Blog

  • How to edit your homepage in WordPress

    Key takeaways

    • Settings > Reading names your homepage, but a block theme’s Front Page template, or front-page.php in a classic theme, overrides that setting.
    • The fastest way to reach the right document is to open the live homepage while logged in and click Edit (or Edit with Elementor) in the admin bar.
    • Clear each cache layer once: browser, cache plugin, host and CDN. If a full purge changes nothing, cache was not the problem, so go back and check which document you edited.
    • The WooCommerce Shop page, stale Google results and a homepage sent back to Drafts by a theme switch all look like failed edits. None of them is.
    • Stop and get help when the fix needs a template file, a host limit changed, or deleting pages you have not yet confirmed are duplicates.

    You change the headline, click Update and reload the site, and the old headline is still there. On WordPress this rarely means the save failed. Usually you edited something other than what WordPress serves at the root of your domain.

    “Edit the homepage” can mean three different jobs. You might be choosing which page WordPress shows at the root, editing that page’s content, or changing the template that lays it out. Each job happens on a different screen. Our guide to editing pages in WordPress covers the page editor in general. This article covers the homepage, which is where most of the traps are.

    Find out what produces your homepage before you edit

    You need three answers first, and they take about two minutes to get:

    1. Settings > Reading. “Your homepage displays” is set to either Your latest posts or A static page. If it says static, write down which page is selected as the Homepage.
    2. The Appearance menu. If it has an Editor item, your theme is a block theme. If it shows Customize and no Editor, your theme is a classic theme.
    3. The live homepage, viewed while logged in. If the admin bar shows Edit with Elementor or another builder’s button, a page builder owns the layout.
    WordPress Settings Reading screen for choosing a static homepage
    Selecting a static page under Reading Settings designates the specific page WordPress loads as your site homepage. · Source: learn.wordpress.org

    Those answers tell you where to make the edit:

    Your setupWhere to edit
    Static page, block editorPages > All Pages, then the page named in Reading
    Block theme with a Front Page templateAppearance > Editor > Templates > Front Page
    Latest posts, block themeAppearance > Editor, the Home or Index template
    Classic themeAppearance > Customize for the theme’s homepage options. If the theme has a front-page.php file, the layout lives in that file.
    Page builderThe builder, opened from the live homepage

    One habit prevents most problems. Open the live homepage and click Edit in the admin bar. You get the document WordPress is actually serving, not a duplicate with the same title.

    How to choose which page is your homepage

    WordPress.org’s guide to creating a static front page gives the steps:

    1. Publish the page you want to use. The Homepage dropdown only lists published pages, and our guide to adding pages in WordPress explains why drafts and private pages are left out.
    2. Go to Settings > Reading and select A static page.
    3. Choose your page in the Homepage dropdown.
    4. If you run a blog, you can also choose a Posts page. WordPress will not let the Posts page be the same page as the Homepage.
    5. Click Save Changes.

    Calling a page “Home” does not make it the homepage. Only this setting does. After you save, WordPress marks the page “Front Page” in your Pages list, which makes it easy to find next time.

    Why the page you picked may not be what visitors see

    A template can override the Reading setting. WordPress.org’s additional guide to the Site Editor says that in a block theme, a Front Page template takes precedence over the Reading setting. Classic themes have the same rule. The template hierarchy uses front-page.php for the front page whatever Reading says. The name home.php is misleading: it is the posts index, not the homepage.

    Here is what that means in practice. Suppose Reading names your page, you edit it, you publish, and nothing changes. Open Appearance > Editor > Templates and look for a Front Page template. A template only shows a page’s own content if it contains a Post Content block. Without that block, your page edits have nowhere to appear. You have two options: add a Post Content block to the template so page edits show up, or edit the template itself.

    How to edit a static homepage in the block editor

    1. Go to Pages > All Pages and find the entry marked Front Page.
    2. Click Edit. Change the text, images and buttons directly in the blocks. If a block is nested inside groups or columns, open List View to select it.
    3. Click Save (called Update in older versions) and wait for it to finish before you leave the screen.
    4. Open the homepage in a private window. The private window skips your logged-in view and your browser cache.

    Colors and fonts that appear across the site belong in the Styles panel, not in each block’s settings. If you style blocks one by one, the next homepage change means redoing that work.

    How to edit the homepage in a block theme’s Site Editor

    If your site shows latest posts, or the theme ships a Front Page template, the homepage is a template, and it may not appear in your Pages list at all. WordPress’s own contributors acknowledge this. Gutenberg issue #56244 is about making the Home page easier to find in the editor.

    1. Go to Appearance > Editor > Templates.
    2. Open Front Page. If there is none, open Home, the template for the posts page. If neither exists, open Index, the fallback. Some themes use slightly different names.
    3. Edit the blocks and click Save.
    WordPress Site Editor templates list with the Front Page homepage template
    In the Site Editor templates list, the Front Page template takes priority for dictating the structure of your homepage. · Source: www.gravityforms.com

    Pay attention to what you are editing. A change to the Front Page template only affects the root URL. The header and footer are template parts shared by every page, so editing them inside the homepage template changes them across the whole site. If a template edit goes wrong, the Site Editor keeps revisions and lets you reset a customized template to the theme’s default.

    How to edit a classic theme homepage

    Classic themes send you to Appearance > Customize. The Homepage Settings panel there mirrors the Reading setting. Many themes add their own panels for homepage sections, such as the hero, featured boxes and widget areas. If the theme has a front-page.php file, some of the layout is written in PHP and no setting will change it. That is a job for a child theme, and our guide to editing themes without losing work explains why you should never edit the parent theme’s files.

    How to edit a homepage built with Elementor or another builder

    Open the live homepage and click Edit with Elementor in the admin bar, then click Update when you are done. Starting from the live page matters. On one WordPress.org support thread, an Astra starter-template import had created two Home pages and two Elementor Default Kits. The owner kept editing the copy that was not live, and caching turned out not to be the cause. If you think you have duplicates, check which page Settings > Reading names before you delete anything.

    Do not open a builder page in the block editor and rewrite it there, because that can break the builder’s layout data. Elementor’s History panel, at the bottom left of the editor, lists recent revisions if you need to step back.

    You may see “Sorry, the content area was not found in your page. You must call the_content function in the current template.” Elementor’s help page on that error gives two causes. Either the template has no content area, or you are trying to edit a dynamic page such as an archive or a shop page. Use Theme Builder for dynamic pages. A template that is missing the_content needs a developer or a different theme.

    Why your homepage changes are not showing

    Check these in order. The cheap, common causes come first:

    1. You edited the wrong document. Click Edit from the live page and compare. Confirm the status is Published, not Draft, Pending or Scheduled. Also confirm you are on the live domain and not a staging copy or a translated version.
    2. A template controls the layout. See the Front Page and Post Content section above.
    3. A cache is serving an old copy. There can be several layers: your browser, a cache plugin, your host’s cache and a CDN. Elementor sites have one more, the CSS files Elementor generates, which its changes-not-appearing guide tells you to clear at Elementor > Tools > Clear Files & Data. Purge each layer once. If a full purge changes nothing, the cache was not the problem, so stop purging and go back to step 1.
    4. The editor will not load or save. Plugin conflicts, PHP memory limits and host firewalls cause this. Take a backup first (see what a backup plugin covers), then isolate the cause using our guide to fixing plugins that are not working.
    5. It only looks wrong on mobile. Builders store separate settings for mobile. Check at phone width before you decide the desktop edit failed.
    Elementor Tools screen with Clear Files and Data for homepage changes not showing
    Clearing files and data in the Elementor Tools panel forces WordPress to purge and regenerate the builder’s internal CSS cache. · Source: elementor.com

    Three problems that look like homepage edits but are not

    The WooCommerce Shop page. WooCommerce assigns its Shop page separately from your homepage. According to WooCommerce’s Product Catalog documentation, the layout of that page comes from the Product Catalog template in the Site Editor. Content you type into the Shop page may not appear.

    Google still shows the old version. Search results are not your website. Google Search Central’s page on asking Google to recrawl says recrawling can take days to weeks. You can request it once with URL Inspection in Search Console. Requesting it repeatedly does not make it faster.

    The homepage vanished after a theme switch. WordPress.com’s homepage troubleshooting guide notes that the old homepage can end up in Pages > Drafts. The same check works on any WordPress site: republish the page, then select it again in Settings > Reading.

    When to stop and get help

    Stop when the fix means editing front-page.php or adding the_content to a template. Stop when the error points to a host limit such as memory or a firewall rule, because only your host can change those. And stop before you delete pages or re-import a starter template to fix duplicates you have not identified yet. Doing that before you know which copy is live usually makes the damage worse.

    Whoever helps you will want the same things: the URL, what Settings > Reading says, the theme, the builder, and the exact error text. If you would rather hand the change over, SiteSelf can make homepage and page edits through chat on request and tell you what it changed and checked, though it refuses pages owned by Elementor, Divi or Beaver Builder when the work starts.

    Frequently asked questions

    Can I edit my homepage by typing directly on the live site?

    No. WordPress edits happen in the dashboard: the page editor, the Site Editor or your builder. The Edit link in the admin bar on the live page takes you to the right one.

    Why can’t I find my homepage in Pages?

    On a block theme that shows latest posts, or one with a Front Page template, the homepage is a template rather than a page. Look under Appearance > Editor > Templates.

    How do I put my blog on its own page?

    In Settings > Reading, choose A static page, pick your homepage, and pick a different page as the Posts page. Leave that Posts page empty, because WordPress replaces its content with your post list.

    How do I change the homepage title that shows in search results?

    SEO plugins set it in different places depending on your Reading setting. For a static homepage it is usually set on the page itself. For a latest-posts homepage it is in the plugin’s site-wide settings. Either way, Google shows the new title only after it recrawls the page.

    Only my homepage breaks in Elementor. What else can I try?

    People report success with a simple workaround: create a new page, copy the content across, and select the new page as the homepage in Reading. This is anecdotal. Afterwards, rename or delete the old copy so you do not create the duplicate-page problem.

    Will editing the Front Page template change my other pages?

    The template itself only applies to the root URL. The header and footer inside it are shared template parts, so editing those changes every page on the site.

  • How to use case studies for research on WordPress

    Key takeaways

    • A usable case study names the date and versions, the exact symptom, the root cause, the fix, how the fix gets misapplied and how the result was checked. If several of these are missing, you are reading an anecdote.
    • The Stripe Gateway 9.4.1 update fixed one incident in April 2025. It was never general advice for missing payment methods, and clearing the payment-method cache does nothing about API rate limiting.
    • Duplicator’s analysis of 8,000+ support tickets is the rare source with a denominator: host PHP limits in close to 1 in 5 migration tickets, wp-admin lockouts in nearly 1 in 10. It covers only migrations that produced a ticket.
    • Test a borrowed fix in a way visitors can’t see, such as Health Check’s Troubleshooting Mode. Then check the business journey (a test order, a submitted form), not just whether the homepage loads.
    • Hold your own case studies to the same standard: starting constraints, what failed, what fixed it, and how you checked.

    WooCommerce released Stripe Payment Gateway 9.4.0 on April 16, 2025. Within days, some stores found payment methods missing at checkout. The fix was version 9.4.1, and a lot of threads and agency write-ups from that week say so, correctly. Read one of them today, apply it to a store whose payment methods have vanished, and you have borrowed the right fix for somebody else’s problem.

    That is the hard part of using case studies for research. Most WordPress knowledge travels this way: a support thread, an agency’s incident page, a host’s write-up, a vendor’s report. Each one describes a single site at a single moment. Read well, a case study is the fastest route to a cause. Read carelessly, it sends you down the wrong path while the checkout stays broken. Our guide to fixing plugins that stop working covers the general diagnosis. This article covers how to judge the stories you find along the way, and how to write your own so someone else can use them.

    What separates a usable case study from an anecdote

    A usable case study lets you check whether its situation matches yours. For that it needs six things, and most published WordPress case studies leave out at least half of them.

    ElementWhy you need it
    Date and versionsWordPress, PHP and plugin versions change what a fix does. An undated fix can’t be scoped.
    The symptom, exactly“Critical error on every page” and “checkout hangs” point to different causes. You need the error text.
    The named root cause“A plugin conflict” is a category. “Broken Link Checker retrying a failed schema update” is a cause.
    The exact fixWhich setting, file or version, and in what order.
    How the fix goes wrongA fix applied to the wrong cause often looks like it worked, or hides the real problem.
    How success was checked“The site loads” and “a test order went through” are different results.

    WordPress.org’s own documentation shows what this looks like. The Recovery Mode article says when the feature triggers (a fatal error during a regular page load, not during cron or background tasks), what to do (deactivate the faulty plugin or theme) and where it stops working. Deactivating is typically a temporary fix, and the recovery email may never arrive if the server can’t send mail. That is a cause, a fix and a warning on one page.

    Provider case studies usually give you the story and leave out the specifics. You get “a plugin update broke checkout” with no plugin name, no host and no error text. Such a case can show you a sensible process. It can’t tell you whether its fix applies to your site.

    Why a case study’s symptom is not your diagnosis

    The same symptom can come from very different causes, and the cause in someone else’s story is only one of them. Migrations show this clearly, because the post-move symptoms look far worse than what usually causes them.

    Duplicator, which makes a migration and backup plugin, published an analysis of more than 8,000 support tickets. Migration and restore problems were the largest technical category. The patterns in it cut against the usual reading of the symptoms:

    • A frozen progress bar is usually the destination host’s PHP execution time or memory limit stopping extraction. That accounted for close to 1 in 5 migration tickets. Running the same migration again hits the same limit. Raise max_execution_time and memory_limit, or ask the host to.
    • Locked out of wp-admin after the move (nearly 1 in 10) often doesn’t mean the migration failed. Check the WordPress Address and Site Address, and clear your cookies. You can set both values in wp-config.php temporarily if the dashboard won’t load.
    • “Error establishing a database connection” after a move is more likely wrong DB_NAME, DB_USER, DB_PASSWORD or DB_HOST values in wp-config.php than a damaged database.
    • A 500 error after a move is more often a stale .htaccess file than corruption. Saving Settings, then Permalinks, regenerates the rewrite rules.

