EDITS.WS

Author: Jen Swisher

  • Shared Hosting vs Managed WordPress Hosting: Which is Best?

    The once obscure term — “hosting” — is a familiar one today, as platforms like WordPress have opened the possibilities for anyone, anywhere to create their own online presence. If you’re new to building a site, however, you likely have a lot of questions about the kind of hosting plan you need. 

    That’s why we’ve set out to dissect two types of hosting plans: shared hosting vs. managed WordPress hosting. What are the differences? What are the pros and cons? And, most importantly, how can you secure your WordPress site, no matter the type of hosting you choose?

    Choosing a hosting plan can feel like being caught between a rock and a hard place. A standard shared hosting plan is easy on the wallet, but does it give you the security you need? Managed WordPress hosting sounds like a dream with all of its features, but do the benefits justify the higher price?

    Let’s dig in.

    woman working at her kitchen table

    What is shared hosting?

    Shared hosting is like renting a room in a large apartment complex. There are multiple tenants, and each one has a private space (your website), but you all share common amenities like water, electricity, and parking (the server resources). 

    Now, this arrangement can be quite affordable, but it does come with its share of challenges, especially if your neighbors are noisy or, in our case, have high traffic.

    What is managed WordPress hosting?

    Managed WordPress hosting, on the other hand, is more like living in a condo. The building management (hosting provider) takes care of all maintenance and updates, and they’ve invested in top-notch security measures to keep your space safe. In essence, you get a specialized environment optimized specifically for WordPress.

    It is important to note, however, that managed WordPress hosting and shared hosting aren’t necessarily completely separate entities. Managed WordPress hosting plans can be on shared servers, or they can be on VPS or dedicated servers — it all depends on your specific provider. The primary differences lie in what’s handled by the host vs the customer.

    For the purposes of this article, when we refer to “shared hosting”, we’re referencing a standard shared hosting plan that is not managed.

    IT worker in a room of servers

    Shared hosting vs. managed WordPress hosting (7 key differences)

    Let’s roll up our sleeves and dive into the nitty-gritty differences between shared hosting and managed WordPress hosting. From performance to security, price, and support, we’ve got it all covered.

    1. Performance

    Shared hosting

    With a standard shared hosting plan, your website is on the same type of server as everyone else, with the same features, no matter what software they run on their site. While there may be performance features included or available, they typically aren’t catered specifically to WordPress. In general, you’re left on your own to take care of speed optimization. 

    Managed WordPress hosting

    Managed WordPress hosting, however, typically shines when it comes to performance. Servers are optimized, caching mechanisms are advanced, and content delivery networks (CDNs) are streamlined. The hosting provider puts their foot on the gas, focusing on delivering high-speed and reliable performance specifically for WordPress websites. 

    2. Security

    Shared hosting

    When it comes to shared hosting, there are typically some general security features that work for all types of websites. They aren’t specialized to WordPress and you typically need to handle the majority of your site security by yourself.

    But the good news is, even if you’re on a shared hosting plan, you can give your site security a major boost with WordPress security plugins like Jetpack Security.

    Managed WordPress hosting

    Managed WordPress hosting is better when it comes to security. It can come with enhanced measures like regular malware scans, automated backups, WordPress-specific firewalls, and proactive monitoring. The hosting provider steps up to the plate, keeping your site secure and up to date with tools that are designed for WordPress.

    What’s more, some of the best hosting providers partner with trusted security services and plugins. For example, Pressable, which solely has managed WordPress plans, includes Jetpack Security at no additional cost.

    3. Updates and maintenance

    Shared hosting

    In the shared hosting realm, you’re in charge of managing WordPress updates, plugin installations, and overall site maintenance. While this may give you more control, it’s just one more responsibility on top of running your business or blog. And since keeping things updated is absolutely critical for functionality and security, it’s important that you’re always on top of things.

    Managed WordPress hosting

    Managed WordPress hosting, on the other hand, handles core WordPress updates, plugin updates, and security patches for you, allowing you to focus more on creating content and running your website. 

    4. Support

    Shared hosting

    Shared hosting providers usually offer basic technical support, but it can sometimes feel like dialing up a call center. The quality and response time can vary greatly, and there’s a chance you might end up on hold when you really need help. 

    customer service rep in a call center

    And, while support typically can solve basic problems with their services, they have to know a little bit of information about each piece of website software rather than being experts specifically on WordPress.

    Managed WordPress hosting

    Managed WordPress hosting, however, usually provides strong support from knowledgeable staff who can assist with WordPress-related issues, optimizations, and troubleshooting. You know that whoever you’re speaking to is an expert on your specific type of website.

    5. Customization and control

    Shared hosting

    With shared hosting, customization options can be limited. You don’t have full control over server settings and configurations, and these options probably won’t be tailored to WordPress. So, your server may not be set up in a way that’s ideal for your site, but you won’t be able to change it.

    You will, however, have more control over the plugins you use on your site, especially when it comes to things like performance and security.

    Managed WordPress hosting

    Managed WordPress hosting can sometimes be more restrictive when it comes to customization, though this does depend on the type of server you’re using. But the server environment will be optimized for WordPress sites, so you may not even need to make many tweaks, if any.

    Some managed hosting plans also restrict the plugins that you install on your website. So, there may be a tool you’d really like to use, but won’t be allowed to add to your site.

    6. Price

    Shared hosting

    Shared hosting is usually the cheaper option because it doesn’t include as many features and tools. It’s like choosing a no-frills, budget airline.

    Managed WordPress hosting

    Managed WordPress hosting, on the other hand, is akin to flying business class. Yes, it comes at a higher price point, but for good reason. The extra cost covers added features, performance optimizations, and support. It’s a premium service for a premium price.

    7. Target audience

    Shared hosting

    Shared hosting is the jack of all trades. It’s suitable for small to medium-sized websites, blogs, and personal projects with moderate traffic and resource requirements. And it typically has a variety of sites using different software, not just WordPress sites.

    Managed WordPress hosting

    Managed WordPress hosting is ideal for businesses, professional websites, ecommerce stores, or high-traffic sites that require optimal performance, security, and expert support. And for enterprises, a service like WordPress VIP is the way to go.

    WPVIP homepage

    Pros of shared hosting

    1. Affordability

    Shared hosting plans are generally more affordable compared to managed WordPress hosting. This makes them an attractive option for those just starting out, on a budget, or testing the waters of website ownership. It’s about establishing your online presence without breaking the bank.

    2. A range of options

    Just like a supermarket aisle full of breakfast cereals, there’s no shortage of shared hosting providers. Each offers various plans with their own set of features. That means you can browse, compare, and pick the one that fits your needs. From storage space to bandwidth and email accounts, the power is in your hands to decide what matters most for your website.

    3. Suitable for low to moderate traffic

    Shared hosting is not the most powerful of hosting options. However, for websites with low to moderate traffic, it gets the job done. You may not get five-star service, but it’s adequate for your needs, providing a platform for growth as you build your audience.

    4. Flexibility

    While the tools and setup of shared servers may not be tailored specifically to WordPress, you typically have a bit more control. There are no limitations on the plugins that you can install, for example, and you can handle performance and security however you’d like. 

    Cons of shared hosting

    1. Performance limitations

    While you have more control over the performance tools you use with shared hosting, you’ll be responsible for figuring out the right setup for your site. Server resources aren’t allocated specifically based on WordPress requirements and WordPress-specific performance tools typically aren’t included.

    laptop computer with lines of code

    2. Security vulnerabilities

    Again, you may have more control over your security setup, but the server environment also isn’t optimized for the security needs of WordPress. You’re on your own. This is why a top-tier WordPress security plugin is crucial to help you stand strong amidst potential threats.

    3. Lack of specialized support

    Sometimes, you simply need a specialist. Shared hosting providers typically offer basic technical support. But if you’re facing a WordPress-specific issue, they may not have the knowledge to get it resolved quickly.

    Pros of managed WordPress hosting

    1. Enhanced performance

    Managed WordPress hosting is the Formula 1 car of hosting environments, designed specifically for WordPress speed and performance. With features like advanced caching mechanisms and content delivery networks (CDNs), your site can run at top speed, helping your users get a smooth ride every time they visit your website.

    2. Better security

    As we’ve emphasized before, security is critical. Managed WordPress hosting providers often partner with trusted security solutions or plugins like Jetpack Security, adding an extra layer of protection to your site. Features like regular malware scanning, firewalls, and proactive monitoring can go a long way towards protecting your hard work.

    3. Automatic updates and backups

    In the managed WordPress hosting world, updates and backups are often taken care of for you. They’ll ensure your site remains protected and up-to-date. Pair this with a reliable WordPress backup solution like Jetpack VaultPress Backup, and you’re in good hands.

    4. Expert support

    Managed WordPress hosting is like having a team of WordPress experts on your side. With this kind of hosting, you’re getting a wealth of WordPress-specific knowledge and expertise. 

    woman working on a laptop with servers

    Cons of managed WordPress hosting

    1. Higher cost

    As with many things in life, quality comes at a price. Managed WordPress hosting usually carries a higher price tag than shared hosting due to the enhanced features, performance optimizations, and support it provides. 

    2. Limited customization

    Managed WordPress hosting providers may apply certain restrictions on plugins or customization options to maintain server stability and security. This can feel a bit restrictive, especially if you’re used to having more control. But remember, it’s all in the name of keeping your site secure and performing optimally.

    3. Not suitable for all websites

    Managed WordPress hosting comes with a price tag that not everyone can afford. If you’re running a small personal blog with minimal traffic, the cost might outweigh the benefits. But if your website is a significant part of your business or organization, then the extra cost may be justifiable as an investment in your online success.

    4. Dependency on the hosting provider

    No matter the kind of hosting you choose, your site’s availability is dependent on the host. That’s why you should look for providers that guarantee at least 99% uptime. With managed hosting providers, however, you may also be relying on them to keep WordPress and your plugins updated. If they drop the ball for any reason, you may find yourself in an unexpected, tough spot down the road. 

