Blog

  • How to create a WordPress staging site safely

    Key takeaways

    • Use your host’s staging tool if your plan includes one. If not, use a plugin such as WP STAGING, whose free version clones to a subfolder and keeps push-to-live for Pro. Build the copy by hand only if you’re comfortable with databases and WP-CLI.
    • WordPress’s ‘Discourage search engines’ setting doesn’t stop anyone from opening the site. Password-protect the copy. Don’t also block it in robots.txt, because that stops Google from reading a noindex tag.
    • A clone keeps live payment keys, outgoing email, cron jobs and webhooks. Switch gateways to sandbox mode and turn off outgoing mail before anyone places a test order.
    • Kinsta’s docs warn that a full database push can lose purchases, comments, sign-ups and new content added since the copy was made. For plugin updates, test on staging and then run the same update on live.

    Most hosts and plugins can copy a WordPress site to a staging URL in a few minutes. The problems come afterwards. Anyone who finds the copy can open it. It still holds your live payment keys and email settings. And pushing it back to live can erase every order, comment and sign-up that came in while you were testing.

    This guide covers the three ways to create the copy, the four things to lock down before you test on it, and how to deploy back without overwriting live data. Before you start, take a fresh backup of the live site and make sure you can actually restore that WordPress backup. Staging is for testing. It doesn’t replace a backup.

    Which staging method fits your site

    Use your host’s tool if your plan has one. If it doesn’t, or the tool fails on your site, use a plugin. Build a copy by hand when you need full control or nothing else works. That order comes up again and again in practitioner threads, and it also matches how much can go wrong with each method.

    MethodAccess you needGood fitWatch out for
    Host staging toolHosting dashboard loginManaged WordPress plans that include stagingOnly on some plans. Can fail on individual sites. Resources and caching may differ from live.
    Staging pluginWordPress adminShared hosting without a staging buttonRuns on your live site’s disk, PHP and database. Push to live is often a paid feature.
    Manual copySSH or file manager, plus database accessDevelopers who want a separate database and subdomainSlowest method, and the easiest to get wrong. A careless search-replace breaks settings.

    How to create the staging copy

    With your host’s staging tool

    Look in the hosting dashboard for “Staging”, “Environments” or “Clone”. On Kinsta, for example, you go to Sites, open the live environment and choose Create new environment, then pick the clone option. Most hosts put the copy on its own subdomain and connect it to a separate database for you, so this is the quickest route.

    If the tool fails on one site but works on others, try a plugin instead of running the same clone again. Repeating a clone without changing anything usually fails the same way.

    With a staging plugin

    With WP STAGING’s free version, go to WP Staging, then Staging Sites, then Create New Staging Site. Give it a name and start the clone. The copy lives in a subfolder of your domain, such as /development. By default its tables sit in your existing database under a separate prefix.

    That shared database keeps the copy separate in software, but not physically. Subdomain clones, a separate database and pushing to live are Pro features. Long-time users say this kind of plugin works best on small, clean sites, and that large sites sometimes need a manual search-replace after the clone.

    By hand

    1. Create a subdomain such as staging.example.com in your hosting panel.
    2. Copy the WordPress files into the subdomain’s folder, including all of wp-content.
    3. Export the live database. Create a new, empty database with its own user, and import the export into it. Don’t reuse the production database credentials.
    4. Edit the staging wp-config.php so it points at the new database and labels the environment:
      define( 'DB_NAME', 'example_staging' );
      define( 'DB_USER', 'staging_user' );
      define( 'WP_ENVIRONMENT_TYPE', 'staging' );
    5. Replace the live URL with the staging URL using a tool that understands serialized data. Run it once with --dry-run to preview the changes, then run it again without that flag to apply them:
      wp search-replace 'https://example.com' 'https://staging.example.com' --skip-columns=guid --dry-run
    6. Password-protect the subdomain before anyone else logs in.

    Step 5 is where most hand-built copies break. WordPress stores some settings as serialized PHP, and the stored value includes each string’s length. If you swap a URL in phpMyAdmin, the length no longer matches and widgets or options stop loading. WordPress’s migration handbook also says to leave the guid column alone. If those IDs change, feed readers can show old posts as new.

    Lock the copy down before you test anything

    A fresh clone is a working copy of your live site. It can do anything live can do: send email, charge cards and fire webhooks. Make these four changes before anyone uses it.

    Put a password in front of it. WordPress’s own documentation says that Settings → Reading → “Discourage search engines from indexing this site” asks search engines not to index the site. It doesn’t stop anyone from visiting it. Real access control means server-level password protection (basic auth), which shows a login prompt before WordPress even loads. Our guide to adding password protection to a site covers the options. Don’t also disallow the copy in robots.txt. Google’s documentation says a crawler blocked by robots.txt can’t read a noindex tag, and the blocked URL can still show up in search results.

    Switch payments to sandbox. Set every payment gateway to test or sandbox mode. WooCommerce’s documentation says test orders can trigger order emails and appear in analytics like real orders, and that other integrations may not be able to tell them apart from real ones.

    Stop outgoing mail and integrations. Turn off outgoing email on the copy. If you send mail through an SMTP provider’s API, remove or change the API key there too, because some plugins that block WordPress mail don’t stop mail sent through the provider. Check webhooks to fulfillment, accounting and CRM tools. In one wordpress.org support thread, a copied database still had live API and webhook access.

    Handle WooCommerce Subscriptions. Subscriptions decides it’s on a staging site by comparing the current URL with the URL it stored when it was first activated. So activate it on live before you clone, then check the mode under WooCommerce → Status. In staging mode it skips payments and subscription emails, but scheduled renewals and events still run. Make sure the live site answers on only one URL. If it works on both www and non-www, Subscriptions can mistake the live site for staging.

    Setting WP_ENVIRONMENT_TYPE to staging helps too, but only as a label. WordPress recognizes local, development, staging and production, and plugins can read the value. That tells everyone which site they’re looking at. It doesn’t stop a plugin that ignores the label from sending mail.

    What a working staging copy looks like

    Open the homepage, a post, a product page and the login screen. Every page should load on the staging address, with the same theme, plugins and content as live. Click the main menu and two links inside page content. If any of them opens the live domain, the search-replace missed something.

    On a store, place one order in sandbox mode and take it through to the thank-you page. Then check the live order list. It should not have gained an order. Your inbox should get the test email only if you redirected mail to yourself. No customer address should receive it.

    Then test the actual change. Do one thing at a time, in this order: core, then theme, then plugins. That way, when something breaks, you know which change caused it. For store updates, WooCommerce’s update guide lists what to check: product pages, cart, checkout, payments, shipping, taxes, order emails and any extensions you rely on.

    When the clone fails: the usual causes

    The clone stalls partway or times out. The site is too big for the PHP execution time limit, or a large table such as orders or analytics logs is slowing it down. Ask your host to raise the limit, or lower the plugin’s batch size. You can leave out log tables, but don’t leave out anything your test needs.

    A memory error. In one wordpress.org support thread, a clone failed because WordPress’s own memory limit was 40 MB even though PHP allowed 256 MB. Adding define( 'WP_MEMORY_LIMIT', '256M' ); to wp-config.php raises WordPress’s limit.

    The copy redirects to live, or every page except the homepage returns 404. Check the siteurl and home values in the copy’s options table. Then go to Settings → Permalinks and click Save Changes. Next, look at .htaccess or the Nginx config, then at caching, SSL, redirect and security plugins.

    A blank page or “critical error” after a clone that reported success. Turn on debug logging and read wp-content/debug.log. It usually names a theme or plugin file. Make sure the copy runs the same PHP version as live before you start deactivating plugins.

    The plugin can’t use a separate database. WP STAGING can’t create the database itself. Create it first, and give its user the CREATE, INSERT and ALTER privileges.

    How to move tested changes to live without losing orders

    A full database push replaces data. It doesn’t merge it. Kinsta’s push documentation warns that a full push can lose purchases, comments, new content, sign-ups and forum posts added since you made the staging copy. On r/woocommerce, one store owner reported duplicated and reset order numbers after pushing from host staging. WordPress has no built-in way to merge two databases that have both changed, so the safe approach is to pick the method that fits the kind of change.

    Change you testedHow to deploy it
    Plugin, theme or core updateDon’t push anything. Run the same update on live, then recheck.
    Theme files or custom codePush files only.
    A new plugin or a settings changeInstall it or change the setting on live by hand. Files don’t carry database settings.
    A redesign with new pagesPause content edits on live, push only the tables you’ve named, and never push orders, users or comments.

    A files-only push has its own limit. Kinsta notes that pushing files doesn’t create a new plugin’s database tables, and dashboard settings are usually stored in the database. Avoid the opposite mistake too: don’t push the whole database just to carry over one setting.

    If you push database tables to a store, first find out where the store keeps its orders. Stores using High-Performance Order Storage keep orders in their own wc_orders tables. Older stores keep them in wp_posts and wp_postmeta, mixed in with your pages. If you can’t name every table a push will overwrite, don’t run it.

    For updates, the test-then-repeat approach is the simplest safe option on a busy site, because it never touches the live database. If you would rather hand the update cycle off, the plugin updates and maintenance page explains how SiteSelf reviews, applies and checks updates on request.

    Four checks on the live site after a deploy

    1. Search visibility. Open Settings → Reading on live and make sure “Discourage search engines” is unticked. That setting is stored in the database, so a push can bring it over from staging and leave production hidden from search.
    2. Protections. Kinsta says .htpasswd files and some bot-protection settings don’t transfer in a push. Check that live still has the protections it had before.
    3. Money paths. Make sure the gateways are back in live mode on production. Run through checkout up to the payment step, and confirm today’s orders are still in the order list.
    4. Links and redirects. Click the menu, a few in-content links and any redirects you rely on. None should point at the staging address.

    Once the work ships, delete the staging copy or lock it away. An unmaintained clone of your site is another login page for attackers to find, and it falls further out of date every week. If something did go wrong, restore the backup you took before the deploy instead of editing live tables under pressure. Our guide to restoring WordPress from backup covers that.

    Frequently asked questions

    Can I create a WordPress staging site for free?

    Often, yes. Many hosting plans include staging, WP STAGING’s free version makes subfolder clones, and you can always build one by hand. What free options usually leave out is the push back to live. With WP STAGING, that’s a Pro feature.

    Should staging be on a subdomain or a subfolder?

    Both work. A subdomain keeps the copy’s address and rewrite rules separate from live. A subfolder copy can clash with the root .htaccess rules and cause wp-admin problems. Neither is clearly safer. Choose the one your tool supports and protect it the same way.

    How do I refresh a staging site that has gone stale?

    Use your host’s pull, refresh or clone-from-production option, or make a new clone with the plugin. Staging doesn’t update itself when live changes. Refreshing replaces whatever is on the copy, so export any unfinished work first. Refresh just before your final test, not weeks earlier.

    Do I need staging for simple content edits?

    Usually not. Text and image changes are easier to make on live, and WordPress keeps post revisions so you can roll them back. Staging is for updates, design changes, new plugins and anything that touches checkout.

    Can I test checkout on a local copy instead?

    You can test layout and code locally. Checkout is different. Payment gateways, webhooks, email and SSL usually need a public URL to behave like they do on live, so test them on online staging with the gateway in sandbox mode.

    Can deleting a staging site break the live site?

    It shouldn’t if the copy uses its own database. Plugin staging that shares the live database deserves more care. One r/Wordpress user reported a live “Error establishing a database connection” after deleting a staging site made with a one-click installer, although the cause was never confirmed. Take a backup before you delete.

  • WordPress user roles explained by what each can do

    Key takeaways

    • A single WordPress site has five default roles: Administrator, Editor, Author, Contributor and Subscriber. Super Admin exists only on Multisite.
    • WordPress checks capabilities such as publish_posts, upload_files and manage_options. It does not check the role name, so plugins that add or demand capabilities change what a role can do.
    • WooCommerce adds Customer and Shop Manager. Shop Manager can handle products, orders, coupons, reports and customer details, so it is not a read-only staff role.
    • wp role reset –all and User Role Editor’s Reset both wipe capabilities that plugins and site owners added. Back up first and reset one role at a time.
    • Hosting-portal access, page privacy and firewall 403 errors sit outside WordPress roles. Changing a role will not fix them.

    A writer can’t upload her own hero image. A store assistant can issue refunds nobody meant him to touch. A contractor still has Administrator two years after the project ended. Each of these is a role decision, and most were made in a hurry from the dropdown on the Add New User screen.

    Roles look like job titles. They are permission bundles, and the bundle on your site may not match the one in the documentation. This article covers what each default role can do, why plugins change the answer, and how to give people the narrowest access that still lets them work. On a Multisite network the same rules apply to each site separately, which is why our article on what a multisite manager manages treats users and roles as two separate things.

    What a WordPress user role actually is

    A role is a named set of capabilities. A capability is one permission: publish_posts, upload_files, manage_options (site settings), edit_theme_options (the Site Editor, menus and widgets), install_plugins, promote_users (changing other people’s roles). When someone clicks a button, WordPress checks the capability, not the role’s name.

    That difference matters. WordPress.org’s Roles and Capabilities documentation says plugins and themes can add roles and capabilities, so two sites can both have an “Editor” that behaves differently. The role’s name tells you the starting point. The capability list tells you what the person can actually do.