    If a case study jumps from a symptom straight to a dramatic cause, such as corruption, malware or a failed migration, look for the ordinary explanation first. Our guide to the WordPress white screen works through the same order for fatal errors.

    WordPress error establishing a database connection screen after a migration
    The default WordPress connection error screen points directly to mismatched login credentials inside the wp-config.php file rather than database corruption. · Source: wedevs.com

    Why an old fix is not current advice

    A case study records one moment, and plugins, hosts and WordPress keep changing after it. The Stripe incident is the clearest example. WooCommerce’s developer advisory explains that 9.4.0 added a sync between plugin and Stripe dashboard settings that made more calls to Stripe’s Payment Configuration API than expected. Some stores were rate-limited, which caused slow admin dashboards and payment methods that disappeared for a while. Updating to 9.4.1 was the fix for that incident. It was never general advice about which version to run.

    WooCommerce’s general page on Stripe methods missing at checkout lists other causes: the payment-method cache, outdated checkout templates, SSL and HTTPS problems, and plugin conflicts. It also points you to the Stripe logs. It notes that clearing the cache doesn’t fix rate limiting. So the two most common forum fixes, “update” and “clear the cache”, each fix one cause and do nothing for the others.

    Before you apply a fix from a case study, compare its date and version numbers with your site. If the case is about a specific release, check that release’s changelog to confirm the problem, and the fix, belong to that version.

    Why one case can’t tell you how common a problem is

    A single case study tells you that something can happen. It can’t tell you how often. Frequency needs a denominator, meaning the total number of cases the share refers to, and almost no WordPress case study has one.

    The Duplicator report is the exception, and it comes with limits. The publisher sells a migration tool. The data covers only migrations that led to a support ticket, so a quick fix that nobody reported isn’t counted. The shares overlap and don’t add up to a total. Use it to decide what to check first during a migration. Don’t use it to rank WordPress problems in general.

    Practitioner incident pages work the opposite way. They are thin on frequency but sometimes strong on mechanism. One maintenance provider, Gaurish, describes a site that went down when MySQL’s per-user connection limit ran out. It traces the cause to Broken Link Checker repeatedly retrying a schema update that kept failing, and says the site was back in 1 hour 30 minutes. It names the plugin and gives the time taken, which is more than most such pages do. What you can take from it: a plugin you barely use can take a site down from the database side. It tells you nothing about how likely that is on your site.

    How to test a borrowed fix without breaking the live site

    Treat a fix from a case study as a guess to test, not as an answer. This order keeps the risk low:

    1. Match the symptom exactly. Same error text, same page, logged in or logged out, front end or admin. If it doesn’t match, the case doesn’t apply.
    2. Check the date and versions. Compare the case’s WordPress, PHP and plugin versions with yours on Tools, then Site Health, then Info.
    3. Confirm the cause on your own site. Look for it in the PHP error log, the plugin’s own log (WooCommerce, then Status, then Logs for payment gateways) and the changelog of anything updated recently.
    4. Test where visitors can’t see. The Health Check plugin’s Troubleshooting Mode, described in the WordPress.org support handbook, turns off plugins and switches the theme for your logged-in session only, so visitors keep the normal site while you test. Deactivating plugins across the whole site disrupts every visitor.
    5. Check the business journey. Place a test order, submit the contact form, log in as a customer. A homepage that loads can still sit on a checkout that fails.
    Health Check Troubleshooting Mode active in the WordPress admin
    The Troubleshooting Mode dropdown in the WordPress admin bar lets you isolate plugins and themes strictly for your own administrative session. · Source: make.wordpress.org

    Caching deserves a separate check, because case studies often assume their host’s defaults. Kinsta’s technical FAQ says it excludes cart, account and checkout pages from caching by default and skips the cache when certain WooCommerce cart cookies are present. Your host may use different rules. If personal pages are being cached, clearing the cache hides the problem until the next visitor. You fix it by adding the exclusion.

    If you’d rather not work through this list yourself, SiteSelf’s WordPress bug fixes start from the symptom you describe in chat, and the agent reports what it changed and what it checked.

    How to read an agency’s or vendor’s case study

    A sales case study is evidence that the provider has solved a problem like yours before. It is not proof they will solve yours. Read it with a few questions in mind:

    • Is it your problem? A case that matches your kind of site and your constraints is worth reading closely. A generic success story isn’t.
    • What did they actually do? Look for their role and their process, not just before-and-after numbers. Screenshots with no explanation tell you little.
    • How was the result measured? Sessions and clicks are easy to report. Ask how the work changed sales, enquiries or hours saved.
    • Who published it, and what is missing? Hosts, plugin makers and agencies publish case studies to win customers. Their data can still be useful, like Duplicator’s tickets, but a survey with no respondent count, or a success story with no plugin, host or price, is a claim to ask about, not a fact to rely on.

    Use the case study to start the conversation. Ask the agency to walk you through one engagement, including what went wrong.

    How to write a case study someone else can use

    Write your own with the same rigour you want from others, because that is also what makes it persuasive. A prospect or a colleague trusts a case study that admits what failed.

    1. Starting point. The site, the stack (theme, key plugins, host type), the versions, the date and the constraint: no staging, a live sale, a locked-down host.
    2. Symptom. What people saw, including the exact error text.
    3. What you ruled out. The approaches that didn’t work and why. This is the part most write-ups drop, and it is the part a reader learns the most from.
    4. Cause and fix. Named plainly, with the setting, file or version involved.
    5. Check. How you confirmed it worked, especially the business journey.
    6. Limits. What you couldn’t verify, and what would make the fix wrong for a different site.

    For marketing, a few deep write-ups aimed at the clients you want usually beat a long portfolio of thin ones. Give every other project a short summary in the same format so readers can skim. Clients are more likely to take part if you offer a short interview and a draft they can approve than if you ask them to write or record something.

    Publishing case studies on a WordPress site

    Most sites give case studies their own post type, so they get their own archive, URL and categories. The usual setup registers the post type with a rewrite slug:

    add_action( 'init', function () {
        register_post_type( 'case_study', array(
            'label'        => 'Case studies',
            'public'       => true,
            'has_archive'  => true,
            'show_in_rest' => true,
            'rewrite'      => array( 'slug' => 'case-studies' ),
            'supports'     => array( 'title', 'editor', 'thumbnail', 'excerpt' ),
        ) );
    } );

    After adding it or changing the slug, save Settings, then Permalinks, so WordPress rebuilds its rewrite rules. A WordPress.org support thread from a nonprofit moving its “Case Studies” post type to Twenty Twenty-Four went through exactly this. If the archive returns a 404 afterwards, the rewrite rules or the registration are wrong, not the content. It’s the same Permalinks save that fixes the post-migration 500 error above.

    WordPress Settings Permalinks screen used to regenerate rewrite rules for a case studies post type
    Clicking the Save Changes button on the Permalink Settings screen flushes and regenerates WordPress rewrite rules to instantly resolve 404 errors on custom post types. · Source: kinsta.com

    Frequently asked questions

    Is this the same as a case study in academic research?

    The core idea is the same: study one case in depth, in its real setting, using more than one kind of evidence. This article is about the practical version that WordPress site owners, agencies and developers run into every day. If you are designing a formal study, follow your field’s methods guidance for sampling and analysis.

    Can I apply a fix from a forum thread directly to my site?

    Only once you’ve confirmed your symptom, versions and cause match the thread. Try it in Troubleshooting Mode or on a staging copy first, and take a backup before changing files or the database. Afterwards, check the journey that matters, such as checkout or a form submission.

    Why do so many agency case studies leave out plugin names and hosts?

    Usually client confidentiality, sometimes to avoid naming a vendor, and sometimes because the write-up is meant to impress rather than inform. Whatever the reason, you can’t check whether its fix applies to you. Ask the agency for those details in a call.

    Which WordPress problems are most common?

    There is no reliable ranking across all WordPress problems. The best narrow data is Duplicator’s migration ticket analysis, where host PHP limits and post-move login problems lead. Treat any wider “most common problems” list as opinion unless it states what its percentages are out of.

    Should I include failed approaches in a public case study?

    Yes, briefly. They show the reader you diagnosed the problem instead of guessing, and they save the next person time. Leave out anything that would expose a client’s security details.

  • What a website backup plugin does and where it fails

    Key takeaways

    • WordPress’s Advanced Administration Handbook says a full backup needs both files and the database, kept as multiple copies in different places. The built-in content export is not a backup.
    • In Duplicator’s analysis of more than 1,400 of its own support tickets, about 1 in 4 backup tickets came down to a host or server limit stopping the build. The host environment breaks backups more often than plugin bugs do.
    • A manual Backup Now run doesn’t show that the schedule works, and a restore that reports ‘completed’ doesn’t show you got a working site. Only a test restore to staging or a local copy shows either.
    • WooCommerce warns that restoring an older backup to a live store can lose orders, customer accounts, payment tokens and subscriptions created after it, and can run processed renewals again.
    • A backup plugin has deep access to your site, so its updates are part of plugin maintenance like any other plugin’s.

    Most site owners find out whether their backups work on the worst possible day. An update white-screens the site, or the host account disappears, or a restore finishes and the site comes back empty. Only then do they check what the plugin had actually been saving, and where.

    A website backup plugin copies your WordPress files and database on a schedule and sends the copy somewhere else. The copying is the easy part, and nearly every plugin in the WordPress.org directory does it. What sets a working setup apart is whether the backup is complete, stored off the server, still running months later, and restorable when the dashboard is gone. If you’re here because an update is coming up, our guide on updating a WordPress theme safely shows where the backup fits in that process.

    What does a complete WordPress backup actually include?

    It includes two things: the database and the files. WordPress’s Advanced Administration Handbook says a full backup needs both. The database holds your posts, pages, settings, users and, on a store, the orders. The files are your themes, plugins, uploads and the WordPress core install. A backup of only one half won’t rebuild the site. One WordPress.org support reply points out that a copy of the uploads folder alone won’t restore anything.

    Two misunderstandings come up again and again. First, Tools → Export in WordPress is a content export, not a backup. It skips your settings, theme, plugins and most plugin data. Second, “full backup” in a plugin’s settings may still leave things out. Many plugins create their own database tables, and WooCommerce is the obvious example. In one WordPress.org support thread, a restore reported success and the site came back with default content. The backup had skipped the tables that weren’t part of core WordPress.

    The handbook also gives an order: back up the database first, then the files. When you restore, put the files back first, then the database.

    Website backup plugin settings in WordPress admin showing files and database options
    Selecting both database and file backup options ensures that website media, code, and dynamic database tables are fully preserved. · Source: www.veerotech.net

    Why does it matter where the backup is stored?

    A backup kept on the same server as the site is lost along with the site. If the disk fails, the host suspends the account or an attacker gets in, the site and its only backup go together. The WordPress handbook recommends several copies in different places and on different media. Practitioners put it more bluntly: a backup on the same server isn’t a backup.

    People who assume otherwise usually learn it from an account problem, not a technical one. One Reddit thread describes a client who lost their site and irreplaceable images after the host deleted the account over a missed payment. The host kept backups, but they sat inside the same account. The practical setup is simple. Keep your host’s backups, and add at least one copy in storage you control, such as Google Drive, Dropbox or an S3 bucket in your own name. Keep weeks of copies, not one night’s, so you can go back past a problem that stayed hidden for a while.

    Why do WordPress backups fail?

    Usually because of the hosting environment, not a bug in the plugin. Duplicator analysed more than 1,400 of its own support tickets. About 1 in 4 backup tickets were a host or server limit stopping the archive build partway through. Compression failures on constrained hosts, sites too large for the host, PHP timeouts, file permissions and memory exhaustion made up most of the rest. These are one vendor’s tickets, not a failure rate for all sites, but the pattern matches what the support forums show.

    Where it brokeWhat you seeWhat usually fixes it
    Building the archive504 Gateway Timeout, “Maximum execution time exceeded”, “Allowed memory size … exhausted”Split the archive into smaller parts in the plugin’s settings, exclude cache folders, or ask the host to raise PHP limits
    Writing it to disk“permission denied”, “failed to open”, a disabled Backup Now buttonDelete old local backups, set a retention limit, and have the host correct the folder permissions
    Running on scheduleThe last backup is weeks old and nothing reported an errorReplace WP-Cron with a real server cron and turn on failure alerts
    Uploading off-siteLocal copies exist but the remote folder is empty or staleRe-authorise the storage connection and check the storage isn’t full

    Memory errors trip people up because of one setting. You can raise WP_MEMORY_LIMIT in wp-config.php, but UpdraftPlus’s restoration documentation says that only helps up to the limit the server allows. Past that, only the host can change it. Our white screen troubleshooting guide covers the same limit from the other side.

    The schedule that quietly stopped

    This failure is the hardest to spot because nothing looks wrong. WordPress’s built-in scheduler, WP-Cron, runs only when someone loads a page. On a low-traffic site, behind password protection, in maintenance mode or on a host that blocks the site from sending requests to itself, scheduled jobs just don’t run. A manual Backup Now works fine, because your click started it, not the scheduler. So a successful manual run tells you nothing about the schedule.

    The fix is to stop depending on visitors. Disable WP-Cron’s page-load trigger and have the server call it on a timer:

    // wp-config.php
    define( 'DISABLE_WP_CRON', true );
    
    # server crontab, every 15 minutes
    */15 * * * * wget -q -O - https://example.com/wp-cron.php?doing_wp_cron >/dev/null 2>&1

    Your host’s control panel usually has a cron screen if you don’t have shell access. Turn on the plugin’s failure notifications too. One small-business thread made a fair point: owners miss emails, so send the alert somewhere they’ll actually see it.

    Remote storage causes the same kind of quiet failure. Duplicator puts about 4 in 10 of its storage-connection tickets down to cloud authorisation or connection breaks. Google Drive, Dropbox and OneDrive connections run on tokens that expire or get revoked. When that happens, the backups keep running and pile up on the server’s disk. In Duplicator’s data, old local backups filling the disk caused about 1 in 7 scheduled-backup failures.

    Remote storage options in a WordPress website backup plugin
    Connecting automated backups to cloud providers like Google Drive or Dropbox relies on authorization tokens that can expire without warning. · Source: www.sktthemes.org

    Why doesn’t “restore completed” mean the site is back?