    How to choose between shared and managed WordPress hosting

    list of recommended hosts from Jetpack

    Selecting the right type of hosting for your WordPress site is a critical decision, and there’s no one-size-fits-all solution. Here’s a straightforward, three-step process to help you make an informed choice:

    1. Assess your needs

    Start by assessing your website’s needs. What tools do you want to use on your site? What level of support do you need? Do you have team members who can take care of maintenance tasks, or would they all fall on your plate?

    2. Evaluate your technical skills

    Consider your technical knowledge and comfort level when it comes to managing a website. If you’re technically inclined and have the time to handle site management tasks, shared hosting could be a suitable choice. On the other hand, if you’d prefer to focus on your business and leave the technical stuff to the experts, managed WordPress hosting might be worth the extra cost.

    3. Consider your budget

    Look at your budget. Shared hosting is more affordable, but remember that you get what you pay for. Managed WordPress hosting, while more expensive, offers a lot more value in terms of performance, security, and support.

    It’s not about what’s good or bad, cheap or expensive. It’s about what’s appropriate for your unique situation.

    In summary, choosing between shared and managed WordPress hosting is a decision that requires careful consideration. Weigh your site’s needs, your technical skill level, and your budget to make the best choice. And whatever hosting option you choose, ensure your site’s security is not an afterthought.

    someone working on code on a laptop

    Remember, no fortress is too robust, no lock too strong to keep out every potential threat, and that’s why a security plugin like Jetpack Security is a must-have. It offers robust protection features that work tirelessly to keep your site safe, secure, and running smoothly.

    Jetpack Security: the best solution for WordPress protection

    Regardless of the hosting option you choose, securing your WordPress site should be a top priority. And that’s where Jetpack Security steps in. This powerful plugin offers a robust suite of security features designed to protect your WordPress site from all angles, including:

    1. Brute force attack protection

    Safeguard your site from brute force attacks, a common method used by hackers to gain access to your site. They employ robots to try thousands of username and password combinations per second until they stumble upon the right one. But Jetpack stops these attacks in their tracks, protecting your site and preventing speed bottlenecks.  

    2. Downtime monitoring

    Jetpack Security keeps a watchful eye on your site, ensuring it’s up and running. If it detects any downtime, it’ll notify you right away. It’s like having a security guard who never sleeps, always vigilant and watching over your online property.

    3. Spam protection

    Spam can make your site look unprofessional and drive visitors away. And spam comments can even direct your followers or customers to unsavory websites, where bad actors can steal their information.

    Jetpack Security’s WordPress anti-spam protection feature automatically filters out spam comments from comment and contact forms, so you don’t have to worry about them.

    4. Malware scanning and automatic threat resolution

    With Jetpack Security, you get automated, daily malware scanning to catch threats before they cause damage. It’s an early-warning system that’s constantly on guard. And if it finds a threat, it can often resolve it with just one click.

    Jetpack Scan homepage

    5. Real-time site backups

    Jetpack Security also offers real-time WordPress backups. If anything ever goes wrong, you can quickly restore your site to a previous state. Those backups are stored separately from your server so that they’re protected even if your host is compromised. And if your website is completely down, you can still restore a backup.

    As you can see, Jetpack Security is a powerful tool that can help protect your WordPress site, whether you’re on shared hosting or managed WordPress hosting. It’s not just a plugin; it’s peace of mind.

    Frequently asked questions

    Let’s now address some frequently asked questions to shed more light on this topic:

    What is the main difference between shared and managed WordPress hosting?

    The main difference lies in the level of tools and support offered. Shared hosting is a more affordable solution that provides basic hosting services. On the other hand, managed WordPress hosting provides a suite of advanced features, including automatic updates, enhanced security, and specialized WordPress support.

    Shared hosting vs. managed WordPress hosting — which is best for my website?

    It depends on your needs and your technical expertise. Shared hosting is ideal for small websites run by someone who’s at least moderately experienced with WordPress to manage it. Managed WordPress hosting is better suited for those who don’t have the expertise or desire to take care of website management tasks.

    Is shared hosting suitable for high-traffic WordPress websites?

    Generally, shared hosting may struggle to accommodate high-traffic websites. If your site attracts a lot of traffic, you may want to consider upgrading to a VPS or dedicated hosting plan. 

    Are there any SEO advantages to using managed WordPress hosting?

    Speed and security, both strong suits of managed WordPress hosting, are essential SEO factors. A faster, secure website provides a better user experience, which can help improve your website’s ranking in search engine results. 

    Can I upgrade from shared hosting to managed WordPress hosting?

    Absolutely! Many managed hosting services will help migrate a WordPress site for you. Otherwise, check out our guide on how to migrate a WordPress site

    Is managed WordPress hosting more secure than shared hosting?

    In general, yes. Managed WordPress hosting providers often offer enhanced security features to protect your site from potential threats. However, regardless of the hosting type, using a solid security plugin like Jetpack Security can give your site an extra layer of protection.

    page full of code on a laptop

    Unpacking the value of Jetpack Security

    We all know prevention is better than the cure, but when it comes to cybersecurity, it’s even more profound. One security lapse, one successful hack, can ruin the trust you’ve painstakingly built with your audience. 

    So, let’s break down how Jetpack Security does more than just prevent security breaches. 

    1. It saves you time with automated scanning and resolutions

    Consider the time you could lose trying to find a hidden piece of malicious code in your site’s back-end. Jetpack Security does this for you with its automated malware scanning for WordPress sites. It’s continuously hunting down potential threats, giving you more time to focus on growing your business. 

    And if it finds something, it doesn’t just alert you — it gives you solutions to solve the problem (often with just a single click). We’re talking about swift damage control here, which is vital when dealing with cybersecurity threats.

    Jetpack Security homepage

    2. You’ll get peace of mind from advanced security features

    We’ve already walked through the advanced features that Jetpack Security brings to the table: brute force protection, spam filtering, secure authentication, real-time backups, and more. But let’s talk about the psychological aspect here. 

    Knowing your site is secure allows you to rest easy. It’s one less thing to worry about, one less potential fire to put out. And that peace of mind is worth its weight in gold.

    3. Maintain business continuity with downtime monitoring and site backups

    What if your site goes down in the middle of a peak traffic hour? Or what if you make a major site update and things go sideways? 

    Jetpack Security’s downtime monitoring alerts you the moment your site becomes unavailable, enabling you to spring into action and resolve the issue. Meanwhile, site backups ensure you can easily revert your site to a previous state if needed.

    woman working on a laptop in a server room

    The final word: Shared vs. managed WordPress hosting

    Now that we’ve walked you through the intricacies of shared and managed WordPress hosting, you’re well-equipped to make a choice that aligns with your needs.

    Remember, the decision isn’t about good vs. bad or cheap vs. expensive. It’s about what’s appropriate for you. It’s about making an informed choice that supports your business growth while keeping your peace of mind intact.

    And no matter which path you choose, a reliable security plugin like Jetpack Security can be the strong guardian that ensures you stay on track, maintaining a secure and smooth-running website. 

    At the end of the day, your website is more than just a collection of pages and posts. It’s a representation of your business and your brand. And it deserves the best security you can provide.

  • How to Add a Search Bar to WordPress (5 ways)

    If you run a large or complex website, you likely have lots of pages for visitors to sort through. At times, it may be frustrating and time-consuming for them to find what they’re looking for.

    A search bar is a great way to combat this problem, and adding one to WordPress is simple. If you’re a beginner, you can use the Search Block feature or install a plugin. If you’re looking for something a little more advanced, you can add a search icon to your navigation menu, or edit your theme files to include whatever customizations you’d like.

    In this post, we’ll take a closer look at the role a search bar plays on your website. Then, we’ll show you five methods to add one in WordPress. 

    Why it’s important to include a search bar on your WordPress site

    If your website only has a few pages, it’s probably easy for visitors to find the content or information they’re looking for. On the other hand, for growing business sites, complex ecommerce stores, or popular blogs, it can take a long time for visitors to navigate your pages using the menu alone. 

    Nalgene Search Bar

    The three-click rule is a principle used by most web designers. This rule suggests that a user should be able to find any desired information on your site using three (or fewer) clicks of the mouse. Otherwise, they can become frustrated and abandon your site.

    This means that a search bar is a great way to improve the User Experience (UX).

    With this feature, you can serve your audience the content they desire much faster, reducing bounce rates and increasing the amount of time they spend on your website. 

    Better yet, you can monitor your site’s search data to keep track of the terms and phrases that visitors use most often. This is a great way to discover gaps between what your guests are looking for and what you’re offering to them. With this knowledge, you can confidently plan new initiatives to serve your visitors and grow your efforts.

    Where to place your search bar

    It’s important to make sure your search bar is easily accessible. Therefore, you’ll want it to occupy a prime position. But you also don’t want this feature to distract from your main content, like blog posts and product pages.

    With that in mind, it’s usually a good idea to place a search bar in your website’s header. This way, it will be one of the first elements your visitors see.

    Rolling Stone Search Bar

    Additionally, this enables you to place your search bar beside your navigation menu. This is effective because it allows you to keep the user’s experience consistent. When they arrive on your site, they’ll know to automatically head to the top of the page.

    On the other hand, you might prefer to use your footer or sidebar to accommodate search functionality. These positions are also widely used to support navigation menus, since they don’t interfere too much with the page’s content. If you opt for this approach, it’s best to make sure the search feature is particularly prominent, so it won’t be missed.

    How to add a search bar to WordPress (5 ways)

    Now, let’s take a look at five ways to add a search bar in WordPress. We’ll start with the simplest approach, and work our way down to more customizable options. It’s a good idea to familiarize yourself with all of these approaches, so you can select the one that best fits your needs and experience.

    1. Add a search bar using the Search block

    The first way to add a search bar to WordPress is to use the Search block. Since any WordPress user will be familiar with blocks already, this is one of the quickest and simplest options.

    There are two ways you can add a Search block to your website. First, you can add the block to a specific page or post. Second, you can add the Search block to a template part (like your header) using the Site Editor. Let’s explore how both of these techniques work.

