Blog

  • Social media plugins for WordPress, sorted by job

    Key takeaways

    • Decide the job first: share buttons, follow icons, a feed, auto-posting, social login, link previews or WooCommerce catalog sync. No single plugin does all of them well.
    • Feeds need the most upkeep. Expired tokens, a stalled WP-Cron and JavaScript conflicts cause most blank or stale feeds, and Wake Forest University’s WordPress guide plans for reconnecting roughly every six weeks.
    • Free share buttons are easy to find. AddToAny shows 300,000+ active installs on WordPress.org. Facebook no longer reliably gives share counts to third-party buttons, so changing plugins won’t bring them back.
    • Link previews come from og:image tags, which your SEO plugin usually sets. A social plugin is rarely the fix for a wrong preview image.
    • On a WooCommerce store, Troubleshooting Mode does not put payment gateways into sandbox, so test conflicts on staging.

    Search the WordPress.org directory for “social media” and you get share buttons, Instagram galleries, auto-posters, profile icons, login tools and catalog sync, all in one list. These are different products. They connect to different things, they break in different ways, and they cost different amounts to keep running.

    So “which social media plugin is best” has no single answer. A better question is which job you need done, and how much upkeep you’re signing up for. The installation itself is the easy part, and our guide to installing a WordPress plugin safely covers it. This article covers the decision that comes before it.

    Which social job do you actually need done?

    Name the job before you look at any plugin. Practitioner threads are full of mismatched answers. In one, someone asked for Pinterest share buttons and was pointed to a feed plugin, which does the reverse.

    JobWhat it doesWhat it connects toOngoing upkeep
    Share buttonsVisitors share your page to their own networksNothing; buttons open share linksLow
    Follow iconsLink to your own profilesNothing; they are plain linksVery low
    Social feedsShow your Instagram, Facebook, YouTube or TikTok posts on your siteThe platform’s API, through an access tokenHigh
    Auto-postingPublish your new posts to your own social accountsEach network’s API, one connection per accountMedium to high
    Social loginVisitors sign in with a social accountEach provider’s OAuth appMedium, and it touches security
    Link previews (Open Graph)Set the image and title shown when someone shares your linkNothing; these are meta tags in your pageLow, usually handled by your SEO plugin
    Catalog syncPush WooCommerce products to Facebook or Instagram shopsMeta’s commerce toolsHigh

    The upkeep column matters more than the feature list. Anything that holds a token for someone else’s platform will break when that platform changes its rules, and you’ll be the one who notices.

    Why share buttons are the easy part

    Share buttons need no account and no API key. Each button opens the network’s share dialog with your URL already filled in. That’s why good free options exist. AddToAny, one of the most installed, showed 300,000+ active installs in the WordPress.org directory.

    There are three things to know before you add them.

    • Share counts are mostly gone. In a Jetpack support thread on WordPress.org, Jetpack’s team explained that Facebook no longer reliably makes share-count data available to third-party sharing buttons. Switching plugins won’t restore the numbers.
    • Icon-only buttons need accessible names. W3C’s guidance on functional images says the text alternative should describe what the control does. “Share on Facebook” works. “icon” or “facebook-logo” doesn’t. Check that your plugin outputs a label, and add one if it doesn’t.
    • Buttons add some weight. Isolated benchmarks of individual share plugins showed small effects. They used different metrics on different setups, so none of them ranks one plugin above another. Measure your own page before and after, on mobile.

    Some practitioners take share buttons off entirely as mobile clutter, and nobody has published usage data that settles the argument. If your analytics show almost no social referrals, removing the buttons is a reasonable choice.

    Why feeds need the most maintenance

    Feeds bring the most visible value and the most support threads. Smash Balloon’s Instagram feed plugin is the most installed in the category, with 1,000,000+ active installs on WordPress.org. Its own documentation also lists the most failure modes, which tells you what running a feed actually involves.

    The token expired or the platform changed its API

    This is the most common cause. The plugin reaches Instagram or Facebook with an access token, and tokens expire, get revoked when someone changes a password or admin role, or stop working when Meta retires an API. Smash Balloon’s error reference covers API error 190: Error validating access token. The fix is to remove the source, save, and reconnect.

    Update the plugin before you reconnect. When Meta retired the older Instagram connection method, reconnecting through an outdated plugin version didn’t help. Wake Forest University’s WordPress guide expects feed connections to need reconnecting roughly every six weeks and recommends turning on the plugin’s feed-issue email report. That interval is one institution’s experience, not a rule. Still, it’s a sensible calendar reminder.

    The feed only updates when you clear the cache

    This usually isn’t a broken plugin. Smash Balloon’s doc on this symptom names three causes: WP-Cron or the server cron isn’t running, the page cache lifetime is too long, or the feed’s own cache interval is too long. WP-Cron only runs when someone visits, so a quiet site can go hours without a refresh.

    Clearing the cache by hand brings the feed back, and it also hides the cause. Check whether cron is running with a plugin such as WP Crontrol, or ask your host about a real server cron. Then shorten the cache lifetime for the feed page, or exclude that page from the page cache.

    The feed is blank or the loader keeps spinning

    Open the browser console first. Smash Balloon’s troubleshooting list includes another plugin’s JavaScript error, outdated or duplicate jQuery, lazy-loading conflicts, script combining by an optimization plugin, a wrong shortcode or feed ID (curly quotes pasted from a document break it), and a theme that never calls the hooks plugins rely on:

    <?php wp_head(); ?>   <!-- inside <head> -->
    <?php wp_footer(); ?> <!-- just before </body> -->

    If you have to edit the theme, do it in a child theme so the next theme update doesn’t undo your fix. Don’t apply site-wide workarounds such as turning off lazy loading everywhere until the console has shown you that’s the cause. Firewalls can also block feeds: support threads point to Cloudflare rules, ModSecurity and Wordfence blocking requests or settings saves. For the wider method, see our guide on fixing plugins that stop working.

    Connecting feeds for clients

    Agencies don’t need client passwords. Spotlight’s directory listing describes an Access Token Generator that lets the client authorize the connection themselves, and it supports separate accounts and feeds for each site.

    Why free auto-posting usually comes with limits

    Auto-posting is where “free” most often stops meaning free. Commenters on r/Wordpress keep reporting the same pattern: the free tier covers one or two networks, and Instagram or LinkedIn needs a paid plan or an add-on. Others ended up switching between plugins until one covered the networks they actually used.

    The underlying reason sits with the platforms. Self-hosted tools that post to Meta’s networks need an approved developer app, and one Reddit user described waiting months for that approval. Before you install anything, write down the exact networks you post to. Then check that the free tier, or the plan you would buy, covers all of them. Also check whether “posting” means the full post with an image or just a link.

    Auto-posters also depend on WP-Cron, the same as feeds. A scheduled share on a low-traffic site can go out late because nobody visited to trigger it.

    Why the wrong image shows when your link is shared

    Link previews come from Open Graph tags in your page’s head, mainly og:image and og:title. On most sites your SEO plugin writes these tags, not a social plugin. Installing a share plugin to fix a preview usually adds a second set of tags and makes things worse.

    Google’s image documentation says its choice of preview image is automated and draws on several sources. og:image is one way to influence it, not a way to control it. Set a relevant image per post in your SEO plugin, give crawlers time to revisit, and never use noindex to “reset” a preview. Image optimization plugins that rewrite image URLs can also change these tags, so check the page source when the preview looks wrong. Our guide to doing SEO on WordPress covers where those settings live.

    What to check before you install any social plugin

    Spend a few minutes on the directory listing first. It saves more time than any feature comparison.

    1. Confirm it does your job. Read the description for the one thing you named above. A plugin that bundles login, counters and sharing adds code for jobs you may not need.
    2. Check maintenance. Look at “Last updated” and “Tested up to”. A feed or posting plugin that hasn’t been updated since the platform’s last API change will fail.
    3. Check the free tier against your network list. Every network, not just the first one.
    4. Decide where it loads. A feed belongs on the page it supports, such as a portfolio or a product page, not on every article template.
    5. Test one workflow. Connect one account and publish one post or one feed. Check the result logged out before you add a second network.
    6. Keep one plugin per job. Two share plugins or two plugins writing Open Graph tags cause conflicts, and removing the unused one closes off code you no longer need.

    Social plugins look finished on the day you set them up, and then they need updates, reconnections and clean-up for as long as they’re installed. If you’d rather not do that yourself, SiteSelf handles plugin updates, settings and removals on request through chat, using its connector plugin for settings work and hosting access for file-level fixes. Reconnecting a social account still needs whoever owns that login.

    If you run a WooCommerce store

    Catalog sync to Facebook and Instagram shops gets mixed reports. Store owners on r/woocommerce describe one update to the official integration syncing every product, including disabled variations. Others report the integration working nearly out of the box. When you troubleshoot any social plugin on a store, WooCommerce’s documentation warns that Health Check’s Troubleshooting Mode does not switch payment gateways to sandbox, so an order placed during a test can take a real payment. WooCommerce recommends a backup and a staging site for conflict testing.

    Frequently asked questions

    Do social media plugins slow down WordPress?

    They can, depending on the scripts they load and the external requests they make. Isolated tests of share-button plugins showed small effects, but nobody has published comparable benchmarks for feed plugins, which tend to be heavier. Measure the specific page before and after, and load feeds only where they are used.

    What is the difference between sharing and auto-posting?

    Share buttons let your visitors post your page to their own accounts. Auto-posting publishes your new content to your own accounts. Each one needs a different plugin, and only auto-posting needs you to connect accounts.

    Can WordPress post to Instagram automatically for free?

    Sometimes, but free tiers often leave Instagram out or put it behind a paid plan. Network support changes, so check the plugin’s current listing for Instagram specifically before you build a workflow around it.

    Why did my feed stop working after a theme or plugin update?

    Usually a JavaScript conflict, a script optimization setting, or a theme that dropped the wp_head() or wp_footer() call. Check the browser console, update the feed plugin, then isolate the cause with the Troubleshooting plugin, which disables plugins only for your logged-in session, or on a staging copy.

    Are follow icons the same as share buttons?

    No. Follow icons are plain links to your profiles and connect to nothing. Many themes and the block editor’s Social Icons block can add them without a dedicated plugin.

    How many social plugins is too many?

    There’s no safe number. One per job is the rule that matters. Duplicates, especially two plugins writing Open Graph tags or two loading share scripts, cause most of the conflicts.

  • How to speed up a WP site without breaking it

    Key takeaways

    • Check Time to First Byte (TTFB) first. If it is slow, look at hosting, PHP or a missing page cache. If TTFB is fast but the main content appears late, look at images, CSS and scripts.
    • In SpinupWP’s 2023 lab test, page caching raised server throughput from 42 to between 213 and 287 requests per second. Caching does nothing about heavy pages or too many scripts.
    • Don’t lazy-load the hero image. Resize images to the size they actually display at. The weight of each image matters more than how many there are.
    • On WooCommerce, keep Cart, Checkout, My Account, AJAX and Store API requests out of every cache. Place a full test order after each change.
    • Run one page cache, one CDN and one optimization tool. Find out what your host already does before you add anything.

    HTTP Archive’s 2025 Web Almanac found that 45% of WordPress sites passed all three Core Web Vitals on mobile, and 53% had a good Largest Contentful Paint. So most WordPress sites are still slow on phones. The usual reaction is to install another speed plugin. In support threads, that is the most common way people make a site slower or break it.

    The method that works is boring. Measure the page that is slow, find out where the time goes, make one change and test again. A speed setting that breaks a menu, a form or checkout is a bug, not an improvement. Stacked optimization features are also a common reason WordPress plugins stop working.

    What do you need before you start?

    You need an administrator login, access to your hosting dashboard (that is where server cache, PHP version and CDN settings usually live) and a recent backup you know you can restore. If your host offers a staging copy, test the risky steps there first.

    You also need three free tools: PageSpeed Insights, your browser’s developer tools (the Network tab), and the Query Monitor plugin, which shows slow database queries and outside HTTP calls. Most image and plugin work happens in the WordPress admin. Changing caching rules, PHP or theme files needs hosting access.

    Step 1. Measure the page that matters, on mobile

    Test the page that earns money or leads, such as a product page, a service page or the booking form. The homepage alone doesn’t tell you enough. Run it through PageSpeed Insights on the mobile setting.

    A single run is noise. The WordPress Performance Team’s measurement best practices recommend taking several measurements with the same setup. Run the test at least three times and use the middle result. Write down LCP, INP, CLS, TTFB, total page weight and the LCP element (the image or text block the test flags).

    MetricWhat it measuresGood
    Largest Contentful Paint (LCP)When the main content appears2.5 s or less
    Interaction to Next Paint (INP)How fast a tap or click gets a response200 ms or less
    Cumulative Layout Shift (CLS)How much the page jumps while it loads0.1 or less

    The thresholds come from Google’s Core Web Vitals documentation. Google also says that meeting them doesn’t guarantee better rankings. Aim for real visitors’ numbers (the field data at the top of the report). The lab score is there to help you diagnose.