    The message only means the plugin ran its steps. It doesn’t mean the result is a working site. You find that out by restoring a copy somewhere safe before you need to. The WordPress handbook recommends periodic manual backups to check that the automated ones are working. The test that settles it is restoring the backup to a staging site or a local environment like LocalWP and clicking around. One Reddit practitioner puts a local test restore at about 20 minutes. A test on a small local machine won’t catch every problem a large production site would hit, but it catches missing tables, corrupt archives and missing files.

    UpdraftPlus’s restoration documentation maps the common restore errors to fixes, and most of it applies to any plugin:

    • PCLZIP_ERR_BAD_FORMAT (-10): the archive is damaged. Download it again and test-unzip it on your computer. When you delete the bad local copy, leave “also delete from remote storage” unticked, or you lose the good copy too.
    • Memory exhausted: raise WP_MEMORY_LIMIT up to the server’s ceiling, then ask the host.
    • Disk quota exceeded: free up space. A good backup still needs room on the server to unpack.
    • “Could not move the files into place”: a permissions problem on the server, and the documentation sends you to the host.

    If the site was hacked, restoring a backup that already contains the malware brings the problem back. Restore to a clone first and check it. Our guide to malware removal that holds covers what to check.

    Stores need a different restore plan

    On WooCommerce, restoring an older backup over the live site also removes everything that happened since that backup was taken. WooCommerce’s Subscriptions documentation warns that it can lose orders, customer accounts, payment tokens and subscriptions created after the backup, and can run renewals again that were already processed. Restore to staging, find what you need, and bring it across selectively. Back up more often too. A daily backup still means a day of orders at risk.

    Can you restore when you can’t reach wp-admin?

    Only if you set that up in advance. Most backup plugins live inside WordPress, so a white screen or a hacked admin can lock you out of the restore button along with everything else. Before you need it, find out whether your setup can restore from outside the dashboard. That could be a standalone installer you upload over FTP, your host’s own restore tool, or a service with its own interface. Write the steps down where someone other than you can find them.

    How should you choose a backup plugin?

    Choose by how you will need to recover, not by feature count. Ask these questions of any plugin, and ask them about the edition you’ll actually pay for:

    • Does it back up the full database, including plugin tables, and every file you need?
    • Can it send copies to storage you own, on a schedule, and alert you when a run fails?
    • Can you restore without wp-admin?
    • Is restoring a large backup part of the free version? One WordPress.org support user found they needed a $69 extension to restore theirs.
    • Does it handle what you run: Multisite, a busy store, a site too big for your host’s limits?

    Popularity is a weak signal. WordPress.org shows install counts in rounded tiers. All-in-One WP Migration and Backup shows 5+ million, and UpdraftPlus’s badge shows 4+ million while its own description still says “more than 3 million.” WordPress.org’s backup tag also lists migration, staging and site-management tools, so it isn’t a ranking of backup plugins.

    Why does the backup plugin need updating too?

    A backup plugin can read your whole database, write to your files and unpack archives on your server. That makes it one of the most privileged plugins on the site. Its updates fix both reliability problems and security holes. UpdraftPlus’s 1.26.8 release, for example, fixed backups failing on PHP-FPM servers and on WebDAV storage. Updating it belongs in your regular update cycle, not only when something breaks. After an update, run a backup and read the log.

    The link works in both directions. WooCommerce’s update guide tells store owners to back up before updating and to test updates on staging. The backup exists so updates are safe, and the plugin that makes it needs updates of its own. If you’d rather not run that cycle yourself, SiteSelf handles plugin updates on request through chat.

    What if a backup file is publicly reachable?

    Remove it or put it behind a password. An archive in a public web folder contains your whole database, including user emails and password hashes. Google Search Central says noindex doesn’t control access and robots.txt isn’t a security measure. Once the file is secured, you can ask Google to remove it from search results.

    WordPress backup plugin log showing backup and restore status
    A detailed activity log reveals the precise file operations and uncleaned archives that a simple finished status can easily conceal. · Source: wordpress.org

    Frequently asked questions

    Does WordPress have built-in backups?

    No. WordPress core has no full-site backup. The Export tool saves content as an XML file, and the WordPress handbook is clear that a real backup needs the files and the database. Most hosts offer backups, but how often they run, how long they’re kept and whether you can restore them yourself all vary.

    Do I need a plugin if my host already backs up the site?

    You need at least one copy that doesn’t depend on the host account. Host backups are fine as one layer, but if the account is suspended or deleted, they usually go with it. A plugin sending copies to storage you own gives you that second copy.

    How often should I back up?

    As often as you can afford to lose data. A brochure site that changes monthly is fine with daily or weekly backups. A store taking orders all day needs backups every few hours or continuously. The answer comes from how fast the site changes, not from a standard.

    How do I know my backup plugin is working?

    Check three things: the log shows recent scheduled runs, not just manual ones; the files are actually in the remote folder; and a test restore to staging or a local copy produces a working site. Turn on failure notifications so a stopped schedule doesn’t stay hidden.

    Can a backup plugin slow down my site?

    It can on weak hosting, because building an archive takes CPU, memory and disk. Practitioners schedule heavy backups overnight, exclude cache folders and back up less often if jobs overlap. Plugins that back up only what changed put less load on the server per run.

    Who is responsible for backups on a client site?

    Whoever the contract says, and vague contracts cause disputes. “Install a backup plugin” doesn’t cover how often, how long copies are kept, where they’re stored, who watches for failures or who does the restore. Write all of that down, including whose storage account holds the copies.

  • How to update a WordPress theme without losing work

    Key takeaways

    • WordPress’s Updates screen warns that changes made to theme files are lost on update. Edits in the parent theme disappear without any error, so move them into a child theme, a small custom plugin or Additional CSS first.
    • A child theme protects you, but it can still break. After a major ColorMag release changed class names, users running child themes lost CSS and menus, and the developer told them to rewrite their custom code.
    • Since WordPress 6.3, a manual theme update that fails partway restores the previous version on its own. That does nothing for an update that installs cleanly and then breaks your layout, so you still need a backup.
    • On WooCommerce stores, open WooCommerce > Status > System Status after the update and look under Templates. Outdated template overrides can break shipping or checkout even when the theme update itself succeeded.
    • Match the exact error message to its cause before you retry. “Could not create directory” means a permissions or disk problem, and “Download failed. Unauthorized.” means a license problem.

    The update button is the easy part. WordPress’s own Updates screen warns that any changes made to theme files will be lost, and that warning covers most of the damage people see afterward: a header gone, a mobile menu that stops opening, a custom template back to the theme author’s version. The site still loads, so nobody notices until a customer does.

    This guide covers the dashboard update, the manual route, premium themes, what to check afterward, and how to read the error when an update fails.

    Answer three questions before you click update

    A theme update is low risk when nobody has edited the theme and the site is simple. It carries more risk when the theme has been customized, when it is a premium theme with a license, or when the site is a store. Three questions tell you which case you are in.

    Where do your customizations live? If someone edited style.css, functions.php or a template file inside the parent theme, including through Appearance > Theme File Editor, the update overwrites those edits without warning you. Before you update, move them into a child theme (for PHP and templates), a small site-specific plugin (for code snippets) or Appearance > Customize > Additional CSS (for styling). Setting up a child theme does not move existing edits into it. You have to find each edit, copy it across and test it. Our guide to theme customization that survives updates covers where each kind of change belongs.

    Where does this theme get its updates? Free themes from the WordPress.org directory update through the dashboard. Themes bought on the WooCommerce Marketplace update through the WooCommerce.com Update Manager. Other premium themes update through their vendor’s license, which is usually tied to one domain.

    Can you get back? Take a backup of the database and the whole wp-content folder. WooCommerce’s update guide gives the same scope for a manual store backup. Then confirm you can actually restore it. A backup you have never restored is a guess.

    For a store or a heavily customized site, run the update on a staging copy first. If your host offers one-click staging, use that. Otherwise a staging plugin will do the job.

    How to update a theme from the dashboard

    You need an administrator login. No hosting access is needed unless WordPress asks for FTP credentials, which is covered in the errors table below.

    1. Go to Appearance > Themes. A theme with an update available shows a notice on its card. Click the card, then View details to read the changelog. Look for a major version jump, a new minimum PHP version or a new required plugin.
    2. Take and confirm your backup.
    3. Click Update now on the theme card. The other route is Dashboard > Updates: tick the theme under Themes, then click Update Themes.
    4. Wait until the screen confirms the update is done. Closing the tab while it runs is how sites end up stuck in maintenance mode.
    5. Clear every cache layer: your caching plugin, the host’s server cache, and any CDN. Then open the site in a private browser window.

    You do not need to deactivate a child theme to update its parent. Leave the child theme active and update the parent.

    WordPress Themes screen showing a theme update available notice
    An update banner appears directly across the theme card, alerting you to new versions before you perform the update. · Source: www.hostinger.com

    Theme updates and plugin updates share most of their mechanics: the same Updates screen, the same maintenance file, the same permission failures and rollback tools. If you would rather not run this cycle yourself, SiteSelf handles WordPress plugin and theme updates on request through chat, and anything that touches theme files needs hosting access.

    Premium themes follow the vendor’s channel

    A premium theme that shows no update usually has a license or connection problem. The theme itself is rarely at fault. For WooCommerce Marketplace themes, WooCommerce’s troubleshooting page lists the usual causes: an expired subscription, the wrong or disconnected WooCommerce.com account, a key assigned to another site, a missing Update Manager, a blocked REST API (load yourdomain.com/wp-json/ and you should see JSON), Plain permalinks, WP-Cron not running, a firewall or security plugin, or restrictive file permissions.

    Other vendors bind the license to a domain. After a migration, or on a staging copy, updates can fail with “Download failed. Unauthorized.” until you register the license again for the current URL.

    Updating manually with a ZIP

    The manual route is fine when the dashboard update is not offered, for example with a premium theme you downloaded from the vendor. Go to Appearance > Themes > Add New > Upload Theme and upload the ZIP. When WordPress recognizes the theme is already installed, choose Replace current with uploaded.

    Three mistakes cause most manual failures. The first is uploading the vendor’s full package (theme plus documentation) instead of the installable theme ZIP, which returns “No valid themes found” or a missing style.css error. The second is extracting the ZIP first. The third is deleting the old theme before you upload, which WooCommerce’s theme update guide warns loses your customizations.

    Uploading the theme folder over FTP into /wp-content/themes/ also works. Treat it as a workaround: if the dashboard update failed, the reason it failed is still there.

    What a correct result looks like

    A finished update shows the new version number on the theme’s card under Appearance > Themes. On the site itself, check the pages that earn money or leads, not just the homepage:

    • Header, footer and menus, including the mobile menu at phone width.
    • One post, one page, an archive and the 404 page.
    • Every form, with a real test submission.
    • Your browser console and the PHP error log, for new warnings.

    Stores need more. WooCommerce’s update guide lists product pages, cart, checkout, payments, shipping, taxes and emails. Then open WooCommerce > Status > System Status and scroll to Templates. If your theme overrides WooCommerce templates and those copies are now outdated, they are flagged there. Update the override to match the current template, or remove or rename it so WooCommerce falls back to its default.

    WooCommerce System Status Templates section flagging outdated theme overrides after a theme update
    The WooCommerce System Status report highlights overridden template files in red when their bundled versions lag behind the core release. · Source: forum.bricksbuilder.io

    Some breakage stays invisible. In one project’s GitHub issue, an Avada site came through an update with “nothing visibly broken,” yet its pages grew to about 1.46 MB of raw HTML, up from about 0.3 MB. A quick page-weight or speed check after the update catches this kind of regression.

    Should you turn on theme auto-updates?

    WordPress lets you enable auto-updates per theme from Appearance > Themes. That makes sense for an unedited theme on a simple site with working backups. It makes less sense for a store, a site with template overrides or a page builder, or any site where a broken checkout costs revenue before anyone notices.

    Professionals are split. In MelaPress’s 2025 survey of 264 professionals, 32% of web designers and 33% of web developers used automatic updates. Agencies commonly stage risky updates (page builders, WooCommerce, major versions), batch the low-risk ones and keep a 24 to 48 hour rollback window. Waiting forever carries its own risk: a site several major versions behind is much harder to bring up to date than one that has been updated regularly.

    What to do when the update fails

    Read the exact message before you retry anything. Each message points to a different cause.

    What you seeLikely causeFix
    “Could not create directory”, or WordPress asks for FTP detailsFile ownership or permissions on wp-content/themes and wp-content/upgrade, or a full diskAsk your host to correct ownership and check disk space. Don’t open permissions across the whole site.
    “There has been a critical error on this website.”A PHP, plugin or page-builder conflict with the new versionUse the recovery-mode email link, read wp-content/debug.log, test on a default theme, then deactivate plugins one at a time.
    No error, but custom layout or features are goneEdits in the parent theme were overwrittenRestore the old theme files from backup, move the edits into a child theme, then update again.
    “Download failed. Unauthorized.”License expired or registered to another domainRenew, or register the license again for this URL.
    “Briefly unavailable for scheduled maintenance. Please check back in a minute.”An interrupted update left a .maintenance file behindDelete .maintenance from the WordPress root (not the theme folder), then run the update again.
    “Destination folder already exists” or “No valid themes found”Wrong ZIP, or the upload collided with the existing folderUpload the installable ZIP and choose Replace current with uploaded.
    Site looks unchanged, or oddly styledCachePurge the plugin, server and CDN caches, then check in a private window.

    Deleting .maintenance brings the site back but does not finish the update. Confirm the version number afterward. For a white screen or critical error, our guide to fixing a WordPress white screen walks through the isolation steps.

    Stop and get help when the error log names the theme and you cannot tell what changed, when a restore fails, or when checkout is affected on a live store. Stacking more changes on top of a failure you don’t understand makes the cause harder to find.

    WordPress stuck in maintenance mode after a failed theme update
    Encountering this maintenance message typically indicates that an interrupted update failed to automatically delete the temporary maintenance file from the site root. · Source: kinsta.com

    How to roll back a theme update

    Since WordPress 6.3, if a manual theme update fails partway through, WordPress restores the previous version, which it keeps temporarily in wp-content/upgrade-temp-backup/themes/. That covers a broken install. It does nothing when the update installs cleanly and the new version is the problem.