    Add a Search block to a post or page

    One way to use the Search block feature is to add it to a specific post or page (like your homepage). To do this, you’ll need to open the relevant post or page for editing, or create a new one. 

    Then click on the plus (+) icon to add a new block. Enter “search” and select the Search option.

    Search Block

    This will place a search bar directly on your page. Then you can use the toolbar to change the button position, add a button icon, and adjust the alignment.

    Search Block

    Plus, you can use the Block Settings at the left of the screen to alter the width of your search bar, change its colors, and even swap out the font selection.

    Add a Search block using the Site Editor

    If you’re using a block theme, you can also add the Search block to a template part like your header. This way, you can display the search bar across all pages of your site.

    First, you’ll need to make sure you have a block theme activated. Otherwise, you won’t be able to access the Site Editor. 

    Then, navigate to Appearance → Editor in your WordPress dashboard. Click on Template Parts → Header, and select the pencil icon to edit your current website header.

    This will open your header inside the Block Editor, where you can make lots of customizations to your template part.

    Header Template Part

    Choose the plus (+) icon to browse your WordPress blocks for the Search option.

    Header Template Part

    Now, all you need to do is drag the Search block into your header area.

    Header Template Part

    You can use the arrows in the toolbar to move your search bar to the edge of your menu. Then you can access all the same settings as when you add the Search block to a page or post. 

    So, you’re able to change the button icon, adjust the position, and toggle the search label from the toolbar. Plus, in the Block Settings, you can alter the width of the block and change the colors and fonts. 

    Once you’re happy with your search bar, click on Save. Then visit your website in a browser to view the search bar on the front end.

    Homepage

    If you want to make any more changes, you can revisit the Site Editor at any time. You can also use this method to place your search bar elsewhere, such as in your footer.

    2. Add a search bar using the widget panel

    Another way to add a search bar to WordPress is to use the widget panel. This is a beginner-friendly option that’s best suited to those using classic WordPress themes. 

    To add a search bar using the widget panel, you’ll start in your WordPress dashboard. Then head to Appearance → Widgets.

    Here, expand the section where you want to add a search widget. And click the + icon at the bottom. This will open up a list of blocks for your site. Search for, “Search.” Select the search block. 

    Search Widgets

    Now, you can style and customize the search block however you’d like and save to add it to that section of your site. 

    Search Widget Styling

    If you want to change the button, position, or style of your search widget, head back to the Widgets screen and use the toolbar to customize your search bar.

    3. Add a search bar using a plugin

    If you’re looking for an option that’s more flexible but still simple, you might prefer to use a plugin to add a search bar to WordPress. Using a plugin is quick and requires no special know-how, but gives you more control over your search bar than you’ll get from the default WordPress settings.

    Add a search bar with Jetpack Search 

    Jetpack Search, for example, lets site owners nudge visitors in the right direction by customizing results and providing easy-to-use filtering options that are intuitive to use. It’s also smart enough to understand what visitors are looking for, even if they misspell a word or type in a complex, multi-faceted search like, “Bulk jars of tangy poultry seasoning for under $50.”

    Leading interior designer, Kylie. M. Interiors, uses Jetpack Search to more efficiently navigate visitors to one of more than 3,000 articles and reduce the workload for her and her team. 

    Jetpack Search also supports dozens of languages and works lightning fast, providing logical results that update as visitors type. So people can find the right answers before they’re even finished submitting their search. 

    It also integrates seamlessly with your WordPress site for brand consistency and provides insights to site owners about what visitors are searching for. 

    Perhaps most impressively, all of this power comes with minimal performance impact to your site because it operates on the cloud. So, even if thousands of new visitors are searching for content each day, your server resources won’t suffer. 

    You’ll need to start by installing Jetpack Search on your site, and you have two options here:

    • Add the Jetpack Search plugin. This adds just the search functionality to your site, and has both free and premium plans available depending on your usage.
    • Purchase the Jetpack Complete plan. Jetpack Search is bundled in this plan, alongside additional site features for security, growth, and more. 

    In the following steps, let’s say that you choose the Jetpack Search plugin. In the WordPress dashboard, go to Plugins → Add New and search for “Jetpack Search.” Then, click Install now → Activate.

    You’ll be prompted to connect to a WordPress.com account, and can purchase a premium plan if you choose to do so. Once the plugin is set up, go to Jetpack → Search in your dashboard. Here, you can enable the feature, turn on instant search, view data about the searches placed on your site, and more.

    Enable Jetpack Search

    If you’d like to customize the search experience, click the Customize search results button. This will open a new screen with lots of additional options for styling, included post types, and more. For example, you might choose to highlight search terms in your brand color, show additional information for product results, and exclude media files from results.

    Customize search results

    Add your search bar to your site

    Now, you can add the new Jetpack Search experience anywhere you’d like on your site, just as we did earlier in this article. You’ll simply add a Search block using the Block Editor, Site Editor, or Widget panel depending on your specific situation. Jetpack Search will automatically replace the default WordPress setup with the new, instant search experience.

    Product Search

    4. Add a search icon to your header or menu without a block theme

    A header or navigation menu is an ideal place for a search icon, since it’s instantly visible to everyone who lands on your website. 

    If you’re using a block theme, you can add a search bar to your header using the steps detailed above. If you’re using a classic theme, you’ll need to install a plugin like Ivory Search.

    To get started, you’ll need to install and activate Ivory Search in WordPress. Then, go to Ivory Search → Menu Search, and choose the menu where you want to display your search bar.

    Ivory Search

    Click on Save to view all the available settings. For instance, you can select search form styles such as drop-down and full-width.

    Further down, use the toggle to display a search form close icon. Then click on Select Color to apply a menu magnifier icon color.

    Ivory Close Icon

    You can also add a menu title to display instead of the search icon. 

    Finally, select the search form that will control the menu search functionality. Use the drop-down menu to make your selection.

    Search Functionality Options

    Then, click on Create New. This will take you to a new screen where you can give your search form a name and configure your searchable content.

    Search Configuration

    Choose Save Form to generate your search form shortcode. Then you can add it to a widget area, like your header.

    You can view your site on the front end to see the results:

    Homepage Search

    You should see the search icon in your preferred color. When you click on that icon, a full search bar will appear.

    5. Add a search bar manually using custom code

    All the methods we’ve looked at so far have been suitable for beginners. However, this next option requires some technical knowledge, since you’ll need to add and edit code in your theme files. You’ll want to make all changes using a child theme, so that when you update your theme down the road, your code won’t be lost.

    Before you get started, it’s important to make a backup of your WordPress site. That way, if you enter a wrong line of code, you can easily restore your site to a previous version.

    To add a search bar manually, connect to your site via FTP or your hosting provider’s cPanel. Navigate to your website files (typically the public_html folder), then choose /wp-content → /themes → /your-theme. Browse through the files, and find the header.php or footer.php file (depending on where you want to add your search bar).

    Once you’ve found the file you want to use, open it and add this function

    <?php get_search_form(); ?>

    This will call the search form from your searchform.php template. If you don’t have this template yet, the function will create one.

    Your search bar should now be visible on the front end.

    Search from php function

    From here, you can continue to tweak your search form via custom code to look and function exactly how you prefer.

    How to offer the best search experience to your visitors 

    The search experience is a crucial part of your website, since it affects the way customers find and engage with your content. One of the easiest ways to take your search experience to the next level is to use a handy tool like Jetpack Search.

    Jetpack Search

    Jetpack Search is a superb solution for large and complex websites. Once installed, you can present instant search results with advanced filtering to help visitors find exactly what they’re looking for. 

    There’s a free version that can handle 5,000 records and 500 requests per month. 

    The premium version can handle larger sites and a greater search volume, plus you can display an unbranded search bar, so the experience fits in seamlessly with the rest of your site. 

    To get started with Jetpack Search, all you need to do is install and activate it. Then go to Jetpack → Search and scroll down to the settings.

    Enable Jetpack Search

    Here, you can use the toggle to Enable Jetpack Search. You can also toggle on the instant search experience. This will enable dynamic overlay for searching, sorting, and filtering, without forcing visitors to reload the page. Your changes will update automatically, providing visitors with an advanced search experience right away.

    Frequently asked questions (FAQs) about WordPress search

    In case you still have a few questions, let’s look at a few common reader queries regarding search functionality.

    Why should I add a search bar in WordPress?

    A search bar is an easy way to improve your user experience. Small websites might be able to match visitors with the content they’re looking for pretty quickly. 

    However, large and complex sites like ecommerce stores can have hundreds or even thousands of pages. Therefore, visitors might get frustrated trying to find content using the navigation menu alone. 

    A search bar can deliver instant results, and point visitors to where they want to be on your site. This way, you can reduce bounce rates and increase time spent on site. 

    What is the difference between a search bar and a search box?

    ‘Search bar’ and ‘search box’ are interchangeable terms. Both describe a field that is placed on your website (usually in your menu or header). Visitors can enter search terms and keywords into this field to discover content on your site.

    It’s important to note that a search bar is different from an address bar. An address bar is the field near the top of your browser where you can either type in a specific URL or enter search terms. Then a search engine (like Google) matches you with content in its index. The address bar searches the entire web, while the search bar (or box) is tied to a single website.

    How can I improve the WordPress search experience for my visitors?

    A search bar is a great way to provide a stellar user experience, but there are also ways to optimize the search experience.

    For instance, you can place your search bar somewhere that’s easily accessible, like your header, footer, or sidebar. Additionally, you can improve the WordPress search experience by providing live search suggestions.

    Spelling correction is another great tool to make the search experience more accurate. Plus, you might support filtered searches, so customers can find content by searching for specific tags, categories, dates, and more.

    Jetpack Search: A powerful and customizable WordPress search plugin

    One of the easiest ways to keep visitors on your site is to streamline navigation. A search bar enables you to do this because it quickly connects visitors with the content they seek. Better yet, there are lots of easy ways to add a search bar to your website.

    For instance, you can add a search bar to WordPress using the Search block or use custom code and tweak it to meet your needs.