    Step 2. Work out whether the server or the page is slow

    TTFB tells you which half of the problem you have. If the first byte takes a long time, the browser is waiting for WordPress to build the page. Compressing a stylesheet won’t help with that. If TTFB is fast but LCP is slow, the page itself is too heavy.

    SymptomLikely causeWhere to look
    High TTFBNo page cache, slow PHP, heavy queries, hosting limitsHost dashboard, Query Monitor
    Fast TTFB, slow LCPOversized or lazy-loaded hero image, render-blocking CSSNetwork tab, LCP element
    Poor INPHeavy JavaScript from the theme, a page builder or widgetsPerformance trace, plugin list
    High CLSImages or ads without dimensions, late fontsMissing width and height

    If a theme or plugin is the suspect, isolate it. WooCommerce’s slow site troubleshooting guide suggests switching to a default theme for a while and turning extensions off one at a time. Do that on staging, not on the live site.

    Step 3. Fix server response with hosting, PHP and one page cache

    Start by finding out what your host already caches. Many hosts run their own server or edge cache, and some won’t let you add a caching plugin. Kinsta’s technical FAQ says it doesn’t allow them. A second page cache on top of the host’s cache causes conflicts and old pages that won’t go away.

    Page caching matters when TTFB is the problem. In SpinupWP’s 2023 lab test, uncached WordPress handled 42 requests per second. With WP Rocket, WP Super Cache or W3 Total Cache it handled 213 to 253, and with Nginx FastCGI Cache it handled 287. That was one setup measuring server capacity, not what a visitor feels. If your host doesn’t cache, add one plugin that suits your server, for example LiteSpeed Cache on a LiteSpeed server.

    Then check that the cache is actually working. Open the page in a private window, reload it, and look at the response headers in the Network tab for a cache “HIT” from your plugin or host. An installed cache that never hits does nothing.

    Next, check PHP. Go to Tools > Site Health > Info > Server. WordPress’s requirements page recommends PHP 8.3 or newer. Check that your theme and plugins support it, then switch PHP in your host’s dashboard. On stores and membership sites, which can’t serve every page from cache, a persistent object cache such as Redis can reduce repeated database work if your host supports it.

    If TTFB is still high while the cache is hitting, or you see 502, 503 or 504 errors, the server is running out of capacity or a request is too slow. Our guide to the 504 error on WordPress explains how to read the logs. Only upgrade hosting once you have measured that the server is the bottleneck. A pricier plan doesn’t fix a heavy plugin.

    Step 4. Make pages lighter, starting with images

    The usual image problem is size, not number. A 4,000 by 3,000 pixel camera photo shown 800 pixels wide makes every visitor download pixels nobody sees. A large Media Library doesn’t slow a page. Only the images on that page count.

    1. In the Network tab, filter by images and sort by size. Fix the largest files first.
    2. Resize to the width the theme displays, compress, and use WebP or AVIF where your setup supports them. WordPress then serves smaller copies to small screens through srcset.
    3. Lazy-load images below the fold. Never lazy-load the hero image. Load it straight away and give it fetchpriority="high". Lazy-loading the LCP image delays the one thing the test measures.
    4. Give every image a width and height so the browser can save space for it. This keeps CLS down.

    Our guide to optimizing pictures in WordPress covers formats, bulk tools and how WordPress decides which images to lazy-load.

    Step 5. Remove scripts and plugins you can’t justify

    Plugin count is a poor guide. One badly built plugin can do more damage than twenty small ones. Use Query Monitor and the Network tab to see what each plugin loads and which queries it runs. Then delete any plugin nobody can explain, especially abandoned ones. That is cheaper than faster hosting, and every deleted plugin is one less thing to keep patched.

    Third-party scripts such as chat widgets, trackers and ad code are often the heaviest items on the page. Removing one can be a business decision, so ask whoever owns it before you cut it.

    Front-end optimization features (minify, combine, delay JavaScript, remove unused CSS) break things more often than anything else in this list. Turn them on one at a time. WP Rocket’s documentation says to turn off Combine JavaScript files when Delay JavaScript Execution is on. If a feature breaks a script, exclude only that script. After each change, open the mobile menu, submit a form and press the main button with the keyboard as well as by tapping.

    If a heavy theme or page builder is the cause, replacing it is a redesign, not a quick fix. A builder your team edits every week can be worth its overhead. In that case, turn off the builder features you don’t use.

    Step 6. On WooCommerce, protect checkout first

    A faster store that can’t take payment is broken. WooCommerce’s checkout spinner documentation says to keep Cart, Checkout and My Account out of page and edge caching, and to make sure AJAX and Store API requests are never served from cache. If they are, customers see the wrong cart, a spinner that never stops, or wrong shipping rates.

    After every change, purge every cache layer and place a full test order using your payment provider’s test mode. Add a product, change the quantity, apply a coupon and check the shipping and tax totals. Turning off cart fragments can speed pages up, but it can also stop the header cart from updating, so test that on staging first.

    Step 7. Test the same way again, then keep or undo

    Retest the same page with the same settings and the same number of runs, and compare it with your baseline. Keep a change only if it improved the metric you aimed at and nothing broke. Otherwise undo it before you try the next one. Write each change down in one line, because three weeks later nobody remembers which setting broke the contact form.

    If a change doesn’t show up, an old copy is being served from somewhere. Purge the plugin cache, the host cache, the CDN and then the browser, in that order. Our guide to a page that isn’t updating explains how to tell which layer answered. Field data in Search Console takes weeks to catch up, so judge field results over time.

    What if it’s still slow, or only the admin is slow?

    A slow wp-admin is a different problem. Common causes are a bloated wp_options table, very large numbers of posts or custom fields, no object cache, old PHP, host limits and outgoing calls that time out. WooCommerce’s wp_options and site speed guide points out that autoloaded options load on almost every page. Check what is autoloaded before you delete anything, because removing rows blind can wipe settings a plugin still needs.

    Stop and get help if checkout breaks and you can’t trace why, if you’re unsure what a database table belongs to, or if a script conflict goes beyond what the plugin settings can fix. If you’d rather hand the work over, SiteSelf’s speed optimization work starts from your slow page URL in chat. The agent makes the change on your site using hosting (SSH) access and reports what it changed and what it checked. Speed also drifts as content and plugins change, so a website care plan should name who retests and when.

    Frequently asked questions

    Do too many plugins slow WordPress down?

    Quality matters more than count. One plugin that loads heavy scripts on every page or runs slow queries can outweigh many small ones. Measure what each plugin loads instead of deleting by number.

    Do inactive plugins slow my site?

    No official source in our research settles this. Delete inactive plugins anyway if nobody needs them. They clutter the admin and can still be a security risk if they fall out of date.

    What is the best caching plugin?

    The one that suits your host and server. If your host already caches pages, you may not need one at all, and some hosts don’t allow them. In SpinupWP’s lab test, the three popular plugins it measured landed in a similar range.

    Do I need a CDN?

    A CDN serves static files from servers closer to your visitors. It helps with delivery but won’t fix a slow server or a heavy page. Use one CDN, not two.

    Why is my site fast on desktop but slow on mobile?

    Phones have slower processors and less steady connections, so heavy JavaScript and large images hurt more there. PageSpeed Insights tests mobile on a slowed-down profile on purpose. Always test mobile directly.

    How often should I run a speed test?

    There is no official schedule. Retest after any plugin, theme or major content change, and check your key pages now and then for slow drift.

  • What makes a high converting landing page work

    Key takeaways

    • Unbounce’s 6.6% median comes from more than 41,000 pages built on Unbounce, not on WordPress. Industry medians in the same data run from 3.8% for SaaS to 12.3% for entertainment, so use your own baseline.
    • Before you change any copy, submit the form on a phone and confirm the email arrives, then place a test order. A missing Email action in Elementor’s Actions After Submit or a From address that doesn’t match your domain can quietly lose every lead.
    • Google rates LCP at 2.5 seconds or less, INP under 200 ms and CLS under 0.1 as good. Never lazy-load the hero image. Only 40% of WordPress sites passed all three on mobile in 2024.
    • W3C’s guidance is to drop irrelevant or excessive form fields, not necessary ones. Every field needs a real label, and text, including placeholder text, needs 4.5:1 contrast.
    • Change one thing at a time and compare it with a dated baseline. Almost every published landing-page win changed several things at once, so none of them can say which change worked.

    Paid traffic doesn’t tell you when a page is broken. One r/smallbusiness poster spent $2,000 on ads at $75 a day without a conversion. Threads like that one keep finding the same thing: the visitor arrived, but something between the button and the inbox failed, or the page never said clearly what the ad had promised.

    A high-converting landing page isn’t a template. It’s a page that works, loads fast on a phone, and gives one clear offer to the people the ad sent. Check those in that order. Rewriting the headline won’t help if the form email never leaves the server.

    This article covers the diagnosis and the order of work. For layout and visual hierarchy, see our landing page design best practices. If you still need to build the page, start with how to build a landing page in WordPress.

    What counts as “high converting” depends on your offer, not a benchmark

    No single number qualifies a page as high converting. Unbounce’s 2024 benchmark report puts the median landing-page conversion rate at 6.6%, based on more than 41,000 landing pages, 464 million visitors and 57 million conversions. Those are pages built on Unbounce’s own platform, not on WordPress, and the median hides a wide spread.

    In the same data, industry medians run from 3.8% for SaaS to 12.3% for entertainment. Traffic source moves the number just as much. Unbounce reports averages of 19.3% for email traffic, 12% for paid social and 10.9% for paid search. A free download and a $900 service booking aren’t the same conversion. One r/marketing commenter pointed out that 8% might be fine for SaaS account creation and poor for product sales.

    Your real benchmark is your page’s own rate, over a fixed date range, using one definition of a conversion. Count completed actions: a submitted lead, a booked call, a paid order. Don’t count button clicks. Our guide to measuring landing page conversion rate shows how to set up that event so the number holds still while you make changes.

    Why a page that “doesn’t convert” is often a page that doesn’t work

    A page can look perfect and still lose every lead. The form shows its thank-you message while the email never leaves the server. Checkout sits behind a spinner. The tracking tag never fires, so a working page reports zero. The fixes for these are known, so test the real path before you change anything else.

    1. Open the page on a phone, on mobile data, from the ad’s actual URL with its tracking parameters.
    2. Fill in the form as a visitor would, and submit it.
    3. Confirm the lead arrived in the inbox or CRM where your team actually works. Check spam too.
    4. Confirm the thank-you page loads and your analytics recorded the conversion.
    5. If the page sells something, complete a test order with a test payment method and check that the order appears in WooCommerce.

    This test tells you the page works. It doesn’t tell you whether it persuades anyone. Still, it’s the cheapest check you can run, and it rules out the failures that copy changes can’t fix.

    When the form says “sent” but nothing arrives

    Start with the form’s own settings. Elementor’s documentation says Email has to be listed under Actions After Submit for notifications to go out at all. Elementor also warns that form emails can land in spam, and it recommends sending site email through a dedicated email service.

    The next most common cause is the From address. In one 2026 wordpress.org support thread, Contact Form 7 returned mail_failed because the server refused to send mail from an address that didn’t belong to the site. The suggested fix: use a From address on your own domain, put the visitor’s email in Reply-To, and install WP Mail Logging to see what the server said. If your form plugin stores entries in the WordPress admin, check whether submissions are landing there. If they are, the form works and only the email is failing.

    When checkout spins and never finishes

    WooCommerce’s troubleshooting docs say a spinner alone doesn’t tell you the cause. It can be a cached response, an extension conflict, a request blocked by a firewall or a server error. Find out first whether the store uses the Checkout block or the classic checkout. WooCommerce advises against switching checkout types as your first step, because the switch can hide the conflict instead of fixing it.

    Open the browser’s developer tools, find the failing request under Network, and read its status code. WooCommerce maps 403 to a firewall or authorization problem, 404 to a URL or rewrite problem, and 500 to a server-side failure. Separately, WooCommerce’s docs say to exclude Cart, Checkout and My Account from page caching. Before a buyer or tester tries again, check WooCommerce > Orders, because an order may already exist. Our guide to fixing WordPress issues without guessing covers the full sequence.

    When the numbers themselves can’t be trusted

    Check your measurement tools before you trust what they tell you. One r/Wordpress user reported an A/B testing plugin that wasn’t splitting traffic and wasn’t recording most sessions. Submit a test conversion and watch it appear in your analytics before you make any decision based on the data.

    Does the page say exactly what the ad promised?

    Once the page works, the most common advice from practitioners is message match. The visitor should see the ad’s promise in the headline, in the same words, within a second of arriving. Brochure-style homepages, rotating carousels and clever headlines fail this test because the visitor has to work out the offer for themselves.

