WordPress & WooCommerce
The WordPress settings, plugins and WooCommerce defaults behind the most common findings on WordPress sites.
Guides
- WordPress12 min read
Too many plugins in WordPress? Measure what each one costs
How many WordPress plugins is too many depends on what each one loads, not on the count. Measure every plugin's cost per page, then remove, replace or restrict the heavy ones.Updated 27 Sept 2026 - WordPress24 min read
Speed up WooCommerce: the store checklist for cart, checkout, cache and schema
To speed up WooCommerce, cache every page except the cart, checkout and account, stop cart fragments outside the cart, and fix the host, images and plugins that slow the rest.Updated 26 Sept 2026 - WordPress14 min read
LiteSpeed Cache settings for Core Web Vitals, tab by tab
Which LiteSpeed Cache switches move LCP, CLS and INP, which ones need a LiteSpeed server or QUIC.cloud, and which ones break WooCommerce. Tab by tab, with a check after each.Updated 25 Sept 2026 - WordPress12 min read
Multilingual WordPress: WPML, Polylang and hreflang done right
Pick the URL structure, set the default language and x-default, and fix the hreflang failures the checker finds on WPML, Polylang, TranslatePress and Weglot: missing return links, dead alternates.Updated 4 Oct 2026 - WordPress11 min read
WordPress login URL: how to find it, and how to protect it with 2FA and rate limits
The WordPress login URL is yoursite.com/wp-login.php, and /wp-admin/ takes you there too. Here is how to find it on any install, why bots hammer it, and how to protect it with two-factor login and rate limits.Updated 4 Oct 2026 - WordPress13 min read
Staging with WordPress: host tools, plugins and the noindex trap
Which WordPress staging option to use, why a public staging copy needs both a password and noindex, the eight things that go wrong on push, and a wp-config snippet that makes staging safe by hostname.Updated 27 Sept 2026 - WordPress11 min read
WordPress user enumeration: stop it and replace "admin"
WordPress user enumeration lets anyone list your login names through /?author=1, the REST API and the login form. Close each leak and replace the "admin" user safely.Updated 27 Sept 2026 - WordPress12 min read
WordPress vulnerabilities: find and replace risky plugins
Almost every WordPress vulnerability is in a plugin or theme. Find the vulnerable, abandoned and closed ones on your site, judge a replacement and swap it safely.Updated 27 Sept 2026 - WordPress11 min read
Yoast vs Rank Math: which to keep, and why never both
Yoast vs Rank Math compared on what each includes free, how to choose, and why running both breaks titles, canonicals, schema and sitemaps. Plus how to switch safely.Updated 27 Sept 2026 - WordPress11 min read
Eliminate render-blocking resources and unused CSS in WordPress
How to eliminate render-blocking resources and remove unused CSS and JavaScript in WordPress: find which plugin or theme each file comes from, stop it loading where it is not needed, then defer, inline and trim the rest with your builder and cache plugin.Updated 26 Sept 2026 - WordPress17 min read
How to speed up a WordPress site: 11 steps in the order that pays off
Speed up a WordPress site step by step: measure first, then fix the server and page cache, PHP, plugins, the builder, images, scripts, fonts and background jobs, re-testing after each change.Updated 26 Sept 2026 - WordPress9 min read
How to tell what WordPress theme a site is using, child themes included
To tell what WordPress theme a site is using, search its page source for /wp-content/themes/: the folder name after it is the theme. How to confirm the name and version from the theme stylesheet, spot a child theme and its parent, and why theme detectors sometimes fail.Updated 26 Sept 2026 - WordPress8 min read
Is it WordPress? Five signs a website runs WordPress, and how to confirm it
Is it WordPress? Look for /wp-content/ and /wp-includes/ in the page source, a generator tag naming WordPress, and a link to the /wp-json/ API. Five signs, how to confirm them without probing the site, and why some WordPress sites hide them.Updated 26 Sept 2026 - WordPress15 min read
Reduce initial server response time on WordPress: find and fix a slow TTFB
How to reduce initial server response time on WordPress: check that the page cache is really hit, then find what makes uncached pages slow (plugins, queries, autoloaded options, outbound calls, wp-cron, PHP workers).Updated 26 Sept 2026 - WordPress12 min read
Speed up the WooCommerce backend: orders, scheduled actions and analytics
A slow WooCommerce admin usually comes from order storage in the posts table, a backed-up Action Scheduler queue, analytics imports and plugins calling home. Here is how to find which one, and fix it without touching the shop front.Updated 26 Sept 2026 - WordPress21 min read
Why is my WordPress site so slow? Plugins, builders, caching and hosting, diagnosed