    Alternatively, you might prefer to create this feature with a plugin, which can be one of the best ways to implement a powerful search function on your site. With a solution like Jetpack Search, you can implement quick results and powerful filtering to keep visitors on your site.

    What’s more, you can enable an instant search experience with a dynamic overlay, to generate results even faster. Check out the plans today to get started!

  • WordPress Database: A Detailed Guide with Best Practices

    The WordPress database stores all the information for your site and enables you to make changes to your content. And if you’re new to WordPress, you might not know how to access and use this database. 

    Fortunately, it’s not as complicated as you might think. Once you learn the basics, you can secure your database, resolve errors, and perform vital tasks when you don’t have access to the dashboard. 

    In this post, we’ll take a closer look at the WordPress database. Then, we’ll show you how to access, create, and secure it. Plus, we’ll cover some common database issues and their fixes. 

    What is a WordPress database?

    The WordPress database is a collection of your site’s data. This is where you’ll find all the files and tables to create and manage posts, pages, users, comments, and more.

    To manage this data, you’ll need access to a special type of software. WordPress uses MySQL and relies on Hypertext Preprocessor (PHP) to store and fetch data from the database. PHP is the programming language that WordPress is built on. 

    Why does WordPress require a database?

    Every WordPress site requires a database. Even if your site is small, there’s a lot more going on behind the scenes. 

    Your website is made up of different kinds of data like pages, user information, comments, settings, plugins, theme data, categories, tags, and more. Therefore, you need a separate place to store this information, as your website wouldn’t be able to accommodate all of it. 

    Thanks to the WordPress database, your website can function seamlessly and you (and others) can apply changes. Plus, if you need to switch to a different web host, you can make a copy of the database and move it to the new server, without losing your site’s valuable content. 

    How does a WordPress database work?

    Now that you know what the WordPress database is, it can be useful to understand how it works. When you install WordPress to create a website, you’ll need to create a database to store important information. 

    This process is typically automated, especially when using a managed hosting plan. You can also configure a WordPress database manually, though this requires a fair bit of technical knowledge. 

    Once you’ve created a database, it will reside on your host’s server. Therefore, every time a user requests your website, their browser sends the request to your hosting server. Then, the server sends the data required to display your site, dynamically generating HTML pages.

    WordPress uses MySQL. This software enables the database to store information and provide access to it. 

    Additionally, when data (like comments or posts) needs to be changed or deleted, WordPress sends a MySQL query to the database, instructing the action. It’s important to note that many of these queries work automatically. Therefore, you’ll be completely unaware of this process as you make changes to your site. 

    Some advanced users might prefer to access the database and run these queries manually. This way, you can perform tasks that you can’t do through the dashboard, like changing your account’s username and password. Plus, it can be a much faster way to execute certain commands. 

    What is inside a WordPress database?

    The WordPress database is organized into tables that make it easy to find, view, and edit data on your website. Each table contains a specific type of data. 

    You’ll find one table for posts, one for comments, and so on. These tables often start with the wp_ prefix, so your comments table will be named something like wp_comments.

    Within WordPress tables, you’ll find columns and fields that contain more specific information. So, if you open the wp_comments table, you’ll see fields like comment_ID, comment_author, and comment_date.

    An overview of the tables in a WordPress database

    Now that you know what’s inside the WordPress database, let’s take a closer look at the tables that you can access.

    1. wp_posts

    The wp_posts table contains the data for all content on your site. This isn’t specific to posts. Instead, it extends to pages, products, courses, revisions, custom post types, and any other content on your site.

    2. wp_postmeta

    As the name suggests, the wp_postmeta table supports all the meta information about your content. You’ll find the template used to display the page, custom fields, SEO information, and more.

    3. wp_options

    If you open the wp_options table, you can access most of the settings for your WordPress website. You can edit your site URL and admin URL, change the number of posts per page, adjust the time format, and more. Additionally, wp_options is used by some plugins to store the plugin settings.

    4. wp_users

    The wp_users table is where you’ll find user information like usernames, email addresses, and passwords.

    5. wp_usermeta

    With wp_users, you’ll find a corresponding wp_usermeta table that contains the meta information about users registered on your site.

    6. wp_termeta

    If you’re a standard WordPress user, wp_termeta shouldn’t concern you too much. It’s mainly used by developers to store custom metadata for terms under custom taxonomies. For example, WooCommerce uses wp_termeta to store metadata for product attributes and categories.

    7. wp_terms

    In wp_terms, you’ll find the terms for each of your taxonomies. To help you understand, individual taxonomy items (like tags and categories) are called taxonomies, while each tag and category within the taxonomies are known as terms.

    8. wp_term_relationships

    The wp_term_relationships table is an important one since it manages the relationship between WordPress post types and terms in the wp_terms table. This helps WordPress determine which category each of your posts is in. 

    9. wp_term_taxonomy

    The wp_term_taxonomy table defines taxonomies for terms in the wp_terms table. Here, you’ll find all the data that says your term is associated with a taxonomy called category. This way, WordPress can differentiate between which term is a category, which is a tag, and so on.

    10. wp_links

    Within wp_links, you can access all the information needed to manage blogrolls that were created by earlier versions of WordPress.

    11. wp_comments

    The wp_comments table stores all data concerning your WordPress comments. Therefore, you can expect to find the user’s name, URL, email address, comment, and more.

    12. wp_commentmeta

    Lastly, the wp_commentmeta contains meta information about the comments posted on your site. This table consists of four main fields: comment_ID, meta_ID, meta_key, and meta_value. You might come to this table to check on the status of a comment to see whether it’s been approved, is pending approval, or is logged as trash.

    How to access the WordPress database

    It’s important to note that while you can access the WordPress database, you don’t need to access the database to manage your site. For most users, the WordPress dashboard is sufficient for carrying out the majority of tasks. 

    But there are some situations when it can be useful to access your database. If you’re a beginner, you might like to understand more about your site’s structure. 

    On the other hand, advanced users can access the database to perform tasks that can’t be done through the dashboard. Plus, the database enables you to troubleshoot common WordPress errors if you get locked out of your dashboard. 

    In the next section, we’ll show you two ways to access the WordPress database. Note that, if you’re on a shared hosting plan, you may not have access to the database. Therefore, you might need to ask your web host to make database changes for you.

    1. Using phpMyAdmin

    As we mentioned earlier, your WordPress database is stored on your host’s server. Therefore, you can access it by logging into your hosting account. This method varies depending on your host, but you’ll likely be using phpMyAdmin. 

    Before you get started, it’s important to make a fresh backup of your site in case anything goes wrong. The easiest way to do this is to use a backup plugin like Jetpack VaultPress Backup. If you accidentally delete an important site file, you can replace it with the one stored in your backup. If at all possible, you should use a staging website or development environment when making changes to a database.

    To access phpMyAdmin, you’ll normally need to log into cPanel through your hosting account. Then, look for the Databases section and you should see an option for phpMyAdmin.

    Databases section inside cpanel

    You might need to enter your database username and password to access the software. These should be different from the credentials you use to access cPanel.

    The phpMyAdmin interface should look something like this:

    opening screen of phpMyAdmin

    Next, click on Databases and choose your website from the menu. Now, you should see all the tables within your WordPress database.

    list of tables in the database

    Here, you can click on any of the tables to add, change, or delete data. If you’re making a change to a field, you’ll need to click on Browse. Then, find the exact row that you want to edit, and use the Edit link to do so.

    options to edit, copy, and delete database tables

    Once you’re done editing, click on Go to apply the changes.

    2. Using a WordPress plugin

    If you don’t want to use phpMyAdmin to access the WordPress database, you can use a plugin instead. For example, you might not be comfortable using the interface and would prefer to remain in the WordPress dashboard.

    WP Data Access enables you to perform database tasks without leaving your website. Once you’ve installed and activated the plugin, navigate to WP Data Access in your WordPress dashboard and use the Database dropdown to select your database.

    editing the database in the WordPress dashboard

    Here, you can view all the tables within your database. These are presented similarly to posts and pages in WordPress, so you won’t need to learn a complex layout like phpMyAdmin.  

    When you hover over a table, you’ll see two options: Manage and Explore. If you click on Manage, you’ll be able to control all data on your site. 

    You can rename, copy, or export data. Meanwhile, the ALTER link enables you to edit the table directly.

    using the data explorer to edit tablees

    If you click on Explore, you’ll find details about the table and where it’s used on your site. Note that some tables won’t display any options when clicked.

    How to create a WordPress database

    Now that you know how to access the WordPress database, let’s take a look at two ways to create one for your site. 

    1. Create a database with cPanel

    The easiest way to create a WordPress database is to use cPanel. To get started, log into your hosting account and then the cPanel.

    Now, look for the Databases section and select the MySQL Database Wizard.

    In the Create Database Users area, enter the database name and click on Next Step.

    creating a database with MySQL

    Then, find Create Database Users and create the database username and password. To keep your database secure, make sure that you create a unique and strong password.

    creating a new database user

    Now, click on Create User

    checklist of user permissions

    In Add User to Database, check the All Privileges checkbox and proceed by selecting Next Step. Here, it’s important to take note of the hostname, username, and database name so that you remember them for future reference. 

    2. Create a database with phpMyAdmin

    The next way to create a WordPress database is to use phpMyAdmin. This can be slightly more complicated, but it’s a great solution for users that don’t have access to cPanel.

    To get started, open phpMyAdmin from your hosting account. Then, click on the Database tab at the top of the screen.

    selecting "Databases" in phpMyAdmin

    Here, click on Create database and enter a database name. Then, choose the best configuration option for language and encoding. 

    Now, select phpMyAdmin to return to the main page and navigate to Users. This is where you can create users for your database.

    Click on Add User and enter a name in the User field. Then, create a strong and unique password for the user. 

    You’ll want to leave the options under Global privileges as they are. When you’re ready, select Go and return to the Users screen. 

    Next, you’ll need to configure the correct permissions for each user with access to your database. Click on the Edit privileges icon. In the Database-specific privileges, select the new database under the Add privileges to the Server.localhost database dropdown. Then, click on Go.