    The fixes repeated across Reddit, X and agency write-ups are consistent:

    • One audience, one problem. A page for “anyone who needs a website” persuades nobody in particular.
    • Proof on the first screen. A named result, a sourced rating or a short case study (problem, fix, outcome) near the button, not in the footer.
    • Price and commitment in plain view. Fees, contract length and “card required” belong near the button. Visitors who find them in the FAQ later trust the page less.
    • One obvious next step. Repeat the same action after the proof. Don’t add a second, different offer.

    The supporting numbers are self-reported, so treat them as direction, not forecasts. A coaching business on r/smallbusiness said its ad return rose from about 2× to 3× ad spend after it stopped sending ads to the homepage and built a dedicated page. A home-inspection company on the same subreddit tested two calls to action. “Free Quote” converted 23% of visitors, and 29% of those leads became customers. “Contact Now” converted 20%, and 38% of those leads became customers. The button with the lower conversion rate brought in better leads. That is one reason to judge a page on qualified leads, not on submissions alone.

    Is it fast on the phone your visitors actually use?

    In Unbounce’s data, 83% of landing-page visits came from mobile, while desktop visitors converted 8% better. A slow page loses people before they read the headline. Google rates Core Web Vitals as good when Largest Contentful Paint is 2.5 seconds or less, Interaction to Next Paint is 200 ms or less, and Cumulative Layout Shift is 0.1 or less. Most WordPress sites still miss that bar. HTTP Archive’s 2024 Web Almanac found that 40% of WordPress sites passed all three on mobile, up from 28% in 2023.

    The most common self-inflicted problem is lazy-loading the hero image. Google’s lazy-loading guidance says not to lazy-load content that is likely to be visible straight away. On most landing pages, the hero image is the LCP element, so it should load first, with high priority. Lazy-load the images further down the page.

    Builder speed settings come with their own warnings. Elementor labels Element Caching and Optimized Control Loading as experimental. Its optimized image loading, which prioritizes the LCP image and lazy-loads below-the-fold images, is listed as stable. Third-party form embeds can undo your optimizations too. One wordpress.org thread reported Kit forms loading about 750 KB of JavaScript that skipped WP Rocket’s and Perfmatters’ delay settings.

    Make one change, then measure again. After you purge a cache, run the test several times: Kinsta’s docs note that the first request after a purge may be a cache MISS, which isn’t how cached visitors experience the page. For the wider responsive checks, see making a mobile friendly website.

    How many form fields should a landing page ask for?

    Ask for as many fields as your team needs to take the next step, and no more. W3C’s forms tutorial says excessive or irrelevant questions can increase abandonment. The wording matters, though: the advice is to cut irrelevant fields, not necessary ones. A quote form without the service area just moves the work to a phone call.

    The form also has to be usable. W3C says each field needs a real <label> whose for matches the field’s id. A placeholder is not a label. Explain required fields and expected formats before the visitor submits. Error messages should name the fix (“Enter a phone number with area code”), not just the fault. WCAG sets minimum text contrast at 4.5:1, or 3:1 for large text, and that applies to the pale grey placeholder text many themes ship with.

    How to tell which change worked when traffic is thin

    Record a baseline before you touch anything: the conversion rate, the date range, the device split and the traffic source. Then make one change and compare a similar period afterwards, with the same ads running. A split test only gives a clear answer when each version gets enough conversions. On a small-business page, an honest before-and-after comparison is usually the better tool.

    Published case studies show why this matters. Elementor’s 2018 NinjaOutreach write-up reports a rise from 0.73% to 5.8%. The same project moved hosts, cut plugins from 30 to 12 and redesigned the page at the same time, so no single change can claim the result. Keep a short log with the date, page, what changed, why, and the metric you expect it to move. A few weeks of that log will tell you more than any benchmark.

    How the work changes when the site does it

    Most of the fixes above are small: a From address, a headline, a cache exclusion, one image’s loading priority. The slow part is the process around them. A marketer who wants six words changed to match a new ad often waits in the same development queue as a site rebuild. Meanwhile the ad keeps spending.

    SiteSelf is an AI agent that works on your existing WordPress site. You describe the job in chat or from Telegram, and the agent does the work on the live site, checks the result and reports what changed. For landing pages that covers both kinds of work: editing page copy and layout and fixing a broken form or page.

    Example request: “Our spring offer page at /spring-offer is getting ad clicks, but no leads have come in since Tuesday. Find out whether the form is sending, fix it, and change the headline to match the ad: ‘Same-week oven cleaning across Leeds.’”

    The agent reads the form plugin’s notification settings and recipient. It checks whether the From address belongs to your domain, and it reads mail or error logs where they exist. Before it changes anything, it tells you what it is about to change, such as moving the From address to your domain and putting the visitor’s email in Reply-To, and whether that change can be undone. It edits the headline and then fetches the changed page to confirm the new text is live. Its report says what it changed, what it checked, and what it found but left alone.

    Access depends on the task. The SiteSelf Connector plugin from the WordPress.org directory covers content and settings work, like the headline and the form plugin’s options. Server logs, code and speed work need hosting (SSH) access.

    The limits matter here. The agent can’t read your inbox, so you still send a test submission and confirm the lead arrived. It doesn’t write to your ad account, analytics or CRM. If Elementor, Divi or Beaver Builder owns the page, the agent refuses the edit and says why. It doesn’t watch the page after the fix, either. Work happens when you ask for it. For cost, see pricing.

    Frequently asked questions

    Do I need a paid page builder to make a landing page convert?

    No. A landing page is an ordinary WordPress page with one job, and the block editor can build one. A builder can save build time, but no source in our research shows that paying for one raises conversions. Our article on whether you need a landing page builder covers the tradeoffs.

    My Elementor Landing Pages menu disappeared. Did I lose my pages?

    No. Elementor deactivated its separate Landing Pages feature for new sites in version 3.22 and deprecated it in Pro 3.27. Elementor says existing landing pages are not affected. Build new campaign pages as regular pages in the standard editor.

    Should a landing page remove the site navigation?

    Focused campaign pages often remove it, so the visitor’s only path is the offer. That’s a design choice, not a rule. Some landing templates hide the menu by design, which confuses site owners who didn’t expect it. Keep the menu if visitors need to check something before they commit, such as your service area.

    One call to action or two?

    Usually one primary action, repeated after the proof. The home-inspection test above suggests a gentler second option can catch visitors who aren’t ready yet. If you add one, track lead quality for each button, not just the click count.

    My landing page returns a 404 while the rest of the site works. What first?

    Go to Settings > Permalinks and click Save Changes without editing anything. WordPress rebuilds its rewrite rules when you do. Then clear every cache layer and test again. If the page is still missing, check whether a plugin or theme conflict is involved.

  • How to back up a WordPress site that will restore

    Key takeaways

    • Back up the database first and the files second. Restore in the opposite order: files first, then the database. That is the order WordPress’s Advanced Administration Handbook gives.
    • Tools > Export is not a backup. It saves content only, and WooCommerce’s docs say the XML export leaves out orders, products and settings.
    • A backup stored only in your hosting account can disappear with it, through a suspension, a compromised login or a host failure. Keep one copy somewhere you control.
    • Read the backup log, not the status label. On wordpress.org, one UpdraftPlus user reported a run marked as succeeded with no database archive and no failure email.
    • On a live WooCommerce store, restoring an older database removes every order placed since that backup. When only code broke, roll back the code and leave the data alone.

    Your hosting dashboard probably says backups are on. That sounds fine until something breaks and you have to answer three questions: what does the copy contain, where is it stored, and has anyone ever restored it? Most failed recoveries had a backup. The backup just had a problem nobody found until the day it was needed.

    This guide covers making a backup you can actually use: what it has to include, three ways to make one, how often to run it, where to keep it and how to prove it works. If you already have a backup and need to use it, our guide on restoring a WordPress site from backup covers that side.

    Why a WordPress backup is always two things

    A full backup is the database plus the files, taken at the same moment. Leave out either half and you can’t rebuild the site.

    The database stores posts, pages, comments, users, settings and most plugin data. On a store, it also holds products, orders and customers. The files are WordPress core, your theme, your plugins, the wp-content/uploads folder with every image you have uploaded, and wp-config.php. WordPress’s Advanced Administration Handbook on backups warns that downloading the WordPress folder does not include the database, because the database is stored separately. The handbook’s order is to back up the database first and then the files, and to restore the files first and then the database.

    The common mix-up is Tools > Export. That screen produces an XML file of your posts and pages. It contains no theme, no plugins and no settings. WooCommerce’s backup documentation says a store’s data lives in two places, the wp-content folder and the database, and that the XML export does not include orders, products or settings. Use the export to move content around, not as a backup.

    Treat every archive as sensitive. wp-config.php holds your database password and security keys, and a store’s database dump holds customer names and addresses.

    Which backup method suits your site

    There are three ways to do it, and many sites use two of them together.

    • Host backups. You don’t have to set anything up, and you can usually restore with one click or a support ticket. Ask your host what the backups include, how long they are kept and where they are stored. They often sit in the same account as the live site.
    • A backup plugin. You choose the schedule and send copies to storage you own, such as Google Drive, Dropbox or S3. It is one more piece of software to keep updated, and it can fail when the server runs out of memory, time or disk space. Our explainer on what a backup plugin does and where it fails covers the failure modes.
    • A manual backup. You export the database and copy the files yourself. You get full control and no plugin limits, but it takes more skill, and nothing happens unless someone remembers to do it. It works best as a one-off copy before a risky change.

    For an owner without a web team, a sensible default is to keep the host’s backups as one layer and add a plugin that sends copies off-site. Plugin choice matters less than people think. Practitioners on Reddit and wordpress.org disagree about which plugin is most reliable, and the same plugin works for one person and fails for another depending on the server. Pick one plugin, not two, and check that it works.

    How to make a manual backup

    You need your hosting control panel login, SFTP or file manager access, and access to phpMyAdmin or SSH. Check the database name in wp-config.php (the DB_NAME line) before you start, because exporting a staging database by mistake is easy to do.

    1. Pause writes if they matter. On a store or a busy membership site, pick a quiet hour. Orders that arrive while you copy can end up in one half of the backup but not the other.
    2. Export the database. In phpMyAdmin, select the database named in wp-config.php, open the Export tab and export all tables as SQL. Name the file with the site and the date and time.
    3. Copy the files. Using SFTP or the host’s file manager, download the whole WordPress folder, including wp-content and wp-config.php. Turn on hidden files so you also get .htaccess. Check that the transfer finished and didn’t just stop partway.
    4. Write down the environment. Note the WordPress, PHP and database versions. Restoring an old backup onto a newer PHP version is a known way for restores to fail.
    5. Move the copy off the server. Put the SQL file and the file archive together in storage outside your hosting account, encrypted if it holds customer data.

    With SSH access, the same backup is two commands, run from the WordPress folder:

    wp db export ~/backup-$(date +%F).sql
    tar -czf ~/files-$(date +%F).tar.gz .

    Then copy both files somewhere other than that server. Before you rely on the backup, open the SQL file and check that the tables you expect are there, including the plugin tables, and that the archive size makes sense for your site.

    How to set up a plugin backup that you can trust

    Installing the plugin is the easy part. What makes it work is the setup and a habit of checking it.

    • Include everything. Back up the database, plugins, themes, uploads and other wp-content folders. Leaving out uploads makes the archive smaller, but the backup is no longer complete.
    • Set a remote destination. A copy that stays in the plugin’s folder on your server is not off-site.
    • Turn on email reports. Then actually read them.
    • Read the log after the first run. In a 2026 wordpress.org thread, an UpdraftPlus user’s log showed errors and no database archive, yet the run ended as succeeded and no failure email was sent. Other people in the thread questioned the cause. Either way, the status label was not enough to go on.
    • Check the remote storage directly. In another thread, a remote upload failed, the local copies kept building up, and the server filled until the site went down. Open the Drive or S3 folder now and then and check that new files keep arriving.

    How often should you back up?

    Back up often enough that you never lose more work than you could stand to lose. WordPress’s handbook suggests weekly backups for small sites with little activity and daily backups for busy ones. Neither is a rule. A brochure site edited once a month is fine with weekly backups. A blog publishing every day needs daily backups. A store taking orders all day needs database backups more often than daily, and Reddit commenters suggest every few hours.

    Files usually change less than the database, so a common pattern is to back up the database daily and the files weekly. Separately from the schedule, take a fresh backup before every plugin, theme or core update, before a migration and before any developer starts work on the site.

    Where should backup copies live?

    Keep at least one copy outside your hosting account, in storage only you control. A backup in the same account as the site goes down with it: if the account is suspended, if someone steals the login, or if the host has an outage, you lose both. Practitioners call this a “3-2-1 style” setup: the live site, the host’s backup and one independent copy.

    Keep enough old copies to go back past a problem you didn’t spot right away. A hack often starts days before anyone sees it, and the newest backup may already include it. Our guide on what to do when your site is hacked explains why to restore only a backup you know is clean, and only after the way in has been closed.

    How do you know the backup will actually restore?