    For that case you have two options. WP Rollback reverts any theme from the WordPress.org directory to an earlier version. It does not cover premium themes. For everything else, restore the backup you took before updating. Once the site is back, reproduce the problem on staging and fix the cause before you try the update again.

    Frequently asked questions

    Will updating my theme delete my posts and pages?

    No. Posts, pages and media are stored in the database and uploads folder, not in the theme. The update puts code edits inside the theme’s folder at risk, and it can change how the site looks. Customizer settings are stored separately from theme files.

    Do I need to update my child theme when the parent updates?

    Not if it only holds small CSS or function tweaks. If it contains copied template files, or code that depends on the parent’s class names, compare those files against the new parent after a major release. The ColorMag threads on wordpress.org show child-theme sites breaking after a major update that changed classes.

    Why did I lose customizations even though a child theme was active?

    The edits were never moved into the child theme. Creating and activating a child theme does not copy anything across from the parent. Restore the old parent files from backup, find the edits, and move them over by hand.

    Should I update core, plugins or the theme first?

    People disagree, and there is no official order. What matters more is updating risky items one at a time (the theme’s major releases, page builders, WooCommerce), so a failure points to one cause. Batch the low-risk updates.

    How do I stage a store update without losing new orders?

    Don’t push the staging database back to live, because orders keep arriving on production while you test. Test the update set on staging, then apply the same updates on production and run your checkout checks there.

  • How to do SEO on WordPress, step by step

    Key takeaways

    • Start with Settings > Reading and your server’s response headers. One leftover noindex from staging can hide the whole site, and some hosts add an X-Robots-Tag header that the WordPress checkbox never removes.
    • Run one SEO plugin and one sitemap. Two plugins writing titles, Open Graph tags or schema is one of the most common sources of duplicate output.
    • Choose Post name permalinks on a new site. On an established site, change URLs only when you have 301 redirects ready, or old links start returning 404s.
    • Check what the site actually serves (page source, headers, /robots.txt, the sitemap), not what the plugin says it saved.
    • In Search Console, “Excluded by noindex tag” is a setting you can fix. “Crawled – currently not indexed” usually points to the content, not the configuration.

    A WordPress.org forum poster once described 39 indexed pages, every one green in Yoast, a submitted sitemap and search engines allowed, and still nothing showed up in search. That thread sums up the whole topic. The settings were correct, and correct settings only get your site considered. Being considered and being found are separate problems.

    Doing SEO on WordPress means three jobs. Get a handful of technical foundations right. Confirm they took effect on the live site. Then do the ongoing work of publishing useful pages and linking them together. The first two take an afternoon. The third never ends, and it is where the results come from.

    What WordPress handles, and what stays your job

    Out of the box, WordPress core gives you a search visibility setting, a permalink setting and an automatic XML sitemap at /wp-sitemap.xml. An SEO plugin such as Yoast SEO, Rank Math or All in One SEO adds control over per-page titles, meta descriptions, canonical URLs and structured data. No plugin has been shown to rank a site better than another, so pick on workflow and price.

    What no plugin does is decide whether two pages compete for the same search, whether a page answers the question better than the pages already ranking, or whether anyone can reach it through your menus. Those decisions stay with you. If you are adding pages as you go, the basics of publishing pages Google can find apply to every one of them.

    What you need before you start

    • Administrator access to wp-admin. Every setting below lives under Settings or in the SEO plugin’s menu.
    • A verified Google Search Console property for the live domain. It is the only place Google tells you how it sees your pages.
    • A backup before you change permalinks, switch plugins or edit theme files.
    • Optional: a terminal or your host’s file manager for the header checks and any theme fixes.

    The setup, in the order that matters

    1. Make sure the live site can be indexed at all

    Go to Settings > Reading and find “Discourage search engines from indexing this site.” When it is ticked, WordPress adds a noindex, nofollow robots meta tag to every page. Visitors still see the site normally, which is why the setting survives unnoticed after launch. Untick it and save.

    WordPress Settings Reading screen with the search engine visibility checkbox for SEO
    Leaving the Search engine visibility checkbox unchecked in WordPress Reading settings ensures search bots are not blocked from indexing published pages. · Source: wordpress.org

    Then check two things the checkbox does not control. First, some hosts noindex staging sites with an X-Robots-Tag HTTP header as well as the WordPress setting. Kinsta’s documentation describes exactly this for its staging environments. If staging configuration was copied to production, the header can remain after you untick the box. Second, look at individual pages. Your SEO plugin can set noindex per page, per post type or for whole archives.

    Do not use robots.txt to keep pages out of Google. Google’s noindex documentation is explicit: Google has to crawl a page to see its noindex tag. If robots.txt blocks the URL, Google never reads the tag, and the page can still appear in results.

    2. Set permalinks once and redirect if you ever change them

    On a new site, go to Settings > Permalinks and choose Post name, so URLs read /pricing/ rather than /?p=123. WooCommerce stores have a separate “Product permalinks” section on the same screen. WooCommerce’s documentation recommends short structures with relevant words, and warns that a custom product base can conflict with a taxonomy base.

    On an established site, “switch to Post name” is not automatic advice. Changing the structure changes every existing URL, and old links from Google, email and social posts start returning 404s. If you must change it, map each old URL to its new one with a 301 redirect first. Google treats redirects as a strong signal of which URL you prefer.

    3. Install one SEO plugin and use one sitemap

    Pick one plugin and deactivate any other plugin that writes titles, meta descriptions, Open Graph tags or schema. Two plugins doing the same job produce duplicate tags. Yoast’s own help pages warn about Open Graph conflicts for exactly this reason.

    Most SEO plugins replace the core sitemap with their own. That is fine, as long as only one exists. In Yoast, the switch is under Yoast SEO > Settings > Site features > XML sitemaps, and content types you set to stay out of search are left out of the sitemap automatically. Yoast also advises deleting any physical sitemap.xml file left in the site root by an old plugin, because it can shadow the real one.

    A sitemap helps Google discover URLs. Google’s sitemap documentation says it does not guarantee crawling or indexing. A page that appears only in the sitemap, with no links from your menus or other pages, is still close to invisible.

    4. Write a real title and description for each important page

    Use the plugin’s fields under the editor, or set templates for whole post types. Each title should say what the page is, specifically: “Emergency plumbing in Leeds, same-day callouts” beats “Home | Services | Company Name.” Avoid template text repeated across dozens of pages.

    Set expectations accordingly. Google can rewrite title links, and its snippet documentation says the result text comes mainly from page content and only sometimes from the meta description. Write the description anyway, because it is the version you control, but do not spend hours on it.

    5. Pick one version of every URL

    The same page can exist at http and https, with and without www, with and without a trailing slash, and with tracking parameters. Choose the preferred form, redirect the others to it, and keep internal links and sitemap entries consistent with it. Your SEO plugin outputs a self-referencing canonical tag on each page by default. Leave that alone unless you have a reason.

    Manual canonicals are where this goes wrong. In one WordPress.org support thread, a Yoast post sitemap showed “This XML Sitemap contains 0 URLs.” Cache purges, a Cloudflare purge, disabling plugins and switching themes did nothing. The cause was hand-entered canonical URLs without trailing slashes on a site that used them. Removing them fixed it.

    6. Validate structured data, and expect eligibility only

    Your SEO plugin, WooCommerce or your theme outputs schema for articles, products and breadcrumbs. Run key pages through Google’s Rich Results Test, then URL Inspection in Search Console. Valid markup makes a page eligible for richer results. It does not guarantee them and it is not a ranking boost.

    Theme code causes duplicates as often as plugins do. In a GeneratePress forum case, breadcrumbs loaded twice and Search Console reported “Missing field ‘item’ (in ‘itemListElement’).” The cause was a child theme’s header.php calling wp_head() twice, so every plugin’s head output appeared twice.

    7. Measure speed with field data before you change anything

    Google’s Core Web Vitals thresholds for a good experience are Largest Contentful Paint within 2.5 seconds, Interaction to Next Paint under 200 milliseconds and Cumulative Layout Shift under 0.1. Google uses them in its ranking systems, and its page experience documentation also says good scores do not guarantee top rankings.

    WordPress sites are improving here. HTTP Archive’s 2024 Web Almanac found that the share of WordPress mobile sites passing all three metrics rose from 28% in 2023 to 40% in 2024. Check your own field data in Search Console’s Core Web Vitals report, find the failing template, and fix the specific cause: usually an oversized hero image, a heavy builder section or unneeded scripts. Adding a third optimization plugin on top of two others makes debugging harder and rarely helps.

    8. Connect Search Console and submit the sitemap

    Submitting the sitemap in Search Console is optional, and it is worth doing because you then get a report of what Google fetched. Use URL Inspection on your homepage and two or three key pages. It shows whether Google can crawl the page, which canonical Google chose, and whether a noindex was found.

    Google Search Console URL Inspection result for a WordPress page
    The URL Inspection tool in Google Search Console confirms whether a specific page is crawled and successfully indexed in search results. · Source: developers.google.com

    How to confirm the settings actually reached the live site

    A plugin’s “Settings saved” message tells you what is in the database. It does not tell you what the site serves. Caching, host rules, security plugins and theme code all sit between the two. Check the output directly, logged out, after clearing your cache:

    # Any robots header added by the server or host
    curl -sI https://example.com/ | grep -i x-robots-tag
    
    # The robots meta tag and canonical in the served HTML
    curl -s https://example.com/ | grep -iE 'name="robots"|rel="canonical"'
    
    # What robots.txt really says
    curl -s https://example.com/robots.txt

    No terminal? Open the page, choose View Page Source, and search for robots and canonical. Then open /robots.txt and your sitemap URL in a private window.

    A correct result: no noindex anywhere on pages you want found, one canonical tag per page pointing at the URL you chose, one title tag, one set of Open Graph tags, a robots.txt that does not disallow those pages, and a sitemap that lists real URLs in the same format as your canonicals. Repeat this after every plugin update, theme change or migration. Updates occasionally change defaults, and nothing on screen tells you when they do.

    WordPress page source showing robots meta tag and canonical link for SEO checks
    Inspecting the rendered page source reveals the exact canonical link and robots directives delivered to search engines. · Source: rankmath.com

    What to do if Google still is not showing your pages

    Read the exact status in Search Console’s Pages report, because each one points somewhere different.

    • “Excluded by ‘noindex’ tag.” A technical block. Find where the noindex comes from: the Reading setting, a page-level plugin setting, an archive default or a host header. Remove it, then request indexing.
    • Sitemap “Couldn’t fetch.” Open the sitemap yourself. Common causes are Plain permalinks (one forum poster fixed a sitemap 404 by switching to Post name), two sitemap sources, a stale physical file, or a security rule blocking Googlebot.
    • “Crawled – currently not indexed.” Usually not a setting. Google fetched the page and decided it was not worth indexing yet. Resubmitting the sitemap will not change that. Make the page more distinct and more useful, and link to it from pages Google already values.

    If a plugin misbehaves in a way you cannot explain, test for conflicts one plugin at a time on a staging copy. The steps for isolating a plugin that is not working apply here too.

    The part that moves rankings: pages worth finding

    Google’s guidance on helpful content says its systems favour reliable, people-first content, written from first-hand knowledge. In practice that means one page per real question, answered better than the pages already ranking, with headings a reader can scan.

    Practitioners on X and Reddit repeat one method so often it is worth trying, though nobody has controlled data for it. In Search Console’s Performance report, filter for queries where you sit around positions 4 to 20 and sort by impressions. Those pages are already close. Answer the query more fully, fix a weak title, and add internal links from related pages. That usually beats writing another near-duplicate post.

    Three smaller habits help. Write alt text that describes informative images, and use alt="" for decorative ones, as the W3C images tutorial recommends, rather than stuffing keywords. Keep tags and categories purposeful, because a tag per post creates hundreds of thin archive pages. And do not noindex every archive by default either, because older posts can lose their only crawl path.

    Give it time. Forum replies to owners with correct setups say competitive searches can take months. The r/marketing commenters in the research put it at three to six months before anything shows. Measure impressions and clicks in Search Console, not the plugin’s score.

    When to stop and get help

    Get a developer or your host involved when a noindex or X-Robots-Tag header persists after you have removed every setting you can find, when duplicate tags come from theme files, when a migration or domain change needs a redirect map, or when a security plugin or firewall is returning 403 errors to the SEO plugin. Those are code, server and hosting problems, not settings. If what you want off your plate is the routine part (titles, descriptions, redirects, plugin settings), SiteSelf handles WordPress SEO changes from chat: it works through its connector plugin for settings and content and needs hosting access for header or theme fixes, then fetches the changed page and reports what it found.

    Frequently asked questions

    Can I do SEO on WordPress without a plugin?

    Partly. The visibility setting, permalinks and the core sitemap at /wp-sitemap.xml are free and built in. Per-page titles, meta descriptions and canonical control normally come from a plugin, and the free versions of the major ones cover those basics.

    Which SEO plugin is best?

    No evidence shows one plugin ranks sites better than another. Choose on interface, the features you actually use and licensing cost across your sites. Whichever you pick, run only one.

    Does a green plugin score mean I will rank?

    No. The score checks things like keyword placement and length on one page. It knows nothing about competing pages, links or whether your content answers the search better than what already ranks.

    Do I need to submit my sitemap to Google?

    No, Google can find it through robots.txt and links. Submitting it in Search Console is still worth doing, because you get a report on whether Google could fetch it and how many URLs it read.

    Should I change my permalinks to Post name on an old site?

    Only if the current structure causes a real problem, and only with 301 redirects from every old URL. Otherwise you trade a cosmetic improvement for broken links and lost signals.

    How is WooCommerce SEO different?

    Product permalinks have their own settings, product schema comes from WooCommerce or your SEO plugin and needs validating, and near-identical product descriptions compete with each other. Filling in every metadata field is not enough on its own. Distinct product pages and guides that link to them do more.

  • How to check the WordPress version your site runs

    Key takeaways

    • WP-CLI has two similar commands. wp core version reports the WordPress release, and wp cli version reports the version of WP-CLI itself. If you get ‘This does not seem to be a WordPress install’, you’re in the wrong folder.
    • WooCommerce’s Status report, host dashboards and Site Health show several version numbers side by side. Read the row labelled WordPress, not the WooCommerce, PHP or database number.
    • In SmartWP’s September 2026 scan of 1,203 WordPress sites, 38.2% showed their version in neither the generator tag nor the RSS feed.
    • When a scanner, your host and WordPress show different versions, confirm the real one with Site Health or WP-CLI before you change anything. Sometimes a plugin conflict is making the version look wrong.
    • On September 22, 2026, WordPress.org’s release archive listed 7.1.2 as the latest release and said only the newest release in the 7.1 series is maintained.