    What each default role can do

    On a single self-hosted site there are five default roles. A sixth, Super Admin, appears only on Multisite.

    RoleCan do by defaultCannot do by defaultUsual fit
    Super Admin (Multisite only)Everything, across the whole networkNothing withheldThe network owner
    AdministratorSettings, plugins, themes, users, all contentOn Multisite, some capabilities are reserved for the Super AdminWhoever maintains the site
    EditorPublish and manage all posts and pages, including other people’s; moderate commentsPlugins, themes, users, site settingsContent lead
    AuthorPublish and manage their own posts; upload mediaPages; other people’s postsWriter who publishes their own work
    ContributorWrite and edit their own postsPublish; upload mediaWriter whose work gets reviewed
    SubscriberRead; manage their own profileAnything else in the dashboardMembers, commenters

    Online guides disagree on whether WordPress has five or six roles because some describe WordPress.com, the hosted service. Its support documentation lists an extra Viewer role that self-hosted WordPress doesn’t have. When a guide’s advice doesn’t match your dashboard, check which platform it was written for.

    Most role decisions happen between Editor, Author and Contributor

    Contributor and Author differ in two capabilities: publishing and uploading. A Contributor’s draft arrives without its images because the role has no upload_files. If your writers supply their own photos, Author is usually the right role. Moving files back and forth by email for every post is the wrong fix.

    Author and Editor differ in scope. An Editor can change or delete anyone’s posts and every page on the site. People often hand Editor to every writer because one of them needs to update the About page. Authors can’t edit pages by default, so that one task pulls the whole team up a level. Give Editor to the person who owns the content, and keep the rest of the team on Author or Contributor.

    Why a role’s name doesn’t tell you what someone can do

    Plugins add their own capabilities, and the default roles don’t have them. In a WP Job Manager support thread, users with a custom Consultant role got “Sorry, you are not allowed to access this page” when they opened job listings. The missing capability was edit_job_listings. Granting the general edit_posts capability made the error go away, but it also gave those users access to posts they were never meant to edit.

    Some plugins lock features behind a broad capability. In another support thread about a slider plugin, an Editor couldn’t even see the slider menu because the plugin required manage_options. Giving Editors that capability would let them use the sliders. It would also open every site setting to them. When a plugin forces that choice, the better answer is to ask its author for a feature-specific capability.

    WooCommerce is the biggest example. Its Roles and Capabilities documentation says it adds a Customer role and a Shop Manager role, and gives Administrators store capabilities. Shop Managers can manage products, orders, coupons, reports and customer details. That makes it a powerful role, not a safe default for someone who only needs to pack orders.

    WooCommerce also shows that one account can hold more than one role. Its guide to Shop Manager editable roles says Shop Managers can edit Customer-only accounts by default. To edit any other account, every role on that account has to be on an allowlist. The woocommerce_shop_manager_editable_roles filter changes that allowlist. It does not give Shop Managers any WordPress user-management capabilities.

    How to choose the right role for each person

    Start from the tasks, not the job title. “Marketing assistant” can mean writing blog posts at one company and running the store at another.

    1. List what the person does in a normal week. For example: publish posts, swap a banner image, edit product descriptions, reply to comments.
    2. Pick the lowest default role that covers the whole list. If two roles both work, take the lower one.
    3. If one task is missing, grant that one capability. Add it to a custom role. Don’t move the person up a whole role, and don’t hand out manage_options or Administrator to cover one task.
    4. Test it as that user. Create a test account with the role and log in from a private browser window. If you test from your Administrator account, you won’t see the gaps a real user hits.
    5. Write down why each role above Author was granted. A note such as “Editor for launch week” makes it easier to remember to take temporary access back.

    Check one more setting. Under Settings → General, New User Default Role decides which role every new registration gets. If “Anyone can register” is turned on, that role goes to strangers, so keep it at Subscriber, or Customer on a store. Changing it only affects future signups. You change existing accounts under Users → All Users.

    How to change a role and see what it really grants

    In the dashboard, go to Users → All Users. Tick one or more users, choose a role from the “Change role to…” dropdown, and click Change. To change one user, you can also open their profile and use the Role field. You need the promote_users capability to do either, and by default only Administrators have it.

    The dashboard won’t show you the full capability list for a role. With SSH access and WP-CLI you can see it directly:

    wp role list
    wp cap list editor
    wp user list --role=administrator --fields=ID,user_login,user_email
    wp user set-role 42 author

    The third command is the useful one for an audit. It lists every Administrator, and on older sites that list is usually longer than anyone expects.

    When a custom role is the right answer, and what breaks it

    Create a custom role when no default role fits without giving too much away. Examples include a copy editor who fixes other people’s posts but can’t publish new ones, or store staff who need orders but not settings. The common tools are role-editor plugins. User Role Editor lists 700,000+ active installations in the WordPress.org directory, and Members lists 300,000+. Most people clone an existing role and remove capabilities from the copy.

    In code, register the role once, when the plugin is activated. The Plugin Handbook warns that removing and re-adding roles on every load when nothing has changed can “degrade performance considerably.”

    register_activation_hook( __FILE__, function () {
        add_role( 'copy_editor', 'Copy Editor', array(
            'read'                 => true,
            'edit_posts'           => true,
            'edit_others_posts'    => true,
            'edit_published_posts' => true,
        ) );
    } );
    
    register_deactivation_hook( __FILE__, function () {
        remove_role( 'copy_editor' );
    } );

    Custom roles break in three common ways:

    • Resets. Hostinger’s WP-CLI guide warns that wp role reset --all resets every role, including roles created by plugins, and removes custom capabilities. User Role Editor’s own documentation says its Reset returns roles to a fresh-install state and loses changes made by you or by plugins. Take a backup, then reset only the role that is broken: wp role reset editor.
    • Another plugin overwrites your changes. If a role change looks saved and then disappears, another plugin may be re-registering that role. In a Members support thread about this, the advice was to disable plugins one at a time until the change stays.
    • Hiding a menu is not restricting access. Admin menu editors hide items in the dashboard. A user who knows the URL can still reach the screen if their role has the capability. Use menu hiding for a tidier dashboard and capabilities for security.

    What WordPress roles don’t control

    Several problems look like role problems but aren’t.

    Hosting accounts. Hosts run their own user systems. Kinsta’s guide to client access management treats MyKinsta access and WordPress roles as two separate things to assign. WP Engine has its own User Portal users and roles. Removing someone’s WordPress account doesn’t remove their hosting, SFTP or database access. When someone leaves, check both.

    Who can see a published page. Roles control what logged-in users can do in the dashboard. They don’t decide who can view a public URL or whether search engines index it. For private content, use a login or a password. Our guide on password protecting a WordPress page explains which one fits which situation.

    Some “not allowed” errors. A 403 can have causes other than a missing capability. In a Ditty support thread, the reply explained that the editor saves through the REST API. A 403 there could be rest_forbidden, which means a capability really is missing. It could be rest_cookie_invalid_nonce, which means the session has expired and logging out and back in fixes it. Or it could be a firewall’s block page. Check the response in your browser’s network tab before you change anyone’s role.

    Who should hold Administrator on a client site

    This is where roles become a business question. Agencies worry that a client with Administrator rights will install a plugin and break the site, leaving them with repair work they can’t bill for. Owners worry about being locked out of a site they paid for. Both concerns are reasonable, and neither is solved by sharing one Administrator login.

    The setup that holds up: the client owns the domain and hosting and has an Administrator account of their own, even if they rarely use it. Their day-to-day staff get Editor or a narrower role. The agency’s developers get named accounts, not a shared one. Plugin changes are agreed before they happen and made after a backup. Every account is removed when the engagement ends. The weak spot that our article on common WordPress security issues keeps coming back to is the old contractor whose admin login still works.

    Clients often push for Administrator because every small change otherwise waits in the agency’s queue. Handling those routine client requests is the work SiteSelf’s page for agencies describes.

    Frequently asked questions

    Can a WordPress user have more than one role?

    Yes, at the data level. The standard dashboard shows one role per user, but plugins can assign several, and WooCommerce’s documentation describes accounts with more than one role. The user gets the combined capabilities of all their roles.

    What role should a freelance writer get?

    Contributor if someone reviews their drafts before publishing, Author if they publish their own posts. Contributor can’t upload images, so pick Author if they supply their own photos. Editor is too much for a writer who only handles their own work.

    Does a developer need Administrator?

    For plugin, theme or settings work, usually yes, because those tasks need Administrator-level capabilities. Give them a named account of their own, agree on the scope of work, take a backup first, and remove or downgrade the account when the work is done. Code and file work may also need hosting access, which is a separate account.

    Can I give WooCommerce staff a “view orders only” role?

    Not with the built-in roles. WooCommerce adds only Customer and Shop Manager, and Shop Manager covers far more than orders. Clone Shop Manager with a role editor, remove what the job doesn’t need, and test the result with a staff account before you hand it over.

    Does WordPress record who changed a user’s role?

    Core WordPress doesn’t keep an activity log of role changes. If you need that record, install an activity log plugin. Check the Administrator list regularly with wp user list --role=administrator, because a new Administrator you didn’t create is also a sign of a hacked site.

    Why do my role changes not stick?

    Another plugin is probably re-registering the role when it loads. Disable plugins one at a time until the change stays, then make the change through that plugin’s own settings or hooks. Don’t use a full reset to fix it, because a reset wipes every other custom capability too.

  • How to edit a menu in WordPress, classic or block

    Key takeaways

    • If Appearance shows Editor but no Menus, you have a block theme. WordPress.org says block themes on WordPress 6.0 and later don’t get the classic Menus screen by default.
    • On a classic theme, a saved menu only appears after you tick a Display location under Menu Settings and click Save Menu.
    • On a block theme, the menu shows only when a Navigation block in the header points to it, and a homepage template can have its own Navigation block pointing to a different menu.
    • Clicking Edit on a Page List turns it into separate links, and new pages stop being added to the menu automatically.
    • When a change doesn’t show, check the plugin cache first, then the host or CDN cache, then the browser. Look at the page in a private window before you edit anything again.

    You publish a new Services page and go looking for the screen that puts it in the header. Maybe you find Menus, drag the page in, save, and the header stays the same. Maybe Appearance has no Menus item at all, just something called Editor. Neither means WordPress is broken. Your site uses one of two menu systems, and most menu problems come from editing in one system while the site displays the other.

    The fix is to find out which system your theme uses, edit the menu there, and then confirm that the saved menu is the one visitors actually get. If you’re adding a page for the first time, our guide to adding pages in WordPress covers that part. This article starts once the page exists.

    Which screen edits your menu depends on your theme

    Open the Appearance menu in the dashboard. If it has Editor but no Menus, you have a block theme, such as Twenty Twenty-Four. If it has Menus and usually Customize, you have a classic or hybrid theme. WordPress.org’s Menus screen documentation says 5.9 was the last version that showed that screen on every site by default. From 6.0 on, block themes manage navigation through the Navigation block. Some classic and hybrid themes, and some plugins, still bring the old screen back, so trust what your own dashboard shows over any tutorial.

    Your setupWhere to editWhat makes it appear
    Classic themeAppearance > MenusA ticked Display location
    Classic theme, with live previewAppearance > Customize > MenusA Menu Location set in the Customizer, then Publish
    Block themeAppearance > Editor > NavigationA Navigation block in the header (or another template part) pointing to that menu
    Header built in Elementor, Divi or a similar builderThe builder’s header template and its menu widgetWhichever menu the widget is set to

    Before you change anything, write down three things: the theme name, its type, and the screen you’re using. If the result looks wrong later, that note tells you where to look first.

    How to edit a menu on a classic theme

    You need an Administrator account, or any role with the edit_theme_options capability. By default, Editors can’t change menus.

    1. Go to Appearance > Menus. Pick the menu from “Select a menu to edit” and click Select. Sites often have several menus, so check the name. Editing the existing menu keeps its location, so the header stays filled while you work.
    2. Show any hidden panels. Click Screen Options at the top right. Some panels, such as Tags, are hidden by default. Turn on Link Target there too if you’ll need “open in new tab”.
    3. Add items. From Pages, Posts, Custom Links or Categories on the left, tick what you want and click Add to Menu.
    4. Reorder and nest. Drag items up or down. To make a dropdown, drag an item slightly to the right under its parent until it’s labelled “sub item”. Our guide to building a drop-down menu covers the details.
    5. Assign the location. Under Menu Settings, tick the Display location your theme uses: Primary, Header or whatever your theme calls it. This is the step people miss most often.
    6. Click Save Menu. This screen doesn’t save automatically. If you leave the page, your changes are lost.
    7. Check the live site in a private window. This screen has no preview. The Customizer route has one, if you’d rather see the change before it goes live.

    Renaming, removing and new-tab links

    To change the text visitors see without renaming the page, click the arrow on the item and edit Navigation Label. The page title stays the same. Remove in the same panel takes the item out of the menu and leaves the page alone. Once Link Target is turned on in Screen Options, each item gets an “Open link in a new tab” checkbox.