    The importance of backing up your database

    Now that you have created a database for your WordPress website, let’s take a look at some of the best backup practices to keep your data secure. 

    1. Schedule regular backups

    Making a backup of your database is great, but it’s important to remember that this isn’t a one-time thing. You must make backups at regular intervals so that you always have a recent copy of your WordPress data.

    The easiest way to schedule regular backups is to use an automated plugin like Jetpack VaultPress Backup.

    Jetpack VaultPress Backup homepage

    Once activated, the plugin will perform a backup of your site. Then, you can navigate to Jetpack → VaultPress Backup to see your backups in the cloud or view your most recent restore point.

    available backups with Jetpack

    Jetpack VaultPress Backup will automatically save your website in real-time, so every single change made on your site — updated pages, new blog posts, customer orders, etc. — will always be available if you need it. The best part? You can restore a backup even if your site is completely down.

    2. Securely store your backups off-site

    It’s important to store backups offsite to keep your database copies safe. If your backups are stored on the same server as your site, they can be just as susceptible to online attacks and malware infections. 

    For this reason, you’ll want to choose a secure location to store your backups. You could download backups to your computer or save them to the cloud. 

    VaultPress Backup is, again, an ideal solution for this as it uses the same secure, off-site servers trusted by Automattic, the people behind WordPress.com.

    3. Have a disaster recovery plan in place

    Having a solid disaster recovery plan can help reduce the time needed to resolve a problem. Otherwise, you might waste precious time troubleshooting the problem. 

    Plus, if something goes wrong, your website might be offline and inaccessible to the public. Not only will you lose traffic and revenue, but this can also damage your reputation.

    Jetpack VaultPress Backup offers one-click restores that are available even if you can’t access your dashboard. Plus, with the app, you can restore from nearly anywhere in the world.

    The importance of securing your database

    While backups are a must-have in case something goes wrong, you should also be mindful of preventative measures to make your database more secure. Let’s look at some of them. 

    1. Use strong passwords

    One of the easiest ways to secure any aspect of your website is to use strong passwords. This goes for your WordPress dashboard, your hosting account, and your database.

    It’s important to use a mix of letters, numbers, and symbols in your passwords. You’ll also want to make them long, using at least eight characters. 

    You can use a password generator to handle the process for you. If you’re worried about forgetting your passwords, you can store them with a password management tool.

    2. Limit access to the database

    Another way to secure the WordPress database is to limit the number of individuals that can use it. Only users that you trust should have access to your site’s data. 

    Additionally, you’ll want to make sure that they understand how to use it. The last thing you want is for a new user to find their way into the database and accidentally delete vital WordPress tables. 

    If you’re using a plugin to access your database, users with certain roles will have the ability to make database changes that could harm your site. 

    For this reason, and for general security-best practices, it’s always a good idea to regularly review your user roles and permissions, making sure that the correct privileges are assigned to the right people. You can do this from your WordPress dashboard by going to Users → All Users. Then, click on Edit and scroll down to Role.

    editing user permissions

    Here, use the dropdown to select the correct role for each user registered on your site. Typically, only administrators will have complete access to the database. 

    The same advice goes for any accounts on your cPanel or hosting provider’s dashboard.

    3. Keep software up-to-date

    Updating software can increase security on your WordPress site. This includes plugins, themes, and WordPress Core. 

    When you have outdated tools on your site, hackers might exploit vulnerabilities in the software to gain entry. Updates typically contain patches for these security flaws, so you’ll want to run them as soon as they’re released. 

    4. Monitor database logs for suspicious activity

    Another way to secure the WordPress database is to monitor logs for suspicious activity. Database logs enable you to track all user activity so that you can see all actions taken on your site, all requests made, and all errors encountered. 

    Typically, you can view your logs through cPanel. Here, you’ll find a Log Viewer where you can monitor these activities:

    database log viewer

    If you use a plugin like VaultPress Backup, you’ll also get access to an activity log that lets you see everything that happens on your website. Note that it will not, however, log changes made directly in the database, but can be an excellent indication of suspicious activity and a handy tool when troubleshooting common WordPress errors

    5. Consider an enterprise security plugin like Jetpack Security

    One of the best solutions for protecting your WordPress database is to use an enterprise security plugin like Jetpack Security. With this tool, you’ll get a suite of advanced features in one installation.

    Jetpack Security homepage

    This includes Jetpack’s Web Application Firewall (WAF), which blocks malicious traffic from reaching your website. Plus, the plugin provides complete comment and spam protection, and conducts automatic malware scans.

    With Jetpack Security, you’ll also get an activity log for your site. This way, you can view every action and find the cause of any issue that arises. 

    The plugin also comes with VaultPress Backup, enabling you to make real-time backups of your website, database tables, WooCommerce data, and more. Better yet, with the mobile app, you can restore your site from any location. 

    How to optimize your database

    Over time, your database performance starts to slow down. This typically happens because the database has grown in size since you first launched your site. Therefore, the query execution time will get slower as your memory overheads increase.

    Fortunately, there are plenty of ways to optimize your WordPress database. One of the quickest methods is to run a MySQL command.

    To get started, open phpMyAdmin and click on your database to see the list of WordPress tables. Then, select the Check All option below the tables and use the With Selected dropdown menu to choose Optimize table.

    optimizing a database table in phpMyAdmin

    This will defragment the selected tables, making queries run a bit faster. Plus, it will slightly reduce the size of the database.

    How to migrate your database to a new server or hosting provider

    You might find yourself in a situation where you need to migrate your database. For instance, you might want to move your site to a new server or hosting provider.

    First, you’ll need to navigate to phpMyAdmin in your current hosting account and select your database in the list on the left-hand side. Then, click the Export tab. 

    You can either choose a Quick export, which is plenty for most websites, or a Custom export, which allows you to configure settings for the database export. Then, click Go, and the file will download to your computer.

    exporting a database

    Now, navigate to your new hosting provider, where you’ll need to create a new database user. This will vary depending on your host, but if you’re using cPanel, you’ll take the following steps:

    Under Databases, select MySQL Databases. Create a database name and click Create Database.

    creating a new database

    Scroll down and find the Add New User section. Create a new user here, keeping in mind security best practices for the password you generate. Click Create User.

    creating a database user

    Scroll to the Add User to Database section. In the User dropdown, choose your new user. In the Database dropdown, choose your new database. Click Add. A new screen will appear, allowing you to set permissions for the new user. Check the box next to All Privileges, then click Make Changes.

    assigning user permissions

    Now, navigate to phpMyAdmin in cPanel and select the new database you created in the left-hand list. Click the Import tab at the top. Upload the database file you saved earlier, then click Go.

    importing a database

    And your database is migrated! Your final step will be to tell your site on the new host that it should use the new database. Note that this step assumes that you’ve already migrated your website files to your new hosting provider.

    Navigate to your File Manager, find your website’s folder (typically public_html) and open the wp-config.php file. Find the following block of code:

    /** MySQL database username */
    
    define('DB_USER', ‘sample_username’);
    
    /** MySQL database password */
    
    define('DB_PASSWORD', ‘27839hafgdl’);

    Replace the username and password with the ones you created for your new database, being sure to keep the quotation marks in place. In the example above, you’d replace ‘sample_username’ with ‘new_username’ and ‘27839hafgdl’ with ‘newpassword’. And that’s it! 

    If you’re looking for a simpler solution, you can use a plugin like Duplicator to export and import databases between sites.

    Common database uses

    At this point, you might be wondering how to utilize the WordPress database. Let’s look at four common use cases. 

    1. Edit post or page content

    One of the most popular ways to use phpMyAdmin is to edit post or page content from the interface. All you need to do is open phpMyAdmin from your hosting account. Then, click on Databases and select the database for your website.

    Next, locate the wp_posts table. This is where WordPress stores all content like posts, pages, custom post types, and more.

    selecting the wp_posts table

    Here, you’ll see a list of all content items on your site. You can also see information like the post status and comment status for each of your pages and posts.

    Once you find the post that you want to modify, click on the Edit link. Then, you can change the post content, post title, comment status, post excerpt, and more.

    editing post information

    Once you have finished making changes to the post, click on Go at the bottom of the screen to save your work.

    2. Change user information

    You might also find it useful to change user information from the phpMyAdmin interface. For instance, you might wish to reset your WordPress password.

    To do this, launch phpMyAdmin and select your database. Then, locate the wp_users table and click on Browse

    Now, you’ll see a list of all the users registered on your site. Click on Edit next to the user account that you need to change.

    Here, you’ll see all the user fields that you can edit, like the username, email, password, and more.

    editing user password information

    To change the password for your user, you’ll need to delete the value in the user_pass field and enter a new one. Under the Function column, select MD5. Then, click on Go to save the changes.

    3. Update WordPress settings

    As we mentioned earlier, the wp_options table contains most of your site-wide settings. You can access this table via phpMyAdmin to update settings like the time format, site URL, plugin configuration, and more.

    To get started, launch phpMyAdmin and select your database. Then, open wp_options and locate the row you need to change.

    You’ll see plenty of fields here, like admin email, site URL, posts per RSS, and more.

    changing site information in the database

    Click on Edit next to the setting you want to change. Then, enter a new value into the field and click on Go.

    4. Delete plugins or themes

    There are times when it might be necessary to delete a plugin or theme from your website via phpMyAdmin. This is often the case if you’ve encountered a WordPress error (caused by a problematic plugin), leaving you without access to your WordPress dashboard.

    Additionally, even when you delete themes and plugins from your dashboard, some tools leave behind rows and tables in your database. Over time, this data can mount up and start to affect your site’s performance.

    In this instance, you can launch phpMyAdmin and find your WordPress database. Depending on the plugin, there can be traces of it in multiple database tables. That’s why the best method to delete plugins in phpMyAdmin is to use the Search feature.

    searching in phpMyAdmin

    For instance, if you want to delete the WooCommerce plugin from your site, enter “woocommerce” into the search bar. Under Find, check the option that says all the words. Then, select Go.

    choosing search settings

    Here, you’ll see a list of all the fields and tables where the plugin stores data on your site.

    list of search results

    As you can see, there are traces of WooCommerce in tables like wp_posts, wp_users, and wp_options.  

