: files first, then the database.

1. Restore the files. Move the current web root aside, then upload or extract the backup in its place. Copying clean files over a compromised site leaves the attacker’s extra files where they are. After extracting, check you haven’t ended up with an extra nested folder such as public_html/public_html.
2. Import the database. An empty database gives the most predictable result. In phpMyAdmin, select the site’s database in the left-hand panel before you open Import. Large files often time out in the browser, so import them from the command line instead.
3. Match the configuration. In wp-config.php, check DB_NAME, DB_USER, DB_PASSWORD and DB_HOST. Then check that $table_prefix matches the restored table names. If the tables are named wp7x_posts and the config says wp_, WordPress acts as if nothing is installed.

The command-line versions, over SSH:

mysql -u dbuser -p dbname < backup.sql
# or, with WP-CLI
wp db import backup.sql

Why the restore failed, and what the log says

Read the restore log before you try again. Running the same restore over and over seldom changes the result. UpdraftPlus’s documentation on restorations that don’t complete matches the common errors to their causes:

Message in the log	Cause	What to do
PCLZIP_ERR_BAD_FORMAT (-10)	Corrupt or incomplete archive	Download it again straight from storage, check it unzips, upload it and rescan. When you delete the bad local copy, leave the option to also delete it from remote storage unticked.
“Allowed memory size … exhausted”	PHP memory limit	Raise WP_MEMORY_LIMIT. If it already equals the server’s limit, ask the host.
“Disk quota exceeded”	No free space	Delete old backups or files, then retry.
“Could not move the files into place”	File permissions	Ask the host to fix ownership. Don’t set folders to 777.

On large sites, restore one part at a time: database, then plugins, themes and uploads separately. Shared hosts often run out of resources on a single upload folder over 1 GB. If the plugin offers to continue an interrupted restore, use that option, then check the result. A half-finished restore can leave parts of the site from different dates.

Old backups bring their own problem. WordPress’s upgrading handbook warns that rolling back can fail when an update changed the database structure. A theme from 2018 on today’s PHP can throw fatal errors even after a clean restore. To get it running, temporarily match the PHP version, or rename the incompatible plugin or theme folder.

The restore finished but the site still looks wrong

“Restore complete” means the tool finished. It doesn’t mean the site works. Check these in order:

• Empty site or install screen: table prefix or database name mismatch in wp-config.php.
• Old pages showing: clear the page cache, any server cache (such as LiteSpeed) and the CDN.
• 404s on every page except the home page: go to Settings > Permalinks and click Save Changes without changing anything.
• Broken images: wp-content/uploads didn’t transfer, or the server can’t read it.
• Wrong content, or another site’s content: you restored the wrong set, or mixed files and a database from different backups.

If you restored to a different domain, don’t run a find-and-replace on the SQL file. WordPress’s migration handbook warns that a plain replace breaks serialized data, the format themes and widgets use to store settings. Use a tool that understands it, and do a dry run first:

wp search-replace 'https://old.example.com' 'https://new.example.com' --dry-run

How to check the restored site before reopening

Run the structural checks first: wp db check for table errors and wp core verify-checksums for changed core files. Then test what the business depends on:

• Log in to wp-admin as an existing user.
• Load the home page and your main landing pages. Check the text, images and menus.
• Submit a form and confirm the email arrives, not just the thank-you message.
• Open a recent upload in the Media Library.
• On a store, place a test order with sandbox payment details. Check recent orders, subscriptions and the scheduled actions under Tools > Scheduled Actions.

If the restore followed a hack, the backup may already be infected, and the hole the attacker used is still open. Confirm the backup is from before the compromise. Then go through the admin users, plugins and scheduled tasks, update everything and change passwords. Our WordPress security issues guide covers the containment steps.

When to stop and get help

Stop when you’ve tried twice with the same error, when the log says the database is invalid, when subscription renewals fall in the gap period, or when you can’t tell whether the backup is clean. At that point, more attempts add risk without adding information. Ask your host for a newer copy, or ask the previous developer, before anyone quotes for a rebuild. Pages that look “missing” are sometimes sitting in a backup someone else holds.

If you’d rather hand over the diagnosis, SiteSelf works on the live site through chat, using hosting access for file and database work. Before it changes anything, it says what it’s about to change and whether that can be undone, and afterwards it reports what it checked. Here is how SiteSelf handles broken sites.

Frequently asked questions

How long does a WordPress restore take?

WP Engine’s support documentation says an automated restore takes “a few minutes to several hours,” depending on site size and file count. Small sites on a healthy host often finish in minutes. Large upload folders, big SQL files and repeated timeouts are what turn a restore into a day’s work.

I only have the files, not the database. Can I recover the site?

Partly. The files give you the theme, plugins and images, but not posts, pages, users or settings, because those live in the database. Ask your host whether they kept database backups before you start rebuilding content by hand.

Should I restore a backup that is years old?

Only after asking your host or previous developer for something newer. An old backup loses every change since it was taken, and its plugins and theme are more likely to break on current PHP and WordPress versions. If it’s all you have, restore it to staging first.

Is restoring from backup enough to fix a hacked site?

No. The backup may already contain the malware, and the vulnerability the attacker used is still there after the restore. Use a backup from before the compromise, then check users, plugins and scheduled tasks, and close the hole.

Can I restore only part of a site?

Many host tools and plugins let you restore just the database, just the plugins or just the uploads. That keeps newer data you’d otherwise lose. The risk is a mismatch, such as theme files that expect database settings from a different date, so check the site carefully afterwards.

Where you add a password to a WordPress site depends on what you want to hide. The editor’s Visibility setting protects one post or page. Locking the whole site takes a plugin or a password tool from your host. Locking uploaded files takes server-level protection. Most “it doesn’t work” reports come from using a tool on the wrong scope, or from a cache serving the page without its gate.

Use this guide to choose a method and set it up. If you only need one page, our guide to password protecting a single WordPress page goes into more detail on that case.

Which method fits what you are protecting?

Start with the scope. The table below matches each common need to the method that covers it, along with the limit people most often miss.

You want to protect	Use	Watch for
One post or page	WordPress Visibility setting	Title stays visible, 20-character limit
The whole site, without host access	A sitewide plugin	Caching, uploads stay public
A staging site or pre-launch build	Your host’s password tool (HTTP Basic Auth)	CDN conflicts, wp-cron stops
A store or selected products	WooCommerce product settings or a WooCommerce extension	Protected products still listed
PDFs, images, member documents	Server or directory protection	Page passwords do not cover them
Access per person, revocable	User accounts or a membership plugin	A shared password can’t tell people apart

How to password-protect one page or post

This is built into WordPress and needs no plugin. WordPress.org’s documentation describes it as a per-item setting, not a site-wide one.