    When a page exists, choose it from the Pages panel instead of pasting its address as a Custom Link. WordPress.com’s support docs point out that a pasted address never changes, so it leads to a 404 if the page’s URL changes later. A menu item picked from the Pages panel stays tied to the page.

    How to edit a menu on a block theme

    WordPress.org’s Site Editor navigation docs list every menu in one place, but they also make a point people miss: creating or editing a menu there doesn’t put it on the site. A Navigation block inside a template part has to use it.

    1. Go to Appearance > Editor > Navigation and select the menu.
    2. Edit the items. Add a page, post or custom link with the + button. Open List View to drag items and nest them into submenus. Nested items are much easier to select there than on the canvas.
    3. Rename or retarget a link by selecting it. You can edit the label text directly, and the link settings have an “Open in new tab” toggle.
    4. Save. The menu is now stored, but it may not be displayed yet.
    5. Check where it’s placed. Open Patterns or Template Parts, then Header (wording differs a little between versions). Select the Navigation block and confirm in the block settings that it uses the menu you just edited. Save the header.
    6. Set mobile behaviour. In the same block settings, Overlay Menu set to Off shows the full menu at every screen size with no hamburger icon. Mobile folds it behind a hamburger icon on small screens.
    7. Check other templates. A homepage or landing template can contain its own Navigation block that points to a different menu.

    Why new pages stopped appearing in the menu

    A new Navigation block often starts as a Page List, which adds every published page automatically. The Navigation block documentation explains that clicking Edit on it converts it into individual Page Link blocks. You can then remove or reorder single items, but newly published pages stop showing up on their own. That’s expected behaviour. From then on, add new pages to the menu yourself.

    Adding WooCommerce product categories

    WooCommerce’s documentation describes two routes. On a classic theme, turn on Product categories in Screen Options, and a Product Categories panel appears beside Pages. On a block theme, add a block inside the Navigation editor and search for Product Category Link.

    Your category tree doesn’t come with them. One store owner on r/woocommerce found that parent and child categories went into the menu as one flat list. The fix was to drag each subcategory under its parent by hand.

    Why a saved menu doesn’t show on the site

    A menu that saved correctly but looks unchanged is usually not broken. Somewhere between the editor and the visitor, the site is showing something else. Check in this order and stop when you find the cause:

    1. Wrong editor. You edited in Menus while a block theme’s Navigation block draws the header, or the other way round.
    2. Not placed. On a classic theme, no Display location is ticked. On a block theme, the header has no Navigation block, or its block points to another menu.
    3. A different template. If the menu changed everywhere except the homepage, open that template under Appearance > Editor > Templates, select its Navigation block, choose the shared menu and save.
    4. A separate mobile menu. A mobile-menu plugin can show its own menu. In one wordpress.org thread, phones kept showing an old menu until the plugin was set to use the same WordPress menu as the desktop header.
    5. Cache. Clear the caching plugin first, then the host or CDN cache, then the browser. In another wordpress.org case, clearing the plugin and browser caches wasn’t enough, and only the host clearing its own server cache fixed it.
    6. A stale link. If one item leads to a 404, it’s probably a pasted address for a page whose slug changed. Remove it and add the page again from the list.

    Open the page in a private window before you edit anything again. If it looks right there, the problem is cache and the menu is fine. Making the same edit over and over just makes it harder to tell what happened. If the page still looks old after every cache is cleared, our guide on a WordPress page not updating goes through the next layers.

    Check it like a visitor before calling it done

    The editor canvas shows roughly what the site looks like. It isn’t a phone. Open the published site on a real phone, open every submenu, and tap every link you changed.

    Then put the mouse down. The W3C’s menus tutorial says fly-out menus must work with a keyboard as well as a mouse, shouldn’t disappear the moment the pointer leaves them, and need touch targets large enough to tap. Tab from the top of the page and watch for a visible focus outline. Open a submenu with Enter or Space, and close the mobile overlay with Escape.

    Before a large reorganisation, take a screenshot of the item list. Page and post revisions don’t bring back menus, as our guide to undoing changes in WordPress explains. Without a record, an undo means rebuilding the menu from memory.

    When to stop and get help

    Label changes, reordering and adding a link are safe jobs to do yourself. Stop when the problem stops being about the menu:

    • The Menus screen loads blank or shows PHP warnings such as “Cannot modify header information”. That points to a conflict in a theme or plugin. Isolate it on a staging copy, not by switching off plugins on the live site.
    • Saving returns a 404 or “Bad Request”. On large menus, a server security rule can reject the save request. Your host can check its logs and relax the rule for the save, then turn it back on afterwards.
    • Opening Menus causes “There has been a critical error on this website.”
    • Your account can’t see the menu screens at all. Ask an administrator to check that your role has edit_theme_options.
    • The header is built in a page builder, or the change means rebuilding a template rather than a list of links.

    If you’d rather describe the change than click through it, SiteSelf makes menu edits like these on the live site through chat. It connects through the SiteSelf Connector plugin, fetches the changed page to check it, and reports what changed, which is how it handles everyday website edits.

    Frequently asked questions

    Can I get the old Menus screen back on a block theme?

    Not by default. WordPress.org’s docs say block themes on 6.0 and later manage navigation through the Navigation block. Some plugins bring the classic screen back, but on a block theme the header still shows whatever its Navigation block points to.

    Does removing a menu item delete the page?

    No. Removing an item only takes the link out of the menu. The page stays published at its address, and other links to it still work.

    I want to edit the dashboard sidebar, not the site menu. Is that the same thing?

    No. The admin sidebar is a separate system, usually changed with a plugin such as an admin menu editor. Hiding a dashboard link doesn’t stop someone from opening that page by its URL. User roles and capabilities decide who has access.

    Why does my menu look different on my phone?

    Check the Navigation block’s Overlay Menu setting, and whether a mobile-menu plugin is showing a different menu. Then test the published site on a real phone, not the editor’s mobile preview.

  • How to reduce bounce rate on a WordPress website

    Key takeaways

    • In GA4, a bounce is a session that was not engaged. A session counts as engaged if it lasts longer than 10 seconds, records a key event or views two or more pages, so a reader who stays 30 seconds and leaves is not a bounce.
    • A sudden jump or drop usually comes from a tracking change, such as a consent plugin or a plugin that fires events. Check that before you change the site.
    • Contentsquare’s 2025 benchmark found a 53% bounce rate on pages with poor LCP and 49% on pages with good LCP. Speed matters, but nobody can promise how much it will move your number.
    • Speed fixes can break WordPress sites. Keep WooCommerce Cart, My Account and Checkout out of the page cache, don’t lazy-load the hero image, and turn on optimization options one at a time.
    • Judge a fix by what the page is for (calls, leads, orders), measured against the same page’s own baseline.

    A 70% bounce rate on a blog post and a 70% bounce rate on a paid landing page are different problems. On the blog post, readers may have found their answer and left happy. On the landing page, you are probably paying for clicks from people who leave right away. So before you compress an image or install another plugin, work out which of those you’re looking at.

    The steps below work in order. First check what the number measures. Then find the pages where it matters, fix the cause your data points to, and confirm the result against what the page is supposed to do. That last step usually means conversions, which our guide to measuring landing page conversion rate covers in more detail.

    What GA4 actually counts as a bounce

    In Google Analytics 4, bounce rate is the share of sessions that were not engaged. Google’s Analytics Help page on engagement rate and bounce rate says a session counts as engaged if it lasts longer than 10 seconds, records a key event, or has at least two page or screen views. A bounce is a session that does none of the three.

    This is a different measure from the old Universal Analytics one, which counted any single-page visit as a bounce. If you compare today’s figure with a blog post from 2019 or an industry benchmark, you may be comparing two different metrics.

    What the visitor didPagesTimeKey eventGA4 result
    Read a guide for 30 seconds, closed the tab130 sNoEngaged
    Landed, left after 4 seconds14 sNoBounce
    Opened two product pages in 6 seconds26 sNoEngaged
    Copied your phone number in 5 seconds and called15 sNoBounce

    Look at the last row. A visitor who got exactly what they came for still counts as a bounce unless a key event fires. Marking any event as a key event also makes the session engaged. You can lower the number without changing anything about the visit, and that is not a fix.

    Why your bounce rate suddenly jumped or dropped

    If the rate moved sharply overnight, check your tracking before you look at visitor behaviour. Real behaviour rarely changes that fast. A tracking setup changes the moment someone clicks save.

    The WordPress.org support forums have plenty of examples. In one Complianz support thread, a site owner saw bounce rate go from an average of 25% to about 80% over a similar 30-day period, after plugin updates and a rerun of the consent setup wizard. Other owners report the opposite: bounce falling from around 60% to under 10% the day they installed a plugin that sends extra events. Neither case proves a cause. Both tell you where to look first.

    Check these, starting with the most recent change:

    • A new or reconfigured cookie consent plugin. It changes which sessions get tracked at all.
    • An analytics or marketing plugin that sends scroll, timer or click events.
    • A second copy of the GA4 tag, added by a theme, a plugin or Google Tag Manager.
    • A new redirect that sends visitors through an extra URL before the real page.
    • A spike from one referrer or country, which often means bot traffic.

    Find the pages worth fixing first

    A site-wide average mixes your guides, your product pages and your contact page into one number, and that number points at nothing. Start where visitors enter the site.

    1. In GA4, open Reports, then Engagement, then Landing page. If your property doesn’t show it, an admin can add it from the report Library.
    2. Bounce rate isn’t always a default column. Use Customize report to add it next to engagement rate, average engagement time and key events.
    3. Sort by sessions. A page with 40 visits and a 90% bounce rate is noise. A page with 4,000 visits and 65% is worth your week.
    4. Add Session source/medium as a secondary dimension, then compare by device. A page can be fine on desktop and fail completely on mobile visits from paid social.
    5. Use at least four weeks of data, and write down the starting numbers for each page you pick.

    Now ask what each page is for. A how-to article that answers the question on its first screen can bounce heavily and still do its job. A service page fed by paid ads, or a product page, is supposed to lead somewhere. A high bounce rate on those pages is the one worth fixing.

    Fix the cause your data points to

    The pattern in your data narrows down the cause. Very short mobile sessions point to slow loading or a broken layout. Visits from one ad campaign that leave without scrolling point to a promise the page doesn’t keep. A spike on one template after an update points to a conflict.

    Make the page match what brought the visitor

    Message mismatch is a common cause, and it’s the one no speed plugin can fix. A typical example on Reddit’s small-business forum: a gardening business sends its Google Ads traffic to the homepage, sees bounce above 80%, and gets one booking. The ad promised hedge trimming. The homepage talked about the company.

    Give each ad group or offer its own page. Make its headline repeat what the ad said, and answer the visitor’s questions in the order they would ask them. A page headed “Emergency plumber in Leeds, same-day callouts” with a tap-to-call button keeps visitors that “Welcome to our services” loses. If the gap only appears for one campaign, the fix may be the campaign’s targeting rather than the page.

    Put the answer on the first screen

    Within a few seconds, visitors should be able to see what you do, roughly what it costs, and what to do next. A good test: time someone who has never seen the site. On articles, put the answer first and the background after it. On product pages, show the price and whether it’s in stock. On lead pages, show the form or the button above the fold, with no slider or second offer competing for attention.

    Speed up the slow pages, without breaking them

    Speed and bounce rate move together, but the gap in the best data is smaller than most guides suggest. Contentsquare’s 2025 Digital Experience Benchmarks covered 90 billion sessions on 6,000 sites. Pages with poor Largest Contentful Paint had a 53% bounce rate, against 49% for pages with good LCP. That is a correlation across the whole web, using the one-page definition of a bounce. Treat a slow page as a real cause, but don’t expect a fixed percentage back.

    Use field data from PageSpeed Insights and look at mobile on its own. Google’s web.dev counts a page as good when LCP is 2.5 seconds or less, INP is 200 milliseconds or less and CLS is 0.1 or less, measured at the 75th percentile of real visits.

    On WordPress the usual causes are a hero image several megabytes in size, plugins nobody uses any more, a heavy theme or page builder, cheap shared hosting, and third-party scripts such as chat widgets. Our guide to speeding up a WP site without breaking it goes through each one. The rules that keep speed work from causing new bounces:

    • Back up the site first, or work on a staging copy.
    • Check what caching your host already does before you add a plugin. Two caching layers can conflict.
    • On WooCommerce, keep Cart, My Account and Checkout out of the page cache. WooCommerce’s developer docs list all three.
    • Don’t lazy-load the hero image. It is usually the LCP element, so delaying it makes the page feel slower.
    • Turn on minification, JavaScript delay and unused-CSS removal one option at a time, and test menus, forms and checkout after each one.
    • If the layout breaks with WP Rocket, add ?nowprocket to the end of the URL. WP Rocket’s troubleshooting guide uses that to show whether its optimizations are the cause.
    • Run speed tests more than once. The first request after a cache purge is uncached and slower.

    If you’d rather not do this work yourself, SiteSelf can fix slow WordPress pages for you from chat, using hosting access, and report what it changed and checked.