    Click on Browse to open the table. Then, you’ll want to filter the table to find every instance of WooCommerce. Enter “woocommerce” where it says Filter rows.

    finding "woocommerce" in database tables

    Select all the relevant rows and click on the Delete link. Then, you can go through all the other tables where the plugin stores data and repeat the same steps. 

    Common database issues and their causes

    When accessing and editing your WordPress site, you might run into some issues. Typically, you’ll know if it’s a database issue because you’ll see the following error message: “Error establishing database connection”.

    Other signs of a database issue are:

    • Images missing from your site
    • Content missing from your site
    • The “No update required your WordPress database is already up-to-date” error

    Meanwhile, some common causes of database issues include:

    • Incorrect database access credentials
    • Connection errors
    • Corrupt database tables
    • A hacked database 

    It’s a good idea to work your way through the list and eliminate each of the potential problems. You can check your connection on your operating system and make sure you’re running the latest version of your browser. It’s also useful to double-check your database credentials in your hosting account. 

    As we mentioned earlier, you might also want to optimize your database using a simple MySQL command to ensure faster performance.

    Frequently asked questions about the WordPress database

    Although we’ve tried to provide a complete guide to the WordPress database, you might still have some questions. Let’s answer some of them. 

    Where is the WordPress database stored?

    The WordPress database is stored on your web host’s server. Therefore, you can access it through cPanel. If your host does not provide access to cPanel, you might be able to use a plugin to access it. It’s important to note that the WordPress database is sometimes inaccessible to those on shared hosting plans.

    Can my WordPress database be stored on a separate server?

    Yes, but you’ll need to make sure that the MySQL server allows the database to be accessed by an external server. You can export the current database and create a new one on another server.

    Then, in wp-config.php, find define (‘DB_HOST’’localhost’) and add the IP address of the server instead of localhost.

    Can I export my WordPress database to use on another website?

    Yes, there are various ways to export the WordPress database. The easiest option is to use the built-in export tool in your dashboard. To access the tool, go to Tools → Export.

    exporting a database in WordPress

    Then, select the content that you want to export and download your export file.

    You can also use a plugin like Duplicator to export your WordPress database. For advanced users, you can export your database manually using phpMyAdmin.

    What happens if I accidentally delete a record from the WordPress database?

    If you delete a row like wp_posts, you’ll lose all the content on your site. Meanwhile, if you delete a row like wp_options, you’ll lose your site settings. This can have a negative impact on your search engine rankings. Plus, your website may suffer downtime as you repair the issue.

    That’s why it’s important that you assign the correct permissions to users on your site. That way, only those with technical knowledge can access and edit your database.

    On top of that, it’s a good idea to install a backup recovery plugin like Jetpack VaultPress Backup. Then, even if you accidentally delete a record from the database, you can easily restore your site to an earlier version. 

    What are the best practices for backing up the WordPress database?

    One of the best ways to secure your website is to make frequent backups. With a plugin like Jetpack VaultPress Backup, you can also back up your entire database. 

    You’ll also want to store your database backup in a different location than your server. You might download it to your computer, or save it in a remote location like the cloud.

    It’s important to make sure that you can restore your site quickly should something go wrong. Otherwise, you can lose out on traffic and revenue. 

    With VaultPress Backup, you can restore your site in just one click. Plus, if you use the Jetpack mobile app, you can even get your site up and running again from almost anywhere. 

    How can I ensure the security of my WordPress database?

    It’s important to maintain top levels of security for your WordPress database since this is where vital information is stored. For instance, anyone with database access can edit content on your site, change user passwords, and delete entire tables.

    Therefore, consider limiting the number of people with access to your database. In fact, you should make sure that only those you trust have these privileges. Additionally, you can educate them on how to interact with the interface to reduce the likelihood of accidents.

    You’ll also want to enforce strong passwords on your site. Ideally, they should contain a combination of letters, numbers, and special characters. 

    Finally, you’ll need to make sure that software, like plugins and themes, is kept up-to-date. This will help protect your database against cyberattacks. 

    WordPress database: The power of independence at your fingertips 

    While you don’t need to understand how the WordPress database works to run your website, this knowledge can come in handy. For instance, you might need to edit user information, troubleshoot common errors, or perform certain actions when you can’t access your dashboard. 

    Your database is stored on your web host’s server, and you can access it via phpMyAdmin. You can also create a new database in phpMyAdmin and perform tasks like configuring site-wide settings. 

    Protect your WordPress site

    After all the hard work you’ve put into learning how to work with your site’s database, building the perfect site, and developing a strong flow of visitors and users, you don’t want anything to stop your progress. 

    Jetpack’s top-tier WordPress security plugin not only provides a best-in-class, real-time, cloud-based backup solution, but also features that prevent most issues and resolve many others in just a few clicks. 

    From malware scanning to spam prevention, downtime monitoring, brute force attack protection and more — Jetpack’s got your back.

    Don’t risk losing your hard work — get Jetpack Security today

     

  • How to Install and Configure WordPress on Localhost (Full Guide)

    Utilizing a localhost for your WordPress site enables you to run updates, test plugins, or build your site in private. This means you can make changes without affecting the user experience (UX) or worrying about mistakes that could disrupt operations. 

    Sounds pretty great, right? Even better is that most moderately-experienced developers will find it straightforward to get started. 

    By following this step-by-step guide, you should be able to download the localhost software, add WordPress files, and create a database without any issues.

    In this post, we’ll take a closer look at WordPress localhost and its benefits. Then, we’ll show you how to configure WordPress on localhost and run through some common errors.

    What is localhost, and why is it useful for WordPress?

    When you create a WordPress site, you typically purchase a domain name and choose a web hosting provider. Your site resides on your web host’s server and is accessible to anybody with the correct URL. 

    With localhost, you can run a website from your own operating system like a PC. This means it will have a different hardware configuration than a live website. Plus, your site won’t be available online.

    You’ll create a private and remote environment, using your PC storage as the host. Then, you’ll download third-party software like XAMPP to install WordPress.

    XAMPP homepage with download information

    There are many reasons why you might want to use localhost. First, it enables you to create a development site that you can use for testing and experimentation. 

    In this instance, WordPress will function as a staging site. This is a popular option for designers and developers since you can detect issues before you launch your live application. Better yet, localhost enables you to work on your website even if you don’t have an internet connection. 

    Additionally, a local website provides a safe environment for trying new things. This can prevent downtime on your live website in the event that a change introduced breaks something.

    Localhost can also be a safer way to test new software or run updates. You won’t need to worry about breaking your site. If something goes wrong, your live site will remain completely unaffected.

    Can you install WordPress locally on any operating system?

    There are many platforms that enable you to install WordPress locally, but XAMPP tends to be the most user-friendly. 

    What’s more, XAMPP is open-source and free, and it supports all operating systems including Mac, Windows, and Linux. When you visit the official XAMPP website, you’ll see all the different versions of the software. Then, you can download the version that’s compatible with your operating system. 

    What are the requirements to install WordPress on localhost?

    To install WordPress on localhost, you’ll need a fully-functioning operating system like a PC to store your website files. This will work as a virtual server, which is equivalent to a web host’s server that you’d use for a live site.

    You’ll also need to download software like XAMPP. There are plenty of tools that enable you to create a local environment. WAMP, MAMP, LAMP, and Vagrant are other popular options. 

    XAMPP tends to be an excellent choice for WordPress, since it’s free and open-source. Plus, it works on a variety of systems including Windows, OS X, and Linux.

    Once you’ve downloaded the XAMPP software, you can install it along with WordPress. You’ll also need to make sure to select three modules from the control panel. These are Apache, MySQL, and PHP.

    How to install WordPress on localhost

    Now that you know a bit more about localhost, let’s take a look at how to install WordPress on Localhost using XAMPP. 

    Step 1: Download XAMPP 

    The first step is to download the XAMPP software from Apache Friends. You can access XAMPP for Windows, Linux, or OS X.

    download options for XAMPP files

    Choose the version that matches your operating system. The download will start automatically and may take a few minutes.

    Once downloaded, run the file to launch the XAMPP importer. If you have an antivirus program installed, you might see a warning, but you can proceed with the installation.

    You might also get a warning about User Account Control (UAC). In most cases, you should just continue through that prompt and any others that come up. 

    Then, you should see the installer screen. Here, click on Next.

    XAMPP setup wizard

    Now choose which components you want to install. It’s important to note that you don’t need all the components for WordPress. Instead, you’ll need the required ones plus MySQL and phpMyAdmin.

    choosing components to install

    You can install additional components. For instance, you might want email-related features if you plan to send or debug transactional emails. So, go ahead and uncheck everything you don’t need. Then, hit Next.

    Now, choose which folder to install XAMPP into and select your preferred language.

    choosing an installation folder

    You’ll be notified that you can opt to install Bitnami for XAMPP. This is not needed for WordPress, but it can make the process slightly simpler. 

    If you continue without Bitnami, click on Next to run the installation.

    XAMPP installation process

    When this is complete, you can launch the control panel and start working with XAMPP.

    Step 2: Run the modules

    To install XAMPP and WordPress, you’ll need three specific modules:

    • Apache (the web server that XAMPP relies on)
    • MySQL (the database that WordPress uses)
    • PHP (the programming language that WordPress is built on)

    You can start these modules from the XAMPP control panel. The status of each one should turn green once it’s launched.

    choosing modules in XAMPP

    Then, test to see that the local server is working properly by going to http://localhost in a web browser.

    welcome screen for XAMPP

    If it was successful, you’ll now have a functioning XAMPP server on your operating system.

    Step 3: Add the WordPress files

    Now that you’ve downloaded XAMPP and run the modules, it’s time to install WordPress. To do this, navigate to the official WordPress website and download the latest version of the software by clicking on Get WordPress.

    downloading WordPress

    You’ll see that there’s an option to get set up with a hosting provider. This only concerns users who want to create a live WordPress site. 