    Most people look up their WordPress version for one of a few reasons. A security release has come out, a plugin says it needs a newer WordPress, a scanner report has flagged the site, or someone has inherited a site and nobody knows what’s on it. Checking takes seconds when you can log in. The trouble starts when you can’t log in, or when two tools give you two different numbers.

    This guide goes through each method, from the official screen to the command line, and explains which results you can trust. The WordPress version is only one number. Before an update you’ll usually want the plugin versions too, and our guide to listing plugins with wp plugin list covers those.

    Where the dashboard shows your WordPress version

    Site Health is the most reliable screen. WordPress.org’s documentation says its Info tab lists the version your site is currently using. Site Health was added in WordPress 5.2, so any site you’re likely to run today has it.

    1. Log in to wp-admin as an administrator.
    2. Go to Tools → Site Health and click the Info tab.
    3. Expand the WordPress section and read the Version line.

    The same tab has a Server section, which shows your PHP version. Keep the two separate: the PHP version is the one people most often report by mistake. WordPress.org’s Site Health screen documentation lists every section on the Info tab.

    WordPress Site Health Info tab showing the WordPress version
    Navigating to Tools and Site Health reveals the Info tab, where the top WordPress drawer houses your installation details. · Source: make.wordpress.org

    Three other screens show the version too:

    • At a Glance on the Dashboard home screen. This widget can be hidden under Screen Options, so if you don’t see it, it may just be switched off.
    • Dashboard → Updates, which also tells you whether a newer release is available.
    • The admin footer, bottom right, on most admin screens.

    If one of these is missing, try another. Plugins and custom admin themes sometimes hide the footer or remove widgets. That doesn’t mean something is wrong.

    How to check without logging in to WordPress

    If it’s your own site, you don’t need wp-admin. You need access to the files or to the server. Three methods work.

    Read wp-includes/version.php

    WordPress keeps its version in a file. Open your hosting file manager or connect over SFTP, find the folder that holds wp-config.php, wp-admin and wp-includes, and open wp-includes/version.php. Look for this line:

    $wp_version = '7.1.2';

    Only read the file. Don’t edit it or save it. The usual mistake here is opening the wrong installation. Hosting accounts often hold a staging copy, an old copy in a folder like /old/, or several sites next to each other. Check the folder path against the domain before you trust the number. Staging copies often drift from production, so don’t assume they match.

    Run wp core version over SSH

    If you have SSH access and WP-CLI, one command gives you the answer:

    cd /var/www/example.com/public
    wp core version

    Or point the command at the site from anywhere on the server:

    wp core version --path=/var/www/example.com/public

    The WordPress Developer Blog points out that wp core version is not the same command as wp cli version. The second one reports the version of WP-CLI itself, and people mix them up all the time. If you see Error: This does not seem to be a WordPress install. Pass --path=`path/to/wordpress` or run `wp core download`., you’re in the wrong directory. Move into the site folder or pass --path.

    According to the wp core version command reference, the command runs before WordPress loads. That means a plugin with a fatal error usually won’t stop it from answering.

    Look in your host’s dashboard

    Many hosts show the WordPress version in their control panel, often on a site overview or updates screen. Make sure you’re signed in to the right account and looking at the right site or environment. Treat the number as a convenience, not proof. WordPress.com says it may run one version behind while it tests a new release. WP Engine’s support docs tell you to refresh the portal’s Updates section if the version shown might be out of date. If the host’s number doesn’t match Site Health or WP-CLI, go with Site Health or WP-CLI.

    WooCommerce stores: the Status report

    If you run a store, WooCommerce → Status shows the WordPress version under WordPress environment. WooCommerce’s guide to updating PHP and WordPress mentions Site Health as another option. The same report also shows the WooCommerce version and the PHP version, so read the WordPress row. This report is also what support forums usually ask for, so it’s worth knowing where it is.

    WooCommerce Status report showing the WordPress version under WordPress environment
    The WordPress environment panel in the system status report clearly separates the core WordPress version from your WooCommerce build. · Source: woocommerce.com

    Which number is actually the WordPress version

    A WordPress site has at least five version numbers, and a status report may show all of them together:

    NumberWhat it isWhere you see it
    WordPress coreThe release you’re running, such as 7.1.2Site Health → Info → WordPress, version.php
    PHPThe server language versionSite Health → Info → Server
    WooCommerceThe store plugin’s own releasePlugins screen, WooCommerce → Status
    Database revisionAn internal schema number, not a releaseversion.php, WP-CLI
    ?ver= on CSS and JS filesA cache-busting string, often a theme or plugin versionPage source

    If a plugin’s requirements, a PHP upgrade or a support ticket depends on the core version, take it from the WordPress row and nowhere else.

    Can you tell another site’s version from outside?

    Sometimes. From outside you only have clues, and they’re often missing. There are two to try, in this order:

    1. Page source. View the source of the homepage and search for generator. An unmodified site outputs <meta name="generator" content="WordPress 7.1.2" />.
    2. The RSS feed. Open /feed/ and look for <generator>https://wordpress.org/?v=7.1.2</generator>.

    Many sites hide both. In September 2026, SmartWP scanned 1,203 WordPress sites. It found 40.7% showed the version in the generator tag, 21.1% showed it only in the RSS feed, and 38.2% showed it in neither place (SmartWP’s version study). SmartWP also offers a version-checking tool, so treat the study as a useful snapshot, not a census. Still, the lesson holds: check the feed after the page source, because many sites that hide the tag still expose the feed.

    Two other clues often come up, and both are weak. readme.html no longer shows the version number in current WordPress, and many sites block it with a 403 or remove it entirely. ?ver= strings on stylesheets often belong to a theme or plugin, not to WordPress.

    If nothing turns up, you’ve learned nothing. Security plugins and some themes remove these clues on purpose. A hidden version doesn’t mean the site isn’t WordPress, and it doesn’t point to any particular version. If you need the real number, you need access to the site.

    What to do when your checks disagree

    Almost nobody gets stuck on how to check. People get stuck when the answers don’t match. A scanner reports an old version on a site you updated last week. The host panel shows one release and Site Health shows another. Or a plugin complains that WordPress is too old when you know it isn’t.

    First, confirm the version with a method that reads the installation itself: Site Health, version.php or wp core version. Then look into why the other tool disagrees. A scanner may be reading a cached page, a CDN copy or a stale clue. A host panel may need a refresh. Don’t swap files around or re-run updates because a scanner told you to.

    Sometimes the version is right and something else is wrong. In one resolved WordPress.org support thread, a store owner saw plugin requirements in red, as if WordPress were out of date, and core updates weren’t showing up. The WooCommerce Status report confirmed WordPress was current. The real cause was a conflict with another plugin, found by isolating plugins one at a time. That process is explained in our guide to fixing plugins that are not working.

    If the check itself fails, the problem is bigger. A missing or broken version.php, or a site that returns a 500 error after an update, points to a failed core update. Restore from a backup, or reinstall the same version from a fresh download. Our guide to the WordPress white screen covers recovering a site that won’t load.

    What to do once you have the number

    Compare it with WordPress.org’s release archive. As of September 22, 2026, the archive listed 7.1.2, a security release, as the latest. It also said only the most recent release in the 7.1 series is safe to use and actively maintained. Don’t rely on a version number printed in an article, including this one. Check the archive on the day you check your site.

    If you’re behind, updating is a separate job. WordPress.org’s Updating WordPress guide covers it. In short:

    • Take a backup you know you can restore, and try the update on staging if the site matters.
    • Update from Dashboard → Updates.
    • If WordPress asks for FTP details, the server’s file ownership isn’t set up for direct updates. Use the correct credentials or ask your host to fix the ownership. Don’t loosen permissions across the whole site.
    • If a “briefly unavailable for scheduled maintenance” notice won’t go away after a failed update, delete the .maintenance file in the site root. That clears the notice but doesn’t finish the update.
    • If you update by hand, never delete the existing wp-content folder. It holds your themes, plugins and uploads.
    • Check the version again afterwards. Don’t assume an auto-update ran just because it’s switched on.

    Agencies and freelancers taking on a client site usually record the core, PHP, plugin and theme versions at intake, with the date. That way the next mismatch has a baseline to compare against.

    If you’d rather hand over the check and the updates that follow, SiteSelf handles WordPress core and plugin updates on request through chat. It tells you what’s about to change before it starts, records what it did, and reports what it checked afterwards.

    WordPress Dashboard Updates screen showing the installed WordPress version
    The WordPress Updates screen confirms whether your site is running the latest core release and displays your current version number. · Source: wordpress.org

    Frequently asked questions

    Do I need a plugin to see my WordPress version?

    No. Site Health is built into every WordPress release since 5.2, and the admin footer and At a Glance widget need no setup either. Version-display plugins exist, but installing one just to read a number adds code you then have to keep updated.

    Should I hide my WordPress version from the public?

    Many security guides recommend removing the generator tag and the version in the feed, and plenty of security plugins do this. The tradeoff is that some client scanners and audits expect to read the version publicly. Stripping ?ver= from every stylesheet can also break cache-busting, so visitors keep seeing old CSS after an update.

    Why does my scanner show an older version than WordPress does?

    External scanners read public clues, which can come from a cached page, a CDN copy or a stale file. Confirm the version with Site Health or wp core version. If those show the current release, the scanner is wrong, and you can send it the confirmed number along with how you checked.

    Is the version in the dashboard the same on every site in a Multisite network?

    Yes. A Multisite network runs one copy of WordPress core, so every site in it is on the same version. Check it once from the network admin or with WP-CLI in the installation folder.

    My WordPress version is current but a plugin says it is too old. What now?

    Clear any caching first, then check whether another plugin is interfering with update or version data. Deactivating plugins one at a time on staging usually finds the one causing it. Reinstalling WordPress rarely helps, because core was never the problem.

  • How to customize a 404 page in WordPress

    Key takeaways

    • If your Appearance menu shows Editor, you have a block theme. Edit Templates > 404 there. If it shows Customize, you have a classic theme, and 404.php belongs in a child theme.
    • Publishing a normal Page called “404” does not make it the error page. A plugin such as Smart Custom 404 Error Page, or a template, has to point WordPress at it.
    • Google treats a “not found” message sent with a 200 status as a soft 404. Test with a URL that doesn’t exist and check that the response code is 404.
    • When a custom 404 doesn’t show up, first resave Settings > Permalinks. Then look for a saved Site Editor template, an unpublished builder template, or a stale cache.
    • Redirect a missing URL only when a relevant replacement exists. Sending every 404 to the homepage risks soft 404s.

    Most WordPress themes ship a 404 page that says something like “Oops! That page can’t be found.” and not much else. Replacing it takes minutes once you know which part of your site controls it. Most failed attempts go wrong because they edit the wrong part.

    “Customize 404 page” covers two jobs. One is design: what a visitor sees when a URL doesn’t exist. The other is status: what the server tells browsers and Google. This guide covers both, because a polished 404 page that sends the wrong status code is worse than the stock one.

    Which method fits your site?

    First, work out what kind of theme you run. Open Appearance in the dashboard. If you see Editor, you have a block theme. If you see Customize, Widgets or Menus, you have a classic theme. When a tutorial’s menu path doesn’t match your dashboard, it was usually written for the other kind of theme.

    Your setupWhere the 404 livesCode needed
    Block themeAppearance > Editor > Templates > 404No
    Classic theme404.php in a child themeSome PHP
    Elementor ProTemplates > Theme Builder > Error 404No
    Any setupA plugin that assigns an ordinary PageNo

    One approach doesn’t work at all: publishing a normal Page titled “404”. WordPress gives it a URL like /404/ and does nothing else with it. It only becomes the error page if a plugin or a template tells WordPress to use it. If you’re not sure which template files your theme actually uses, our guide to editing themes without losing work shows how to find out.

    How to edit the 404 template in a block theme

    Block themes keep the 404 page as a template you edit with blocks. You don’t need a plugin or any code.

    1. Go to Appearance > Editor > Templates.
    2. Open the 404 template. Recent versions list it as “Page: 404”. If your theme doesn’t include one, use Add New Template and pick the 404 option.
    3. Replace the heading and message. Add a Search block and links to your homepage and your main sections. Keep the header and footer template parts so visitors can tell they’re still on your site.
    4. Save, then open a URL that doesn’t exist on your site to see the result.
    WordPress Site Editor showing the 404 template open for editing
    The WordPress Site Editor opens the 404 template directly on canvas, allowing you to customize error messages and layout blocks in real time. · Source: themeisle.com

    One detail catches developers out. Once you save a template in the Site Editor, WordPress uses that saved version instead of the theme’s file. According to the Theme Handbook, a saved template takes priority, so editing the theme’s 404.html afterwards changes nothing on screen. To go back to the file, reset the template from the Templates list. Learn WordPress has a short lesson on personalizing your 404 template if you want a walkthrough.

    How to customize 404.php in a classic theme

    Classic themes use a PHP file. WordPress’s template hierarchy looks for 404.php and falls back to index.php if it doesn’t exist. Don’t edit the parent theme’s copy, because the next theme update overwrites it. Put your version in a child theme. Our guide to theme customization that survives updates covers setting one up.

    1. Create or activate a child theme.
    2. Copy the parent’s 404.php into the child theme folder, or create a new one. You need SFTP or your host’s file manager.
    3. Edit the content between the header and footer calls.
    4. Upload the file and test with a nonexistent URL.

    A minimal version looks like this:

    <?php get_header(); ?>
    <main id="primary" class="site-main">
      <h1>Page not found</h1>
      <p>This page has moved or never existed. Search the site or start from one of these pages.</p>
      <?php get_search_form(); ?>
      <ul>
        <li><a href="<?php echo esc_url( home_url( '/' ) ); ?>">Home page</a></li>
        <li><a href="<?php echo esc_url( home_url( '/services/' ) ); ?>">Our services</a></li>
      </ul>
    </main>
    <?php get_footer(); ?>

    Some themes keep the visible text somewhere else. In one wordpress.org support thread, the Hestia theme’s 404.php only called a theme action, and the site owner couldn’t find where “Oops!” was coming from. If your 404.php contains no text, check the theme’s options panel. You can also replace the file entirely in your child theme. If you’d rather describe the page than build it, SiteSelf handles design changes to your WordPress site like this one. It needs hosting access for a 404.php edit, and it doesn’t edit templates owned by Elementor, Divi or Beaver Builder.