    Test it on a real phone

    A fast page with a menu that won’t close loses visitors just as quickly as a slow one. On a real phone, open and close the menu, submit each form with a deliberate mistake in it, and watch the first screen while the page loads. Look for a cookie banner covering the call to action, or a chat widget pushing the headline down. Content should fit a 320-pixel-wide screen without scrolling sideways, which is the WCAG 2.2 reflow width. Pop-ups that show up before the visitor has read anything, or that are hard to close, cost more than they bring in. If they still earn their place, trigger them on exit intent instead. For layout problems, see making a mobile-friendly website.

    Make sure the page loads at all

    Broken pages almost never appear in bounce-rate case studies, yet they lose every visitor who reaches them. A 404 from an old link, a redirect loop after an SSL or CDN change, or the “There has been a critical error on this website” screen all show up as bounces. Check Tools, then Site Health, look at your 404s, and open your top landing pages while logged out. If a page throws errors, our guide to fixing WordPress issues without guessing covers how to track down the cause.

    Give the visitor a next step

    A visitor who isn’t ready to buy still needs somewhere to go. Inside an article, link to the related service or the next question, a few paragraphs in. End with one specific action, such as “Get a quote for your postcode”. Commenters in WordPress forums are skeptical that a sidebar of related posts helps much. Links inside the text get clicked more because they appear right where the visitor has the next question.

    How to tell whether the fix worked

    Change one thing per page and note the date. Wait until the page has had enough sessions that one quiet day can’t swing the figure, then compare it with that page’s own baseline, split by the same source and device. If you changed the headline, the images and the caching in the same week, you won’t know which change did anything.

    Then check the number that matters for that page. If bounce rate drops and calls, leads or orders don’t move, nothing improved for the business. If a new tracking event lowered the bounce rate, nothing improved for visitors either.

    Stop and get help if the site shows a critical error, checkout stops working after you changed caching, or you can’t tell whether a plugin or the theme is causing the problem. WooCommerce’s own advice is to test for conflicts on staging, switching to a default theme and reactivating plugins one at a time. On a live store, that is not something to try during business hours.

    Frequently asked questions

    What is a good bounce rate?

    There’s no single number you can rely on. Published benchmarks use different definitions and different sites, and the right number depends on what the page is for. Compare a page with similar pages on your own site and with its own past figures.

    Is a high bounce rate always bad?

    No. Someone who gets the answer from one article and leaves may be completely satisfied. It matters most on product, service and campaign pages, where you expect the visitor to take a next step.

    Does bounce rate affect Google rankings?

    We haven’t found a Google statement saying GA4 bounce rate is used for ranking, and practitioners disagree about it. Fix the page for the people visiting it. If the same problems are hurting search, those fixes help there too.

    Should I add scroll or timer events to lower bounce rate?

    Only if those events measure something you actually care about. Adding events just to count more sessions as engaged makes the report look better and hides the pages that need work.

    Do I need a caching plugin?

    It depends on your host. Many managed WordPress hosts already cache pages on the server, and adding a plugin on top can cause conflicts. Read your host’s documentation before you install one.

    Why is bounce rate higher on mobile than desktop?

    Phones have slower processors and less steady connections, so heavy images and scripts hurt more there. Mobile layouts also hide problems a desktop check misses, like a sticky header or cookie banner covering the button.

  • How to undo changes in WordPress without losing work

    Key takeaways

    • Revisions restore a post’s title, author, content and excerpt. They don’t bring back menus, settings, SEO plugin fields or page builder data.
    • Block theme design changes are stored in the database, so deleting and reinstalling the theme leaves them in place. Reset the template or the styles instead.
    • WP Rollback swaps a plugin’s files for an older version. It doesn’t reverse database changes the update made, so keep a backup from before the update as your fallback.
    • Since WordPress 6.3, core puts the old plugin or theme back only when a manual update fails to install. An update that installs fine and then breaks the site stays in place.
    • On a WooCommerce store, a database restore can delete orders placed after the backup, and restoring with Subscriptions can trigger duplicate renewal charges.

    You rewrote the shipping page on Tuesday and only noticed today that a heading is missing. Or a plugin updated at lunchtime and the cart is now an empty column on mobile. In both cases you want an undo button, and WordPress doesn’t have one for the whole site.

    What it has is a set of separate recovery tools. Each one covers one part of the site and has its own limit. The skill is matching the tool to the place where the change is stored, then using the smallest tool that can reach it. Picking the wrong one is how a typo turns into a lost week of orders. A full restore is the last step on that ladder, and our guide to restoring a WordPress site from backup covers it in detail.

    Which undo tool fits the change you made?

    Find the row that matches what changed. The last column shows what that tool can’t reach, which is usually the reason an undo fails.

    What changedWhere it livesUndo withWhat it can’t reach
    An edit you haven’t savedThe editor sessionUndo arrow or Ctrl+ZAnything already saved
    Saved post or page contentRevisions in the databaseRevisions panelMenus, settings, plugin and builder data
    A deleted post or pageTrashRestore from TrashItems already emptied from Trash
    Block theme styles or templatesDatabase customizationsStyles revisions or template resetChanges outside the Site Editor
    A plugin or theme updateFiles, sometimes data tooIsolate, then roll back the filesDatabase changes the update made
    Damage across files and dataEverywhereBackup made before the problemNothing, which is the danger

    Check the cache and save the broken state first

    Before undoing anything, make sure the problem is real. WordPress.org’s FAQ on changes that seem to do nothing lists browser caching, server-side caching and caching plugins as common reasons a page looks wrong when the site is fine. Do a hard reload first. Then clear your caching plugin or builder cache, then your host’s cache and any CDN.

    If the problem is still there, take a backup of the site as it is now, even though it’s broken. That copy lets you undo your undo. It also holds any orders, comments or form entries that came in since your last good backup. You may need to copy them back later.

    How to undo an edit you haven’t saved yet

    Use the Undo arrow in the editor’s top toolbar, or press Ctrl+Z on Windows. Each press steps back one action in the current editing session. Redo, next to it, steps forward again.

    Undo only covers the current session. Once you save or publish, use revisions instead. One quirk confuses people: after you undo every change, the Save button can stay active. If you want to throw away a whole session of experiments, close the tab or reload without saving.

    How to restore a saved post or page from revisions

    WordPress records a revision every time you save a draft or publish an update. Restoring one replaces the content of that single post or page and leaves the rest of the site alone. For content mistakes, it’s the safest undo there is.

    1. Open the post or page in the block editor.
    2. Open the Settings sidebar, select the Post or Page tab, and click Revisions. If you don’t see it, the item may only have been saved once, or revisions are switched off.
    3. Drag the slider to the last good version and check its date and time. The good and bad versions are often one step apart.
    4. Read the comparison. Anything added on purpose after that version, such as a corrected price or a colleague’s paragraph, will be lost if you restore past it.
    5. Click Restore This Revision. The version you replaced stays in the history, so you can undo this step too.
    6. View the live page in a private window and check links, forms and the SEO title before you move on.

    Know the limits before you rely on this. WordPress’s revisions documentation says core tracks the title, author, content and excerpt. It doesn’t track menus, widgets, site settings or most plugin data. People testing SEO changes on r/Wordpress warn that revisions don’t always restore SEO plugin fields or page builder data cleanly. Revisions are unlimited by default, but the WP_POST_REVISIONS constant in wp-config.php can limit or turn them off. A host or plugin may have set it without telling you.

    Autosaves are separate. WordPress keeps one per user per post, each new one replaces the last, and an autosave never overwrites published content. To get a reliable restore point, save by hand before a big edit.

    How to get back a page you deleted

    Go to Posts or Pages, open the Trash view at the top of the list, hover over the item and click Restore. Restored items may come back as drafts, so check the status and publish again if needed.

    Trash only holds items for a limited time before deleting them for good, and the window depends on your setup. Once an item is gone from Trash, you need a backup made before you deleted it. Restore that backup to a staging copy and copy the page across, rather than rolling the whole site back for one page.

    Why reinstalling a block theme doesn’t undo design changes

    Block themes save your Site Editor changes in the database, not in the theme files. In a wordpress.org support thread, a user deleted and reinstalled the theme and found their customizations still there. Clearing the template’s customizations is what removed them.

    Go to Appearance → Editor. For site-wide colours, fonts and spacing, open Styles and use its revision history to compare and restore an earlier version, or reset it. For a template or template part, open it, then use the three-dot menu to reset it to the theme’s version. Menu labels have changed between WordPress versions, so look for “Reset” or “Clear customizations”.

    Be careful with what you reset. A template controls every page that uses it, and resetting it removes all of its customizations, including the ones you wanted to keep. Global styles affect the whole site. If you edit a classic theme’s files directly instead, a theme update can overwrite those edits. Learn WordPress’s advice is to use a child theme, and our guide to updating a WordPress theme safely covers the checks to run before an update.

    How to undo a plugin or theme update

    Find the component that’s causing the problem before you roll anything back. WordPress.org’s plugin documentation suggests checking the plugin’s support forum or deactivating plugins one at a time. If you updated five plugins and rolled all five back, you still wouldn’t know which one broke the site.

    Once you know which plugin it is, the free WP Rollback plugin from the WordPress.org directory can install an earlier version. Go to Plugins → Installed Plugins, click Rollback under the plugin, choose a version and confirm. For premium plugins, download the earlier version from your account with the vendor and upload it.

    Rollback only replaces files. WP Rollback’s own FAQ says a downgrade doesn’t reverse database changes a newer version made, and that older versions can be missing security fixes. If the update changed how the plugin stores its data, the old code is now running against new data and can stay broken. The changelog is the best clue. Look for words like “migration”, “database update” or a major version jump. In that case, restoring the pre-update backup is the real undo.

    WordPress core won’t do this for you. Since 6.3, core automatically puts the previous version back only when a manual plugin or theme update fails to install. Make WordPress Core’s announcement says it doesn’t keep the old version once an update succeeds. An update that installs cleanly and then breaks the site stays installed.

    If you can’t reach the dashboard

    When the site shows “There has been a critical error on this website,” check the admin email inbox for WordPress’s recovery link first. If that doesn’t work, connect by SFTP or your host’s file manager and rename the plugin’s folder inside wp-content/plugins. WordPress deactivates a plugin it can’t find. Renaming the whole plugins folder also works, but it turns off every plugin at once. Our guide to fixing a WordPress fatal error walks through reading debug.log to find the cause.

    When a backup restore is the right undo, and what it erases

    Use a backup when the damage covers both files and data, or when you can’t find the cause and the narrower tools have failed. WordPress’s backup handbook says a complete backup needs both the files and the database. A database-only backup doesn’t bring back themes, plugins or uploads.

    The cost is everything that happened after the backup’s timestamp. One r/Wordpress poster restored a five-month-old backup to fix a problem. It wiped theme changes, a slider, an infographic and their stock counts. Kinsta’s documentation makes the same point about staging: pushing a whole staging database to live replaces the live database. That loses orders, comments, form entries and users created since the copy was made.

    To keep the damage small, choose the newest backup taken before the problem, not just the newest backup. Restore it to staging first if your host allows, and compare it with live. If your host offers selective restore, restore only the files or only the database, whichever actually needs it. Our article on backups that actually restore covers setting this up before you need it.

    On a WooCommerce store, protect orders first

    WooCommerce’s update guide recommends a current backup, testing on staging, and keeping checkout out of use while you restore or troubleshoot. Rolling back a plugin’s files doesn’t delete orders, but a database restore can. Practitioners on r/woocommerce export orders and customers before a restore and re-import them afterwards. They add that the right method depends on whether High-Performance Order Storage is enabled.

    Subscriptions add a money risk. WooCommerce’s Subscriptions documentation warns that restoring a backup can remove orders, customer details, payment tokens and subscriptions from the gap between the backup and the restore. Renewals may then run again and charge customers twice, unless you fix the renewal schedule. If you need to refund anyone afterwards, WooCommerce’s refund docs are clear: changing an order’s status to Refunded doesn’t return the money. The refund has to go through the payment gateway.

    How to tell the undo actually worked

    The error going away isn’t the finish line. Log out, open the page in a private window, and check whatever the change touched: the form submits, the cart adds an item, the menu opens on a phone. A restored page can bring back an old form, an outdated offer or missing image alt text you had already fixed. Then save the post or take a fresh backup, so the repaired state becomes your next restore point.

    When to stop and get help

    Stop undoing and start diagnosing when:

    • a critical error survives a plugin rollback
    • the files are back but the data is still wrong
    • a restore would erase live orders
    • a fix removes the error but breaks something else

    At that point you’re fixing a bug, not reversing a change. Collect the error message, the time it started and what changed just before, then take it to the plugin’s support forum or your developer. If you’d rather not do it yourself, SiteSelf handles finding and fixing WordPress errors on request. It needs hosting (SSH) access for code and file work, says what it is about to change and whether that can be undone, then fetches the page and reports what it changed and what it checked.

    Frequently asked questions

    Why is the Restore This Revision button greyed out?

    You’ve selected the revision that matches the current content, so there’s nothing to restore. Move the slider one step to the left to an earlier version and the button becomes active.

    Can I restore one paragraph instead of the whole post?

    Yes. WordPress.com’s revisions documentation describes copying selected blocks from an older revision. You can also open the comparison, copy the text you need, and paste it into the current version. This keeps everything else on the page as it is.

    Why didn’t a revision bring back my menu or header?