    Since you want to install WordPress on localhost, click on Download WordPress 6.2.

    options for downloading WordPress

    At this point, WordPress will download to your computer. 

    Now, on your computer, head to the folder where you installed XAMPP. This might be named something like C://xampp

    Open the folder and locate the htdocs subfolder:

    finding the htdocs folder

    In htdocs, create a new folder for your site. The name of this folder will become the sub-name used to access your site. You might name the folder “testsite” if you’re using WordPress localhost as a staging site. 

    Then, you would access your site by going to http://localhost/testsite. When you’ve created the folder, extract the WordPress zip file that you downloaded at the start of this step.

    Step 4: Create your database 

    At this point, you’ve downloaded XAMPP, run the modules, and downloaded WordPress. Now, it’s time to create a MySQL database for your WordPress installation. 

    First, you’ll need to launch phpMyAdmin from your XAMPP control panel. To do this, click on the Admin button for MySQL.

    installing MySQL

    Inside phpMyAdmin, select the Databases tab.

    phpMyAdmin dashboard

    Then, enter a name for your database and select Create.

    That’s it! You can now move on to the last step.

    Step 5: Complete the WordPress installation

    The final step only requires a few tasks to complete the WordPress installation. First, visit your local website, where you should see the normal WordPress installer. You can find your website by typing http://localhost/url into the address bar. 

    Everything is the same as it would be for any other WordPress site except for the database details. Instead, you’ll need to enter the database details like this:

    • Database name: name of the database you created in phpMyAdmin (you set this up in Step 4 of this guide)
    • Username: “root”
    • Password: leave blank

    Complete the rest of the process. Now, you should see a fresh WordPress install running on your localhost.

    How to move WordPress from localhost to a live server

    To move WordPress from localhost to a live server, you can use a WordPress migration plugin like Duplicator. This will export your files from the local installation. Then, you’ll need to create a database on your live server and copy over your files using an SFTP client like FileZilla

    How to transfer WordPress localhost to another computer

    You can transfer WordPress localhost to another computer by exporting your website and database to another system. There are plenty of plugins to help you do this, like All-in-One WP Migration.

    You can also use the built-in WordPress import and export tools. You can find these in your WordPress dashboard by going to Tools → Export.

    export options in WordPress

    If you’re an experienced WordPress user, you can also transfer WordPress localhost to another computer using phpMyAdmin. This process requires you to export your old database and create a new one on the new PC.

    How to uninstall WordPress on localhost

    Once you’ve completed your tests, updates, or experiments in the local environment, you might want to uninstall XAMPP. To do this on Windows, open the Control Panel and navigate to Programs and Features. Then, locate the XAMPP app and right-click on it to delete it.

    Now, navigate to the C:/xampp folder (or whichever folder you used for XAMPP) and delete any remaining files and folders on your computer. 

    Common WordPress localhost issues and how to resolve them

    So far, we’ve tried to provide as much detail as possible to help you install and configure WordPress on localhost. But there are some WordPress localhost issues that you might encounter. 

    So, in this section, we’ll discuss some of the most common issues and show you how to fix them.

    1. Installation failed: Could not create directory

    The first WordPress localhost issue that you may encounter is when the installation fails. There are three situations when you might see this error:

    • You install a theme or plugin in the WordPress dashboard.
    • You update a plugin or theme.
    • You upload files directly to the wp-content folder.

    Typically, the “installation failed” error occurs on new WordPress sites. You might be seeing the message because the permission settings are incorrect. Or, you might not have enough free space on your system. 

    Therefore, you can clear the error by checking your file permissions. In your WordPress dashboard, go to Tools → Site Health. Then, click on the Info tab and scroll down to Filesystem permissions.

    Ideally, all the files will be listed as “Writable.”

    fillesystem permissions in WordPress

    If they say “Not Writable,” your permissions aren’t configured correctly. 

    Fortunately, you can change the permissions by accessing your site files. To do this, you can connect to your site via FTP. Then, go to public_html and locate the following folders: 

    • wp_content 
    • wp_includes 
    • wp_admin

    Right-click on each of the folders (one at a time) and choose File Permissions.

    finding the wp-admin folder

    Check that the options are set to the following values:

    • Owner permissions: Read, Write, Execute
    • Group permissions: Read, Execute
    • Public permissions: Read, Execute
    • Numeric value: 755
    • Recurse into subdirectories
    • Apply to directories only

    Click on OK and return to your site to see if the error has cleared.

    2. Login not working

    Another common WordPress localhost issue is that the login procedure doesn’t work. In this case, you’ll need to navigate to phpMyAdmin to resolve it. 

    First, it’s important to make a backup of your website since this might require you to edit important site files. Therefore, if you make a mistake, you won’t need to worry about losing your work.

    The easiest way to create a backup of your site is to use a reliable plugin like Jetpack VaultPress Backup.

    Jetpack VaultPress Backup homepagee

    VaultPress Backup makes real-time backups that are stored securely in the cloud. The tool will store your backups for 30 days, and you can restore your site to a previous version in just one click. 

    Not only does VaultPress backup save your website, but it also secures all your database tables. Plus, the plugin also saves a copy of all WooCommerce customer and order data. 

    Once you’ve installed and activated your backup plugin, open phpMyAdmin and find the config.inc.php file. Here, you can check your login details. Then, return to the login screen and enter the values. 

    3. This site can’t be reached

    If you see an error message that reads “This site can’t be reached,” it means there’s something stopping the browser from accessing the website. For example, you might be lacking an internet connection, or you might be facing DNS (Domain Name System) issues.

    First, you’ll need to temporarily disable any antivirus software, firewall, or proxy service, since this can interrupt the connection. Then, you can check your internet connection and clear your browser cache. 

    In Google Chrome, click on the three dots in the top-right corner. Then, choose More Tools → Clear Browsing Data.

    clearing browser cache in Chrome

    If this doesn’t work, it can be useful to flush your DNS settings. To do this, check out Error 6: error_err_connection_refused further down. 

    Alternatively, you might simply need to change your DNS provider. Google Public DNS tends to be a safe solution.

    Google Public DNS page

    The method for doing this varies depending on which operating system you use. For Mac users, you can change your DNS provider by going to System Preferences.

    Then, click on Network → Advanced.

    troubleshooting wifi connection

    Open the DNS tab and click on +.

    DNS settings on a computer

    Now, type in the numbers for the public server you want to use. Click on OK → Apply to change the settings.

    4. Error establishing a database connection

    When you install and configure WordPress on localhost, you can often run into database connection issues. This usually indicates that there’s incorrect database information in your WordPress settings or an unresponsive database server.

    To resolve this error, you can check your database credentials. These are stored in your wp-config.php file, so you can access the file through SFTP. 

    Once you’ve opened the file, make sure that the following credentials are correct:

    • Database name
    • Username
    • Password
    • Database host 

    You can also check your database credentials using phpMyAdmin. Once you’ve opened phpMyAdmin, click on wp_users.

    wp_users table in phpMyAdmin

    Then, find the user listing and click on the Edit link. Here, you can see the user ID, password, and more for each user on the site. 

    If these values aren’t correct, you can change them here. Simply delete the existing values and enter new ones. Then, click on Go to apply your changes.

    You can also reboot your server. To do this, all you need to do is start and stop the server from your XAMPP control panel. 

    5. Error err_ssl_protocol_error

    The err_ssl_protocol_error can present itself in a number of different ways. For instance, you might be told that your site can’t provide a secure connection or that localhost sent an invalid response.

    Sometimes this issue can be easily resolved by clearing your browser cache. To do this in Google Chrome, see Error 3: This site can’t be reached

    You can also try using your site’s DNS entry instead of the URL. So, in this case, you’d type something like: http://127.0.0.1:8080 into your browser instead of http://localhost:8080

    6. Error err_connection_refused

    The err_connection_refused error is another common localhost issue. It’s likely due to a misconfigured port. It might also indicate incorrect permissions or alert you to the fact that the Apache web server is not running properly.

    If it’s an issue with WordPress permissions, see Error 1: Installation failed. If you want to change the port number, go to Error 13: XAMPP Apache shutdown unexpectedly. You can also disable your firewall or antivirus program since this might be blocking the connection.

    The next solution is to flush your DNS, since this can fail if it’s storing too many records. To do this, open the command prompt by typing “cmd” in the search bar next to the start menu. 

    Now, enter the following command: ipconfig/flushdns

    You can also make sure that Apache is definitely running. Go to the XAMPP control panel. If it says Start then the server must have stopped running and was likely the cause of the err_connection_refused error.

    7. 404 page not found error

    If you see the 404 page not found error when you try to install and configure WordPress on localhost, it means that the requested page can’t be found on the web server. Typically, this indicates that another program is on the port (port 80).

    Fortunately, you can clear the error by changing the port number. To do this, see Error 13: XAMPP Apache shutdown unexpectedly. 

    If you’ve already tried this solution, and you’re still seeing the 404 page not found error, the problem may be that you’re not adding the port number to every URL that you type in the browser. For example, you might need to enter: http://localhost:8080 instead of just http://localhost.

    8. WordPress localhost asking for FTP credentials

    Another common issue with WordPress localhost is that your site might start asking for your FTP credentials. Typically, this occurs when you try to run an update or install a new theme or plugin.

    It’s generally the result of WordPress having insufficient permissions. Therefore, you can try changing the permissions. To do this, see Error 1: Installation failed

    You can also try to force WordPress to use the direct PHP method for updates (rather than using FTP). You can do this through your wp-config.php file, using SFTP. 

    Once you’ve opened the wp-config.php file, add the following line of code: 

    define(‘FS_METHOD’,’direct’);

    Make sure to save your changes. Then, head back to WordPress to see if the error has cleared. 

    9. Images not showing

    Whether you’re using WordPress on localhost or a live WordPress site, you might encounter an error that prevents images from showing. This means that the path toward the images is broken. 

    The first step is to check that your WordPress Address (URL) and Site Address (URL) match. All you need to do is go to your WordPress dashboard and click on Settings → General.