1. Open the page or post in the editor.
2. In the sidebar, click the current value next to Visibility (usually “Public”).
3. Choose Password protected and type the password.
4. Click Publish or Update.
5. Open the URL in a private window. You should see a password form, not the content.

Know the limits before you share the link. WordPress.org’s “Protect posts with password” page says the password can be at most 20 characters, the title stays visible, and the browser remembers access through a cookie. That cookie tracks only one post password at a time, so a visitor moving between pages with different passwords has to re-enter the earlier one. Administrators, Editors and the post’s Author can see the content without the password.

“Private” is a different setting. A private page is visible only to logged-in Administrators and Editors. Use it for internal notes, not for sharing with a client.

The visible title matters for previews. A protected draft sits on the live site, titled and listed. For client reviews, a staging copy behind a host password usually works better.

To remove protection, set Visibility back to Public and click Update.

How to lock the whole site with a plugin

Whole-site privacy isn’t part of WordPress core, as WordPress.org’s installation FAQ notes, so you need a plugin or a host tool. A plugin is the easier route when you have wp-admin access but no hosting panel.

The most widely installed option is Password Protected (slug password-protected). It has more than 300,000 active installs, and its WordPress.org listing says protecting the complete site is free. Several plugins have similar names, so check the slug and author before you install. Our guide to installing a WordPress plugin safely covers that check, plus taking a backup first.

1. Take a backup and confirm you can reach the site’s files over SFTP or your host’s file manager.
2. Install and activate the plugin, then open its settings.
3. Turn on protection, set a password, and decide whether logged-in users and administrators skip the prompt.
4. Save, then test the homepage and a deep link in a private window.

If the prompt locks you out, rename the plugin’s folder in wp-content/plugins over SFTP. WordPress deactivates a plugin it can’t find, and the gate goes with it.

Selective rules, such as a public homepage with everything else locked, are often in paid tiers. Check the free tier covers your rule before you build around it. Keep these plugins updated like any other code that controls access.

How to lock the whole site at the host

HTTP Basic Auth is a browser prompt the web server shows before WordPress loads. It covers the login page, every URL and the uploads folder at once. That makes it the usual choice for staging sites and pre-launch builds.

Most hosts offer it as a panel tool. In cPanel it is Directory Privacy: select the site’s root folder, turn on password protection, name the area, and create a username and password. On Kinsta it is under MyKinsta, Sites, your site, Tools, Password protection.

On an Apache server without a panel tool, create a password file outside the public folder and add four lines to .htaccess. Back up the file first, and put the block above WordPress’s rewrite rules without touching them.

htpasswd -c /home/youruser/.htpasswd clientname

AuthType Basic
AuthName "Client preview"
AuthUserFile /home/youruser/.htpasswd
Require valid-user

Host-specific behaviour is where this goes wrong:

• Nginx doesn’t read .htaccess. Pasting these lines on an Nginx host does nothing. Use the host’s own tool.
• Kinsta’s documentation says its htpasswd tool doesn’t work with its CDN and edge caching, which you must disable first. Cancelling the prompt returns “401 Authorization Required”.
• Protecting a folder inside a folder that is already protected can make the prompt appear over and over. Protect one level only.
• Malformed rules can produce a 500 error or a blank page. Restore your backup of .htaccess and try again.

Server passwords also block requests the site makes to itself. WooCommerce’s Product Search FAQ notes that the server rejects the wp-cron request, so scheduled tasks quietly stop running. Scheduled posts, imports and emails can fail on a protected staging site, as our article on autoblogging plugins and missed schedules describes. Webhooks and payment callbacks can fail the same way.

How to protect a WooCommerce store or products

A product’s own password gates its page, not its listing. WooCommerce’s product editor documentation says a password-protected product can still appear in the catalog. To take it out of the shop and search results, set Catalog visibility to Hidden in the product’s Publish box.

For a private store or early-access sale, WooCommerce’s Password Protected extension can lock the whole site, the store including cart and checkout, or selected products, categories and pages. Its documentation lists a setting to hide protected products completely on shop and archive pages.

Category locks can break automation. One store owner on r/woocommerce found a category-protection plugin blocked CSV imports and a supplier’s inventory feed. They kept the products open and added a passcode field at checkout instead.

Why your uploaded files are probably still public

A page password protects the page WordPress renders. The PDF linked from that page is a static file the server sends without asking WordPress. The Password Protected plugin’s GitHub documentation says plainly that it doesn’t protect uploaded images or files at their direct URLs.

Copy a file link from the protected page and open it in a private window. If it loads, the file is public. For anything sensitive, such as a member list with addresses, protect the uploads folder at the server or use a tool built to protect files.

How to test that the gate actually works

A browser that has already entered the password hides every failure. Test like a stranger:

• Open the protected URL in a private window and confirm the form or prompt appears.
• Open a deep link and, for whole-site locks, /wp-login.php.
• Open a file URL from protected content.
• Purge the cache, then load the page on a phone using mobile data.
• Check any staging or preview domain separately.

If anything loads without a prompt, the method doesn’t cover that path. Change the method rather than adjusting the password.

What to do when the password just reloads the form

Caching is the first suspect, in both directions. A cached copy can show content with no prompt, or ignore the cookie WordPress sets after a correct password, so the form reloads. The Password Protected plugin’s documentation says caches must not serve cached pages when its cookie is set.

1. Exclude the protected URL from your caching plugin, host cache and CDN. For core page passwords, exclude requests carrying the wp-postpass_ cookie.
2. Purge every layer. An exclusion without a purge can leave a stale public copy in place.
3. Retest in a private window.

In a long WordPress.org support thread on this symptom, users reported fixing it by bypassing the URL in cPanel’s Cache Manager, whitelisting wp-postpass* in CloudFront, and adding a URI exclusion in LiteSpeed Cache after hours of trying. Excluding a large gallery page from cache can slow it down, so exclude only what you protect.

If caching isn’t the cause, switch to a default theme to rule out the theme or page builder, then deactivate plugins one at a time. A 403 on /wp-login.php?action=postpass usually means a login-hiding plugin is blocking the URL that the password form submits to. Our guide to fixing WordPress login problems covers those plugins. If you’d rather hand off the setup and testing, SiteSelf can make the change on your site when you ask in chat. It uses the connector plugin for page and plugin settings and hosting access for server rules, then fetches the page and reports what it found.