    Revisions only track post content, title, author and excerpt. Menus, widgets and site settings are stored elsewhere. On a block theme, the header is a template part you can reset in the Site Editor. On a classic theme, you need a backup.

    How do I recover text after the browser crashed?

    Reopen the post. If WordPress has an autosave newer than the last saved version, the editor offers to restore it. There is only one autosave per user per post, so do this before you start typing again.

    Who is responsible for backups on a site someone else built?

    Whoever your contract or hosting plan says. Often nobody wrote it down. Find out who configures backups, how often they run, where they’re stored, and whether restores are included or billed separately. Do this before you need one.

  • WordPress forgot admin password and how to get back in

    Key takeaways

    • “Lost your password?” emails a reset link. WordPress never sends your old password, and requesting a new link can make the earlier ones invalid.
    • If the email never arrives, sending the form again will not help. Check that the right account is linked to that address, then fix mail delivery or skip email and reset another way.
    • Without email, go in this order: your host’s tool, then WP-CLI (`wp user update USERNAME –prompt=user_pass`), then phpMyAdmin with a temporary MD5 value after a backup. Theme code and emergency scripts are the last resort.
    • A 404 at /wp-login.php usually means a plugin such as WPS Hide Login has moved the login page. A reset link that is “invalid” every time usually points to caching, not to your password.
    • Without access to the hosting account, the only legitimate way back in is through your host and the site’s owner. WordPress.org support cannot reset a self-hosted site’s password.

    WordPress has a working reset built in, and in most cases it takes a couple of minutes. It works when three things are true: you know which account you are resetting, the email reaches you, and the reset page loads without interference. Lockouts that go on for days nearly always mean one of those three has failed, not the password.

    So treat this as a diagnosis. Start with the standard reset. If it fails, find out why before you try something heavier. If the problem turns out to be a login that rejects you even though your password is correct, our guide to fixing a WordPress login by symptom covers that separately.

    What “Lost your password?” actually does

    It emails you a link to set a new password. It does not send your old password or a new one. WordPress’s Developer Handbook describes this as the standard recovery route and the one to try first.

    1. Go to your site’s login page, usually yoursite.com/wp-login.php or yoursite.com/wp-admin.
    2. Click “Lost your password?” under the form.
    3. Enter the username or the email address on your WordPress user account. The site name and your display name will not work.
    4. Open the newest email you receive and click the link. Choose a new password and save it in a password manager.
    5. Log in with the new password in a private browser window to check that it works.

    Ask for one link and wait. WordPress checks each link’s reset key against your account, and a newer request can make older links stop working. If you click the form five times while the mail is slow, you get five emails and only one link that still works.

    Why the reset usually fails before the password does

    Nobody publishes data on how often each failure happens. In WordPress.org and Reddit support threads, the same causes come up again and again, roughly in the order below.

    The email never arrives

    When WordPress says the email was sent, it means the site passed the message to its mail system. It does not mean the message was delivered. WordPress’s troubleshooting FAQ explains that it sends mail through PHP’s mail() function, so a badly configured server or sender address can stop delivery completely. Many cheap hosts and every local development site have this problem.

    Check spam and any other inboxes you use. Then confirm which address is on the account. If you inherited the site from a developer or agency, the admin account often points to their old mailbox, and no number of retries will change that. If the address is right and nothing arrives, ask your host to check the outgoing mail log. On a WooCommerce store, don’t rely on WooCommerce’s email log for this. WooCommerce’s email troubleshooting docs send you to your SMTP provider’s logs or a mail-logging plugin instead.

    Fixing mail delivery for good, with an SMTP plugin connected to a real sending service and a test email, usually needs you to be logged in. So while you are locked out, the faster route is often to skip email and reset another way (see below).

    WordPress doesn’t recognise the username or email

    The messages are “The email address provided is not associated with a user account” or “The username … is not registered on this site.” The usual cause is that the address you are using receives the site’s notifications but does not belong to an administrator account. WordPress keeps these separate. The address under Settings, General is the site’s contact address, and each user has their own email address on their profile.

    Other causes are a username that was changed, a migration that brought over a different user table, or a staging copy that you have mistaken for the live site. To see which accounts really exist, you need a second administrator or access through your host (the WP-CLI and database routes below).

    The reset link says it is invalid or expired

    “Your password reset link appears to be invalid. Please request a new link below.” Request one fresh link and use it straight away. If you still get the error, look at the reset URL, not your password.

    The most common hidden cause is caching. If your host, a caching plugin or a CDN caches the reset page, the key in your link never reaches WordPress. In one WordPress.org thread about WPS Hide Login, the invalid links stopped as soon as WP Engine’s support team added action=rp to the site’s cache exclusions. Other causes people report are switching between www and non-www or between HTTP and HTTPS partway through, old cookies, and custom login or membership plugins that take over the reset form.

    /wp-login.php returns a 404 or a blocked page

    A 404, a redirect to the homepage or a “blocked” screen means you never reached WordPress’s login. That is not a password problem. Login-hiding plugins such as WPS Hide Login move the login page to a custom address. Use that address, and the lost-password page that goes with it.

    If nobody remembers the custom address, WPS Hide Login’s documentation describes two ways out, and both need hosting access. You can look up the whl_page option in the database, or you can temporarily rename or remove the plugin’s folder in wp-content/plugins so the default login page comes back. Put the plugin back afterwards. Security plugins that limit logins by IP address or require a secret word cause the same kind of lockout, and the fix is the same: whoever controls the hosting disables the plugin for a few minutes, or the host does it for you.

    You are trying the wrong login

    WordPress sites often involve several separate accounts, and people mix them up:

    • Your hosting control panel login is not your WordPress admin login.
    • A WordPress.com account is separate from a self-hosted site. WordPress.com has its own account recovery process.
    • Your WordPress.org forum account cannot reset your site’s password.
    • WooCommerce’s docs say the mobile app can sign you in with a WordPress.com account or with your site’s own credentials. Test your password on the site’s login page first.
    • A customer resetting their password on a WooCommerce “My Account” page is not an admin reset.

    How to reset the password without email

    All of these routes need access to the hosting behind the site. Go down the list and stop at the first one that works. Each step down is more powerful and easier to get wrong.

    1. Use your host’s tool or ask support

    Many managed hosts have a “change admin password” option in their WordPress management screen. Where they don’t, the host’s support team can often reset the password from a ticket once they have confirmed you own the account. If mail is broken, this is often faster than trying to fix mail first. It is the safest route for a non-technical owner because nothing on the site has to be edited by hand.

    2. Reset with WP-CLI over SSH

    WordPress’s Developer Handbook recommends WP-CLI for a technical reset. Connect over SSH and go to the folder that contains wp-config.php. If the server hosts more than one site, run wp option get siteurl to make sure you are working on the right one. Then list the administrators:

    wp user list --role=administrator

    Choose the account by its exact username or ID. Don’t assume the admin is user 1, because many inherited sites deleted the original admin long ago. To set a password you choose yourself, run:

    wp user update USERNAME --prompt=user_pass

    This asks for the password at a prompt, so it never appears in your shell history. Some guides suggest --user_pass='newpassword' instead, but that saves the password in plain text in your history file. The other option is wp user reset-password USERNAME --show-password, which creates a password and prints it on screen. Treat that output as sensitive and keep it out of screenshots and tickets.

    3. Edit the database in phpMyAdmin as a fallback

    Use this when you can open the database through your hosting panel but have no SSH access. The Handbook gives the steps and says to back up first. Export the database and download the file before you change anything. Our guide to backing up a WordPress site explains what a backup you can restore should contain.

    1. Open wp-config.php and check the database name and $table_prefix. The prefix is often not wp_.
    2. In phpMyAdmin, open yourprefix_users and find your row. Check user_login and user_email, not just the ID.
    3. Click Edit. In the user_pass row, set the Function dropdown to MD5 and type a temporary password in the Value field.
    4. Click Go, log in, and then change the password again from your profile in wp-admin.

    The most common mistake is forgetting to choose MD5. If you do, the column holds plain text that WordPress will never accept. One WordPress.org support thread was solved by doing exactly that step. The Handbook describes the MD5 value as temporary: WordPress replaces it with its own hash after you log in successfully. That is why you should change the password again from inside wp-admin once you are back in.

    4. Theme code or the emergency script, only as a last resort

    WordPress.org’s reset guide still documents two methods that only need file access over FTP. One is a line of code in the theme’s functions.php. The guide warns that this code resets the password every time a page loads, until you remove it. The other is an emergency reset script that you upload to the site’s root folder, and the guide says to delete it when you are done. Both leave a password in a file on a live server, so they are risky if anyone forgets to clean up. If you have to use one, remove the code or file in the same sitting, then check that it has really gone.

    What if the reset worked and login still fails?

    Then something other than the password is wrong. Go through these in order, because the first ones take the least time:

    • Exact username and case. Passwords are case-sensitive. Try the user_login value rather than your email address.
    • A clean browser session. Use a private window or clear the site’s cookies. An old session cookie can make a good password look wrong.
    • The same address throughout. Mixing www and non-www, or HTTP and HTTPS, can bounce you back to the form. Check that the site address and WordPress address match.
    • Login and security plugins. Too many failed attempts can block your IP, and from the outside that looks exactly like a wrong password. Disable the plugin by renaming its folder, test, then put it back.
    • Your role. If you get in but see “You do not have sufficient permissions to access this page,” the account may no longer be an administrator. That is a separate fix, done in the database or with WP-CLI.

    Don’t add another method on top of one that has not worked. A half-finished database edit plus a theme snippet is harder to undo than one attempt that failed cleanly.

    When to stop and get help

    Stop if you have only the login page. Every route above needs either the account’s email or access to the hosting. Without either, you cannot reset the password from inside WordPress. A WordPress.org moderator said the same thing in a recent thread: the owner has to get hosting access or contact the host. WordPress.org’s own support cannot reset a self-hosted site’s password.

    That makes it a question of ownership. Find out who pays for the hosting and the domain, because whoever pays can usually get the hosting account back from the host. If you are a freelancer and the client cannot prove they have legitimate access, work through the client and the host. Don’t look for a way around the login. Be wary of anyone who offers to “get you in” through an unusual sign-in flow. Practitioners report fake client requests used to hijack accounts.

    Also stop if the reset keeps failing for reasons you can’t see: a reset loop that clearing the cache doesn’t fix, a plugin that takes over the reset form, or two-factor codes that never arrive. That is a troubleshooting job. If you would rather not do it yourself, SiteSelf takes on WordPress troubleshooting work like this through chat. While you are locked out of wp-admin, it needs hosting (SSH) access to reach the site, and it cannot recover a hosting account you don’t hold.

    What to do once you are back in

    Check the email address on your profile first. It should be a mailbox you control, not a former contractor’s. Then set things up so the next lockout takes two minutes instead of two days:

    • Set up an SMTP plugin with a real sending service and send a test email. Then you will know a reset email can actually be delivered.
    • Add a second administrator with a different email address, held by someone you trust.
    • Write down who owns the hosting account, the domain and the login details for each.
    • Give collaborators their own user accounts instead of sharing yours, and remove admin accounts nobody can explain.
    • Delete any reset code, emergency script or database export left on the server.

    If you find admin users you did not create, or files you don’t recognise, treat it as a possible break-in rather than a lockout. Read what to do when a WordPress site is hacked before you go any further.

    Frequently asked questions

    Can WordPress tell me my current password?

    No. WordPress stores a hash, not the password, so neither the site nor your host can read it back to you. Every recovery method sets a new password. That includes anything you find in wp-config.php, which holds the database password, not your login.

    How long should the reset email take?

    Learn WordPress says it should arrive within a few minutes. If nothing has come after that, sending the form again won’t help. Check spam, confirm the address on the account, then ask your host about mail or reset another way.

    Can another administrator reset my password?

    Yes. Another administrator can open Users, edit your account and set a new password. If your site has a second admin, this is the quickest route that doesn’t rely on email. It is also a good reason to set up a second admin after you recover access.

    Is the phpMyAdmin method safe?

    It is safe if you take a backup first and check the database, table prefix and user row before saving. Editing the wrong row or forgetting to choose MD5 are the usual ways it goes wrong. Change the password again from wp-admin once you can log in.

    Why did my site lock me out after the host changed something?

    Some plugins encrypt stored secrets, such as SMTP API keys or two-factor settings, using the salts in wp-config.php. Practitioners report that when the salts change, those secrets can stop working, so reset emails and two-factor codes stop arriving. Getting back in usually needs SSH or WP-CLI to turn off two-factor and enter the keys again.

    Does this work the same on WordPress.com?

    No. WordPress.com accounts recover through WordPress.com’s own process, using a recovery email, a text message or proof of ownership. The host, WP-CLI and database methods here only apply to self-hosted WordPress.

  • How to fix the HTTP error in WordPress uploads

    Key takeaways

    • Check Media, then Library, before you retry. WordPress.com support notes that an upload can succeed even when the uploader reports an error, and retrying creates duplicates.
    • In the browser’s Network panel, find the failed async-upload.php request. A 413 points at a size cap, a 500 at PHP failing, and a 403 at a security rule or an expired session.
    • Tools, then Site Health, then Info, then Media handling shows the effective upload limit and whether GD or Imagick resizes your images.
    • Raising PHP limits doesn’t lift a web-server or proxy cap. Kinsta warns that more memory per PHP thread can mean fewer threads.
    • Hand it to the host when the evidence points at server configuration, a firewall rule or a missing image module. Give them the URL, the timestamp and the status code.