    Restore it somewhere that isn’t the live site. A host staging copy or a local install with LocalWP both work. Do it once now and then on a regular schedule. Some practitioners do it monthly. Restore the files, import the database, then check the pages, images, forms and logins, and count posts or products against the live site. A homepage that loads can still hide missing tables.

    A staging copy is a working site and can do real things. The Make WordPress Hosting handbook on staging warns that a clone can be indexed as duplicate content, can send emails to customers, and can run scheduled tasks that call payment or subscription services. Put a password on the copy, stop or catch outgoing email, switch payments to sandbox mode and turn off cron. If you push from staging back to live, check Settings > Reading on the live site afterwards. WordPress’s Reading settings documentation explains that “Discourage search engines” adds a noindex tag, so if that setting comes across from staging, search engines get the same instruction for your live site.

    What is different on a WooCommerce store?

    Restoring an older database takes the whole store back to that moment, and every order placed since then disappears. One store owner on r/woocommerce rolled back to fix a payments problem and lost several days of orders. Restoring the site doesn’t bring back the business records. You would have to match up the missing orders against your payment provider by hand.

    When an update breaks something, roll back the one plugin or theme that caused it and leave the database as it is. Use a partial restore if your tool offers one. Test updates on staging before they reach checkout. Never push a staging database over a live store, because the Make WordPress Hosting handbook notes that this overwrites orders, comments and users created since the copy was made.

    When to stop and get help

    Stop and ask for help if a restore freezes partway through, if a backup is too big for your host’s upload limit, if the site shows “There has been a critical error on this website” after a restore, or if you suspect the backup itself is infected. Running the same browser restore again rarely works unless something has changed, such as higher PHP limits or more free disk space. If a former developer or host ran the site, ask them for a backup before you rebuild anything. They often have one.

    If a backup before every update is the step you keep skipping, SiteSelf can take on routine WordPress updates and maintenance on request through chat. Before each change it says what is about to change and whether it can be undone. You still need your own off-site backup. A WordPress care plan should say who is responsible for that.

    Frequently asked questions

    Does WordPress back up my site automatically?

    Self-hosted WordPress doesn’t back itself up. Backups come from your host or from a plugin you install. On WordPress.com, whether you get automatic backups depends on your plan.

    Are my host’s backups enough?

    Usually not on their own. Ask what they include, how long they are kept and how a restore works. Then keep one more copy outside the hosting account so a suspension or a stolen login can’t take away both the site and its backups.

    Do I need the files if I have the database?

    Yes. The database brings your text and settings back, but not the images, theme or plugin code needed to display them. A full restore needs both halves, taken at the same time.

    Will restoring a backup undo recent changes?

    Yes. Anything stored in the database goes back to the moment of the backup, including posts, users, settings and orders. That is why a partial or code-only rollback is safer when only a plugin broke.

    Should one site run two backup plugins?

    Usually not. Two plugins double the load on the server and the chance of hitting its limits, and you end up with two restore processes to learn. One plugin with an off-site destination, plus the host’s backups, covers most sites.

    Who is responsible for backups, me or my developer?

    Whoever the contract names. If it names nobody, assume it’s you. Write down who backs up, how often, where the copies go and who pays for a restore.

  • What a multi site website is and when it fits

    Key takeaways

    • WordPress Multisite shares core files, plugins, themes and the user list across every site. Each site keeps its own content tables and its own uploads folder.
    • It fits a franchise, a school district or a group of closely related brand sites. Unrelated client sites usually belong on separate installs with a management dashboard.
    • Moving a site out of a network is a project, not a setting. One estimate puts the first extraction at four to six hours.
    • WooCommerce stores on one network are independent. Products, checkout sessions and user accounts are not shared unless you add an integration.
    • Most broken networks are infrastructure problems. Check DNS, then the Site Address, then SSL, then cookies, then rewrite rules.

    People search for “multi site website” when they mean three different things. Usually they mean WordPress Multisite, where one installation runs a network of sites. Some of them mean several separate websites run by one person or team. Some are a business with several locations, asking whether each location needs its own site. Each meaning has a different right answer, so work out which one you have before you change anything.

    Which kind of multi site website do you actually have?

    Here are the three setups side by side.

    SetupWhat it isUsually right for
    WordPress Multisite networkOne install, one database, many sites, managed from Network AdminSites that share an owner, a theme, a plugin set and a team
    Separate installs, one operatorEach site is its own WordPress install, with updates often handled from a central dashboardAgencies, freelancers and anyone running unrelated sites
    One site, many locations or servicesA single WordPress site with a distinct page for each location or serviceMost small businesses with several branches or service lines

    The rest of this article is mostly about the first setup, because that is where the expensive mistakes happen. If you already know you want a network, our WordPress Multisite installation steps cover the setup in detail. If your sites are separate installs, see how to manage multiple WordPress websites.

    What a Multisite network shares and what it keeps separate

    A network shares the engine but not the content. WordPress keeps one copy of core, plugins and themes, and one user list. Each site gets its own posts, pages and settings in its own database tables, and its own uploads folder under /wp-content/uploads/sites/, named by site ID.

    • Core: one copy. When you update WordPress, every site moves to that version at once.
    • Plugins: installed once. A Super Admin can network-activate a plugin so it runs on every site, or a plugin can be activated on individual sites. The code is shared either way.
    • Themes: installed once and enabled per site.
    • Users: one list for the whole network. A role on one site gives no role on another until someone adds it.
    • Content: separate per site. Sites cannot share posts or pages without a plugin or custom code.

    This is what makes the decision hard. Shared code helps when the sites are meant to stay the same. Once the sites start to differ, it gets in the way.

    When one network is the right call

    Multisite fits when the sites are really one operation: one owner, one set of rules, the same theme and plugins, and one team running them. WordPress’s own Before You Create A Network page opens by asking whether you really need a network, and it warns against creating one just to get sites that look different.

    Good fits that come up again and again: franchise locations on one template, a school district whose sites share a footer and admins, university departments, and closely related brand sites. Practitioners on X and Reddit sum it up the same way. If each site is basically the same site on the same theme and plugins, a network saves work. If not, it creates work.

    Site count matters less than similarity. One wordpress.org moderator suggests separate installs for two to four sites, with Multisite becoming more appealing above that. That is one person’s opinion. Most practitioners decide by asking whether the sites are alike, not by counting them.

    Interest is also cooling at the top end. In the State of Enterprise WordPress survey, the share of respondents who rated Multisite capabilities very or quite important fell from 56% in 2023 to 46% in 2024. The sample is small and the question measured importance, not usage, but the trend matches what practitioners are saying.

    Why unrelated sites usually belong on separate installs

    Every site on a network shares the same code and database, so they also share failures. One vulnerable plugin, one bad update, one weak password on a sub-site admin account or one traffic spike can reach every site. How far it spreads depends on the host. You still can’t fully isolate one site from the rest.

    Agencies feel this most. A client wants a plugin nobody else needs, so it goes onto the shared codebase. Another client wants to leave, so you have to extract their site. Plenty of agencies have moved client sites off a single network for these reasons. Some went back to separate installs and some moved to isolated hosting. One Reddit user split off about 15 client sites but kept a network of around 50 nearly identical ones, which is the right pattern.

    Leaving a network is harder than joining one. To extract a site you separate its database tables, media, users, URLs and plugin records. One estimate puts the first extraction at four to six hours, and it notes that some hosts charge per site to do it. Changing the network type later is also a migration. WordPress’s Multisite Network Administration page says that switching between subdomains and subdirectories takes more than editing SUBDOMAIN_INSTALL and the rewrite rules. The stored addresses, DNS, virtual hosts, TLS, redirects and cookies all have to change too.

    The practical rule: if you might want separate sites later, start with separate sites. You can get the single-dashboard convenience with a management tool across isolated installs. Our explainer on what a multi site manager manages covers that choice. If you’d rather not handle the routine client requests yourself, SiteSelf for agencies handles the work on each connected site when you ask for it in chat.

    Backups are the other hidden cost. In one wordpress.org thread about an 18-site network, a backup plugin’s free version could back up sub-sites manually, but it needed the paid version for scheduled backups and for the main site, and it could not back up the whole network as one package. Before you consolidate, test whether you can restore one site without touching the others. The usual steps to restore a WordPress site gain an extra step on a network: making sure you import only that site’s tables.

    WooCommerce stores on a network do not share anything

    Owners often expect one network to mean one catalogue. It doesn’t. WooCommerce’s installation docs say each sub-site stores its data in separate tables and runs on its own. Network activation does not share product databases, checkout sessions or user accounts. A customer who buys from two of your stores has two order histories.

    Shared stock needs an extension, such as WooCommerce’s Central Stock or a sync plugin. For two related product lines, the usual advice on r/woocommerce is one store with categories and landing pages.

    Does a business with several locations need several sites?

    Usually not. Advice in small-business and marketing communities favours one site with a distinct page for each location or service. Separate sites duplicate the maintenance, make it harder to compare conversions, and split your search authority across several domains.

    The location pages have to differ in more than the name. A page that is a clone of another with only the city swapped won’t do you any favours. Give each one real local content: staff, hours, the area served and reviews. Keep each one consistent with that location’s business profile.

    What breaks after setup, and the order to check it

    Most broken networks are infrastructure problems: DNS, the web server, certificates or cookies. A mapped domain only works when three layers agree: DNS and the host, the Site Address in WordPress, and SSL. Check them in this order.

    1. DNS and host routing. Sub-sites on a subdomain network that return “Not Found” almost always come down to a missing wildcard DNS record, or a wildcard document root that doesn’t point at the WordPress directory. Creating an empty folder for each subdomain makes this worse. DNS changes can take up to 24 hours to propagate.
    2. The Site Address. In Network Admin, go to Sites, then Edit, and set the Site Address (URL) to the full mapped URL, including https://. WordPress has supported this natively since version 4.5, according to the domain mapping handbook, so you don’t need an old mapping plugin.
    3. SSL for every domain. The primary domain’s certificate does not cover mapped domains. A host rule that forces all traffic to the primary domain makes every mapped site unreachable.
    4. Cookies. Only check these if login loops or “Cookies are blocked” errors remain on mapped domains. The handbook’s fix goes in wp-config.php after the network setup lines.
    5. Rewrite rules. Replace the old WordPress rules with the exact ones that Network Setup generates, and back up the file first. On Apache, confirm that mod_rewrite is on and that AllowOverride permits .htaccess.
    define( 'COOKIE_DOMAIN', $_SERVER['HTTP_HOST'] );

    That line fixes one login problem. It does nothing for DNS, SSL or routing.

    After a migration, “Error establishing a database connection” can mean more than bad credentials. On a network it can also mean the requested domain is missing from wp_blogs. A common cause is a search-replace that only reached one site. WP-CLI’s search-replace works on the current site unless you add --network. Our guide to changing a WordPress domain safely covers the network case.

    Plugins are the other common source of trouble. WP Activity Log 5.3.4 was reported to make a network’s main site show the wrong content, and the developer shipped a redirects fix in 5.3.4.1. Gwolle-Gb 5.1.0 failed to network-activate with a fatal error, and the person who reported it said 5.1.1 worked. Test on staging or on one sub-site before you network-activate anything.

    When to stop and get help

    Stop if you are editing server configuration on a host you don’t control, if the main site is now broken as well, or if you are about to run SQL from the handbook’s debugging page on a production database. Those examples cover specific cases and can do damage if copied blindly. Ask your host whether your plan supports Multisite before you start. Many setup problems on shared hosting turn out to be host limits.

    Frequently asked questions

    Is WordPress Multisite free?

    The feature is built into WordPress. Hosting is a different matter. Some managed hosts only allow Multisite on certain plans, so check with yours before you enable it.

    Should I choose subdomains or subdirectories?

    Neither is better in general. Subdomains need wildcard DNS if you want to create sites on demand, and certificate coverage for every subdomain. Subdirectories need only rewrite support. Choose carefully, because switching later is a migration.

    Is a Multisite network slower than separate installs?

    There is no controlled comparison. Forum consensus is that the network itself makes little difference, and that hosting and plugin load matter far more. Large networks that report slowness tend to also run a very large number of plugins.

    Can each site have its own plugins?

    Each site can activate plugins separately, but every plugin is installed on the shared codebase. A common hardening step is to let only Super Admins install plugins and themes.

    Can I add an existing site to a network?

    Yes. WordPress documents how to migrate single sites into a network. Do a test run on staging first, and confirm you could take the site back out if you needed to.

  • Choosing a WordPress theme for a landing page

    Key takeaways

    • Check three things before you pick a theme: it has a blank or full-width page template in the free version, it is lightweight, and it fits the person who will edit the page each week.
    • On a block theme like Twenty Twenty-Five you can build a landing page with patterns and a custom template, with no page builder at all.
    • Elementor’s separate Landing Pages feature is deprecated as of Elementor Pro 3.27, and those pages can’t be set as the homepage. Build on a regular Page with the Canvas or Full Width layout instead.
    • If you set a homepage and nothing changed, look at the block theme’s front-page.html template first. WordPress’s template hierarchy lets it override the Reading setting.
    • Canvas layouts remove the theme’s header and footer, which also removes navigation and privacy links. Put the legal links back by hand.