When a shared password is the wrong tool

A shared password can’t tell people apart. You can’t remove one person without changing the password for everyone, and you can’t see who used it. That is fine for a two-week client preview. It isn’t enough for wholesale pricing, member records or anything you would need to revoke from one person.

When access varies by person, give people their own accounts with the lowest role that works, usually Subscriber, or use a membership plugin. It’s more setup, but you get control over each person’s access.

A password is also not a search setting. Google’s robots.txt guide says robots.txt isn’t a way to keep a page out of Google. For a page that should stay out of search, use noindex or password protection.

Frequently asked questions

Can I password-protect a WordPress site without a plugin?

Yes, at the host. Use cPanel’s Directory Privacy, your host’s own password tool, or .htaccess and .htpasswd on Apache. The prompt appears before WordPress loads and covers uploads too. Check that scheduled tasks still run afterwards.

Will a password-protected page show up in Google?

Don’t assume it is hidden. The title stays visible on the site, and files attached to the page can still be indexed if their URLs are public. Google recommends password protection or noindex to keep a page out of search, not robots.txt.

Why does a visitor have to re-enter the password on another page?

WordPress remembers only one post password per browser. If two pages use different passwords, opening the second replaces the first. Use the same password across a set of pages that belong together.

How do I make a custom password form accessible?

Give the field a visible label, add autocomplete="current-password", and allow paste. WCAG 2.2’s accessible authentication criterion treats blocking paste or autofill as a failure, because people rely on password managers.

I changed the password and the new one is rejected. Why?

Usually a stale cache or an old cookie. Purge every cache layer, clear the site’s cookies or use a private window, and try again. If it still fails, check for a login-hiding plugin blocking the form’s submit URL.

You design a hero section with its own headline, publish the page, and WordPress prints “About” or “Home” in large type above it. Removing that word looks like a two-minute job. Often it is. It goes wrong when the method doesn’t match the page. Titles disappear from every blog post, a menu item goes blank, or the title comes back after the next theme update.

The fix depends on three things: whether you run a block theme or a classic theme, whether a page builder renders the page, and whether WooCommerce owns the template. This guide covers each case. It starts with the step most failed attempts skip: working out which “title” you are looking at.

Which “title” are you actually trying to hide?

In WordPress, “title” can mean any of four things, and each has its own control. Most “it didn’t work” support threads come from changing the wrong one.

• The stored title. The name you type at the top of the editor. WordPress uses it for menus, the slug and the admin page list. Themes print it with the_title().
• The visible heading. The theme or template prints the stored title on the page, usually as an H1. This is almost always what people want gone.
• The document title. The <title> tag in the page head, shown in browser tabs. SEO plugins such as Yoast or Rank Math usually control it. Hiding the visible heading doesn’t change it.
• The site title. Your site’s name in the header. WordPress gives it its own Site Title block, separate from the page’s Title block.

To check which one you’re looking at, open the page on the front end, right-click the text and choose Inspect. The highlighted element shows the tag and its classes. One OceanWP owner on WordPress.org couldn’t get “Hide Page Title” to work because the text sat inside the header’s logo area, not the content. The theme prints the site title there when no logo is set. No page-title setting would ever have touched it.

If you change classic theme files, put those changes in a child theme. Our guide to theme customization that survives updates explains why.

Why deleting the title is the wrong fix

Clearing the title field does make the heading disappear. It also breaks other things. WordPress.com’s support page on hiding titles says that without a title, the slug can fall back to the content ID and the page becomes hard to find in stats, where it shows as untitled. Menu items that take their label from the page name lose that label too.

So keep a real, descriptive title on every page and hide only how it displays. The WordPress slug explainer covers why a numeric URL is worth avoiding.

How to hide the title in a block theme

In a block theme such as Twenty Twenty-Four or Twenty Twenty-Five, the heading is a Title block inside a template, not part of your page content. WordPress’s own documentation says templates control the layout and one template can serve many pages. That is the part to plan around.

1. Go to Appearance > Editor > Templates.
2. Open the template your page uses, usually Pages or Single Page.
3. Select the Title block and delete it.
4. Save, then open several pages that use the same template, not just the one you were fixing.

That change applies to every page on the template. If only your homepage or one landing page should lose its title, follow WordPress.com’s advice and use a separate template without the Title block. Assign it to those pages from the Template setting in the page’s sidebar. Some default themes include a “No title” page template. One Reddit user reported that picking it in Twenty Twenty-Four did not hide the title, and no cause was found. So check the result on the front end, not in the editor preview.

The page then needs a heading of its own, usually the headline in your hero. Our guide to customizing a WordPress template safely covers duplicating and assigning templates in more detail.

How to hide it with your theme’s own setting

Many classic themes have their own switch, and it beats CSS when it exists. The theme knows its own markup, so the setting keeps working when the markup changes in an update. Look in three places: a panel under the page editor, the page’s sidebar settings, or Appearance > Customize. Themes call it things like Disable Title, Page Header or Hide Title. Some only offer it in a paid version.

Check how far a global setting reaches. One WordPress.org thread describes a Customizer “Hide Page Title” option that also hid every post title. Turn it on, then look at a page, a blog post and an archive before you move on.

How to hide it with CSS in a classic theme

CSS is the fix people use most, and the one that breaks most easily. It works when it is scoped to the right page and uses your theme’s actual class. Add it under Appearance > Customize > Additional CSS. On WordPress.com, custom CSS needs a paid plan.

WordPress.com’s examples use .entry-title, which many themes use and many don’t. Swap in the class the inspector showed you.

/* every page, but not posts */
.page .entry-title { display: none; }

/* one page: replace 123 with the page ID */
.page-id-123 .entry-title { display: none; }

/* one post */
.postid-123 .entry-title { display: none; }

The page ID is the number after post= in the editor’s address bar. Don’t use a bare .entry-title rule. It hides post titles and archive headings too. A stray comma between selectors does the same: .page-id-123, .entry-title applies the rule to every title on the site.

Expect three side effects:

• A leftover gap. display: none removes the heading but not the margin or padding on the box around it. Inspect that wrapper and adjust only its spacing, scoped to the same page.
• Silent drift. In a ColorMag thread on WordPress.org, a theme update changed the heading markup and the hidden title came back. The owner needed a new selector from support. After any theme update, recheck the pages where you hid titles.
• Caching. A correct rule can look broken because a cached copy of the page is still being served. Clear your caching plugin, your server or CDN cache, and your browser cache before you change the CSS again.