A slow WordPress site is almost always one of five things: the server, missing page caching, heavy plugins or a page builder, big images, or background jobs.Updated 26 Sept 2026 - WordPress14 min read
WooCommerce checkout slow? Find the cause: server, gateways, shipping or emails
A slow WooCommerce checkout has four usual causes: an uncached page on a slow server, payment gateway scripts, live shipping and tax lookups, and work done while the order is placed. Here is how to time each one and fix it.Updated 26 Sept 2026 - WordPress16 min read
WooCommerce hosting: choose a host by measured speed, not reviews
Good WooCommerce hosting is the plan that builds your cart, checkout and account pages fast without a cache. How to test that before you pay, and what else a store needs from a host.Updated 26 Sept 2026 - WordPress15 min read
WooCommerce security: protect the admin, the checkout and your customers
WooCommerce security is WordPress security plus three store-specific risks: card-testing bots on the checkout, skimming scripts on the payment page, and customer data in orders, logs and backups. Here is the checklist for each.Updated 26 Sept 2026 - WordPress13 min read
WordPress admin slow? Heartbeat, autoloaded options, database bloat and admin plugins
A slow WordPress admin is almost always the database, autoloaded options, the Heartbeat API or plugins that do heavy work on admin screens. How to find which one with Query Monitor and Site Health, and how to fix each.Updated 26 Sept 2026 - WordPress14 min read
WordPress cookie consent plugin: choosing one that really blocks scripts
A WordPress cookie consent plugin only protects you if it stops analytics, pixels and embeds from loading until the visitor agrees. What to look for, how to set it up with caching and other plugins, and how to prove it works.Updated 26 Sept 2026 - WordPress16 min read
WordPress Core Web Vitals: passing LCP, INP and CLS on WordPress
Core Web Vitals on WordPress depend on four levers: hosting and page caching, the theme or page builder, plugins and their scripts, and images. What fails each metric on WordPress and the fix for each.Updated 26 Sept 2026 - WordPress10 min read
WordPress debug log: where debug.log lives, why it leaks and how to lock it down
The WordPress debug log is written to wp-content/debug.log, a file anyone can download unless your server blocks it. Here is how to check yours, use the log safely while troubleshooting, and switch it off or move it on production.Updated 26 Sept 2026 - WordPress12 min read
WordPress redirects: plugin or server rule, and how to set up a 301
How to redirect a page in WordPress with a plugin such as Redirection, Rank Math or Yoast SEO Premium, when a server rule is better, and what WordPress already redirects on its own.Updated 26 Sept 2026 - WordPress11 min read
WordPress robots.txt: where it is, how to edit it and a safe default
WordPress serves a virtual robots.txt until you add a real file. Where it comes from, how to edit it with Yoast SEO, Rank Math or a file, and a safe default for blogs and WooCommerce shops.Updated 26 Sept 2026 - WordPress14 min read
WordPress security plugins: what they do, where they overlap and when you need none
WordPress security plugins bundle five jobs: a firewall, a malware scan, login protection, vulnerability alerts and an activity log. Here is what each job is worth, which ones overlap, and when your host already covers them.Updated 26 Sept 2026 - WordPress19 min read
WordPress security: the checklist that stops most attacks, with or without a plugin
WordPress security comes down to ten habits: updates, two-factor logins, few administrators, locked files and tested backups. Here is the checklist, and what a security plugin adds on top.Updated 26 Sept 2026 - WordPress11 min read
WordPress sitemap: core, Yoast SEO or Rank Math, and which to keep
Where your WordPress sitemap lives, how the core wp-sitemap.xml differs from the Yoast SEO and Rank Math sitemaps, which one to keep, what to leave out of it and how to fix a sitemap that answers 404.Updated 26 Sept 2026 - WordPress10 min read
xmlrpc.php in WordPress: what it is, how it is attacked and how to disable it safely
xmlrpc.php is the old remote API of WordPress. Bots use it to guess passwords and to turn your site into a pingback cannon. Check whether anything still needs it, then block it at the right level.Updated 26 Sept 2026 - WordPress12 min read
"Discourage search engines": the WordPress box that hides your site
One checkbox in Settings → Reading adds noindex to every WordPress page. See what it does, why it survives launches and migrations, how to switch it off and how to get back into Google fast.Updated 25 Sept 2026 - WordPress13 min read
Divi performance: the settings that actually cut page weight
What each option on Divi's Performance tab does, which ones to switch on, how the static CSS cache and a caching plugin fit together, and how to measure Divi's share of the page before and after.Updated 25 Sept 2026 - WordPress13 min read
Elementor performance: asset loading, fonts and DOM size