    Most people who search for a landing-page theme have the same problem. The offer is ready and the ad goes live on Friday, but the site’s header won’t go away and the form breaks on a phone. A new theme looks like the fix. Usually it isn’t.

    On a landing page, the theme supplies the frame: header, footer, content width, base typography and the page templates on offer. The page itself is built on top of that frame with blocks, a builder or a plugin. When the frame can’t step aside cleanly, switching themes rarely fixes it. The template and the build route do. If you want the build steps, our guide on how to build a landing page in WordPress walks through them. This article covers the choice that comes first.

    What should a landing-page theme actually give you?

    Three things. Theme demos rarely show any of them.

    A blank or full-width template in the free version. A landing page usually needs one of two layouts. One drops the header and footer completely. The other stretches content edge to edge and keeps the site frame. Check that the free tier includes the template you need before you build on the theme. A Virtue theme user on the wordpress.org forums tried a blank-slate plugin and several other fixes to remove the header and footer from one page. In the end, page-specific CSS was the workaround, because the theme’s own landing template was a paid feature.

    A light base. The theme loads on every page, so a heavy theme makes every landing page heavy too. Pressidium, a host, tested default installs on its own servers. Hello loaded in under 230 ms, Neve in under 250 ms, and Astra and GeneratePress in under 300 ms. OceanWP took about 500 ms. Read these as a direction, not a promise. They are a host’s own test on an empty site, and they say nothing about conversions.

    A fit with the editing model. Who will change the headline next month, and with what tool? A marketer who iterates every week needs something different from a developer who builds once and hands off. Decide this before you pick a theme, because the theme often pulls a builder in with it.

    If you want names to start from, roundups such as ThemeBurn’s keep coming back to Astra, GeneratePress, Kadence, Blocksy and Neve as free starting points. Hello is the usual choice under Elementor. ThemeBurn itself says there is no universal winner. These are affiliate-funded lists, so treat them as a shortlist and check each theme against the three points above. Our guide to installing a WordPress theme safely covers testing one without breaking the live site.

    Which build route matches who edits the page?

    Pick the route first. The theme follows from it. There are three common routes, and each one fails in its own way.

    A block theme with no builder

    On a block theme you can build the whole page in the WordPress editor. WordPress.com’s support guide describes the route: create a Page, add patterns or blocks, then create a separate template without a header or footer and assign it to that page. WordPress’s own default theme, Twenty Twenty-Five, ships patterns for landing and services pages. It is free and has more than a million active installs.

    The catch: WordPress.org’s documentation says the Site Editor only appears when a block theme is active. If Appearance shows Customize and no Editor, you have a classic theme, and block-theme tutorials won’t match your screens. Classic themes handle templates in PHP files instead.

    A lightweight theme plus a page builder

    This is the most common setup in practice. HTTP Archive’s 2025 Web Almanac found that about 60% of WordPress sites use a page builder. The theme stays minimal and the builder does the layout. In Elementor, the page layout setting decides how much of the theme shows. Canvas removes the theme’s header, footer and sidebars. Full Width keeps the header and footer and widens the content. Theme uses the theme’s normal layout.

    The tradeoff is lock-in. A page built in a builder is edited in that builder, and moving off it later means rebuilding the layout, not swapping a theme. Our article on whether you need a landing page builder covers when that cost is worth paying.

    A dedicated landing-page plugin

    Plugins such as PluginOps bundle templates and campaign features. Some store pages as their own content type, outside the normal Pages list. One PluginOps user on wordpress.org thought publishing had failed because the page wasn’t in Pages. It was live the whole time and reachable from the plugin’s View link. That matters later, when someone else needs to find the page or wants to make it the homepage.

    Why “I set the homepage and nothing changed” is rarely the theme

    WordPress has precedence rules, and they catch people out. Check these before you blame the theme.

    • The block theme’s front-page template wins. WordPress’s template hierarchy uses a front-page.html template for the front page even when Settings, Reading names a static page. Edit or remove that template, or build your landing design into it. Our guide to setting a page as the front page covers the full setting.
    • Elementor Landing Pages can’t be the homepage. Elementor’s help center says the feature is deprecated as of Elementor Pro 3.27. Those pages are a custom post type, so they never appear in the Reading dropdown. Save the design as a template, insert it into a regular Page, and set that page as the homepage.
    • The WooCommerce Shop page is set somewhere else. WooCommerce assigns its Shop page under WooCommerce, Settings, Products, and it can render as a product archive rather than a normal page. The homepage is still set in Settings, Reading.
    • A custom template is missing the content call. If Elementor says “Sorry, the content area was not found in your page. You must call the_content function in the current template, in order for Elementor to work on this page.”, the page template doesn’t output content. Elementor’s fix is to switch the page to Elementor Full Width or Canvas.

    If the page looks right in the editor and wrong when live, you are probably looking at a stale cache, not a template problem. Clear the caches one layer at a time: plugin, host, CDN, then check in a private window. On Elementor sites, also regenerate the CSS files. Our guide to a WordPress page not updating goes through that order. Clearing caches won’t fix a page that has the wrong template assigned, so check the template first.

    What a blank template takes away that you still need

    Removing the theme’s frame is the point of a landing page, and it also removes things you need. Elementor’s own example landing page keeps a footer with privacy and terms links. If your page collects email addresses, put those links back by hand.

    Headings are next. Many themes print the page title as an H1. If your hero also uses an H1, the page has two, and both screen readers and search engines lose track of the structure. Hide the theme title properly, or make the hero heading an H2. Our guide on hiding page titles safely shows how for each theme type.

    Last, check the form and the colours yourself. No theme does it for you. W3C’s WCAG 2.2 guidance sets minimum contrast at 4.5:1 for normal text and 3:1 for large text. Every form field needs a visible label, not just placeholder text. Bold hero designs often fail both checks.

    When the theme is fine and the page is slow

    A light theme only sets the starting weight. Hero videos, oversized images, animation libraries, chat widgets and tracking scripts are added at page level, and they can make any theme slow. One Salient theme owner on Reddit found the landing-page demo slow on mobile. They dropped the separate landing page and improved the existing product page instead. Sometimes that is the better campaign page anyway.

    Measure the finished page with your real form, analytics and consent banner loaded, not the theme demo. If you’d rather not do the template and layout work yourself, SiteSelf handles design changes on your existing site from a chat request. It checks the changed page and reports what it did. Pages owned by Elementor, Divi or Beaver Builder are refused, with the reason.

    Frequently asked questions

    Do I need a special landing-page theme?

    No. A general lightweight theme with a blank or full-width template does the same job, and it keeps working when the campaign ends. A dedicated landing theme can save setup time for one page, but it usually suits a growing site poorly.

    Do I still need a theme if I use a page builder?

    Yes. WordPress always runs an active theme, and builder layouts work with it. Elementor’s Theme, Full Width and Canvas options each decide how much of the theme shows. That is why builder users pick a minimal theme such as Hello: there are fewer styles to fight.

    Can I still use Elementor’s Landing Pages feature?

    Existing pages keep working, but Elementor says the feature is deprecated as of Pro 3.27, so don’t start new pages with it. Page building in Elementor in general is not deprecated. Build new campaign pages as regular Pages with Canvas or Full Width.

    Should my landing page be my homepage?

    Only if the whole site has one job. A page made for an ad or an email campaign usually works better at its own URL, with the normal homepage left alone. Then you can retire the campaign without redesigning the front of the site.

    Why can’t I find my published landing page in the Pages list?

    The plugin or builder that made it probably stores it as its own content type. Look in that plugin’s menu and use its View link to confirm the page is live. If you want it to be the homepage, rebuild it as a regular Page.

  • What to do when your WordPress site is hacked

    Key takeaways

    • A 500 error, the critical-error message or a white screen is usually a bug, not a hack. Strong signs of a hack are Google or browser warnings, admin accounts you don’t recognise, redirects and defacement.
    • Patchstack counted 11,334 new WordPress vulnerabilities in 2025. 91% were in plugins and 46% had no fix when they were made public, so the way in is usually third-party code or stolen credentials.
    • WordPress.org warns that reinstalling from the dashboard only overwrites existing files, so files the attacker added stay. Replace core and plugins from clean copies of the same version.
    • Change the hosting, SFTP, database and WordPress passwords and the secret keys, then change the passwords again after cleanup. A WordPress password reset alone leaves the other routes open.
    • Google’s Search Console samples are not a full list of affected URLs. Ask for a review only after every issue is fixed, and expect it to take days or weeks.

    A hacked WordPress site rarely makes the problem obvious. Google shows “This site may be hacked” under your listing, or a customer says your homepage sent them to a casino. Or there is an admin user you never created. The obvious move is to restore last night’s backup and get back to work. That is also how many sites end up hacked twice.

    Restoring a backup, deleting the strange script or running one clean scan all fix the symptom. If the attacker still has a way in, they come back. The steps below are in order, and the order is the point.

    Is the site actually hacked, or just broken?

    Check this before anything else, because the two problems need opposite responses. WordPress.org’s hacked-site FAQ lists these as stronger signs of a hack:

    • Google or a browser flags the site.
    • A scanner reports malware.
    • Your host suspends the account.
    • Users appear that nobody created.
    • Pages are visibly defaced.

    Add redirects you didn’t set up and scripts in the page source that you don’t recognise.

    Some messages look alarming but usually have ordinary causes: “500 Internal Server Error”, “There has been a critical error on this website”, “Error establishing a database connection” and the white screen. Most come from a plugin conflict, a PHP fatal error or a database login problem. Our guides to fixing a 500 server error and fixing a WordPress fatal error cover those. If what you have is a fault rather than an intruder, SiteSelf can find and fix the broken part when you ask in chat. A confirmed hack is work for your host or a security specialist.

    A clean-looking homepage doesn’t prove much either. Injected redirects often target only mobile visitors, logged-out visitors or people arriving from Google, so administrators see a normal site. Open a private window, stay logged out, and check on a phone too.

    What to do in the first hour, before you delete anything

    Your first job is to stop harm to visitors and keep evidence. Cleaning comes later. Kinsta’s malware documentation warns that wiping or resetting the site straight away can destroy forensic evidence without closing the hole the attacker used.

    1. Write down what you see. Note the symptom, when you first noticed it, the URLs involved and anything that changed recently. WordPress.org’s FAQ recommends doing this before you contact your host.
    2. Contact your host. Ask them to look at the whole hosting account and whether they can restrict public access while you work. A maintenance page served by compromised WordPress code may not block direct requests to malicious files.
    3. Save a copy of everything, infected or not. That means files, the database, and the access and error logs. Label the copy as compromised and store it away from your normal backups so nobody restores it later by mistake.
    4. If you run a store and the checkout may have been changed, pause it. Contact your payment provider through its normal support channel.

    Don’t install three security plugins, bulk-delete unfamiliar files or restore the newest backup during this hour. Each one changes the evidence you need to find the way in.

    How attackers usually get into WordPress

    The entry point decides whether the cleanup holds, so find it before you rebuild. Here are the routes, from most to least common.

    Vulnerable or outdated plugins and themes

    Patchstack’s 2026 report counted 11,334 new WordPress vulnerabilities in 2025, 42% more than the year before. 91% were in plugins and only six were in core. 46% had no fix from the developer when they were made public. Patchstack also reports a weighted median of five hours from disclosure to the first observed attack. That figure is weighted toward the most heavily attacked bugs, so it doesn’t mean every flaw is hit in five hours. It does mean a monthly update routine is slow compared with an attack. All of these counts are found flaws, not hacked sites.

    Stolen credentials

    Firewalls and login-lockout plugins don’t see logins to your hosting control panel, SFTP or database. WordPress.org’s FAQ also names malware on the administrator’s own computer as a way FTP and wp-admin passwords get stolen. If you change your passwords on an infected laptop, the attacker gets the new ones too.

    Pirated (“nulled”) plugins and themes, and neighbours on shared hosting

    Pirated premium plugins often ship with a backdoor already in place. On shared hosting, one compromised site can reach the other sites in the same account. That is why moving hosts on its own often brings the infection along.

    Expect some uncertainty here. A disabled security plugin, a strange file and a new admin are all clues, but they rarely show which came first. Host logs are usually the best evidence you have.

    Why deleting the malicious code is not the fix

    The code you can see was put there by something you can’t see yet. WordPress.org’s FAQ points out that the dashboard’s reinstall only overwrites existing files. Files the attacker added stay where they are. Attackers commonly leave a way back in these places:

    • Administrator accounts that exist in the database but don’t appear in the Users screen.
    • Changed rows in wp_options, or injected content in posts.
    • Redirect rules in .htaccess, and edits to wp-config.php.
    • PHP files in wp-content/mu-plugins, drop-ins, or wp-content/uploads.
    • WordPress cron events and server cron jobs.
    • Files outside public_html, or a second WordPress install in a subfolder.