How to hide it in Elementor

Open the page in Elementor, go to Page Settings and set Hide Title to Yes. That switch hides an element by selector, so it only works if Elementor targets the element your theme actually prints. Elementor’s help page says the default selector is generally h1.entry-title, and its settings say “If your theme’s selector is different, please enter it above.” The field is Site Settings > Layout > Page Title Selector. Enter the class you found in the inspector.

After changing it, clear Elementor’s generated CSS and your caches. One known bug, GitHub issue 24852 from January 2024, showed that this selector setting produced invalid CSS, and the reporter said it could upset WP Rocket’s CSS optimization. If the toggle does nothing, check the selector first.

How to hide shop and product titles in WooCommerce

On a block theme, editing the Shop page itself often changes nothing. WooCommerce’s documentation says the Product Catalog template controls the main Shop page. To remove the “Shop” heading, go to Appearance > Editor > Templates, open Product Catalog and remove or edit the Archive Title block.

On the Storefront theme, WooCommerce’s setup guide says the Template dropdown doesn’t appear for the page set as the Shop page. If the option seems to be missing, check which page is set as the Shop page under WooCommerce > Settings > Products. For a Storefront homepage, the guide uses the Full Width template.

When a plugin is the simpler route

If your theme has no switch and you don’t want to maintain CSS, a plugin adds a checkbox to each page. Hide Page And Post Title, from the WordPress.org directory, adds a “Hide the title” option when you edit a page, post or public custom post type. Its listing says later versions support block themes. Its docs say it leaves the stored title and SEO metadata alone, and that you should add a heading if the hidden title was the page’s only H1.

The tradeoff is one more plugin to keep updated. After plugin updates, check that hidden titles are still hidden.

How to keep a heading for screen readers and search

Hiding the title can remove the page’s only main heading. W3C’s accessibility tutorials say headings show how a page is organized and let screen-reader users jump through it. A separate W3C tutorial notes that display: none and visibility: hidden hide content from assistive technology as well as from sight.

So after you hide the theme’s title, make sure the page has one meaningful heading set as an H1, usually the headline in your hero. Check that it isn’t just a paragraph styled to look big. Also check you haven’t ended up with two H1s, which happens when a builder adds its own. Our article on building a landing page in WordPress covers how headings should sit on a designed page.

On search: Google’s documentation on title links lists several sources it uses, including the <title> element, the main visible title, headings and other prominent text. Hiding the theme heading doesn’t change your SEO plugin’s title. No source in our research shows ordinary title hiding hurting rankings. What matters is that the page still makes its subject clear.

What a correct result looks like, and when to stop

A finished change passes four checks:

1. The target page shows no theme title on desktop and mobile.
2. Other pages, posts and archives still show theirs.
3. Menus, the slug and the browser tab still use the real page name.
4. The page still has one clear H1.

If the title still shows, work through the causes in this order:

1. You targeted the wrong element, such as the site title or a WooCommerce template.
2. A cached copy of the page is being served.
3. The selector doesn’t match the class the theme actually prints.
4. A builder setting points at the wrong selector.
5. An update changed the theme’s markup.

Several of the threads we read ended without a fix, often where a theme and a builder both printed a heading. If you have checked all five and the title is still there, the snippet isn’t the problem. Finding which layer prints the heading is the real work, and that is the point to hand it to whoever maintains the theme. If you would rather describe the change in chat than trace it yourself, see how SiteSelf handles design changes on an existing site.

Frequently asked questions

Can I hide the page title without a plugin?

Yes. Use your theme’s own setting, a block template without the Title block, or CSS in Additional CSS. A plugin only helps when none of those fit how your site is built.

Will hiding the title remove it from my menu?

Hiding the heading leaves menus alone, because the stored title doesn’t change. Deleting the title is what breaks menu labels, so hide it rather than clearing the field.

Does hiding the title change what Google shows?

Not directly. Google builds title links from several sources, including the <title> element your SEO plugin controls. Keep that title accurate and keep a clear main heading on the page.

Why does my CSS work in the Customizer preview but not on the live site?

Usually caching or CSS minification. Clear your plugin, server, CDN and browser caches and regenerate any builder CSS before you rewrite the rule.

How do I hide the title on custom post types?

In a block theme, edit the template for that post type. In a classic theme, use the body class WordPress adds for that type, which you can see in the inspector. Hide Page And Post Title also supports public custom post types.

Is it better to hide the H1 or restyle it?

If the theme’s heading says what the page is about, restyling it to fit the design keeps the structure intact with no extra work. Hide it when your design already has its own heading, and make that heading the H1.

Contact Form 7’s own FAQ says the green “Thank you for your message. It has been sent.” response only means WordPress’s mail function finished running. It does not mean the email arrived. That gap is how small businesses end up with a contact form that looks fine for weeks and catches nothing.

Putting a form on a page is the easy half. This guide covers that half quickly, then spends most of its time on the parts that decide whether you ever read the message: the sender address, how the mail gets sent, where entries are stored, spam, and testing.

What do you need before you start?

You need administrator access to a self-hosted WordPress site, an email address on your own domain (such as hello@yourbusiness.com), and a way to change your domain’s DNS records, or the name of whoever can. Most delivery problems get fixed in DNS and mail settings, not inside the form.

If your site runs on WordPress.com rather than your own hosting, it has its own Form block and its own rules about plugins, so some of these steps will look different.

Which form plugin should you use?

Pick the simplest tool that does what you need. WordPress doesn’t ship a contact form in core, and themes usually style forms without creating them, so you will be installing a plugin.

Contact Form 7 is free and shows 10+ million active installs on WordPress.org. You build forms by editing short tags rather than dragging fields around, and it doesn’t save submissions unless you add a plugin for that. It’s a good fit for a plain name, email and message form if you’re happy reading settings carefully.

Drag-and-drop builders such as WPForms Lite (5+ million active installs), Fluent Forms, Forminator and Ninja Forms are easier for a non-developer to check. Some keep entries and integrations behind a paid tier, so look at the free feature list for the things you need, like a phone field or saved entries, before you commit.

Whichever you choose, check its last update date, tested-up-to version and PHP requirement before you click Install. Our guide to installing a WordPress plugin safely covers what to look for on the listing.

How to add the form, step by step

The steps below use Contact Form 7 as the example. Other builders use different screen names for the same steps.