    How to use an ordinary page as your 404

    A plugin lets you design the 404 as a regular Page in the block editor, without touching theme files. Smart Custom 404 Error Page, maintained by NerdPress, is the most widely installed option. Its WordPress.org listing shows more than 100,000 active installs.

    1. Create and publish a Page with your 404 content.
    2. Go to Appearance > 404 Error Page, select that Page and save.

    Its listing notes three things. It doesn’t work with the “Plain” permalink structure. It sends a proper 404 status and creates no redirects. And by default, visiting the assigned Page directly returns a 404 too, so test with a made-up URL, not the Page’s own address. The changelog records a security fix in version 11.4.8 in October 2024, after NerdPress took over the plugin. Check “Last updated” and “Tested up to” before you install it.

    Smart Custom 404 Error Page settings screen for choosing a WordPress 404 page
    Selecting a published page from the 404 Error Page dropdown designates it as the site custom template while preserving standard 404 response headers. · Source: wpmarmite.com

    Not every “404 plugin” does the same job. Some redirect missing URLs somewhere else instead of showing a page with a 404 status. Read what the plugin does before choosing it.

    How to build a 404 page in Elementor

    Elementor’s documented route is Templates > Theme Builder > Error 404. Elementor’s help center says this needs Elementor Pro. Design the template, publish it, and set its display condition to 404 pages. A draft template, or one without that condition, never appears. The official route doesn’t exist in free Elementor. The plugin method above works with any setup.

    What should a good 404 page include?

    Google’s Search Central guidance recommends a clear, friendly message, your site’s usual look and navigation, and links to popular content or the homepage. It also suggests a way to report the broken link. Practitioners add a search box near the message and ask you to keep the page light.

    • Say what happened in plain words. “We couldn’t find that page” beats a joke the visitor has to decode.
    • Put search near the top. The visitor came looking for something specific.
    • Link to where people actually go. A publisher links recent articles, a service business links its services and contact page, and a store links search, categories and a few featured products.
    • Keep it accessible. The usual WCAG 2.2 rules apply: a descriptive page title (2.4.2), clear headings (2.4.6), link text that makes sense (2.4.4) and a labeled search field (3.3.2).

    How to test it, and why the status code matters most

    Open a URL that can’t exist, such as yoursite.com/this-page-does-not-exist-123. Don’t test with the assigned Page. Check that your design shows up, then check the status code. In a terminal, run:

    curl -I https://yoursite.com/this-page-does-not-exist-123

    The first line should say 404. You can also open your browser’s developer tools, go to the Network tab and reload the page. If it says 200, you have a problem. Google defines a page that says “not found” but returns 200 as a soft 404, and it flags blank or nearly blank pages the same way. Google’s guidance is plain: a custom 404 page should still return HTTP 404.

    Browser Network tab confirming a custom WordPress 404 page returns status 404
    Inspecting the Network tab confirms that the server correctly returns a 404 Not Found header rather than masking missing content with a standard 200 response. · Source: spin.atomicobject.com

    Why isn’t my custom 404 page showing?

    These causes are ranked roughly by how often they come up in WordPress docs and support threads. Start at the top.

    1. Stale rewrite rules. Go to Settings > Permalinks and click Save Changes without changing anything. That rebuilds the rules, and it’s the first fix WordPress’s common-errors handbook gives. If it doesn’t help on Apache, check .htaccess and mod_rewrite, or ask your host. Nginx doesn’t use .htaccess at all. Our guide to adding pages and getting them seen covers this reset in more detail.
    2. The wrong part was edited. A Page called “404” was published but never assigned. A saved Site Editor template is overriding the file. An Elementor template is still a draft. The plugin has no Page selected, or permalinks are set to Plain.
    3. Cache or CDN. Purge your caching plugin, your host’s cache and your CDN, then test in a private window. If you use Cloudflare and nothing else works, pause it, resave permalinks, then unpause.
    4. A theme or plugin conflict. In one support thread, a Sensei email template replaced the 404 template. Switch to a default theme, then deactivate plugins one at a time, preferably on staging. The steps for isolating a plugin conflict apply here too.
    5. The server answers before WordPress runs. If you see your host’s branded error page instead of anything from your theme, the request never reached WordPress. Nginx try_files and Apache ErrorDocument rules live on the server. Nothing you change in the dashboard fixes them, so ask your host.

    Should you redirect missing URLs instead?

    Only when there is a real replacement. Google’s guidance is to return 404 when content is gone, 410 when it was removed on purpose and won’t come back, and 301 when it moved to a clear replacement. A discontinued product can point to its successor or its category. An old article can point to the updated version.

    Redirecting every missing URL to the homepage is the mistake practitioners warn about most. Google may treat those redirects as soft 404s, and visitors land somewhere that has nothing to do with what they clicked. Avoid redirect chains and timed “meta refresh” redirects too. For URLs you never replaced, a helpful 404 page is the honest answer.

    WooCommerce stores need two extra checks. WooCommerce’s permalink docs say the product base must not clash with the category or tag bases. Old product URLs return 404 after a permalink change unless you redirect them.

    Frequently asked questions

    Do I need a plugin to customize my 404 page?

    No. The Site Editor on a block theme or 404.php in a child theme does the job without one. A plugin is worth it if you want to design the page as an ordinary Page and never touch theme files. If you go that way, check that the plugin is still maintained.

    Will my 404.php changes survive a theme update?

    Only if the file is in a child theme. Theme updates overwrite edits to the parent theme’s files. Site Editor changes are stored in the database, so theme updates don’t replace them.

    Can I make a custom 404 page with free Elementor?

    Not through Theme Builder, which requires Elementor Pro. A plugin that assigns an ordinary Page as the 404 works with any theme or builder. You can also write a 404.php in a child theme.

    What should I do with hundreds of broken URLs after a migration?

    Export the list from Search Console or a crawler and match each old URL to its new one where one exists. Bulk-import 301s for those. Let everything without a real replacement return 404 or 410. A custom 404 page makes the leftovers less painful for visitors, but it doesn’t remove them.

    Why does visiting my assigned 404 page show an error?

    That’s the default behavior of Smart Custom 404 Error Page. The plugin has a setting to turn it off. Either way, test with a URL that doesn’t exist on your site.

  • What a WP autoblogging plugin does and where it fails

    Key takeaways

    • The biggest feed-to-post importers on WordPress.org, WP RSS Aggregator and Feedzy, list about 40,000 active installs each. WPeMatico lists 10,000, and most AI autopost plugins list under 1,000.
    • The plugin that is actually called WP Autoblog carries a WordPress.org warning that it has not been tested with the last three major WordPress releases.
    • WP-Cron only runs when someone loads a page. Low traffic, full-page caching and password-protected staging sites all miss scheduled imports. The usual fix is a real server cron every 5 to 15 minutes.
    • When a run reports ‘nothing imported’, the per-run item cap, a keyword filter or the duplicate check is often behaving exactly as configured.
    • Google’s spam policies target large amounts of low-value content no matter how it was made, so rewording or spinning copied items does not make them acceptable.

    Search for a WP autoblogging plugin and you find a category, not a product. The phrase covers feed importers that turn RSS items into posts, AI tools that write articles from keywords, multi-source “robots” that pull from YouTube and affiliate feeds, and custom workflows that publish through the WordPress REST API. Each kind fails differently, so which one you pick matters less than knowing what it has to do.

    Most autoblogs also break for boring reasons. Cron doesn’t fire, a feed sends back HTML instead of XML, or a run times out halfway. Switching plugins just moves those failures somewhere else. If you have already tried reinstalling, the general steps for WordPress plugins that are not working still apply. The causes below are the ones specific to automated publishing.

    What a WordPress autoblogging plugin actually does

    An autoblogging plugin creates WordPress posts on a schedule, with no one writing each one. The only real difference between tools is where the content comes from:

    • Feed-to-post importers such as WP RSS Aggregator, Feedzy and WPeMatico. They read RSS or Atom feeds and turn each item into a post.
    • AI article generators. They write posts from keywords or titles and schedule them, usually through a paid API key.
    • Multi-source tools. They mix RSS, video, social and affiliate product sources in one campaign, often with an AI rewrite step added on.
    • Custom workflows. Tools like n8n, Make or Zapier post to WordPress through the REST API, so no dedicated plugin is involved.

    An RSS aggregator and an autoblogging tool are also different things. An aggregator can simply show feed items in a block or shortcode, with a title, an excerpt and a link. Feed-to-post creates real WordPress posts that search engines can index. That second step is where duplication, attribution and indexing start to matter.

    The category is small. On WordPress.org, WP RSS Aggregator and Feedzy list about 40,000 active installs each and WPeMatico lists 10,000. Content Pilot lists 800 and Auto Robot lists 40. WP RSS Aggregator’s own page says it is used on 50,000+ websites. That doesn’t contradict the directory: the directory counts current active installs, rounded, while the vendor counts every site that has ever used it.

    The plugin literally named WP Autoblog is not the one you want

    If you search the exact phrase, you may land on “WP Autoblog” by Sascha Huber. Its WordPress.org listing warns that it has not been tested with the latest three major WordPress releases and may no longer be maintained. The name matches your search, but the plugin is stale. Check the “last updated” and “tested up to” lines before you install any importer.

    WordPress.org autoblogging plugin page with a not-tested warning
    A prominent warning banner and outdated maintenance metrics on WordPress.org reveal an abandoned plugin that could easily break your site. · Source: www.wpbeginner.com

    How a feed-to-post import works, step by step

    Every feed importer runs roughly the same pipeline. Knowing the steps tells you where to look when posts stop appearing:

    1. Trigger. A scheduled event, normally WP-Cron, starts the run.
    2. Fetch. The plugin requests each feed URL over HTTP.
    3. Parse. SimplePie, the feed parser bundled with WordPress, reads the XML. Feedzy and WP RSS Aggregator both rely on it.
    4. Filter. Keyword, date and category rules drop items you didn’t want.
    5. Deduplicate. The plugin checks each item’s GUID or a stored hash against earlier imports.
    6. Transform. This step is optional. It can fetch the full article, rewrite it with AI, or apply a post template.
    7. Create. WordPress inserts the post as draft, pending or published, and attaches or links the images.

    Each step can skip items without raising an error. That’s why “it imported nothing” is such a common complaint and so rarely a bug. One more trap sits at step 6. Many feeds carry only a summary, and pulling the full article is usually a paid feature. Feedzy’s documentation, for example, puts full-content extraction in its Developer and Agency plans.

    Feed-to-post autoblogging import settings in WordPress admin
    Configuring the item count and duplicate detection rules ensures that only fresh content within designated limits is turned into posts. · Source: docs.themeisle.com

    Why an autoblog stops publishing, most common cause first

    Vendor troubleshooting docs and WordPress.org support threads point to the same rough order. Work down it before you change plugins.

    1. WP-Cron isn’t firing

    WordPress’s Plugin Handbook explains that WP-Cron runs when a page loads, not as a continuous process. With no visitors, nothing runs. Full-page caching can also serve pages without ever reaching WordPress, and a staging site behind a password sends cron requests nowhere. WP Engine’s support docs add two more limits: cron jobs run one after another, so an earlier job that errors can hold up later ones, and sites behind basic authentication are incompatible with WP-Cron requests.

    To check, install WP Crontrol and open Tools, then Cron Events. If the plugin’s import event shows a next-run time in the past, cron is the problem. On the command line, wp cron event list shows the same thing.

    The fix is a real server cron. Feedzy’s troubleshooting guide suggests one every 5 to 15 minutes for low-traffic or cached sites. First turn off the page-load trigger in wp-config.php:

    define( 'DISABLE_WP_CRON', true );

    Then add a server cron job through your hosting panel or crontab -e. You need hosting access for this:

    */10 * * * * cd /path/to/site && wp cron event run --due-now > /dev/null 2>&1

    These two lines only work as a pair. If you set DISABLE_WP_CRON without the server job, every scheduled task on the site stops, including scheduled posts and update checks. If you add the server job but leave page-load cron on, the same job can trigger twice. Hosts also set this up differently, so use your host’s documented path rather than one copied from a forum. WPeMatico ships its own wpe-cron.php endpoint if you’d rather point cron straight at it.

    2. The feed is invalid or blocked

    A URL that opens in a browser isn’t necessarily a feed. It may send back an HTML page, a redirect, a paywall or a bot challenge. Feedzy’s docs also note that a feed can pass the W3C validator and still fail in SimplePie. Blocked requests show up as 403 or 429 errors, which some sites send to shared hosting IPs that poll too often.

    Test each feed URL on its own, add sources one at a time, and poll less often. One bad source can slow the whole run in some importers, so a single broken feed can look like a site-wide failure.

    3. The run times out or runs out of memory

    Too many feeds or items per run, full-content fetching and image downloads all add up. The usual messages are cURL error 28 (the HTTP request timed out, often after 10,000 milliseconds) and, in WPeMatico, a campaign stuck on “Running Campaign…”. Split large campaigns into smaller ones, stagger their schedules, and lower the items per run. On shared hosting, this is often the point where a bigger plan becomes the cheaper option.

    4. Filters and duplicate detection are doing their job

    If a run finds 50 items and imports 10, check the per-run item cap first. Feedzy shows Found, Duplicates and Imported counters and has a Debug log level. WPeMatico logs Found duplicated hash when it skips an item it has seen before. Feedzy’s “Treating this feed of type ‘128’ as an RSS feed” is a notice, not an error.

    A related trap: if you delete imported posts without clearing the plugin’s duplicate record, the plugin either re-imports them or keeps skipping them forever, depending on the tool. Fix the identifier first, usually the item’s original GUID or URL, then clean up.

    5. Images are missing

    Feeds often have no image tag. Source CDNs block hotlinking with a 403, SVGs may be rejected as an upload type, and some themes never show a featured image. Set a fallback image, or use your importer’s option to reference the external image URL. External images break if the source moves them, and copying them locally raises licensing questions.