    You drag a photo into Media, then Add New. The progress bar fills, then turns red with two words: “HTTP error.” There’s no status code, no file name and no hint of what failed. WordPress shows this one message for very different failures: the image was too big to resize, a firewall refused the request, PHP ran out of memory, the server couldn’t write the file, or your login session expired.

    So the fix is never “raise the memory limit” by default. First find out which layer failed. That takes about five minutes, and the checks below need nothing more than your browser and wp-admin. If the whole site returns a 500 rather than only the uploader, follow our guide to fixing a server error 500 instead. That’s a different problem with a different starting point.

    Did the upload actually fail?

    Check first, because sometimes it didn’t. WordPress.com’s upload troubleshooting page notes that “Unexpected response from the server” can appear even when the file uploaded fine. The same goes for the plain HTTP error: the original file is saved, and then a later step such as making thumbnails or running an optimizer fails.

    Open Media, then Library, and reload it. If the image is there, perhaps with a blank or grey thumbnail, the upload worked and the processing did not. That points at image resizing, not at upload limits. If you skip this check and retry five times, you end up with five copies.

    How to find the real cause in five minutes

    WooCommerce’s documentation on HTTP response codes recommends the same two sources for any HTTP error: the browser’s Network panel and the server logs. For uploads, add Site Health and a test image.

    1. Capture the failed request. Open your browser’s developer tools (F12 or Cmd+Option+I), go to the Network tab and upload the file again. Find the request to async-upload.php and note three things: the status code, the response body and the time.
    2. Upload a small, known-good image. Use a screenshot of around 100 KB. If it uploads, the problem is something about the failing file, such as its size, dimensions or format. If it also fails, the problem is site-wide: permissions, a security rule, a plugin or the server.
    3. Check Site Health. Go to Tools, then Site Health, then Info. Under Media handling you’ll see the maximum upload file size, the max size of a POST request, the effective upload limit, and whether GD or Imagick is the active image editor. The Server section shows your PHP version.
    4. Read the log at that timestamp. Your host’s control panel usually has an error log. If it doesn’t, turn on WordPress logging in wp-config.php so errors go to wp-content/debug.log and don’t show to visitors.
    define( 'WP_DEBUG', true );
    define( 'WP_DEBUG_LOG', true );
    define( 'WP_DEBUG_DISPLAY', false );

    Remove these lines when you’re done. The log can contain file paths and other details you don’t want left on a live server.

    Now match what you found against this table.

    What the Network panel showsWhere it pointsFirst move
    413 Request Entity Too LargeA size cap on the web server, proxy or CDN, or PHP’s post_max_sizeCompare the file size with Site Health; ask the host about the server limit
    500PHP failed, often running out of memory while resizing, or a plugin errorRead the log entry at the same time
    403, or a firewall block page in the responseA security plugin, ModSecurity or a host firewall rule, or an expired sessionLog out and back in, then check the security plugin’s log or ask the host
    502, 504, or a long wait then failureProcessing took longer than the server allowsTry a smaller image; check any optimizer plugin
    200, but the response contains HTML or a PHP warningA plugin or theme printed output that broke the responseRead the response body; run a conflict test

    Which cause fits what you found

    These causes are listed in the order worth checking. The order is not measured. Nobody publishes data on how often each one happens, so use what you collected to decide which one applies.

    The image is too big to process

    This is the classic case. When a 12-megapixel phone photo uploads, WordPress makes several resized copies of it, and that work runs inside PHP’s memory and time limits. Newer WordPress versions sometimes show a clearer message for this, starting “The server cannot process the image,” which suggests uploading a smaller image. The log, if you have it, often says Allowed memory size of ... bytes exhausted.

    The fastest fix is on your side. Resize the image to about 2560 pixels on the long edge before uploading. That’s the size where WordPress starts scaling large uploads down anyway, so a larger original rarely improves what visitors see. If you need full-size originals, ask the host about memory for image processing. Don’t just raise the limit blindly. Kinsta’s server-error docs point out that giving each PHP thread more memory can mean fewer threads, so a bigger limit can slow the rest of the site.

    The image library itself can be the problem. In a resolved WordPress.org thread from 2024, images over roughly 1 MB timed out on a Bluehost site. Switching the default editor to GD with the “Default to GD” plugin fixed it, and uploads got faster. Treat that as a workaround to test, not proof that GD is better. Site Health tells you which editor is active before you change it.

    A size limit at a layer WordPress cannot see

    Upload size is capped in several places, and each cap works on its own. PHP has upload_max_filesize and post_max_size, and the lower one wins. The web server (for example nginx’s client_max_body_size), a reverse proxy and a CDN can each reject a request before PHP ever runs. Kinsta’s client-error docs say exactly this: oversized requests are rejected before WordPress receives them, and they can show up in the uploader as a general upload error.

    This is why the popular php.ini and .htaccess snippets often do nothing. They raise a PHP limit while a server limit somewhere else stays where it was. A 413, or a failure that always starts at the same file size, means you should ask the host which layer has the cap. For very large files, Kinsta suggests skipping the browser: upload over SFTP, then import with WP-CLI using wp media import.

    A plugin, theme or security rule is in the way

    Image optimizers, offload-to-cloud plugins and security plugins all run during or right after an upload. If the error started after an update, or the response body contains a block page, one of them is the likely cause.

    Don’t deactivate plugins on a live store to find out. The Health Check and Troubleshooting plugin has a Troubleshooting Mode that turns off plugins and switches to a default theme for your logged-in session only, so visitors and customers see the normal site. Test the upload there, then turn plugins back on one at a time until the error returns. Our guide to fixing plugins that are not working covers what to do with the culprit once you find it.

    A 403 with a firewall page usually comes from the host’s ModSecurity or a similar rule. You can’t change that from wp-admin. Send the host the timestamp and ask which rule matched.

    The server can’t write the file

    Errors such as “could not be moved to wp-content/uploads/…” point at file writing: ownership, permissions or a full disk. Check disk space in your hosting panel first. Never fix this by setting the uploads folder to 777, because that opens the folder to anyone on the server.

    Permissions are suspected more often than they’re guilty. In a 2025 WordPress.org thread, a small 600 by 800 image failed with exactly that “could not be moved” message. Replies suspected folder permissions, but the fix was the host updating the site’s PHP version. If the PHP version in Site Health is old, ask about that before you touch permissions.

    The session or connection dropped

    If the failure is one-off rather than repeatable, log out and back in, then try again in another browser or on another network. Make sure the address bar shows https:// in wp-admin when your site runs on HTTPS, because a mixed setup can break admin requests. If the multi-file uploader itself keeps failing, WordPress’s Media Add New screen offers a simpler browser uploader as a fallback.

    Renaming a file to remove spaces or accented characters is cheap to try. It is rarely the actual cause of a repeatable HTTP error.

    When to stop and get help

    Stop troubleshooting on your own when any of these is true:

    • You can’t get at the logs.
    • The response is a host firewall page.
    • Site Health shows a missing image module or a PHP version your host controls.
    • You’ve worked through the checks above and the failing layer is still unclear.

    From that point, more guessing costs hours, and many confirmed fixes in support threads came from the host.

    Make the request specific. Send the host or developer:

    • the page you uploaded from
    • the exact time and time zone
    • the status code and response body from the Network panel
    • the file’s size and pixel dimensions
    • what you’ve already ruled out

    Then ask about the request-size limit, firewall or ModSecurity rules, PHP memory and timeouts for image processing, GD and Imagick, and disk space. A support request like that gets an answer. “Uploads are broken” gets a reply asking for more information.

    If you’d rather hand the whole investigation over, SiteSelf can do the troubleshooting work on your site. With hosting (SSH) access, it reads the logs, makes the change and reports what it changed and what it checked.

    Frequently asked questions

    Is the WordPress HTTP error the same as a 500 error?

    No. “HTTP error” is the uploader’s catch-all message, and the request behind it can return 500, 413, 403 or something else. Check the actual code in the Network panel. A 500 on every page of the site is a separate problem with its own diagnosis.

    Why do phone photos fail when screenshots upload fine?

    Phone photos are often 4000 pixels or more across and several megabytes in size. Resizing them into thumbnails takes far more memory than a small screenshot needs. Resize to around 2560 pixels before uploading, or ask the host about memory for image processing.

    What does “This file cannot be processed by the web server” mean?

    WordPress.com’s support page says this message means the file type isn’t supported, not that the file is too big. Convert it to JPG, PNG or WebP and try again.

    Should I switch to GD permanently?

    Only if testing shows GD fixes the failure on your server and the image quality is acceptable. It’s a workaround that has helped on some hosts. If Imagick is failing, ask the host why, because the underlying problem may affect other things too.

    Will raising the memory limit in wp-config.php fix it?

    Only if the log shows memory running out, and only up to whatever ceiling the host allows. It does nothing for a 413 from the web server, a firewall block or a permissions problem.

    Why does the error only happen in the editor, not in Media, then Add New?

    The editor uploads through a different request, the REST API, so a security rule or plugin can affect one route and not the other. Compare the failing request in the Network panel with a successful upload from Media, then Add New.

  • How to change your WordPress site title

    Key takeaways

    • Settings → General → Site Title → Save Changes works on every install. In a block theme, the Site Title block and the Site Editor’s Identity panel write to the same setting.
    • If the browser tab shows the old name, check your SEO plugin first. Yoast’s Website name field overrides the WordPress setting in Yoast’s output.
    • View the page source and search for <title>. You should find exactly one, and it should contain the new name.
    • Google writes its own title links and site names. It says recrawling takes a few days to a few weeks, so don’t rebuild a site because search results are slow to change.
    • Renaming the site doesn’t change its URL, domain or permalinks. WooCommerce emails that use {site_title} pick up the new name automatically.

    Go to Settings → General in your WordPress dashboard, type the new name into Site Title, click Save Changes, then load your homepage in a private window. That works on every WordPress install, whatever the theme. If the new name appears in the header and the browser tab, you’re finished.

    If it doesn’t appear, the save almost certainly worked. The word “title” covers several separate things on a WordPress site, and each one is set in a different place. Most of this guide is about finding the one that is actually wrong.

    Which title are you actually trying to change?

    Start by finding where the wrong name is showing, because that tells you which control sets it. The site title is one setting. The header, the browser tab and Google can each show something different.

    Where you see the nameWhat controls it
    Site-wide name, feeds, store emailsSettings → General → Site Title
    Text in the headerThe theme: the Site Title block, Customize → Site Identity, or a page builder’s header
    Headline of one page or postThat page’s own title (the Title block)
    Browser tab and page sourceThe HTML <title>, often written by an SEO plugin
    WooCommerce order emailsThe {site_title} placeholder, which reads Settings → General
    Google search resultsGoogle, using your pages as input

    If you wanted to change one page’s headline, or hide it, you need the page editor, not this setting. Our guide on hiding page titles in WordPress explains the difference between the Title block and the Site Title block.

    How to change the site title in Settings → General

    This is the main route, and every other route saves to the same value. WordPress stores that value as the blogname option. WordPress.org’s Settings General documentation says themes commonly show it in the layout and the browser title bar, and that WordPress uses it to identify the site in feeds.

    1. Log in with an Administrator account. Other roles can’t save core settings.
    2. Open Settings → General.
    3. Copy the current Site Title into a note. A setting has no revision history, so that note is how you undo the change.
    4. Type the new name in Site Title, with the exact spelling and capitalisation of the brand.
    5. Leave Tagline alone unless you mean to change it too. It’s a separate field for a short description, and many themes print it under the name.
    6. Click Save Changes at the bottom of the screen.
    7. Open the homepage in a private window and check the header and the browser tab.

    The WordPress Address and Site Address fields are on the same screen. Don’t touch them. They set the site’s URL, and getting them wrong can lock you out of your own dashboard. Renaming the site doesn’t change your domain, permalinks or URLs.

    How to change it in a block theme’s Site Editor

    Block themes such as Twenty Twenty-Four and Twenty Twenty-Five give you two more routes, and both save back to Settings → General. WordPress.org’s Site Title block documentation says that editing the block and saving the template changes the name everywhere it appears.

    1. Go to Appearance → Editor.
    2. Open the Identity section and edit Site Title there. Or open the header template part and click the Site Title block on the canvas.
    3. Type the new name.
    4. Click Save. Until you save the template, nothing changes on the live site.
    5. Go back to Settings → General to confirm the field shows the new name.

    WordPress.org’s Site Editor Identity documentation says the Identity section only exists when a block theme is active. If your Appearance menu has no Editor item, you have a classic theme. Use the next section.

    Two blocks look the same as the Site Title block on the canvas but behave differently. A Heading block with the name typed into it is just static text. Editing it changes the header but not the site title, and changing the site title won’t update it. A Title block shows the current page’s title, and editing it renames that page only. If your header ignores your changes, click the text and check the block name in the toolbar.

    How to change it in a classic theme’s Customizer

    Classic themes usually show the same fields under Appearance → Customize → Site Identity, with a live preview next to them. Edit Site Title, then click Publish. Changing the preview alone saves nothing.