1. Install the plugin. Go to Plugins, then Add New, search for the plugin, click Install Now, then Activate.
2. Build the form. Open Contact, then Contact Forms. The default form already has name, email, subject and message. Keep it close to that. Each extra field is one more reason for a visitor to give up. Make the phone field optional if you add one. If enquiries go to different people, a drop-down list of topics is easier to route than free text.
3. Label every field. The W3C’s accessibility tutorial says each field needs a proper <label>, and placeholder text alone isn’t a reliable substitute. Placeholder text disappears as soon as someone starts typing. A label stays put.
4. Set up the Mail tab. This is where most forms go wrong. See the next section.
5. Put the form on a page. Go to Pages, then Add New (or open your existing Contact page), insert the Contact Form 7 block and choose your form. A shortcode in a Shortcode block works too.
6. Publish, then test it as a stranger would. The testing section below explains how.

How should the Mail tab be filled in?

Contact Form 7’s mail documentation says the From address should be on the same domain as the website, and its best-practice guide says to put the visitor’s address in Reply-To instead. Your domain can’t legitimately send mail as someone’s Gmail account, and receiving servers know that.

To:       you@yourbusiness.com
From:     Website <hello@yourbusiness.com>
Subject:  New enquiry from [your-name]
Additional headers:
Reply-To: [your-email]

Message body:
From: [your-name] <[your-email]>
Subject: [your-subject]

[your-message]

Each word in square brackets is a mail-tag. It must match a field name in the form exactly. If you rename your-message in the form and forget to update the template, the email arrives with that field missing or with the raw tag in it. With Reply-To set, you can hit reply in your inbox and reach the visitor directly.

Why does the form say “sent” when no email arrives?

Because sending the email and receiving it are two separate steps. SiteGround’s knowledge base says WordPress commonly sends through PHP’s mail() function by default, and some mail providers mark those messages as spam. The form finishes its job and shows success. Then the message gets dropped, filtered or quarantined somewhere you can’t see.

The usual fix has three parts:

• Send through authenticated SMTP. Install an SMTP plugin such as WP Mail SMTP or FluentSMTP and connect it to your mail provider or a transactional mail service. Use the host, port, encryption and login details your provider gives you. Port 587 with TLS and 465 with SSL are common, but your provider’s values are the ones that count. Wrong settings produce errors like “smtp connect() failed” or “535 Incorrect authentication data”.
• Keep From on your domain. Use the same domain address as above, and make it match the account the SMTP plugin sends from.
• Set up SPF, DKIM and DMARC. SPF lists the servers allowed to send for your domain, DKIM signs each message, and DMARC tells receiving servers what to do when those checks fail. Your mail provider publishes the exact records to add at your DNS host.

SMTP improves your chances. It doesn’t guarantee the inbox. A wordpress.org support thread from February 2026 makes the point that even an SMTP log saying “Success” only means the mail server accepted the message.

How do you test a contact form properly?

Don’t test while logged in as admin in the browser you built the form in. That session can hide caching and script problems your visitors will hit. Test like a stranger:

• Submit from a phone on mobile data, logged out of WordPress.
• Check that the email reaches the right inbox. Use an outside mailbox too, and look in its spam folder.
• Hit reply and confirm the reply goes to the address you typed into the form.
• Submit with a broken email address and an empty required field. The form should reject both, say what is wrong in words rather than colour alone, and keep what you already typed.
• Complete the form once using only the keyboard, and once at phone width.

You’re done when a test from another device lands in the right inbox and you can reply to it. The success message doesn’t count.

Why should submissions be stored in WordPress?

Because email will fail eventually. A host changes something, a password expires or a DNS record gets edited. If every submission is also saved in your dashboard, a broken mail setup only delays your leads.

Contact Form 7 doesn’t store messages on its own. Flamingo, from the same developer, or CFDB7 saves them to the WordPress database, and CFDB7 can export them to CSV. Most drag-and-drop builders have an entries screen built in, though on some it’s a paid feature. Treat stored entries as untrusted input. Anyone can type anything into a public form.

How do you keep spam out without blocking real enquiries?

Stack quiet defences first and keep a CAPTCHA in reserve. A honeypot field catches bots that fill in every field, and Akismet screens message content. Rate limiting slows down repeat senders. Each CAPTCHA you show a bot is also shown to a customer on a phone, so add one only when the quiet layers aren’t enough.

Filters can go too far, too. In Contact Form 7, an orange border around the error means a spam check rejected the submission. The FAQ explains how to turn on spam logging, which tells you whether Akismet, reCAPTCHA or the disallowed list blocked it. Test the form again after changing any spam setting.

What to do if the form still isn’t working

Work out which step failed before you change anything. These causes are listed roughly in the order people run into them.

1. Success message, no email. Mail delivery problem. Check whether the entry was stored, then go through SMTP, the From address and DNS as described above.
2. Red border around the error. Contact Form 7 says this means the mail server couldn’t send. Its default message, “There was an error trying to send your message. Please try again later.”, appears for both mail failures and spam rejections, so read the border colour, not the words.
3. Orange border. A spam check flagged the submission. Turn on spam logging to see which one.
4. Email arrives with fields missing or showing [tags]. A mail-tag doesn’t match a field name. Line them up.
5. The page shows [contact-form-7 404 "Not Found"]. The shortcode points to a form ID that no longer exists. Insert the form again with the block.
6. The form won’t submit, or spins forever. Usually a conflict with another plugin, the theme, caching or a script. The Health Check plugin’s troubleshooting mode disables plugins and switches theme for your login only, so visitors see nothing change. Our guide to fixing plugins that stop working walks through the method.

Don’t swap form plugins as the first fix. In one r/Wordpress thread, the owner was told a new builder wouldn’t fix delivery, and the real fix turned out to be SPF and DMARC records set up during a call with their host. Sometimes switching does help when a theme conflict won’t go away, but try it after you’ve checked the mail settings, not before.

Stop and contact your host when the SMTP plugin’s test email fails with the correct details, or when messages leave the site and still never arrive. The host can read the mail server logs. You can’t.

When is a plugin form not enough?

Off-the-shelf forms start to struggle with dynamic recipients (send to whichever branch the visitor picked), post data in the email (which property or product was this about), forms in several languages, CRM or webhook connections, and product enquiries in WooCommerce. WooCommerce’s own Product Enquiry Form extension is no longer available and won’t be updated.

You can build a form without a plugin, but you’d need more than HTML. You also need code that processes the submission, validates and sanitises every field, checks a nonce, filters spam and sends mail safely. That’s a development task. If you’d rather describe the form than build it, SiteSelf can write that code on your existing site through chat. That work is custom WordPress development and needs hosting access. Your DNS records and mail provider stay with you.