Where Elementor's kilobytes and DOM elements come from, what each Performance setting does, how to load fonts without hiding text, and how to measure the builder's share before and after.Updated 25 Sept 2026 - WordPress11 min read
Hello world and Sample Page: cleaning up after a WordPress install
A fresh WordPress install ships with a sample post, page, comment, category, tagline, themes and plugins. See what to delete, what to keep and edit, and how to do it in wp-admin or WP-CLI.Updated 25 Sept 2026 - WordPress14 min read
Image optimisation plugins compared honestly
ShortPixel, Imagify, EWWW, Smush, Optimole, TinyPNG and the core Modern Image Formats plugin, compared by what they actually do, what they cost and what none of them fixes. Pick one and measure the result.Updated 25 Sept 2026 - WordPress13 min read
Page builders vs Gutenberg: the performance reality, measured
What Elementor, Divi, WPBakery, Bricks and Oxygen really cost in kilobytes and DOM elements compared with core blocks, how the report measures it, and when a builder is still the right call.Updated 25 Sept 2026 - WordPress13 min read
Rank Math settings we recommend (and the modules to leave off)
A screen-by-screen walk through the free Rank Math settings that change what Google sees, which modules to enable, which to leave off, and the report findings that show whether it worked.Updated 25 Sept 2026 - WordPress10 min read
Security headers in WordPress without a plugin
Where to set HSTS, CSP, X-Frame-Options and Referrer-Policy on a WordPress site: web server, Cloudflare, host panel or a ten-line mu-plugin, with values that keep wp-admin working.Updated 25 Sept 2026 - WordPress12 min read
The 8 WordPress rookie mistakes getReport checks (and the fixes)
Eight settings left at their defaults after launch cost WordPress sites rankings and security. See how to spot each one from the outside, why it matters and the exact admin screen that fixes it.Updated 25 Sept 2026 - WordPress11 min read
Two caching plugins: why it breaks and which one to keep
Two WordPress caching plugins double-minify scripts, serve stale pages and fight over .htaccess. How to pick the one your host expects, remove the other cleanly, and check that caching still works.Updated 25 Sept 2026 - WordPress11 min read
WooCommerce cart fragments: stop the AJAX call on every page
cart-fragments.js hits your server on every page load to refresh a mini-cart most pages do not show. What it costs, where it is needed, and the snippet or plugin setting that stops it elsewhere.Updated 25 Sept 2026 - WordPress14 min read
WooCommerce product schema: price, availability and reviews
WooCommerce writes Product structured data for you, then a missing price, an unset stock status or a second plugin quietly breaks it. Find which field is gone and fix it in the product editor.Updated 25 Sept 2026 - WordPress11 min read
WooCommerce: keep cart, checkout and account pages out of the cache
A cached cart shows another shopper's basket and a cached checkout fails with an expired session. How to exclude the three pages and the WooCommerce cookies at every layer, from plugin to CDN.Updated 25 Sept 2026 - WordPress9 min read
WordPress attachment pages: why they get indexed, how to stop it
WordPress can create a thin page for every image you upload. Find out whether your site has them, switch them off, clean up the sitemap and redirect the ones already indexed.Updated 25 Sept 2026 - WordPress10 min read
WordPress permalinks: from ?p=123 to clean URLs, rankings intact
Move a WordPress site from ?p=123 addresses to readable URLs, choose the right structure, set up the server rewrite rules and redirects, and test that every old link still lands on the right page.Updated 25 Sept 2026 - WordPress14 min read
WordPress site migration checklist: host, domain and https moves
The WordPress layer of a site move, from the backup and the serialized search-replace to wp-config, the one-hop redirect map and the bulk URL check that proves every old address still lands.Updated 25 Sept 2026 - WordPress12 min read
WP Rocket settings for Core Web Vitals, tab by tab
The WP Rocket switches that change LCP, CLS and INP, in the order to turn them on, what each does to the report, what breaks and how to roll back. Tested on 3.17.Updated 25 Sept 2026 - WordPress12 min read
wp-cron and scheduled tasks: why your site is slow at random moments
WordPress runs its scheduled jobs on the back of visitor requests, which is why the same page is fast one minute and slow the next. Replace WP-Cron with a real cron job in ten minutes and find the plugin that runs every minute.Updated 25 Sept 2026 - WordPress12 min read
Yoast SEO settings we recommend (and the ones to switch off)
A screen-by-screen walk through the free Yoast SEO settings that change what Google sees, with a recommendation for each and the report findings that show whether it worked.Updated 25 Sept 2026
Check all 19 at once
The WordPress health check runs every check on this page against your site.