    The same panel has a Display Site Title and Tagline checkbox, which most themes include. If the name is saved correctly but missing from the header, that box is probably unticked, or the theme is showing a logo instead. The reverse also happens. One WooCommerce shop owner on Reddit found a large, unwanted site-title link above their menu and removed it from Site Identity. For header layout changes that go beyond the name, see our guide to modifying a WordPress header.

    Page builders such as Elementor and Divi often build the header in their own editor. In that case the header shows whatever the builder template contains, so edit it there.

    Why the old name still shows after you save

    Work through these checks in order. Each one rules out a layer, and the order keeps you from clearing caches over and over when the cause is something else.

    1. Confirm the saved value

    Reload Settings → General. If the field still shows the old name, the save failed. Skip to “When to stop and get help” below. If the field shows the new name, the setting is fine and something further along is showing the old one.

    2. An SEO plugin is writing the browser tab title

    The text in the browser tab comes from the HTML <title>. On most sites an SEO plugin writes it. In Yoast SEO, the Website name field under Yoast SEO → Settings → Site basics overrides the WordPress setting in Yoast’s output. The homepage also has its own SEO title. Yoast’s homepage guide says to edit it under Settings → Content types → Homepage when the homepage lists your latest posts, or in that page’s own Yoast search appearance settings when you use a static homepage. Rank Math, AIOSEO and SEOPress have similar settings in their own menus.

    Check that only one plugin is writing titles. In one wordpress.org support thread, a site kept its old title after the setting was changed. Clearing WP Fastest Cache didn’t help. The cause was several plugins with title settings that clashed.

    3. The page has two titles, or none

    Open the page, press Ctrl+U (Cmd+Option+U on a Mac) to view the source, and search for <title. There should be exactly one result. Yoast’s troubleshooting page for SEO titles lists a missing or duplicated <title> as a source-code problem. Older themes that don’t support WordPress’s title-tag feature can print their own title from header.php.

    Yoast has a Force rewrite titles option for those themes, but warns it may considerably slow the site. It also warns that theme updates overwrite edits made directly to theme files. A hard-coded header belongs in a child theme, and that is usually work for a developer.

    4. A cache is serving the old page

    If a private window shows the new name, only your own browser was out of date. If it doesn’t, clear the caches in this order: your caching plugin, then your host’s cache, then your CDN. Clearing the browser cache doesn’t clear the server’s copy. WordPress.org notes that managed hosts often cache pages even when no caching plugin is installed. Our article on pages that won’t update covers each layer and how to clear it.

    5. Google still shows the old name

    Google doesn’t read your title setting. It builds title links and site names from your pages. Google’s title link documentation says it creates them automatically, may rewrite titles it considers outdated or unclear, and that recrawling and reprocessing can take a few days to a few weeks. For the site name, Google recommends WebSite structured data with name and url on the homepage. Google still makes the final choice. Yoast and other SEO plugins usually output this markup from their site name field.

    Once the live page is correct, request indexing in Search Console’s URL Inspection tool and wait. In one wordpress.org thread, a site owner spent hours resetting and rebuilding before learning that re-indexing was all the site needed. Reddit users report waits of 10 days or more. One still saw no change three weeks after adding site-name markup. If Google shows leftover demo text from an imported template, check the Tagline and the homepage’s SEO title before you resubmit.

    Usually the hard part of this job is the diagnosis, not typing the name. If you’d rather send the new name in chat and have it changed, checked on the live page and reported back, that is one of the routine website edits SiteSelf handles. A settings change like this needs only the SiteSelf Connector plugin.

    Changing the title from WP-CLI or the REST API

    If you have SSH access, WP-CLI’s option command reads and writes the setting directly. Read the old value first so you can put it back.

    wp option get blogname
    wp option update blogname "Acme Dental"
    wp option update blogdescription "Family dentistry in Leeds"

    blogdescription is the tagline. On a Multisite network, each site has its own title, so point the command at the right site with --url=. Run without it, the command changes the main site. Our explainer on multi site websites covers how networks keep each site’s settings apart.

    The REST API settings endpoint calls the same values title and description. An authenticated POST to /wp-json/wp/v2/settings with a new title changes the name, and you can use an application password as the credential. Whichever route you use, a success response only proves the value was saved. Load the live page afterwards to confirm visitors see the new name.

    When to stop and get help

    Hand it to your host or a developer if any of these apply:

    • The setting won’t save. The usual causes are a host firewall rule returning a 403, a conflict with a plugin or theme, or a leftover object-cache.php or advanced-cache.php file in wp-content. Ask your host to check its firewall logs before you start disabling plugins.
    • The title is hard-coded in the theme. Editing header.php on a live site without a child theme risks breaking the layout, and the next theme update will undo your edit.
    • The name changed and nobody changed it. That can be a sign the site has been hacked, especially if Google shows a name you never used. Read our guide on what to do when WordPress is hacked before you just rename it back.

    Frequently asked questions

    Will changing my site title change my URL?

    No. The Site Title and the site address are separate settings. Renaming the site leaves your domain, permalinks and links as they were, so you don’t need any redirects.

    Does changing the site title hurt SEO?

    There’s no evidence it affects rankings. It changes what your SEO plugin puts in title templates and what Google may eventually show as your site name. Keep the name accurate and short, and don’t stuff keywords into it.

    Should my site title match my domain?

    It doesn’t need to. Use the name customers know you by. Old forum advice that matching them helps SEO isn’t backed by any evidence.

    Will WooCommerce emails show the new name?

    Yes, wherever the email uses the {site_title} placeholder. WooCommerce’s email documentation says that placeholder reads the WordPress Site Title. Changing an SEO plugin’s title won’t affect it.

    How do I change the site title on WordPress.com?

    Use the same Settings → General screen, or edit the Site Title block in the Site Editor. WordPress.com’s support documentation describes both routes.

    Should every page use the site title as its title?

    No. WCAG 2.2 success criterion 2.4.2 requires each page to have a title that describes its topic or purpose. Use the site name as branding at the end of each page title, not as the whole title.

  • Social media plugins for WordPress, sorted by job

    Key takeaways

    • Decide the job first: share buttons, follow icons, a feed, auto-posting, social login, link previews or WooCommerce catalog sync. No single plugin does all of them well.
    • Feeds need the most upkeep. Expired tokens, a stalled WP-Cron and JavaScript conflicts cause most blank or stale feeds, and Wake Forest University’s WordPress guide plans for reconnecting roughly every six weeks.
    • Free share buttons are easy to find. AddToAny shows 300,000+ active installs on WordPress.org. Facebook no longer reliably gives share counts to third-party buttons, so changing plugins won’t bring them back.
    • Link previews come from og:image tags, which your SEO plugin usually sets. A social plugin is rarely the fix for a wrong preview image.
    • On a WooCommerce store, Troubleshooting Mode does not put payment gateways into sandbox, so test conflicts on staging.

    Search the WordPress.org directory for “social media” and you get share buttons, Instagram galleries, auto-posters, profile icons, login tools and catalog sync, all in one list. These are different products. They connect to different things, they break in different ways, and they cost different amounts to keep running.

    So “which social media plugin is best” has no single answer. A better question is which job you need done, and how much upkeep you’re signing up for. The installation itself is the easy part, and our guide to installing a WordPress plugin safely covers it. This article covers the decision that comes before it.

    Which social job do you actually need done?

    Name the job before you look at any plugin. Practitioner threads are full of mismatched answers. In one, someone asked for Pinterest share buttons and was pointed to a feed plugin, which does the reverse.

    JobWhat it doesWhat it connects toOngoing upkeep
    Share buttonsVisitors share your page to their own networksNothing; buttons open share linksLow
    Follow iconsLink to your own profilesNothing; they are plain linksVery low
    Social feedsShow your Instagram, Facebook, YouTube or TikTok posts on your siteThe platform’s API, through an access tokenHigh
    Auto-postingPublish your new posts to your own social accountsEach network’s API, one connection per accountMedium to high
    Social loginVisitors sign in with a social accountEach provider’s OAuth appMedium, and it touches security
    Link previews (Open Graph)Set the image and title shown when someone shares your linkNothing; these are meta tags in your pageLow, usually handled by your SEO plugin
    Catalog syncPush WooCommerce products to Facebook or Instagram shopsMeta’s commerce toolsHigh

    The upkeep column matters more than the feature list. Anything that holds a token for someone else’s platform will break when that platform changes its rules, and you’ll be the one who notices.

    Why share buttons are the easy part

    Share buttons need no account and no API key. Each button opens the network’s share dialog with your URL already filled in. That’s why good free options exist. AddToAny, one of the most installed, showed 300,000+ active installs in the WordPress.org directory.

    There are three things to know before you add them.

    • Share counts are mostly gone. In a Jetpack support thread on WordPress.org, Jetpack’s team explained that Facebook no longer reliably makes share-count data available to third-party sharing buttons. Switching plugins won’t restore the numbers.
    • Icon-only buttons need accessible names. W3C’s guidance on functional images says the text alternative should describe what the control does. “Share on Facebook” works. “icon” or “facebook-logo” doesn’t. Check that your plugin outputs a label, and add one if it doesn’t.
    • Buttons add some weight. Isolated benchmarks of individual share plugins showed small effects. They used different metrics on different setups, so none of them ranks one plugin above another. Measure your own page before and after, on mobile.

    Some practitioners take share buttons off entirely as mobile clutter, and nobody has published usage data that settles the argument. If your analytics show almost no social referrals, removing the buttons is a reasonable choice.

    Why feeds need the most maintenance

    Feeds bring the most visible value and the most support threads. Smash Balloon’s Instagram feed plugin is the most installed in the category, with 1,000,000+ active installs on WordPress.org. Its own documentation also lists the most failure modes, which tells you what running a feed actually involves.

    The token expired or the platform changed its API

    This is the most common cause. The plugin reaches Instagram or Facebook with an access token, and tokens expire, get revoked when someone changes a password or admin role, or stop working when Meta retires an API. Smash Balloon’s error reference covers API error 190: Error validating access token. The fix is to remove the source, save, and reconnect.

    Update the plugin before you reconnect. When Meta retired the older Instagram connection method, reconnecting through an outdated plugin version didn’t help. Wake Forest University’s WordPress guide expects feed connections to need reconnecting roughly every six weeks and recommends turning on the plugin’s feed-issue email report. That interval is one institution’s experience, not a rule. Still, it’s a sensible calendar reminder.

    The feed only updates when you clear the cache

    This usually isn’t a broken plugin. Smash Balloon’s doc on this symptom names three causes: WP-Cron or the server cron isn’t running, the page cache lifetime is too long, or the feed’s own cache interval is too long. WP-Cron only runs when someone visits, so a quiet site can go hours without a refresh.

    Clearing the cache by hand brings the feed back, and it also hides the cause. Check whether cron is running with a plugin such as WP Crontrol, or ask your host about a real server cron. Then shorten the cache lifetime for the feed page, or exclude that page from the page cache.

    The feed is blank or the loader keeps spinning

    Open the browser console first. Smash Balloon’s troubleshooting list includes another plugin’s JavaScript error, outdated or duplicate jQuery, lazy-loading conflicts, script combining by an optimization plugin, a wrong shortcode or feed ID (curly quotes pasted from a document break it), and a theme that never calls the hooks plugins rely on:

    <?php wp_head(); ?>   <!-- inside <head> -->
    <?php wp_footer(); ?> <!-- just before </body> -->

    If you have to edit the theme, do it in a child theme so the next theme update doesn’t undo your fix. Don’t apply site-wide workarounds such as turning off lazy loading everywhere until the console has shown you that’s the cause. Firewalls can also block feeds: support threads point to Cloudflare rules, ModSecurity and Wordfence blocking requests or settings saves. For the wider method, see our guide on fixing plugins that stop working.

    Connecting feeds for clients

    Agencies don’t need client passwords. Spotlight’s directory listing describes an Access Token Generator that lets the client authorize the connection themselves, and it supports separate accounts and feeds for each site.

    Why free auto-posting usually comes with limits

    Auto-posting is where “free” most often stops meaning free. Commenters on r/Wordpress keep reporting the same pattern: the free tier covers one or two networks, and Instagram or LinkedIn needs a paid plan or an add-on. Others ended up switching between plugins until one covered the networks they actually used.

    The underlying reason sits with the platforms. Self-hosted tools that post to Meta’s networks need an approved developer app, and one Reddit user described waiting months for that approval. Before you install anything, write down the exact networks you post to. Then check that the free tier, or the plan you would buy, covers all of them. Also check whether “posting” means the full post with an image or just a link.

    Auto-posters also depend on WP-Cron, the same as feeds. A scheduled share on a low-traffic site can go out late because nobody visited to trigger it.

    Why the wrong image shows when your link is shared

    Link previews come from Open Graph tags in your page’s head, mainly og:image and og:title. On most sites your SEO plugin writes these tags, not a social plugin. Installing a share plugin to fix a preview usually adds a second set of tags and makes things worse.