Frequently asked questions

Does WordPress have a built-in contact form?

Self-hosted WordPress doesn’t include one in core, so you add a plugin. WordPress.com is a separate hosted product with its own Form block. Some themes offer a form button that installs a plugin in the background.

Can I put the visitor’s email address in the From field?

No. Receiving servers see your website claiming to be someone’s Gmail or Outlook account and treat it as spoofing. Use an address on your own domain as From, and put the visitor’s address in Reply-To.

Where do contact form submissions go?

By default, only to the email address in the form’s To field. Contact Form 7 keeps no copy unless you add Flamingo or CFDB7. Many other builders save entries in the dashboard, sometimes only on paid plans.

Can I add the form inside a page builder or a theme template?

Most page builders have a shortcode widget that takes the form’s shortcode. In a PHP template file, Contact Form 7’s FAQ says to run the shortcode through apply_shortcodes(). Don’t put the form inside another <form> element.

Will updating the form plugin fix a broken form?

Only if the bug is in the plugin. Updates don’t fix mail or DNS. Check the Requires PHP and Requires WordPress lines on the plugin listing before updating, because an update your server can’t run swaps a broken form for a broken site.

Out of the box, WordPress shows your latest posts at the root address. To show a specific page there instead, you change one setting, and it takes about a minute. Most problems people report afterwards have nothing to do with that setting. They come from the theme’s template, a cache, or a page that was never published.

This guide covers the setting itself, what a working result looks like, and what to check when the homepage won’t change. If you want to change what’s on the homepage rather than which page it is, our guide to editing your WordPress homepage picks up from there.

What you need before you open Settings > Reading

You need an administrator account and a published page. WordPress.com’s support docs say only published pages appear in the Homepage dropdown. Drafts, private pages and pages waiting for review won’t be listed. Our guide to adding pages in WordPress explains status and visibility if a page is missing.

Next, decide whether you want a separate blog. If you publish posts, create a second, empty page called Blog or News and publish it too. This becomes the Posts page. If you never publish posts, you can skip this step. WordPress.org’s Reading screen documentation says a Posts page is optional.

Make sure you’re working with an actual page. A block theme may already have something called “Front Page” or “Home” under Appearance > Editor > Templates. That is a template, not a page, and it never shows up in the Reading dropdown. Many people design the template for days and then can’t find their “homepage” in Pages. If that’s you, create a real page and assign it.

How to set a page as the front page

1. In the dashboard, go to Settings > Reading.
2. Under “Your homepage displays”, choose “A static page”.
3. In the Homepage dropdown, pick the page visitors should see at your root address.
4. If you created a blog page, pick it under Posts page. If not, leave Posts page empty.
5. Click Save Changes.

That’s the whole procedure. It matches WordPress.org’s static front page guide, and you don’t need a plugin. Elementor’s help center sends its users to the same Settings > Reading screen. Building a page in a page builder doesn’t change where you assign it.

Two rules catch people out. First, the Homepage and the Posts page must be different pages. Second, the Posts page only shows your post list. WordPress.org’s Reading settings documentation says WordPress ignores that page’s own template when it shows posts there, and nothing you type into the page appears. If you put your designed homepage in the Posts page slot by mistake, its content disappears.

What a correct result looks like

Open your root address, such as example.com/, in a private browser window. Your normal window is logged in, and logged-in users often skip the page cache that visitors get. The private window shows you what a visitor sees.

• The root address shows the page you picked, with its content and the layout you expect.
• Menu links to that page now point to the root address. You don’t need to change the page’s slug.
• If you set a Posts page, its address lists your recent posts.
• The browser tab shows a real title, not “Home” or the theme’s name.

If all four look right, you’re done. If not, work through the next section in order.

Why the homepage didn’t change after you saved

Saving the setting almost always works. When the root address still looks wrong, something around the setting doesn’t match it. Support docs and forum threads keep naming the same causes. Nobody has measured how often each one happens, so the order below runs from the quickest check to the slowest.

The setting didn’t save, or the page isn’t published

Open Settings > Reading again. Check that “A static page” is selected, the right page is in the Homepage dropdown, and Save Changes was clicked. Then check the page’s status under Pages > All Pages.

A page that was published last month may not be published today. WordPress.com’s troubleshooting guide says a previous homepage can move to Drafts after a theme change. Publish it again, then select it again in Reading.

A cache is serving the old homepage

This is a common reason a correct change looks wrong, and you won’t see an error. Clearing your browser cache doesn’t help if the old copy is stored somewhere else. A caching plugin, your host and a CDN can each keep their own copy. Purge them in that order, then test again in a private window.

Host caches cause the most trouble after a migration. In one WordPress.org support thread, a site cloned to a new host with Duplicator kept showing the default “Hello World!” and “Sample page” content on its homepage, whatever the owner changed in Reading. The fix was clearing a host cache the owner didn’t know was running. If your host’s control panel has a cache tool, use it. If you can’t find one, ask the host.

A block theme’s Front Page template is in charge

If you see an Editor item under Appearance, you’re on a block theme. That means the homepage has a layout layer you may not have looked at yet. WordPress.org’s Template Editor documentation says the Front Page template draws the homepage whether Reading is set to latest posts or a static page. WordPress.com’s troubleshooting guide adds that some block themes give that template priority over your Reading choice.

The usual symptom is a homepage with only the header and footer, or a layout that ignores your page. In a resolved WordPress.org thread on Twenty Twenty-Five, the selected page’s content disappeared as soon as it was set as the static homepage. Removing a Front Page template the user had created brought the content back.

First decide where the homepage content should live. Then set things up to match:

• Content lives in the page. Open Appearance > Editor > Templates > Front Page. Add a Content block where the page’s content should appear, and save. Then check that the page is still selected in Settings > Reading. This is the fix WordPress.com documents.
• Content lives in the template. Edit the Front Page template directly. The assigned page then has no effect on what visitors see, so don’t spend time editing it.
• The template is beyond repair. Use Reset on the template to restore the theme’s default. Reset throws away your changes. WordPress.com says View Revisions can recover earlier versions.

Our guide to customizing a WordPress template safely covers the Site Editor side in more detail.

A classic theme has its own front-page.php

Classic themes can cause the same problem with a file. WordPress’s Theme Handbook on front page templates says that when a theme has a front-page.php file, WordPress uses it for the front page before any page template. If that file never outputs the selected page’s content, editing the page changes nothing on screen.

Look in the theme folder with your host’s file manager or SFTP, or ask the theme’s support team whether its front page uses page content. If it doesn’t, the fix is a template in a child theme. That’s developer work.