    Alt text needs the same care. The W3C’s images tutorial says informative images need a text alternative that carries their meaning, and decorative images get an empty alt="". Auto-filling the post title as alt text does neither.

    6. An update changed the parser

    Importers depend on WordPress’s bundled SimplePie and on their own add-ons, so a core, PHP or plugin update can break a working import overnight. Update one layer at a time, keep the plugin and its paid add-ons on matching versions, and test on staging first. If you need a log, turn on WP_DEBUG_LOG and read wp-content/debug.log. Don’t display errors on the live site.

    7. The posts exist but the theme doesn’t show them

    If the posts appear in Posts, All Posts but not in a slider or homepage widget, check that widget’s query and the post’s category. WPeMatico’s FAQ points out that some themes run their own processing only when a post is saved by hand, so posts inserted by a plugin miss it. The importer’s post template is usually the cleaner fix.

    What Google does with automated posts

    Google’s spam policies describe scaled content abuse as producing many unoriginal, low-value pages mainly to manipulate rankings, and they apply it however the pages were made, whether by automation, people or both. Automation alone isn’t the problem. A thousand lightly reworded feed items is.

    Google’s canonicalization documentation explains that it groups duplicate and near-duplicate pages and picks one URL to show. When your imported copy competes with the original article, the original usually wins. Synonym swaps and AI rewording don’t change this, because the claims, structure and source are the same. Blocking pages in robots.txt doesn’t set a canonical either, and using noindex to force the choice can drop the page from search entirely.

    Practitioners who describe good results from automation almost always describe partial automation: drafts, a human edit, a steady pace of about one post a day, and topics grouped so posts don’t compete with each other. Nobody documents fully hands-off publishing going well over time.

    Does an RSS feed give you permission to republish?

    Treat a feed as a way to receive content, not as a license to reuse it. We found no legal source that settles this, and the answer depends on your country. The consistent view among WordPress practitioners is that titles, short excerpts and a clear link back are the lower-risk pattern. Republishing full articles needs the publisher’s permission. Adding a canonical tag or a credit line doesn’t turn copying into permission.

    If a source matters to your site, ask the publisher. Many will agree to syndication when your post adds context their readers don’t get elsewhere.

    A setup that holds up on a live site

    1. Identify exactly what you are running. Note the plugin, its version and any add-ons. Listing plugins with wp plugin list gives you the versions in one command.
    2. Back up, then work on staging. If staging sits behind basic auth, remember that cron won’t fire there without a server job.
    3. Test one source and one post. Check the title, body, links, image, alt text, category, author and canonical URL.
    4. Confirm cron on its own. Use WP Crontrol or wp cron event list before you blame the importer.
    5. Import as drafts first. Auto-publishing makes sense only for sources you control, such as your own product feed or a partner’s feed you have permission to use.
    6. Read the logs before changing settings. The Found, Duplicates and Imported counters answer most “why nothing” questions.
    7. Scale slowly. Add sources one at a time, and only after duplicates, permissions and image handling behave.

    If what you really want is posts written, edited and published when you ask, rather than a feed campaign running in the background, SiteSelf does that work through chat on your existing site. It is described on the page about writing and publishing WordPress content. It works on request, so it doesn’t replace a scheduled import.

    WP Crontrol cron events list used to check autoblogging imports
    The Next Run column in WP Crontrol lets you immediately see whether background tasks are executing on schedule or stalled in the past by a broken cron setup. · Source: wp-crontrol.com

    Frequently asked questions

    Is there a free WP autoblogging plugin?

    Yes. WP RSS Aggregator, Feedzy and WPeMatico all have free versions in the WordPress.org directory. The free tiers usually limit the features people actually want, such as full-content extraction, feed-to-post or AI rewriting, so check which tier includes your workflow before building around it.

    Should imported posts go live automatically or as drafts?

    Use drafts for any new source, new filter rule or AI rewrite step. Auto-publish is reasonable when the feed is yours or you have permission to use it, and its output is predictable, like a product feed or your own second site. Switch over only after a batch of drafts has come through clean.

    How many posts per day is safe?

    No source gives a safe number. Some tools advertise thousands of articles a month, but that is capacity, not a sensible pace. The accounts that describe good results kept to about one reviewed post a day and grew from there.

    Do AI autoblogging plugins need an API key?

    Usually. AI writing, translation and full-text extraction often run on external services with their own keys, quotas and per-request fees on top of the plugin price. Budget for both, and expect model pricing to change.

    How do I know a premium autoblogging plugin is genuine?

    Buy it from the developer’s own site or the marketplace the developer names, not from a reseller or a “nulled” download. Users on WordPress forums have reported rebranded copies of popular autoblogging plugins that injected ads into posts. Treat everything a plugin imports, including HTML, embeds and image URLs, as content from someone you don’t control.

    Can an autoblog run on shared hosting?

    A few feeds with modest item counts usually can, especially with a real server cron. Timeouts and memory errors appear as you add feeds, full-content fetching and image downloads. When runs regularly stall, splitting campaigns helps before upgrading does, but heavy importing eventually needs more server resources.

  • WP malware removal that does not come back

    Key takeaways

    • Wordfence’s own WordPress.org listing says security after a hack cannot be assured without a full reinstall. Treat a clean scan as a first pass, not proof.
    • Sucuri found a backdoor on 49.21% of the sites it cleaned in 2023, and cleaned an average of 610 files per request. That comes from Sucuri’s own client base.
    • WordPress.org’s hacked-site FAQ warns that reinstalling from the dashboard can leave the attacker’s added files behind. Delete, then upload clean copies of the same version.
    • Check the places file scanners miss: wp_users, wp_options, wp-content/mu-plugins, PHP files in uploads, nested .htaccess files and server cron jobs.
    • Test as a logged-out visitor on mobile and from a Google result. Some redirects never fire for a logged-in admin.

    Most WordPress hacks don’t show up as a crash. You find a redirect to a pharmacy site on mobile, an admin account nobody created, or an email from your host saying your account is suspended. The urge is to open the file manager and delete whatever looks strange. That usually removes the symptom and leaves the way back in.

    Removing malware properly is a short incident response job. You measure success by two things: the site doesn’t get reinfected, and the entry point is closed. The tool you use matters much less than whether you handled all of it: files, database, users, credentials, scheduled tasks, the hosting account and the vulnerable component.

    Is it malware, or an ordinary fault?

    These signs point to a compromise:

    • admin users you don’t recognise
    • redirects to spam or scam sites
    • Japanese, pharma or casino pages in a site:yourdomain.com search
    • hidden links in the page source
    • a Chrome warning such as “Deceptive site ahead”
    • a Google Ads malware disapproval
    • PHP files in wp-content/uploads
    • files that changed when nobody edited them

    A critical error, a white screen, a 500 error or a database connection error is usually not malware. Those come from plugin conflicts, memory limits and bad updates. Our guide to fixing a WordPress white screen covers them. If a single plugin misbehaves after an update, work through WordPress plugins that are not working first. If you would rather hand that kind of broken-site diagnosis to someone, SiteSelf takes WordPress bug fixes on request.

    Test while logged out. Some redirect malware only fires for mobile visitors, first-time visitors or people arriving from Google. Some SEO spam is shown only to crawlers. Open a private window on your phone, search for your brand, and click through from the results.

    Why deleting the flagged file rarely fixes it

    Attackers leave more than one way back in. In its 2023 threat report, Sucuri says it found a backdoor on 49.21% of the sites it remediated and cleaned an average of 610 files per request. The same report counts more than 1.1 million malicious database entries removed. These numbers come from Sucuri’s own clients, not the whole web. The pattern still holds: the visible payload is a small part of the job.

    Scanners work within a scope. By default they look at the WordPress directory. They can miss database-only payloads, dormant backdoors, neighbouring sites on the same account, and code that only runs under certain conditions. Wordfence is the most installed security plugin in the directory, and its WordPress.org listing says security after a hack cannot be assured without a full reinstall. Use scanners for triage. Don’t use them as proof the site is clean.

    How to remove WordPress malware, in order

    Doing this by hand takes hosting access: SFTP or SSH, the hosting panel, and phpMyAdmin or database access. Dashboard access alone is not enough, because some of the malware may be hiding from the dashboard.

    1. Snapshot the infected state

    Back up the files and the database as they are now, and keep one copy off the server. Export access logs and error logs before your host rotates them. Write down the symptoms, the affected URLs and the times you noticed them. You will need all of this to find the entry point, and to compare against later.

    2. Contain the site

    Take the site offline at the server level, or restrict it to your IP address. A maintenance-mode plugin changes what visitors see, but malicious PHP and cron jobs keep running behind it.

    3. Revoke every access path from a clean device

    WordPress.org’s hacked-site FAQ recommends a global password reset and new secret keys. It also warns that a trojan on your own computer can steal FTP and wp-admin credentials. Scan your computer first, then change all of these:

    • every WordPress user password
    • hosting panel, FTP, SFTP and SSH (delete FTP accounts you don’t use)
    • the database password (update wp-config.php to match)
    • email and domain registrar
    • API keys, payment gateway keys and plugin licence keys
    • the salts and keys in wp-config.php. New salts log out every session, including the attacker’s.

    Then turn on two-factor authentication for every admin account.

    4. Replace code with clean copies, and don’t overwrite

    The WordPress.org FAQ warns that reinstalling over the top can leave the attacker’s new files in place. Delete wp-admin, wp-includes and the root core files except wp-config.php. Then upload the same WordPress version from wordpress.org. Do the same for every plugin and theme, using original packages. Remove any nulled, pirated or unused component instead of reinstalling it.

    With SSH access, WP-CLI can check core and directory plugins against WordPress.org’s checksums:

    wp core verify-checksums
    wp plugin verify-checksums --all

    Premium plugins, custom themes and a modified parent theme have no public checksums, so compare them file by file against a clean download. Don’t let a scanner’s “repair” button replace a customised functions.php. Replacing a file with the original wipes your custom code along with the injected code.

    WP malware removal: wp core verify-checksums output flagging modified WordPress core files
    Running the core checksum verification command flags wp-load.php as modified from the official WordPress release, pinpointing compromised core files. · Source: www.youtube.com

    5. Clean what replacing the code does not touch

    Replacing core, plugins and themes leaves several places untouched. These are the places reinfections usually come from:

    • Uploads. This folder should hold media, not PHP. Run find wp-content/uploads -name "*.php" and look for PHP disguised as images too.
    • Must-use plugins. Files in wp-content/mu-plugins load on every request and can’t be deactivated from the Plugins screen. wp plugin list --status=must-use shows them. Our guide to listing plugins with wp plugin list covers the other statuses. Look for unfamiliar folders beside it as well.
    • Config and entry files. Check wp-config.php, the root index.php and every .htaccess, including nested copies in subfolders.
    • The database. Look for users you didn’t create, options holding encoded code, and spam posts. Rogue admins can be filtered out of the Users screen, so query the table directly (adjust the wp_ prefix to match yours):
    SELECT u.ID, u.user_login, u.user_registered
    FROM wp_users u
    JOIN wp_usermeta m ON u.ID = m.user_id
    WHERE m.meta_key = 'wp_capabilities'
      AND m.meta_value LIKE '%administrator%';
    • Scheduled tasks. Check server cron in the hosting panel or with crontab -l, and WordPress cron with wp cron event list. A single cron job can reinstall everything you just deleted.

    Search for eval, base64_decode and gzinflate, but treat hits as clues. Legitimate plugins use them too. Check where the file came from and compare it against the original before you delete anything.

    6. Close the entry point

    The most common way in is an outdated, abandoned or vulnerable plugin or theme. Stolen or weak credentials come next. Core itself is rarely the cause. Use the logs you exported to find the first bad request. Update the vulnerable component, or remove it if it’s abandoned. If you can’t find the entry point, changing every credential and updating everything is your best partial answer, but keep watching the site closely.

    7. Check the whole hosting account

    The WordPress.org FAQ notes that a hack on shared hosting can affect more than one site. Every other site, the old /old/ or /staging/ copy and any exposed backup on the same account is a second way in. Ask your host for an account-wide scan. Delete installs you no longer use.

    8. Verify from outside

    Browse in a private window, on mobile, and from Google results. Run site: searches for spam pages. View the page source for hidden links. Run an external scanner alongside the one on the server, because each sees different things. Keep checking logs, users and cron events for several days, since that is when a missed backdoor shows itself.

    9. Only then ask Google to review

    If you had a Chrome warning, check the Security Issues report in Search Console. Wait until every affected page is fixed before you request a review. Then explain what you removed and which vulnerability you closed. If the site is still infected when Google checks, the review fails and you wait again. Rankings and ad approvals can take longer to recover than the warning itself.

    Google Search Console Security Issues report after WordPress malware removal
    The Request Review button in Google Search Console should only be used after confirming that every detected issue has been thoroughly resolved. · Source: www.searchenginejournal.com

    Clean the site or restore a backup?

    A backup is the fastest route when you can show it predates the infection. Restore it to staging first. Then change every credential and patch the entry point before it goes live. Otherwise the attacker gets back in the same way. A long-dormant infection may already be inside the backup, so an undated restore point proves nothing.

    For sites whose data changes, such as orders, comments and new posts, a hybrid often works better. Keep the current database and uploads, replace all code with clean copies, then inspect the database as in step 5. For a small brochure site, rebuilding from clean code is often the most dependable option. For a large store or a heavily customised build, careful cleaning keeps content and custom code that a rebuild would put at risk. Either way, none of it holds if credentials, the vulnerability or a backdoor remain.

    What changes on a WooCommerce store

    WooCommerce’s security guidance recommends auditing admin and shop-manager accounts, REST API keys, WooCommerce logs and site traffic, and removing keys you don’t use or that have more access than they need. After a compromise, treat every payment and API key as exposed and rotate it. Check the checkout, cart, login and account templates for injected scripts, and contact your payment provider. A gateway that keeps card data off your server greatly reduces what an attacker can reach.

    Watch for false alarms, too. URLs ending in ?v= are a normal WooCommerce feature. Unknown admins and obfuscated code are the real warning signs.