    On the WordPress.org forums, one agency reported several client sites hacked the same way: the same rogue user, a plugin called “hellos”, and file-manager plugins installed. Cleaning didn’t stop it, and the sites kept getting reinfected. That pattern points to access outside WordPress, not a missed file.

    If you have SSH and WP-CLI, these commands give you a fast first look. They change nothing.

    wp core verify-checksums
    wp plugin verify-checksums --all
    wp user list --role=administrator
    wp cron event list

    The plugin checksum check only covers plugins from WordPress.org. To find admins that the dashboard hides, query the database directly. Change the wp_ prefix if yours is different:

    SELECT u.ID, u.user_login, u.user_email, u.user_registered
    FROM wp_users u
    JOIN wp_usermeta m ON m.user_id = u.ID
    WHERE m.meta_key = 'wp_capabilities'
      AND m.meta_value LIKE '%administrator%';

    How to clean the site without restoring the hack

    Rebuild from copies you trust instead of patching what is there. Keep the site restricted until you finish.

    1. Replace core with the same version. Delete wp-admin and wp-includes, then upload fresh copies from the matching official release. WordPress.org says this is appropriate only with the same version. Uploading on top of the old folders leaves the attacker’s extra files in place.
    2. Delete plugin and theme folders and reinstall them from the original source. Remove anything unused or pirated. Keep custom code aside and review it before you put it back.
    3. Check uploads, configuration and scheduled tasks by hand. Look for PHP in uploads, files with double extensions, unknown cron events and edits to .htaccess or wp-config.php. Ask the host to check server-level cron jobs and anything above the web root.
    4. Clean the database. Remove unknown admins, then search posts and options for injected scripts and links. Kinsta notes that database infections can take more than one round.
    5. Use a backup only if you know it is clean, and only after the entry point is closed. A backup made before you noticed the hack may still contain it. Our guide to restoring a WordPress site from backup covers how to do the restore once you have a trustworthy copy.

    Scanners help here, but they don’t diagnose the problem for you. One site owner on the WordPress.org forums reported six months of returning malware despite running Wordfence every day. Treat scan results as leads, and back up any file before you change it. Our guide to malware removal that doesn’t come back covers the file and database checks in more detail.

    Which credentials to change, and why you change them twice

    Change every credential, not just your WordPress password. Do it from a device you trust.

    • Every WordPress administrator and editor account.
    • The hosting control panel, and the email address it sends password resets to.
    • SFTP and FTP accounts. Remove the ones nobody uses, and remove SSH keys you don’t recognise.
    • The database user. Update wp-config.php to match.
    • API keys and SMTP passwords stored on the site.
    • The WordPress secret keys (salts). Changing them logs everyone out. WP-CLI does it with wp config shuffle-salts.

    WordPress.org’s FAQ says to change passwords again once the cleanup is done. Anything you changed while malicious code was still running may have been captured.

    How to confirm the site is clean and get Google’s warning removed

    Check the site the way the attacker wanted visitors to see it. Use a logged-out browser and a phone, open the exact URLs that redirected before, and try a link from Google search results, not just the homepage. Clear the page cache, the host’s cache and any CDN cache first.

    Google’s Search Console help says the sample URLs in the Security issues report may not be a complete list. It also advises against opening infected pages directly in your browser; use URL Inspection to see what Google gets. Request a review only after every issue is fixed across the whole site, and explain what you fixed. Google says reviews often take days or weeks. Don’t submit another request while one is pending.

    After you reopen, watch the site for a few days. Check for files coming back, new admins, spam going out from the site’s email, and forms that suddenly behave differently.

    If the hacked site is a WooCommerce store

    WooCommerce’s security FAQ says a store is only as secure as its WordPress installation, and that one badly written plugin or code snippet can put the site and its data at risk. Customer contact details and orders are stored in your site’s database. Card numbers and security codes generally go straight to the payment processor, but payment tokens may be stored on the site. After a store hack, ask your payment gateway and your host what they can see, not just WordPress. Get qualified advice on whether you have to notify customers. The rules depend on where you and your customers are.

    When to stop and get help

    Hand the job to your host or a security specialist if any of these is true:

    • Files come back after you delete them.
    • An admin account keeps reappearing.
    • You have no logs.
    • The host reports that the hosting account itself was compromised.
    • You can’t tell which files are clean.

    Give them the copy you saved, the timeline and a list of what you changed. Some hosts help for free. Paid cleanups range widely, so ask whether reinfection is covered.

    Once the site is stable, preventing a repeat is mostly routine work: update plugins promptly, delete what you don’t use and limit who has admin access. Our list of common WordPress security issues and our guide to what a care plan should include cover the routine.

    Frequently asked questions

    Can I just restore yesterday’s backup?

    Only if you know the backup is clean, and only after you have closed the entry point. A backup made before you noticed the hack may already contain it. A restore also brings back the vulnerable plugin, so the attacker can come straight back in.

    I had a security plugin installed. Why was I still hacked?

    Login lockouts mostly stop repeated failed password guesses. A stolen valid password, a vulnerable plugin, or access through hosting, SFTP or the database gets around them. A security plugin reduces risk, but it can’t stop every attack.

    I can’t log in to wp-admin after the hack. What now?

    Attackers sometimes change the admin email or redirect wp-admin. Get control through your hosting account first. Use SFTP, phpMyAdmin or WP-CLI to check the admin users, then change passwords and the secret keys. If you can’t get into the hosting account either, contact your host before doing anything else.

    Should I take the site offline?

    If visitors could be harmed, for example by redirects, malware downloads or a changed checkout, yes. Ask your host to restrict access at the server level. A short outage costs less than sending customers to malware.

    Can one hacked site infect my other sites?

    Yes, if they share a hosting account or server user. Ask your host to check every site in the account. Cleaning one site while a neighbouring site still has a backdoor usually leads to reinfection.

  • How to measure and raise landing page conversion rate

    Key takeaways

    • The published benchmarks disagree. Unbounce reports a 6.6% median from 41,000+ pages, HubSpot a 5.89% average from a survey of 101 marketers, and Databox a 7.84% median. None of them is specific to WordPress.
    • The same page can show 2% or 5% depending on whether you divide by ad clicks or by tracked visitors. GA4’s counting method and the way your form submits change the result too.
    • A success message on screen does not prove the lead arrived. Check the stored entry and the email delivery as two separate things.
    • Common fixes can backfire. In a CXL case study the longer original form beat a shorter one by 13.56%, and a headline that raised opt-ins produced 21.7% fewer bottom-of-funnel conversions.
    • CXL’s rule for a valid test is at least 7 days and 250 conversions per variant. Most small WordPress sites never reach that, so diagnosing the problem works better for them than A/B testing.

    A landing page that reports 2% might really be converting at 5%. Or its form might not have delivered a lead in weeks. Either way, a new headline is the wrong fix, and you can’t pick the right one until you know which situation you’re in.

    Landing page conversion rate is the share of visitors who complete the one action the page exists for. The arithmetic takes seconds. The mistakes happen when you decide what counts as a visitor and what counts as a conversion. This article covers how to calculate the rate, what the benchmarks mean, and the order in which to check a page that isn’t converting. If you’re still building the page, start with our landing page design best practices and come back once it has traffic.

    How do you calculate landing page conversion rate?

    Divide conversions by visitors and multiply by 100. Say a page gets 1,200 visitors and 66 of them submit its inquiry form: 66 ÷ 1,200 × 100 = 5.5%.

    The numerator needs to be the finished action, not an attempt at it. Count the outcome the business can use.

    Page goalCount thisNot this
    Lead formA submission that reached you (stored entry or delivered email)Button clicks, form starts
    PurchaseA completed orderAdd-to-cart, checkout started
    BookingA confirmed bookingOpening the calendar
    Phone callA tap on the number, recorded as a tapA completed call, unless your phone system records it

    The denominator is also a choice. Ad clicks, page views, sessions and users are four different counts, and each one gives a different rate. Choose one on purpose and keep it, because a rate only means something when you compare it with the same rate from an earlier period.

    Why does the same page show two different conversion rates?

    Each tool counts its own thing, and none of them is lying. A WooCommerce store owner on the wordpress.org forums found that the BrikPanel analytics plugin showed about 400 visitors for 1,000 Meta ad clicks. With 20 orders, that is 2% against clicks and 5% against tracked visitors. The support reply explained that clicks, page views and visitors measure different things. It also found that some visitors arriving from Meta’s mobile app weren’t being counted. The developer then added a setting that counts a visitor when the page opens.

    Google Analytics 4 adds two more variables:

    • Which event you count. GA4’s built-in form_submit event fires for every form on the site, including newsletter boxes and search forms. Google’s help center shows how to build a separate event from form_submit, filtered by the form’s form_name, and mark that event as a key event. Expect a delay before a newly created event appears in reports.
    • How it is counted. GA4 can count a key event once per event or once per session. If a visitor submits twice, “once per event” counts two conversions. Pick one method and keep it.

    The way your form submits matters too. In a wordpress.org thread, the Fathom Analytics integration for Gravity Forms recorded AJAX submissions but missed forms set to redirect after submitting. The workaround was to count views of the thank-you page as the conversion.

    The fix for all of this is a reconciliation. Compare the analytics count with the entries your form plugin stored, or with the orders WooCommerce recorded, for the same dates. When the two don’t match, fix the tracking before you change anything on the page.

    What is a good landing page conversion rate?

    No published benchmark is specific to WordPress, and the three most-cited figures were measured in different ways.

    SourceFigureWhat it is
    Unbounce 2024 benchmark6.6% medianPlatform data from 41,000+ pages. Industry medians run from 3.8% to 12.3%.
    HubSpot5.89% averageA survey of 101 U.S. marketers
    Databox7.84% median69 contributors, mostly tech companies

    A median and an average are different statistics. A few very successful pages pull an average up but barely move a median. Platform data and survey answers also cover different groups. Unbounce and HubSpot both describe 10% as a rough sign of a good page. Treat that as orientation, not as a target. In Databox’s survey of 90 companies, 21.52% didn’t know their own rate.

    The comparison that tells you something is your own page against itself, split by traffic source and device. This matters most for ad budgets. If you plug a generic 5% into a campaign plan, a cold audience can turn a modest budget into very few leads. Spend a small test budget first and measure what an actual customer costs, not only what a lead costs.

    Why isn’t my landing page converting? Check these in order

    The order goes from quick checks that settle the question to slow ones that only suggest an answer. It reflects how often practitioners report each cause in forums and threads. It isn’t based on a survey.

    1. Does the form actually deliver the lead?

    Submit the form yourself on the published page, logged out, on a phone. Then check three things separately: the message shown on screen, the entry stored in the form plugin, and the email in your inbox. These fail independently. One reported pattern shows a success message to the visitor while no notification email is ever sent.

    • Contact Form 7: “There was an error trying to send your message” usually means mail_failed, so WordPress couldn’t send the email. If you use WP Mail SMTP, open Tools, then Debug Events, and look for authentication failures or an expired Google connection. Set the From address to one on your site’s domain and put the visitor’s address in Reply-To.
    • WPForms: an intermittent “Form Cannot Be Submitted” error has been traced to page caching serving an expired anti-spam token. Exclude the page from the cache or adjust the token lifetime.
    • Elementor forms: a “Form Invalid” error can come from duplicate or blank field IDs. Give every field a unique ID.

    Retest after every plugin update, because form plugins change. Our guide to adding a contact form to WordPress covers the setup side. If you’d rather not trace it yourself, SiteSelf can find and fix a broken form on your live site and report what it changed and what it checked.

    2. On a store, does checkout finish?

    WooCommerce’s documentation lists the usual causes of an endless checkout spinner: caching, firewall or security rules, JavaScript or extension conflicts, server errors and external services. Check Orders before you retry, because the order may already exist. Exclude Cart, Checkout, My Account and the AJAX and Store API requests from caching.

    If the Checkout block shows no payment options, an active gateway may not be compatible with the block. Classic checkout is the documented fallback, but switching straight to it can hide the real cause. Guest checkout is controlled under WooCommerce, then Settings, then Accounts and Privacy.

    3. Does it work on a phone, and quickly?

    Google treats a page as giving a good experience when Largest Contentful Paint is 2.5 seconds or less, Interaction to Next Paint is 200 ms or less, and Cumulative Layout Shift is 0.1 or less, measured at the 75th percentile of visits. In 2024, HTTP Archive found that only 40% of WordPress sites passed all three on mobile, up from 28% in 2023.

    Three WordPress mistakes come up again and again:

    • Lazy-loading the hero image. It is usually the largest element on the first screen, and delaying it delays LCP.
    • Testing speed straight after a cache purge. The first request is a cache miss, so run the same tool from the same location several times.
    • Fixing only the tablet layout. In WordPress’s responsive styles (block themes, WordPress 7.1 and later), the Mobile setting falls back to the base style, not to Tablet. A tablet fix never reaches phones.