A plugin or theme conflict

This is rarer. WordPress.com’s troubleshooting guide describes the standard test: switch to a default theme for a moment, deactivate plugins, then turn them back on one at a time. Use a staging copy if you have one. Change one thing at a time, or you won’t know which change fixed it.

What changes if you run a WooCommerce store

WooCommerce assigns its Shop page separately, under WooCommerce > Settings > Products. WooCommerce’s documentation warns that the Shop page is drawn by a template and may look different from your other pages. You can pick the Shop page as your homepage in Reading. Do it on purpose, and check your theme and extensions afterwards, because a page doing both jobs doesn’t always behave like either one.

Product category archives aren’t pages, so they never appear in the Homepage dropdown. A better option is a real homepage that points visitors to your main categories. Redirecting the root address to a category archive is not a good substitute.

Two traps on the same Reading screen

“Discourage search engines” left on from staging

Below the homepage options, Settings > Reading has a “Search engine visibility” checkbox. WordPress.org’s documentation says ticking it can add a noindex,nofollow robots tag to the site, while visitors still see it normally. Staging sites often have this box ticked, and the setting goes live with the site at launch. If your new homepage looks right but never shows up in search results, check this box first.

A redirect is not a homepage setting

Don’t redirect example.com/ to another address to make a page your homepage. The Reading setting shows the page at the root address. A redirect tells browsers and search engines the address has moved, which isn’t true. Save redirects for URLs that have actually changed, as our guide to redirecting WordPress pages explains.

When to stop and get help

Stop when the fix needs code. That includes a classic theme’s front-page.php that ignores your page, a custom template in a child theme, or a host cache with no purge button you can find. Ask your host about server caching before anything else. That one question resolves many “settings ignored” threads.

On a store, test template changes on a staging copy first, because a broken homepage costs orders. If you’d rather hand the job off, SiteSelf can change the Reading setting from chat through its connector plugin, then fetch the homepage and tell you what it found. That kind of request is what website edits through chat covers.

Frequently asked questions

Do I need a plugin to set a static front page?

No. The feature is built into WordPress under Settings > Reading. Plugins only cover edge cases, such as showing a different front page at certain times of day or using a custom post type as the homepage.

Can a blog post or a product be my homepage?

Not with the built-in setting. The Homepage dropdown only lists pages. Small plugins in the WordPress.org directory add this option. Before you rely on one, check when it was last updated. Often the simpler fix is a real page that features the post or product.

Where do I edit the SEO title for a static homepage?

In Yoast SEO, you edit it on the page you assigned as the homepage. Yoast’s help docs say the Content type > Homepage settings apply when the homepage shows your latest posts. Other SEO plugins work in a similar way, so check the assigned page first.

I deleted “Hello World!” and now my homepage says nothing was found. Why?

Your homepage is probably still set to show your latest posts, and there are no posts left to show. Either publish a post, or switch Settings > Reading to a static page and pick a published page.

Does a static homepage hurt SEO?

No. WordPress shows the page directly at the root address, with no redirect. Search engines index whatever is at that address. What does hurt is the “Discourage search engines” box being ticked, or an SEO plugin marking the assigned page noindex.

Why is my blog page blank after I assigned it as the Posts page?

Either you have no published posts yet, or a block theme’s Blog Home template has no Query Loop block to list them. Publish a post to test, then open the template under Appearance > Editor > Templates. Text typed into the Posts page itself never shows, by design.

To reach the dashboard of a self-hosted WordPress blog, add /wp-login.php to the end of your domain. That works on most sites. When it doesn’t, the cause is rarely the password, even though the password is what people reset first. Most failed sign-ins come from the wrong account, the wrong address, or a site that accepts your password and then forgets you a moment later.

This guide starts with finding the right login. Then it works through each symptom in the order people usually hit them. If all you need is a fact about the site, such as its WordPress version, you may not need to log in at all: see finding your WordPress version without logging in.

Is your blog on WordPress.com or self-hosted?

Answer this first, because the two use separate accounts. WordPress.com is a hosted service with one account system. It has its own login page, its own password reset and an option to get a login link by email. A self-hosted WordPress site keeps its own user accounts in its own database, and it doesn’t know about your WordPress.com account at all.

Mixing the two up wastes a lot of time. In one WordPress.org support thread, a site owner reset their password, still got “incorrect password”, and kept trying. A forum moderator pointed out that the WordPress.com login and the self-hosted site’s login are different accounts. They also suggested checking whether a password manager was filling in an old password.

Here is how to tell which one you have:

• If the address ends in wordpress.com, it is WordPress.com.
• If you pay a web host (cPanel, Plesk or a managed WordPress host) and the bills come from them, the site is self-hosted.
• A custom domain doesn’t settle it, because WordPress.com sites can use custom domains too. Search your email for hosting or billing receipts.

Where is the login page for a self-hosted blog?

WordPress’s Advanced Administration Handbook gives the login page as wp-login.php. It also says that visiting /wp-admin/ while logged out redirects you there. They are not the same thing: /wp-admin/ is the dashboard, and wp-login.php is the form that lets you into it.

1. Type the full address yourself: https://yourdomain.com/wp-login.php. Don’t click through a search result.
2. If WordPress is installed in a subfolder, include it: https://yourdomain.com/blog/wp-login.php.
3. Enter the username and password for your account on that site, not your hosting or WordPress.com login.
4. Leave “Remember Me” unticked on shared computers.
5. Once you land on the dashboard, bookmark the address you used.

If you get the dashboard, you’re done. If not, the next section tells you which problem you have.

What happens after you click Log In tells you the fix

Write down exactly what you see after you submit the form. Each response points to a different part of the site.

What you see	Most likely cause	Where to look
“Incorrect password” or unknown username	Wrong credentials or wrong account	Reset, check case, check the password manager
Back to the login form, no error	Cookies, site URLs, cache, plugin	Private window, URL settings, cache rules
“Too many redirects”	Conflicting redirect rules	WordPress, host panel, CDN, proxy, SSL mode
404 at wp-login.php	A login-hiding plugin	The plugin’s custom address
A lockout or CAPTCHA error	A security plugin	Wait, unlock email, or disable via file access
403, 500, blank page or database error	The server or PHP	Your host and the error logs

The password is rejected

WordPress.org’s troubleshooting guide says the username and password fields are case-sensitive. Check Caps Lock, and type the password by hand once so you know an old saved password isn’t being filled in. Then use “Lost your password?” under the form, enter your username or account email, and follow the link in the message.