    Why it keeps coming back, and when to stop

    If malware returns within hours or days, something from this list was missed:

    • a backdoor
    • a hidden admin
    • a copy stored in the database
    • a cron job
    • a password nobody changed
    • the unpatched plugin
    • an infected neighbour on the same account, or the server panel itself

    Treat a reinfection as a new incident and start again from the snapshot, not from where you stopped.

    Stop and bring in a professional in these cases:

    • the site handles payments or personal data
    • it has been reinfected twice
    • you find compromise outside the WordPress folder
    • you can’t read the code you are looking at

    Ask anyone you hire for a written report: the entry point, the files and tables affected, and the credentials changed. A cleanup with no named cause is the kind that comes back.

    Afterwards, keep everything updated. WordPress’s security handbook calls this the most important measure. Also remove plugins you don’t use, keep off-site backups with enough history to go back before an infection, and disable PHP execution in uploads.

    Frequently asked questions

    Can a security plugin remove malware on its own?

    Partly. Scanners compare core and WordPress.org plugin files against the originals and flag files that don’t belong, which is a good first pass. They can miss database payloads, cron jobs and code outside the WordPress folder. Wordfence’s own listing says security after a hack needs a full reinstall.

    Should I reinstall WordPress from the dashboard?

    Not as your only step. A dashboard reinstall overwrites core files but leaves files the attacker added. It also doesn’t touch plugins, uploads, mu-plugins, the database or cron. Delete and replace over SFTP with the same version instead.

    Is base64_decode or eval always malware?

    No. Legitimate plugins use both. Treat them as reasons to look closer, then compare the file against a clean copy from its original source before you delete it.

    Will my host clean the site?

    Usually not. Most hosts treat the application as your responsibility, and some refer you to a paid partner. Ask your host for what only they can provide: an account-wide scan, logs, and help with server-level cron or panel compromise.

    Do I need to tell my customers?

    If payment or personal data may have been exposed, possibly. The rules depend on your jurisdiction and your payment provider’s terms. Speak to your payment provider and a legal adviser early, and keep the infected-state snapshot as evidence.

    Can a remote scanner confirm the site is clean?

    No. It sees public output: redirects, visible injections and blocklist status. It can’t see dormant backdoors, database-only payloads or files on the server, so use it together with a scanner on the server and a manual check.

  • How to add pages in WordPress and get them seen

    Key takeaways

    • Publishing creates a URL and nothing else. On a classic theme you add the page under Appearance > Menus and press Save Menu. On a block theme you edit the Navigation block in Appearance > Editor.
    • If a new page has no header or menu, check its Template setting before anything else. A Landing or canvas template leaves the navigation out on purpose, and switching to Default brings it back.
    • Deleting a page takes its menu item with it. Recreating a page with the same name does not bring the menu item back, so you have to add it again.
    • A page called Cart does nothing until it is assigned under WooCommerce > Settings > Advanced > Page setup. WooCommerce says Cart, Checkout and My Account must each be a separate page.
    • For a page that returns 404, resave your current permalink structure without changing it. Changing the structure on a live site breaks every existing URL.

    Almost nobody gets stuck on the part where you create the page. They get stuck after pressing Publish, when the page doesn’t show up in the menu, has no header, or returns a 404. Those are four separate systems: the page itself, the navigation, the template and the URL rules. Each one needs its own step, and fixing one doesn’t fix the others.

    This guide covers both jobs: creating the page, then making it reachable and getting it to display correctly. To change a page that already exists, see how to edit pages in WordPress.

    What do you need before you add a page?

    You need an account that can publish pages. Administrators and Editors can. If you log in and there is no Pages item in the left-hand admin menu, your role doesn’t include page permissions, and an administrator has to change it.

    Next, find out which kind of theme you have, because the menu steps depend on it. Open the Appearance menu in the dashboard. If it has an Editor item, you’re on a block theme and navigation lives in the Site Editor. If it has Menus and Customize, you’re on a classic theme. Many tutorials were written for classic themes. Readers on block themes follow them, can’t find Appearance > Menus, and conclude WordPress is broken. It isn’t. The setting has moved.

    Finally, check that you actually want a page. WordPress.org’s documentation puts it this way: pages are for non-chronological content, such as About, Contact, Services and legal notices. Posts are dated entries that show up in the blog and its feed. If the content will still be true next year and visitors will look for it in the navigation, make it a page.

    How do you create and publish a page?

    This is the standard workflow in the block editor, and it works the same on classic and block themes:

    1. In the dashboard, go to Pages > Add New Page. Some versions and hosts label the button Add New. The admin bar’s + New > Page opens the same screen.
    2. Type the title. WordPress builds the slug from it, so “Our Services” becomes /our-services/.
    3. Add the content as blocks: a Heading block for each section, Paragraph blocks for the text, and Image, Buttons or Columns blocks where they help. Text pasted from Word or Google Docs often brings stray spacing and fonts with it. Paste it as plain text, or type into the blocks directly.
    4. Open the settings sidebar (the panel icon at the top right) and set everything in the next section before you publish.
    5. Click Save draft, then Preview in a new tab. Check the page at desktop width and on a phone.
    6. Click Publish, then confirm by clicking Publish again.
    Adding a page in WordPress block editor with the page settings sidebar open
    The Page settings sidebar displays essential publishing attributes including status, URL slug, template, and parent hierarchy alongside the main canvas. · Source: easywpguide.com

    Which sidebar settings should you set before publishing?

    Five settings in the Page tab decide how the page behaves once it’s live:

    • Status and visibility. Published pages are public. Drafts, Pending Review, Private and password-protected pages are hidden from visitors. They are also left out of menus and the homepage selector.
    • Slug. Settle it now. If you change it after other pages, emails or ads link to it, those links break unless you add a redirect.
    • Parent. Choosing a parent makes this page a subpage and puts the parent in the URL, so a Board page under About becomes /about/board/. It doesn’t put the page into any menu.
    • Template. This controls the layout around your content. Leave it on Default unless you know you want something else. The template section below explains why.
    • Order. A number (1, 2, 3) that sorts pages in automatic page lists and in some themes’ default menus.

    Can you create pages from the Site Editor instead?

    Yes, on a block theme. WordPress.org’s Site Editor documentation describes Appearance > Editor > Pages, where the plus icon creates a draft. The benefit is that you edit the page inside its real template rather than on a blank canvas. The risk is that the header, footer and title belong to the template, not the page. WordPress locks those blocks and shows “Edit your template to edit this block.” If you unlock and change them, the change applies to every page that uses the template.

    How do you get the new page into the menu?

    You add it yourself. The menu doesn’t pick up new pages, and this is the most common “my page is missing” report on the WordPress.org forums and Reddit.

    On a classic theme

    1. Go to Appearance > Menus.
    2. Pick the right menu from the “Select a menu to edit” dropdown. Sites often have several, and editing the wrong one is a common mistake.
    3. In the Pages box, tick your page and click Add to Menu.
    4. Drag it into position. To create a dropdown, drag it slightly right, under its parent item.
    5. Under Menu Settings, check that the menu is assigned to a location your theme actually shows, usually Primary or Header.
    6. Click Save Menu. Nothing changes on the live site until you do.

    The same screen has an “Automatically add new top-level pages to this menu” checkbox. It only covers top-level pages and only works with classic menus, and it adds every new page, including ones you didn’t mean to show. Most sites are better off adding pages by hand.

    WordPress Appearance Menus screen for adding a new page to a classic theme menu
    Adding new pages to a classic navigation bar requires selecting them from the Pages panel and confirming your changes with the Save Menu button. · Source: wordpress.org

    On a block theme

    Go to Appearance > Editor, open Navigation (or open the header template and select the Navigation block), click the plus icon and add a Page Link to your page. Then save. One Reddit user described getting there by trial and error: “I had to access the template editor, edit the navigation element, and then I could add, reorder, and delete page links.” The Site Editor shows each menu item as a block, and you drag Page Links into one another to build a submenu. For more complex dropdowns, see our guide to building a WordPress drop down list.

    WordPress Site Editor Navigation block adding a page link on a block theme
    The Site Editor lets you configure menus directly on the canvas using the Navigation block rather than the traditional admin menu screen. · Source: make.wordpress.org

    One trap applies to both theme types. In a resolved WordPress.org thread, a site owner deleted their pages and recreated them under the same names, and the menu stayed empty. Deleting a page removes its menu item. A new page with the same title is a different page, so you have to add it to the menu again.

    How do you make the new page the homepage?

    Go to Settings > Reading, choose “A static page”, pick your page under Homepage and save. If you also want a blog, create an empty page called Blog, choose it as the Posts page, and WordPress will list your posts there. Only published pages appear in these dropdowns. If yours is missing, it’s probably still a draft.

    Why does the new page have no header or look different?

    The page has the wrong template. Many themes include a Landing, Blank or Canvas template that deliberately removes the header, footer and menu, which suits a campaign page and nothing else. In a WordPress.org support thread, a site owner getting ready for a promotion published a new page and found it had no menu. The page was using a Landing template, and switching it to Default fixed the problem. Check the Template field in the sidebar before you change anything else.

    If the template is right and the page still looks wrong, the problem is probably in the template itself: its width, spacing, sidebar or header. This is where adding a page turns into design work, and a change made there affects every page that uses the same template. If you’d rather hand that work off, SiteSelf’s page on design changes to an existing site describes the agent editing the styles and templates on your live site from a request you write in chat. If you want to do it yourself, theme customization that survives updates covers which layer to edit.

    How do you add a page with Elementor or another builder?

    Create the WordPress page first, then open it in the builder. With Elementor, that means Pages > Add New Page and then the “Edit with Elementor” button. Builders are common. HTTP Archive’s 2025 Web Almanac found that about 60% of WordPress sites use some form of page builder. Builders often have their own template and header settings, so the WordPress Template field may have no effect on what visitors see. If the builder won’t load or save, the problem is in the builder, not in page creation. Creating the page again usually just leaves you with duplicates.

    What about WooCommerce Cart and Checkout pages?

    They are ordinary WordPress pages, but WooCommerce ignores them until they’re assigned. A page called Cart does nothing until WooCommerce knows it’s the cart page. WooCommerce’s pages documentation sets out the process:

    • If the pages are missing, recreate them from WooCommerce > Status > Tools with the create-pages tool.
    • If you build one by hand, put the Cart or Checkout block on it, or put the shortcode ([woocommerce_cart], [woocommerce_checkout], [woocommerce_my_account]) in a Shortcode block. Pasted into a Paragraph block, the shortcode may not run.
    • Assign each one under WooCommerce > Settings > Advanced > Page setup, and assign the Shop page under Settings > Products.
    • Use a separate page for each function. WooCommerce warns that sharing one page causes incorrect redirects and broken payment gateways, and version 3.7 and later don’t let you do it.
    WooCommerce Page setup settings assigning cart and checkout pages in WordPress
    Selecting your designated Cart page from the Page setup dropdown establishes the functional link WooCommerce needs to direct shoppers. · Source: woocommerce.com

    Themes don’t come with these pages. The theme’s demo content can make it look as if they exist, which is what confused one store owner on r/woocommerce until they ran the Status tool and assigned the pages.

    What does a correct result look like?

    Open a private or incognito window, where you’re logged out, and check four things. The page loads at its URL. It appears in the menu on desktop and inside the collapsed mobile menu. It has the same header and footer as the rest of the site. Its links, buttons and forms work. Checking while logged in as an administrator doesn’t count, because you can see drafts and private pages that visitors can’t.

    What if it still doesn’t work?

    Work through the layers in this order. It goes from the cheapest check to the most invasive:

    1. Status. Open Pages > All Pages. If the page shows “Draft”, “Private” or “Password protected” next to its title, visitors can’t see it.
    2. The URL returns 404. Check the slug for typos and look for a post, category or plugin page with the same slug. Then go to Settings > Permalinks and click Save Changes without changing anything, which rebuilds the rewrite rules. Don’t switch to a different permalink structure on a live site. That breaks every existing URL.
    3. Old version showing. Clear your caching plugin, your host’s cache, any CDN such as Cloudflare, and your browser. Only blame the cache after you’ve ruled out status and menus.
    4. “Publishing failed. The response is not a valid JSON response.” The editor saves through the REST API, and this error means that request failed. Copy your content somewhere safe first. Then resave permalinks and deactivate plugins one at a time. In one WordPress.org case on Google Cloud, the fix was a server setting: Apache’s AllowOverride None had to become AllowOverride All.
    5. “Publishing failed. You are probably offline.” Practitioners usually trace this to an HTTP and HTTPS mismatch, where the WordPress Address and Site Address settings don’t match the SSL setup at the host or CDN.

    Stop and get help once a fix means changing server configuration, .htaccess or wp-config.php, or when you’ve switched to a default theme with all plugins off and the error is still there. At that point the problem is in hosting, not in WordPress. Host support can often fix a server-level error quickly. If your checkout is failing, don’t wait: get help straight away.

    Frequently asked questions

    How do I make a page appear as a dropdown under another page?

    Set the parent in the page’s sidebar so the URL is right, then nest the menu item under the parent in Appearance > Menus or in the Navigation block. The parent setting and the menu are separate, so you have to do both. Setting a parent never puts a page into a menu.

    Can I add a page straight from the Navigation block?

    Yes. In the block Navigation editor you can type a name that doesn’t exist yet and create the page there. It still has to be published before it shows up. It’s easy to end up with a blank published page this way, so add the content before you leave.

    How do I duplicate an existing page?

    WordPress core has no Duplicate link in the page list. You can open the page, use the editor’s options menu to copy all blocks, and paste them into a new page. A duplicator plugin does the same in one step. Either way, give the copy its own slug and title.

    Why can’t I find my new page in Google?

    Publishing doesn’t tell search engines anything. They find pages by crawling, which takes time and speeds up when the page is linked from your menu, footer or other pages. Also check that your SEO plugin hasn’t set the page to noindex.

    Should a developer create pages in theme files?

    No. Page content belongs in the database, created in wp-admin or with WP-CLI’s wp post create --post_type=page. Theme files hold templates, which are the layout that wraps the content, not the content itself.

    Can I add several pages at once?

    The dashboard creates one page at a time. WP-CLI, importers and some builders can create them in bulk. Bulk-created pages that are nearly identical give visitors nothing new and tend to do poorly in search, so only make pages that each have their own purpose.