    Our guide to making a WordPress site mobile friendly goes through the layout checks.

    4. Does the page match the promise that brought people?

    Message match is the most consistent theme in practitioner reports. One common mismatch is several ad groups for different services all pointing at one generic page. In a December 2025 r/smallbusiness thread, an owner said ad return rose from about 2x to about 3x after building a dedicated page. In r/woocommerce, a store owner said that sending influencer traffic straight to the cart moved conversion from 2% to 5%. Both are uncontrolled before-and-after reports, so read them as examples, not as expectations.

    Traffic can be the problem rather than the page. In a March 2026 r/woocommerce thread, a store with 3,000 to 4,000 monthly visitors was converting at about 0.8%. The replies pointed at unqualified search traffic and unclear shipping costs before the design. Analytics give you numbers but not reasons. Session recordings and a short test with five to ten real customers show you where people hesitate.

    Which changes are worth testing, and when can you trust the result?

    W3C’s forms tutorial says people are more likely to abandon forms that ask for irrelevant or excessive information. So cut fields you don’t use. Cutting is not automatically a win, though. In CXL’s landing page case study, the longer original form beat a shorter version by 13.56%. A new headline raised opt-ins but produced 21.7% fewer conversions further down the funnel. Measure qualified leads or revenue, not only submissions.

    CXL’s rule for a test is at least 7 days and 250 conversions per variant. A page converting 5% of 1,000 monthly visitors produces 50 conversions a month, so two variants would need ten months. At that volume, an A/B test mostly measures noise. A better approach is to change one thing at a time, compare it with your saved baseline, and write down the date and what changed so you don’t confuse a promotion or a broken week with a design win.

    When should you stop and get help?

    Stop when the SMTP log shows errors at the mail provider that you can’t resolve. Your host or email provider has to fix those. Stop when checkout requests return server errors, or when the problem only appears with a specific combination of plugins. Don’t deactivate plugins on the live site to find a conflict, because your visitors see every step. Use a staging copy, or the Health Check plugin’s troubleshooting mode, which disables plugins only for your own logged-in session.

    Frequently asked questions

    Is bounce rate a conversion metric?

    No. A visitor can leave after calling the number on the page, and that’s a success. Bounce rate can point you at a problem, but the goal is the completed action and what it’s worth to the business.

    Should a landing page have navigation?

    Many landing pages drop the main menu so the page has one primary action. Repeating the same call to action further down is fine. Offering several competing destinations is what splits attention.

    Does page speed directly raise conversion rate?

    No controlled data quantifies the effect for WordPress pages, and practitioners disagree about whether one or two seconds matters. Fix the specific failures you can identify, such as a late hero image, a laggy form or shifting layout, rather than chasing a score.

    Are page builders bad for conversion?

    Practitioners disagree. Some blame builder weight, while others blame hosting and configuration. Measure your own page against the Core Web Vitals thresholds before you rebuild anything.

    Should I count phone taps as conversions?

    Count them as phone taps, a separate event from completed calls. A tap shows intent, not a conversation. If your phone system records connected calls, use that as the stronger number.

  • What a WordPress multi site manager actually manages

    Key takeaways

    • Multisite puts every site in one database, one file tree and one user table. A bad plugin update or a compromised Super Admin account can reach every site on the network.
    • MainWP’s own documentation says its Dashboard was not designed for Multisite networks and that MainWP does not officially support that setup. Dashboards are built for separate installs.
    • Unrelated client sites usually belong on separate installs with a central dashboard. Multisite fits related sites under one owner, such as locations, brands or language versions.
    • Multisite problems tend to sit in one of four layers: server routing (subsite 404s), plugin activation, mapped domains and cookies (redirect loops), and migrations run without a network-aware search-replace.
    • WooCommerce on Multisite gives you separate stores. WooCommerce’s docs say each subsite has its own tables and runs as an independent store.

    The second site is easy. By the fifth you are logging into five dashboards, updating the same plugin five times and keeping track of which client is on which PHP version. Then you search for a “WordPress multi site manager” and get two sets of answers that don’t match.

    The answers don’t match because the phrase means two different products. One is WordPress Multisite, a feature built into WordPress core. The other is a management dashboard that connects separate WordPress installs to one control screen. They solve different problems, and you can’t swap one for the other. Our broader guide on how to manage multiple WordPress websites covers every setup. This article covers the choice between these two and what each one actually manages day to day.

    Which “multi site manager” do you actually mean?

    If your sites live in one WordPress installation, you mean Multisite. If each site has its own install, possibly on a different host, you mean a dashboard. The table shows the difference.

    WordPress MultisiteDashboard over separate installs
    What it isOne WordPress installation running many subsitesA control site or service connected to each install by a plugin
    Shared between sitesCore files, plugin and theme code, database, user tableOnly the control screen
    Where you workNetwork AdminThe dashboard, plus each site’s own wp-admin
    What one failure can reachPotentially the whole networkUsually one site, unless the dashboard itself is compromised
    Typical fitRelated sites under one ownerUnrelated client sites

    The two don’t stack well. MainWP’s compatibility notes say its Dashboard “was not designed for managing WordPress Multisite networks” and that MainWP does not officially support Multisite setups. Its testing on Multisite is periodic and limited. So if you are building a network and plan to put a dashboard on top of it, check that first.

    Why the real decision is shared fate, not a single login

    Multisite shares fate by design. Every subsite runs the same plugin code from the same file tree and reads from the same database. That is where the efficiency comes from: one core update, one plugin update and one set of users. It also means one bad update, one compromised Super Admin account or one resource spike can turn into a network-wide event.

    Practitioners are careful about the detail here. A broken page on one subsite doesn’t automatically break the others. The risk comes from what the sites depend on together: the shared code, the shared accounts and the shared server. One r/webdev thread made the agency version of the point plainly. A single problem plugin or database change on a network of client sites could hit all the clients at once.

    Community advice comes out in the same place almost every time:

    • Multisite fits related sites. Think of one business with several locations, one organisation with several brands, or one site in several languages. These sites share an owner, governance, a theme and most of a plugin set.
    • Separate installs plus a dashboard fit unrelated clients. Each client gets its own plugins, its own users, its own backups and its own way back if something breaks. You still get central updates and reporting.
    • Leaving a network is real work. You can export a subsite that has grown apart from the rest into its own install, but it takes planning. Decide how a site would leave before you add it.

    WordPress’s own handbook opens its Multisite preparation page by asking “Do you really need a network?” before it lists any requirements. If the answer is yes, our walkthrough of WordPress Multisite installation covers the setup.

    What Network Admin manages, and what it doesn’t

    Network Admin is the Multisite manager. A Super Admin works there on sites, network plugins, themes and users. A few of its rules catch people out:

    • Plugins are installed for the whole network, then activated per site or for every site. “Network Activate” switches a plugin on everywhere. If you network-activate a plugin for one location’s booking widget, all the other locations get it too.
    • Deleting a plugin or theme removes it from the whole network. MainWP’s notes flag this for anyone connecting subsites to a dashboard. A delete that looks like it affects one site affects them all.
    • Users are shared, roles are not. An account exists once for the network, and you give it a role on each site separately. Having a network account doesn’t make someone an editor anywhere.
    • Site admins can’t manage plugins on their own. If a plugin is available on the network, that doesn’t mean every site admin controls it.

    Network Admin also has hard limits, because some of the work happens outside WordPress. WordPress’s handbook says subdomain networks need wildcard DNS and server routing that sends every subdomain to the same install, and that Multisite needs working rewrite rules. No WordPress setting creates a DNS record, a virtual host or a certificate. A very common mistake is to change settings and expect the server to follow.

    WooCommerce has its own limit. WooCommerce’s installation docs say each subsite on a network has separate tables and runs as an independent store. Activating WooCommerce for the whole network doesn’t share products, checkout sessions or customer accounts between stores. Some extensions also don’t support network activation, and some paid licences count each subsite as a separate site.

    Where a Multisite network breaks, layer by layer

    Multisite failures usually fall into one of four layers. The order below is how often each comes up in the support threads and host docs we reviewed. It isn’t a measured frequency. Find the layer that matches your symptom before you try any general “multisite fix”.

    SymptomLayerWhere to look first
    Main site works, subsites return 404DNS and server routingWildcard DNS, document root, rewrite rules, Apache AllowOverride
    “The plugin could not be activated because it triggered a fatal error”, blank screen, missing tablesPlugin activationPHP error log, the plugin’s Multisite notes, activating per site
    Login loop, “Cookies are blocked or not supported”, ERR_TOO_MANY_REDIRECTSMapped domains, HTTPS, cookiesSite Address, home and siteurl, SSL for each domain, host redirect settings
    “Error establishing a database connection” after a moveMigrationwp_blogs against DOMAIN_CURRENT_SITE, and how the search-replace was run

    Subsite 404s mean routing, not WordPress

    WordPress’s network debugging guide says a working main site with child sites that return 404s points to routing or rewrite problems. Check that subdomains reach the same document root, that .htaccess holds the rules Network Setup generated, and that the server reads them. If your host won’t let you turn rewrites on, the handbook’s answer is to contact the host.

    Plugin activation fails network-wide but works per site

    WordPress.org support threads show plugins that crash on network activation but run fine when activated site by site. They also show plugins that never create their per-site tables. Read the error log before you retry, and check for an updated version. In one 2026 thread, a guestbook plugin’s network activation fatal error was fixed in the next point release.

    Mapped domains loop when URLs disagree

    A mapped domain has to agree in three places: the Site Address in Network Admin → Sites → Edit, the site’s home and siteurl options, and the server’s redirects and certificate. Host settings can work against you here. Kinsta’s docs warn that its “force all traffic to primary domain” option stops subsites from being reached on a mapped-domain network, and recommend forcing HTTPS on all live domains instead.

    Migrations need a network-aware search-replace

    WordPress stores full URLs in the database, some of them inside serialized data that breaks under a plain text find-and-replace. WP-CLI’s search-replace handles serialized data, but on a network it only touches every site when you tell it to:

    wp search-replace 'https://old.example.com' 'https://new.example.com' --network --dry-run

    Run it once with --dry-run to see what would change, then run it without the flag. Pantheon’s Multisite docs note that WP-CLI can return “Error: Site not found” when the command runs without the right site context. For a full domain move, our guide to changing a WordPress domain safely covers the order of steps.

    What a dashboard for separate installs manages, and where it breaks

    A dashboard is a separate control layer. MainWP’s setup is typical: you install the Dashboard on a dedicated, clean WordPress site and a Child plugin on each site you manage. Other services use a hosted console and a connector plugin. In both cases you get bulk updates, backups, uptime checks and client reports, while every site stays its own install.

    The trouble people report comes from that extra layer:

    • “Up to date” isn’t always true. Users on r/Wordpress report several tools sometimes missing available updates. Check against a site’s own Dashboard → Updates screen now and then.
    • Connections fail for reasons your browser can’t see. MainWP points out that the Dashboard reaches each site over a different path from your browser. A site can load fine for you and still not connect. Use HTTPS, confirm the Child plugin is active, and run Test Connection.
    • Self-hosted dashboards depend on cron. If the dashboard’s scheduled jobs don’t run reliably, updates and checks quietly stop.
    • Bulk actions slow down at scale. Practitioners describe bulk theme updates getting slow at around 100 sites.
    • The console is the most valuable target you own. One Reddit user described a compromised management console that spread to the connected sites. Give the dashboard its strongest password, two-factor login and the fewest admins.

    The habits matter more than the tool you pick. Update one canary site first, then the rest. Take backups, and make sure you have actually restored from a backup at least once. Give juniors and freelancers the narrowest access that lets them do the job. After an update, load each site’s checkout, contact form or booking page, because a green tick in a dashboard doesn’t show what visitors see. If you sell this as a retainer, write down what it covers. Our explainer on what a care plan should include sets out the usual scope.

    What changes when an agent does the site work

    Dashboards are good at the same action across many sites: update this plugin everywhere, back up everything tonight. They don’t do the other half of a portfolio, which is the steady stream of small requests that are different on every site. One client needs new opening hours, another wants a redirect fixed, a third has a contact form that stopped sending. Each one is a few minutes of work wrapped in a login, a hunt for the right screen and a check afterwards.

    SiteSelf takes that second kind of work. You tell the agent what needs doing in chat or from Telegram. It makes the change on the live site, fetches the changed page to check the result, and reports what changed and what it checked. It joins the stack you already run. Your dashboard, backups and uptime monitoring stay where they are. Our page for agencies handling client site requests shows how this fits a portfolio.

    Example request: “On the Harbor Dental site, Saturday hours are now 9 to 1. Update the Contact page and the footer, and tell me if any other page still says closed on Saturdays.”