    Google’s image documentation says its choice of preview image is automated and draws on several sources. og:image is one way to influence it, not a way to control it. Set a relevant image per post in your SEO plugin, give crawlers time to revisit, and never use noindex to “reset” a preview. Image optimization plugins that rewrite image URLs can also change these tags, so check the page source when the preview looks wrong. Our guide to doing SEO on WordPress covers where those settings live.

    What to check before you install any social plugin

    Spend a few minutes on the directory listing first. It saves more time than any feature comparison.

    1. Confirm it does your job. Read the description for the one thing you named above. A plugin that bundles login, counters and sharing adds code for jobs you may not need.
    2. Check maintenance. Look at “Last updated” and “Tested up to”. A feed or posting plugin that hasn’t been updated since the platform’s last API change will fail.
    3. Check the free tier against your network list. Every network, not just the first one.
    4. Decide where it loads. A feed belongs on the page it supports, such as a portfolio or a product page, not on every article template.
    5. Test one workflow. Connect one account and publish one post or one feed. Check the result logged out before you add a second network.
    6. Keep one plugin per job. Two share plugins or two plugins writing Open Graph tags cause conflicts, and removing the unused one closes off code you no longer need.

    Social plugins look finished on the day you set them up, and then they need updates, reconnections and clean-up for as long as they’re installed. If you’d rather not do that yourself, SiteSelf handles plugin updates, settings and removals on request through chat, using its connector plugin for settings work and hosting access for file-level fixes. Reconnecting a social account still needs whoever owns that login.

    If you run a WooCommerce store

    Catalog sync to Facebook and Instagram shops gets mixed reports. Store owners on r/woocommerce describe one update to the official integration syncing every product, including disabled variations. Others report the integration working nearly out of the box. When you troubleshoot any social plugin on a store, WooCommerce’s documentation warns that Health Check’s Troubleshooting Mode does not switch payment gateways to sandbox, so an order placed during a test can take a real payment. WooCommerce recommends a backup and a staging site for conflict testing.

    Frequently asked questions

    Do social media plugins slow down WordPress?

    They can, depending on the scripts they load and the external requests they make. Isolated tests of share-button plugins showed small effects, but nobody has published comparable benchmarks for feed plugins, which tend to be heavier. Measure the specific page before and after, and load feeds only where they are used.

    What is the difference between sharing and auto-posting?

    Share buttons let your visitors post your page to their own accounts. Auto-posting publishes your new content to your own accounts. Each one needs a different plugin, and only auto-posting needs you to connect accounts.

    Can WordPress post to Instagram automatically for free?

    Sometimes, but free tiers often leave Instagram out or put it behind a paid plan. Network support changes, so check the plugin’s current listing for Instagram specifically before you build a workflow around it.

    Why did my feed stop working after a theme or plugin update?

    Usually a JavaScript conflict, a script optimization setting, or a theme that dropped the wp_head() or wp_footer() call. Check the browser console, update the feed plugin, then isolate the cause with the Troubleshooting plugin, which disables plugins only for your logged-in session, or on a staging copy.

    Are follow icons the same as share buttons?

    No. Follow icons are plain links to your profiles and connect to nothing. Many themes and the block editor’s Social Icons block can add them without a dedicated plugin.

    How many social plugins is too many?

    There’s no safe number. One per job is the rule that matters. Duplicates, especially two plugins writing Open Graph tags or two loading share scripts, cause most of the conflicts.

  • How to speed up a WP site without breaking it

    Key takeaways

    • Check Time to First Byte (TTFB) first. If it is slow, look at hosting, PHP or a missing page cache. If TTFB is fast but the main content appears late, look at images, CSS and scripts.
    • In SpinupWP’s 2023 lab test, page caching raised server throughput from 42 to between 213 and 287 requests per second. Caching does nothing about heavy pages or too many scripts.
    • Don’t lazy-load the hero image. Resize images to the size they actually display at. The weight of each image matters more than how many there are.
    • On WooCommerce, keep Cart, Checkout, My Account, AJAX and Store API requests out of every cache. Place a full test order after each change.
    • Run one page cache, one CDN and one optimization tool. Find out what your host already does before you add anything.

    HTTP Archive’s 2025 Web Almanac found that 45% of WordPress sites passed all three Core Web Vitals on mobile, and 53% had a good Largest Contentful Paint. So most WordPress sites are still slow on phones. The usual reaction is to install another speed plugin. In support threads, that is the most common way people make a site slower or break it.

    The method that works is boring. Measure the page that is slow, find out where the time goes, make one change and test again. A speed setting that breaks a menu, a form or checkout is a bug, not an improvement. Stacked optimization features are also a common reason WordPress plugins stop working.

    What do you need before you start?

    You need an administrator login, access to your hosting dashboard (that is where server cache, PHP version and CDN settings usually live) and a recent backup you know you can restore. If your host offers a staging copy, test the risky steps there first.

    You also need three free tools: PageSpeed Insights, your browser’s developer tools (the Network tab), and the Query Monitor plugin, which shows slow database queries and outside HTTP calls. Most image and plugin work happens in the WordPress admin. Changing caching rules, PHP or theme files needs hosting access.

    Step 1. Measure the page that matters, on mobile

    Test the page that earns money or leads, such as a product page, a service page or the booking form. The homepage alone doesn’t tell you enough. Run it through PageSpeed Insights on the mobile setting.

    A single run is noise. The WordPress Performance Team’s measurement best practices recommend taking several measurements with the same setup. Run the test at least three times and use the middle result. Write down LCP, INP, CLS, TTFB, total page weight and the LCP element (the image or text block the test flags).

    MetricWhat it measuresGood
    Largest Contentful Paint (LCP)When the main content appears2.5 s or less
    Interaction to Next Paint (INP)How fast a tap or click gets a response200 ms or less
    Cumulative Layout Shift (CLS)How much the page jumps while it loads0.1 or less

    The thresholds come from Google’s Core Web Vitals documentation. Google also says that meeting them doesn’t guarantee better rankings. Aim for real visitors’ numbers (the field data at the top of the report). The lab score is there to help you diagnose.

    Step 2. Work out whether the server or the page is slow

    TTFB tells you which half of the problem you have. If the first byte takes a long time, the browser is waiting for WordPress to build the page. Compressing a stylesheet won’t help with that. If TTFB is fast but LCP is slow, the page itself is too heavy.

    SymptomLikely causeWhere to look
    High TTFBNo page cache, slow PHP, heavy queries, hosting limitsHost dashboard, Query Monitor
    Fast TTFB, slow LCPOversized or lazy-loaded hero image, render-blocking CSSNetwork tab, LCP element
    Poor INPHeavy JavaScript from the theme, a page builder or widgetsPerformance trace, plugin list
    High CLSImages or ads without dimensions, late fontsMissing width and height

    If a theme or plugin is the suspect, isolate it. WooCommerce’s slow site troubleshooting guide suggests switching to a default theme for a while and turning extensions off one at a time. Do that on staging, not on the live site.

    Step 3. Fix server response with hosting, PHP and one page cache

    Start by finding out what your host already caches. Many hosts run their own server or edge cache, and some won’t let you add a caching plugin. Kinsta’s technical FAQ says it doesn’t allow them. A second page cache on top of the host’s cache causes conflicts and old pages that won’t go away.

    Page caching matters when TTFB is the problem. In SpinupWP’s 2023 lab test, uncached WordPress handled 42 requests per second. With WP Rocket, WP Super Cache or W3 Total Cache it handled 213 to 253, and with Nginx FastCGI Cache it handled 287. That was one setup measuring server capacity, not what a visitor feels. If your host doesn’t cache, add one plugin that suits your server, for example LiteSpeed Cache on a LiteSpeed server.

    Then check that the cache is actually working. Open the page in a private window, reload it, and look at the response headers in the Network tab for a cache “HIT” from your plugin or host. An installed cache that never hits does nothing.

    Next, check PHP. Go to Tools > Site Health > Info > Server. WordPress’s requirements page recommends PHP 8.3 or newer. Check that your theme and plugins support it, then switch PHP in your host’s dashboard. On stores and membership sites, which can’t serve every page from cache, a persistent object cache such as Redis can reduce repeated database work if your host supports it.

    If TTFB is still high while the cache is hitting, or you see 502, 503 or 504 errors, the server is running out of capacity or a request is too slow. Our guide to the 504 error on WordPress explains how to read the logs. Only upgrade hosting once you have measured that the server is the bottleneck. A pricier plan doesn’t fix a heavy plugin.

    Step 4. Make pages lighter, starting with images

    The usual image problem is size, not number. A 4,000 by 3,000 pixel camera photo shown 800 pixels wide makes every visitor download pixels nobody sees. A large Media Library doesn’t slow a page. Only the images on that page count.

    1. In the Network tab, filter by images and sort by size. Fix the largest files first.
    2. Resize to the width the theme displays, compress, and use WebP or AVIF where your setup supports them. WordPress then serves smaller copies to small screens through srcset.
    3. Lazy-load images below the fold. Never lazy-load the hero image. Load it straight away and give it fetchpriority="high". Lazy-loading the LCP image delays the one thing the test measures.
    4. Give every image a width and height so the browser can save space for it. This keeps CLS down.

    Our guide to optimizing pictures in WordPress covers formats, bulk tools and how WordPress decides which images to lazy-load.

    Step 5. Remove scripts and plugins you can’t justify

    Plugin count is a poor guide. One badly built plugin can do more damage than twenty small ones. Use Query Monitor and the Network tab to see what each plugin loads and which queries it runs. Then delete any plugin nobody can explain, especially abandoned ones. That is cheaper than faster hosting, and every deleted plugin is one less thing to keep patched.

    Third-party scripts such as chat widgets, trackers and ad code are often the heaviest items on the page. Removing one can be a business decision, so ask whoever owns it before you cut it.

    Front-end optimization features (minify, combine, delay JavaScript, remove unused CSS) break things more often than anything else in this list. Turn them on one at a time. WP Rocket’s documentation says to turn off Combine JavaScript files when Delay JavaScript Execution is on. If a feature breaks a script, exclude only that script. After each change, open the mobile menu, submit a form and press the main button with the keyboard as well as by tapping.

    If a heavy theme or page builder is the cause, replacing it is a redesign, not a quick fix. A builder your team edits every week can be worth its overhead. In that case, turn off the builder features you don’t use.

    Step 6. On WooCommerce, protect checkout first

    A faster store that can’t take payment is broken. WooCommerce’s checkout spinner documentation says to keep Cart, Checkout and My Account out of page and edge caching, and to make sure AJAX and Store API requests are never served from cache. If they are, customers see the wrong cart, a spinner that never stops, or wrong shipping rates.

    After every change, purge every cache layer and place a full test order using your payment provider’s test mode. Add a product, change the quantity, apply a coupon and check the shipping and tax totals. Turning off cart fragments can speed pages up, but it can also stop the header cart from updating, so test that on staging first.

    Step 7. Test the same way again, then keep or undo

    Retest the same page with the same settings and the same number of runs, and compare it with your baseline. Keep a change only if it improved the metric you aimed at and nothing broke. Otherwise undo it before you try the next one. Write each change down in one line, because three weeks later nobody remembers which setting broke the contact form.

    If a change doesn’t show up, an old copy is being served from somewhere. Purge the plugin cache, the host cache, the CDN and then the browser, in that order. Our guide to a page that isn’t updating explains how to tell which layer answered. Field data in Search Console takes weeks to catch up, so judge field results over time.

    What if it’s still slow, or only the admin is slow?

    A slow wp-admin is a different problem. Common causes are a bloated wp_options table, very large numbers of posts or custom fields, no object cache, old PHP, host limits and outgoing calls that time out. WooCommerce’s wp_options and site speed guide points out that autoloaded options load on almost every page. Check what is autoloaded before you delete anything, because removing rows blind can wipe settings a plugin still needs.

    Stop and get help if checkout breaks and you can’t trace why, if you’re unsure what a database table belongs to, or if a script conflict goes beyond what the plugin settings can fix. If you’d rather hand the work over, SiteSelf’s speed optimization work starts from your slow page URL in chat. The agent makes the change on your site using hosting (SSH) access and reports what it changed and what it checked. Speed also drifts as content and plugins change, so a website care plan should name who retests and when.

    Frequently asked questions

    Do too many plugins slow WordPress down?

    Quality matters more than count. One plugin that loads heavy scripts on every page or runs slow queries can outweigh many small ones. Measure what each plugin loads instead of deleting by number.

    Do inactive plugins slow my site?

    No official source in our research settles this. Delete inactive plugins anyway if nobody needs them. They clutter the admin and can still be a security risk if they fall out of date.

    What is the best caching plugin?

    The one that suits your host and server. If your host already caches pages, you may not need one at all, and some hosts don’t allow them. In SpinupWP’s lab test, the three popular plugins it measured landed in a similar range.

    Do I need a CDN?

    A CDN serves static files from servers closer to your visitors. It helps with delivery but won’t fix a slow server or a heavy page. Use one CDN, not two.

    Why is my site fast on desktop but slow on mobile?

    Phones have slower processors and less steady connections, so heavy JavaScript and large images hurt more there. PageSpeed Insights tests mobile on a slowed-down profile on purpose. Always test mobile directly.

    How often should I run a speed test?

    There is no official schedule. Retest after any plugin, theme or major content change, and check your key pages now and then for slow drift.