If the email doesn’t arrive, check spam. Make sure you are looking in the inbox actually attached to that WordPress user, which is often the address of whoever set the site up. Don’t request five resets in a row. Each new request makes the earlier links useless, and security plugins may count the attempts against you. WordPress.com’s own help says its reset emails can take a few minutes. It also says that several wrong passwords can block sign-in for a few minutes.

If the account email is one nobody can open anymore, the fix needs hosting access. With WP-CLI on the server, you can list administrators and set a new email address, then run the normal reset:

wp user list --role=administrator --fields=ID,user_login,user_email
wp user update 1 --user_email=you@yourbusiness.com

Without WP-CLI, the same details are in the users table in phpMyAdmin, which your host’s control panel opens. Take a database backup before you change anything there.

You log in and land back on the login screen

If the form reloads with no error, WordPress accepted your password but couldn’t keep you signed in. The handbook lists the usual causes: blocked cookies, a COOKIE_DOMAIN mismatch, mixing http and https, site URLs that disagree, plugin conflicts and server caching. Work through them from cheapest to most invasive:

1. Try a private window. If you get in, clear that site’s cookies in your normal browser and you’re done.
2. Check the address you typed against the site’s own settings. Use the same scheme (https or http) and the same host (www or no www) every time. If wp-config.php defines WP_HOME and WP_SITEURL, those values override the database settings. They should match the address you actually use. The handbook warns against blindly making the home and site URLs identical, because some installs keep WordPress in a different folder on purpose.
3. Exclude the login page from every cache. wp-login.php and logged-in sessions shouldn’t be cached by a plugin, by the host or by a CDN. In one WordPress.org thread, clearing cookies and turning off ad blockers did nothing. Host-level caching can keep running even after you disable the cache plugin.
4. Test plugins by renaming the folder. Over SFTP or in the host’s file manager, rename wp-content/plugins to plugins-off. If you can now log in, a plugin is the cause. Rename the folder back and reactivate plugins one at a time until the loop returns. Renaming is a test, not a fix.
5. Check the theme. The error “Cookies are blocked due to unexpected output” means something printed text before WordPress could set its cookie. In one resolved WordPress.org thread, the cause was two blank lines at the end of the theme’s functions.php.

The browser says “Too many redirects”

This means two or more rules are sending the browser back and forth. The rules can live in WordPress, in .htaccess, in the hosting panel, in a CDN or proxy, or in the SSL mode setting. This loop typically starts after a domain change or an HTTPS switch. Find the conflicting rule and remove it, then purge every cache. Adding another “force HTTPS” rule is the most common way to make this loop worse.

wp-login.php returns a 404

A 404 almost always means someone installed a plugin that moved the login page. WPS Hide Login’s plugin page says the plugin makes wp-login.php and the wp-admin directory inaccessible without renaming core files. If you’ve lost the custom address, the plugin’s documentation says it is stored in the whl_page option in the database, or in sitemeta on a multisite network. Removing the plugin’s folder over SFTP brings back the default address. Reinstall the plugin afterwards if you still want it.

A security plugin locked you out

Security features lock out many site owners. Limits on login attempts, CAPTCHAs, cookie-based brute-force settings and forgotten custom URLs are all common causes. In one WordPress.org thread, enabling the cookie-based brute-force feature in All-In-One Security sent the owner’s login to 127.0.0.1. In another, a CAPTCHA showing “Invalid site key” blocked both login and password reset.

For a temporary lockout, wait it out, use the plugin’s unlock email if it has one, or try another network. If the plugin itself is broken, rename its folder in wp-content/plugins, log in, and fix the setting before you reactivate it. Replies in that CAPTCHA thread warned against turning protection back on until you understand what went wrong. Reactivating too soon locks you out again.

You see a 403, a 500 or a database error

A new password does nothing for these. “Error establishing a database connection” means WordPress can’t reach its database. A 403 is usually a firewall or security rule, and a blank page or 500 is usually a PHP failure. Our guide to fixing a WordPress white screen covers the PHP side. For firewall blocks and database errors, contact your host and ask them to check the error logs.

What if you never had hosting access?

This is the harder situation, and it is common with sites a developer or agency built. Your login may be an editor account rather than an administrator, or you may have no login at all. In one 2026 r/Wordpress thread, the client didn’t know where the site was hosted. A freelancer traced the DNS to a server running Plesk and found the web firm behind it. It turned out three years of hosting invoices had been going to an inbox nobody read.

Start by finding the host. A DNS lookup on your domain shows where it points. Your email and card statements show who you pay. Then ask whoever controls that account to create an administrator account in your name. Don’t ask them to send you their password. Practitioners agree on this order: own the domain, the hosting account, the recovery email and one administrator account yourself. Give developers their own accounts that you can delete when the work ends.

When to stop and get help

Stop at the database or redirect rules if you don’t have a recent backup, or if you’re editing values you can’t explain. Hand server errors to your host early. If you have hosting access but would rather not rename folders or edit wp-config.php yourself, SiteSelf can do that work through chat with SSH access. It checks the result and reports what it changed, and you can read more on getting broken WordPress sites working. Once you’re back in, review who holds which keys as part of your WordPress care plan.

Frequently asked questions

Is /wp-admin the same as /wp-login.php?

No. /wp-admin/ is the dashboard and wp-login.php is the login form. If you visit /wp-admin/ while logged out, WordPress normally sends you to wp-login.php, so either address gets you to the form on a default install.

Where do WooCommerce customers sign in?

Customers sign in on the store’s My Account page, not wp-admin. WooCommerce’s documentation says logged-out visitors to that page see a login form. Customer account options are under WooCommerce, then Settings, then Accounts and Privacy.

Should I password-protect the whole wp-admin folder?

Usually not. Many front-end features call admin-ajax.php, which sits inside that folder, and a folder password can break them. Store carts are a commonly reported example. Our article on Apache security for WordPress covers safer ways to set this up.

Should I give my developer my admin password?

No. Create a separate account for them with only the role they need, and delete it when the work is done. Never send credentials in plain text. Separate accounts also mean your own two-factor codes don’t have to be passed along.

Is hiding the login URL worth it?

It may cut automated login attempts, but nobody has published reliable numbers on how much. It is also one of the most common ways owners lock themselves out. If you use it, save the custom address somewhere your team can find it, and test the recovery route before you rely on it.

Does signing in work differently on Multisite?

Each site in the network has its own dashboard, and only a Super Admin can manage the whole network. If you’re not sure how a site you inherited is organised, our guide to WordPress Multisite installation explains the setup.