    • What the agent does: Before it changes anything, it says what it is about to change and whether the change can be undone. Then it edits the Contact page, updates the footer, and searches the site’s content for other mentions of Saturday.
    • What it checks: It fetches the Contact page and a page that shows the footer, then reports what it found, including any other pages that still mention the old hours. What it did is recorded.
    • What access it needs: The SiteSelf Connector plugin from the WordPress.org directory covers content and settings. If the footer text is hard-coded in theme files, the agent needs hosting (SSH) access for that part.
    • What it can’t do: If the Contact page is owned by Elementor, Divi or Beaver Builder, the edit is refused when the agent gets to it, and it tells you why. It doesn’t update the clinic’s listings on outside platforms. Third-party systems are read at most. It doesn’t monitor the site afterwards either. Work happens on request.

    The point is the cost of coordination. Changing one line of opening hours shouldn’t need a ticket, a login hunt and a reminder to check the page afterwards. If you want to know what this costs across a portfolio, see SiteSelf pricing.

    Frequently asked questions

    Is WordPress Multisite free?

    Yes. You turn it on by adding define('WP_ALLOW_MULTISITE', true); to wp-config.php and running Tools → Network Setup. There is no licence. The cost is hosting, and not every host plan allows a network, so check your plan before you start.

    Can each site on a network have its own domain?

    Yes, through domain mapping. Point the domain at the network’s server, set it as the subsite’s Site Address in Network Admin → Sites → Edit, and make sure the site’s URLs and its SSL certificate match. Mismatches cause cookie errors and redirect loops.

    Can I switch from subdirectories to subdomains later?

    Yes, but changing SUBDOMAIN_INSTALL isn’t enough. WordPress’s handbook says site addresses and server configuration have to change too, and subdomains need wildcard DNS. Treat the switch as a migration and take a backup first.

    Can I put my existing separate sites into one network?

    Yes, as a migration. Back up the originals, create the subsites, export and import the content, and only remove the old installs once everything checks out. Watch for real folders that clash with subsite paths, and remember that users become shared across the network.

    Is Multisite slower than separate installs?

    There is no Multisite-specific speed benchmark to point to. A well-cached network can run fast. The real risk is shared resources: one busy subsite can slow down its neighbours on the same server.

    Can I run MainWP on a Multisite network?

    Some features may work, but MainWP says it doesn’t officially support Multisite. Its notes describe update notices that appear once per subsite for a single network-wide update, and deletions that remove a plugin or theme from the whole network. If you do it anyway, check what each action will affect before you run it.

  • Opt in forms on WordPress that actually add subscribers

    Key takeaways

    • Vendor data puts popup conversion at about 2.1% on average (Omnisend, 1.24 billion displays in 2025). Popups shown after 6 to 10 seconds converted at 2.4%, against 1.9% for those shown at 0 to 1 seconds. No single ‘average WordPress opt-in rate’ exists.
    • Google’s Search Central guidance lists newsletter signup as a normal use for dialogs. It recommends a small banner over a dialog that covers the content.
    • The most common reasons a working-looking form loses signups: a required field in the email service that the form lacks, cached pages serving expired security tokens to logged-out visitors, and double opt-in contacts sitting as pending.
    • Test as a logged-out visitor with a fresh address, and read the plugin’s integration log before you rebuild anything or change API keys.
    • On WooCommerce, check whether your opt-in extension supports the Checkout block before you switch back to classic checkout. WooCommerce warns that switching can hide the real problem.

    A visitor types an email address, clicks Subscribe and sees “Thanks.” The address may still never reach your list. The submission, the subscriber record and the confirmation email are three separate things. On WordPress, any one of them can fail while the other two look fine.

    That is why this guide treats an opt-in form as a pipeline, not a widget. It covers which form types and setups exist, what conversion numbers mean, how to ask for consent cleanly, and why forms that look fine still lose people. If you only need a general enquiry form, our guide to adding a contact form in WordPress covers that separately.

    What counts as an opt-in form, and which setup do you need?

    An opt-in form is any form where a visitor agrees to join an email list. It can sit inline in an article, open as a popup or slide-in, run as a bar across the top of the page, or be a checkbox on another form such as contact or checkout.

    WordPress has no single opt-in feature, so the setup depends on what you already use:

    SetupExamplesGood forWatch for
    Your email provider’s embed code or hosted signup pageMailchimp, MailerLite embedsA simple footer or page formStyling clashes; load the script only where the form appears
    A form builder with an email integrationWPForms, Fluent Forms, Gravity Forms, ForminatorSites that already run a form pluginField mapping to the email service
    A dedicated popup or opt-in pluginOptinMonster, Popup Maker, HustleTriggers, targeting, A/B testsFree tiers that lock the feature you need
    An on-site newsletter pluginMailPoet, NoptinKeeping subscribers inside WordPressYou now own email delivery from your server
    A checkout checkboxWooCommerce Subscribe to NewsletterStores capturing buyersBlock vs. classic checkout compatibility

    For one footer signup, a provider embed is often enough. A plugin earns its place when you need triggers, targeting by page, or testing. A slim announcement-style bar is another option, covered in our guide to adding a hello bar to WordPress.

    What conversion rate should you expect?

    Expect a few percent for popups. Then treat any benchmark as a direction to test, not as a target. The large datasets come from vendor platforms, not from WordPress sites, and they measure different things.

    Omnisend analysed 1.24 billion popup displays from 2025 and reported a 2.1% average conversion rate. Popups that appeared after a 6 to 10 second delay converted at 2.4%, against 1.9% for those shown in the first second. Sleeknote’s dataset of more than 516 million views reports 4.42% for timer-triggered popups and 2.64% for scroll-triggered ones. Those two vendors define and sample differently, so don’t average them together.

    The number that matters more is further down the funnel. One marketer on r/marketing described roughly 3% popup signup and 3% lead-to-sale conversion. After removing the popup, overall lead-to-sale conversion stayed about the same. Another described a lead-magnet page converting around 30% that produced zero booked sales calls. Count confirmed subscribers and what they later buy, not raw submissions.

    Should it be a popup or an inline form?

    Use both if you like, but keep the popup out of the way of the content. Google’s Search Central guidance names newsletter signup as a legitimate reason to use a dialog. It also warns that intrusive interstitials, the overlays that hide the page, make content harder to reach and can hurt search performance. It recommends a small banner that leaves the content usable instead of a full-page overlay.

    In practice, that gives four rules:

    • Delay the popup. Don’t fire it the moment the page loads.
    • Use exit intent on desktop and a time or scroll trigger on mobile, a split many practitioners recommend.
    • Cap how often the popup repeats, and make the close button as obvious as the submit button.
    • Put an inline form after the reader has seen something useful, not only in the footer.

    Popups are a real tradeoff, not a settled question. Some teams report measured revenue gains from a modal. Others see shoppers deliberately abandoning carts to wait for the discount email. Run a split test long enough to measure sales, not just signups.

    How do you ask for the address and the consent?

    Ask for an email, with name optional, and say exactly what the person will get. Every extra field is another place to quit. In one r/marketing report, a quiz with 16 or more questions lost 22% of users at the email question. Name the thing (“the Sunday briefing, one email a week”) and make the button say the action (“Send my first briefing”), not “Submit”.

    The consent checkbox has accessibility rules that people often break. W3C’s Web Accessibility Initiative says each control needs a label that is programmatically tied to it, so a screen reader announces what the checkbox means. WCAG 2.2 success criterion 3.3.1 requires that a detected error is identified and described in text, so a red border on its own is not enough:

    <input type="checkbox" id="news-optin" name="news_optin">
    <label for="news-optin">Email me the weekly briefing (optional). Unsubscribe anytime.</label>

    Keep the marketing checkbox unticked and separate from the thing the visitor asked for, such as a quote or an order. On the legal side, the FTC’s CAN-SPAM guidance covers US commercial email and requires a working opt-out and a valid physical postal address. Rules elsewhere, including the EU, are stricter. Have your wording checked for the countries you email.

    Double opt-in sends a confirmation link and holds the contact as pending until someone clicks it. It costs some signups and filters out typos and fake addresses. Some services require it. Decide based on list quality, not on whether it hides a delivery problem.

    How to set one up on WordPress

    1. Set up the list first. In your email service, choose single or double opt-in, and check which fields the list marks as required.
    2. Build the form. Use your provider’s embed, your existing form plugin’s integration, or a popup plugin. Map only the fields the list needs.
    3. Place it. Add it with a block, shortcode or widget area, and set the display rules: which pages, which trigger, how often.
    4. Exclude it from caching and script optimisation if your cache plugin or CDN offers per-page or per-script exclusions.
    5. Test as a stranger. Open a private window, use a new address you control, submit, confirm, and check that the contact shows as subscribed in your email service. Repeat on a phone and using only the keyboard.

    A correct result: the confirmation email arrives in the inbox, not spam. The contact moves from pending to subscribed. The first real email has a working unsubscribe link.

    Why a form that says “thanks” still loses subscribers

    Most failures come from configuration, caching or email delivery, not from a broken plugin. The message visitors see, such as “An error occurred, please try later”, rarely names the cause. The plugin’s integration log usually does. MC4WP, for example, keeps its log under MC4WP, then Other. Here are the causes in rough order of how often they turn up in support threads.

    A required field the form doesn’t send

    If the email service marks a field as required and the form doesn’t include it, the service rejects every submission. Hookedoncode described an email-only form failing because Mailchimp required First Name. Making that field optional in Mailchimp fixed it after two hours of searching and three minutes of work. Duplicating the broken form copies the same problem, so fix the original.

    Cached pages and deferred scripts

    The form works while you’re logged in and fails for the public. Page caching can serve an expired WordPress security token, called a nonce, to logged-out visitors. Script optimisers can defer or combine the JavaScript that submits the form. MailPoet’s changelog records 2026 fixes for signup forms failing when cached nonces expire. Gravity Forms has a whole FAQ page on cache and script optimiser problems. Turn optimisation off once to confirm the cause. Then exclude only the form page and the form’s scripts, not the whole site.

    A pending contact that looks like a failure

    With double opt-in, the popup can record a conversion while the email service holds the contact as pending. A support reply on the OptinMonster forum explains exactly this with Mailchimp. Check the contact’s status before you assume the form is broken.

    The confirmation email never arrives

    In one MC4WP thread, the log said success but confirmations were landing in spam. The owner traced it to a Mailchimp sending domain that hadn’t been verified. If your site sends the email itself through an on-site plugin, WordPress mail needs authenticated SMTP or an email API. Some hosts restrict ports: WP Engine blocks port 25 and recommends port 2525, with 587 and 465 also allowed. Fix delivery rather than switching off double opt-in.

    Styling that makes a working field look broken

    A wordpress.org thread about a “broken” Mailchimp footer form turned out to be white text on a white background. A few lines in Appearance, then Customize, then Additional CSS fixed it. Before you blame the connection, type into the field and highlight it.

    A missing checkout checkbox on WooCommerce

    Extensions that hook into classic checkout may not appear in the Checkout block. WooCommerce documents that its Subscribe to Newsletter extension supports both classic and block checkout. Its troubleshooting docs warn that switching checkout type can hide a compatibility problem instead of fixing it. Check the extension’s compatibility first, and switch only as a deliberate workaround.

    Conflicts and firewall rules

    If none of the above explains it, isolate the problem. The Health Check plugin’s troubleshooting mode turns off plugins and switches the theme for your admin session only, so visitors see the normal site. Security plugins and server firewalls such as Wordfence or ModSecurity can also block a form’s POST request. Test with protection briefly off, then allowlist the specific request and turn protection back on. Check the plugin’s changelog for your installed version too. Sometimes the bug is real and already fixed.

    Stop and get help when the log shows API errors you can’t read, when the problem only shows up on the live server, or when the fix means editing theme code. If you’d rather not chase it yourself, SiteSelf can handle fixing a broken WordPress form on request. Cache and code fixes need hosting access, and your email platform’s settings stay yours to change.

    Frequently asked questions

    Do I need a plugin for an opt-in form?

    Not always. For a single footer or page form, your email provider’s embed code or a link to its hosted signup page is often enough. A plugin helps when you want triggers, page targeting or A/B testing. Either way, test it logged out.

    Should subscribers live in WordPress or in an email service?

    On-site newsletter plugins keep the list in your database and send from your server, so delivery becomes your job. External services handle sending reputation and authentication for you. Many practitioners prefer the external route for deliverability. Plugins like MailPoet exist for people who want to avoid a separate subscription.

    Why doesn’t my popup appear when I test it?

    Usually because the plugin has set a dismissal cookie, or because it already recognises you as a subscriber. Display rules can also exclude the page you’re on. Test in a fresh private window before you look for a deeper fault.

    How do I stop fake signups?

    Double opt-in keeps unconfirmed addresses off your active list, and you can delete them periodically. Add a CAPTCHA or an invisible token check if bots get through. Server-side validation catches what browser checks miss.

    Can I reuse a test address after deleting it from Mailchimp?

    Not reliably. A deleted contact may be blocked from being added again straight away, which looks like a form failure. Use a fresh address for each test.