    WordPress address and site address settings

    Then, check to see whether the name of the folder where your images are stored is added to the URL. This folder might be named uploads or images.

    Now, navigate to Settings → Permalinks.

    permalink settings in WordPress

    Here, you can select Post name for the permalink structure. Then, save the changes and see whether your images are now showing. 

    10. WordPress localhost is very slow

    Your WordPress localhost website may be slow if you have too many plugins or poor code on your site. Therefore, it’s a good idea to make sure you only have the resources you need. 

    Slow websites and poor code can leave your website more susceptible to security threats. The best way to stay ahead of these issues is to use a plugin like Jetpack Protect

    Jetpack Protect homepage

    Once installed, you’ll get access to automated security and malware scans to keep your website safe. Better yet, the plugin can pick up vulnerabilities in the core software and any plugins and themes on your site. 

    If you want even more protection, check out the Security bundle available with Jetpack. It comes with all the benefits of Jetpack Protect, plus real-time backups and additional features. 

    If WordPress localhost is running very slow, you can also try using the raw IP address for localhost. This can be effective as some systems (like Windows) don’t directly support the type of connection that MySQL uses when localhost is specified.

    To get started, you’ll need to access your wp-config.php file. Here, make sure DB_HOST is not set to localhost. 

    Instead, change it to define(‘DB_HOST’,’127.0.0.1’);

    Then, save the changes and return to your site to see if the problem has been resolved. 

    11. XAMPP maximum PHP execution time exceeded

    The “XAMPP maximum PHP execution time exceeded” error is quite easy to fix. You’ll just need to edit a line of code in one of the XAMPP configuration files.

    Open the XAMPP control panel and click on the Config button next to Apache. In the dropdown list, choose the option for PHP (php.ini).

    selecting php.ini file in XAMPP

    This will open the php.ini file where you can search for the following line: 

    Max_execution_time

    The value should be set to 120. To clear the error, you can increase the value.You might try doubling it to 240. 

    12. XAMPP maximum file size exceeded

    Another common XAMPP localhost issue is the “XAMPP maximum file size exceeded” error. You might see this error when you try to upload a file to the local WordPress site that you created with XAMPP. 

    Again, you’ll need to find the php.ini file within your XAMPP configuration file. But this time, search for the following line: upload_max_filesize 

    Typically, this is set to 40M. To resolve the error, you can try increasing this value. It’s also important to note that when you edit the php.ini file, you’ll also want to make the same change to the post_max_size number.

    13. XAMPP Apache shutdown unexpectedly

    When you see the “XAMPP Apache shutdown unexpectedly” error, the likelihood is that something has gone wrong with Apache, causing it to crash. Apache is the web server that XAMPP relies on, so this error will mean that your local site will also stop working.

    This error suggests that another program might be using the same port as XAMPP. Since ports only support one program at a time, Apache will stop working. 

    Skype is one program that uses the same default port as XAMPP. The good news is that the error is easy to fix as long as you have access to your XAMPP dashboard. 

    First, you’ll need to launch XAMPP. Then, go to Apache → Config. Here, choose the option Apache (httpd:conf).

    The default port for XAMPP is 80 (this is used for most HTTP programs), so you can redirect Apache to port 8080. In the Apache file, press Ctrl + F and enter “80” to search for every instance of 80.

    redirecting Apache to port 8080

    Then, change the following values:

    • Port 80 to Port 8080
    • Listen 80 to Listen 8080
    • Change servername localhost: 80 to servername localhost: 8080

    Now, go back to your XAMPP control panel and revisit Apache → Config. This time, select the file Apache (httpd-ssl.conf). 

    Open the file and press Ctrl + F to search for 443. Port 443 is typically used for secure web transactions, but Apache also needs it. 

    In this file, you need to change two instances of 443:

    • Listen 443 to Listen 4433
    • <VirtuaHost_default_:443> to <VirtualHost_default_:4433>

    Then, restart Apache by clicking on the Stop and Start buttons in XAMPP.

    14. XAMPP 403 access forbidden error

    The final WordPress localhost issue to discuss is the XAMPP 403 access forbidden error. Typically, this occurs when you try to access your database using phpMyAdmin. 

    One of the most common causes of the 403 forbidden error is a misconfiguration in one of the XAMPP configuration files. So, to resolve the issue, you’ll need to open your XAMPP control panel. Then, click on Apache → Config.

    From the dropdown list, select httpd-xampp.config file.

    selecting httpd-xampp.conf

    Once you’ve opened the file, look out for the following line of code that starts with: Alias/phpmyadmin

    Within that code block, you should see a line that reads: Require local

    Now, change that line to say: Require all granted

    At this point, the 403 access forbidden error should clear, giving you access to phpMyAdmin.

    Frequently asked questions about configuring WordPress on localhost

    Although we’ve tried to cover the basics of how to install and configure WordPress on localhost, you might still have some questions. Let’s take a look at the most common ones. 

    Is localhost a web server?

    Localhost is the hostname or computer that runs the program. In this instance, the computer becomes the virtual server for your application. This virtual server is offline and stores your site data the same way that a web host’s server would if you were running a live website. 

    Can someone access your localhost?

    You can share your web server with someone else, but they’d need to have your IP address or your hostname. You can find this information on Windows with ipconfig/all on a command line.

    WordPress localhost vs live server: what are the main differences?

    Localhost is a virtual server that can be stored on your computer. Plus, it’s kept offline, so it isn’t accessible to the public. 

    On the other hand, a live server generally requires a web host that stores your website’s data. Meanwhile, you’ll need to purchase a domain name. This way, anyone on the internet can find your site by typing the URL into the browser. 

    What are the benefits of using localhost for WordPress development?

    There are many benefits to using localhost for WordPress development. Since the website is kept offline, it creates a private space for you to test out functionality or experiment with new features. 

    What’s more, any changes that you make in localhost will leave your live website completely unaffected. Therefore, you can experiment freely without worrying about things going wrong. Then, once you’ve verified that updates or plugins are working (and safe), you can easily push them to your live website. 

    This enables you to preserve your UX. So, while you get creative in your local environment, people can still visit and interact with your live website.

    How do you access WordPress on localhost?

    To access WordPress on localhost, you’ll need to have a local server like XAMPP set up on your computer. Then, you can install the WordPress files. For full details, check out the tutorial above. 

    Once you’ve successfully installed and configured WordPress on localhost, open a web browser and enter this address: http://localhost/filename.

    In this case, “filename” refers to the directory of your local server where you installed WordPress. Here, you should see the WordPress login page where you can enter your username and password to access your site.

    How do you log into WordPress on localhost?

    You can log into WordPress on localhost in the same way that you’d log into a live WordPress website. All you need to do is enter the correct URL into the browser. 

    Usually, it looks something like this: http://localhost/yoursitename. Then, add the login page suffix like /admin or wp-login.php at the end of the address. 

    How do you reset a localhost WordPress password?

    You can’t reset your localhost WordPress password by email (unless you’ve enabled the mail function on your server). This is because the mail function is turned off by default on local servers.

    Therefore, to reset your password, you’ll need to open phpMyAdmin by typing the following URL: http://localhost/phpmyadmin. Then, you’ll need to provide your MySQL password and username. Generally, the username is “root” and no password. 

    Then, select your WordPress database and find the wp-users table. Here, click on the Edit link next to the username of the administrator.

    editing user information in phpMyAdmin

    This opens a form where you can edit the information for that user.

    editing a user's password

    Scroll down to user_pass and type a new password in the value column. Then, select MD5 in the Function column and click on Go to save your changes.

    Can you send an email from WordPress on localhost?

    By default, the mail function is disabled in localhost, so you can’t send an email from WordPress. But you can enable emails by installing a plugin like WP Mail SMTP.

    In this instance, the plugin will take over the default email delivery function and route emails through an SMTP provider. You’ll need to choose an SMTP provider like Sendinblue, which works particularly well for WordPress websites. Then, you can follow the installation wizard in the WP Mail SMTP to set this up successfully.  

    Can you access WordPress localhost from another computer?

    Yes, you can access WordPress localhost from another computer, but you’ll need the local IP address and the port number. So, instead of simply entering the website’s address, it will look something like this: http://192.168.0.4:80/wordpress.&nbsp;

    Is XAMPP safe?

    Yes. XAMPP is open-source, free, and safe to use as a local server for your WordPress website. 

    Does XAMPP install PHP?

    XAMPP is one of the most popular PHP development environments. It’s an Apache distribution containing PHP, Pearl, and MariaDB so yes, it does install PHP. But you’ll still need to install WordPress separately to set up WordPress on localhost. 

    Can you run multiple local WordPress sites under XAMPP?

    Multisite is a network of more than one website that operates off the same WordPress installation. Even if you run your website on a local computer under XAMPP, you can install WordPress Multisite. 

    You’ll need to have a standard WordPress installation running first. Then, you can add more sites under a subdomain or a subdirectory. 

    Localhost: A powerful tool for WordPress developers

    WordPress on localhost is a great tool for designers and developers since it enables you to create a safe, private environment to test out new features and functionality. Better yet, the live website will still be available for visitors and remains completely unaffected by the changes you make in the local environment. 

    What’s more, it’s simple to install and configure WordPress on localhost when you use software like XAMPP. Once you’ve installed XAMPP, you can run the necessary modules and then download the latest version of WordPress. Then, you’re ready to add the WordPress files and create your database. 

    For most developers, it’s also important to find a reliable backup plugin like Jetpack VaultPress Backup so that it’s easy to restore your website in case anything goes wrong. Plus, you can use Jetpack Protect to access a powerful security and malware scanner.

    Another useful tool is the Jetpack Agency Program.

    details about the Jetpack Agency Program

    This is an all-in-one platform that enables you to manage site security, plugins, and licenses. Additionally, you can get your very own Jetpack partner manager to help you grow your business. Meanwhile, you can access your websites from any location using the user-friendly mobile app. 

    Get started with localhost for WordPress 

    WordPress on localhost is an ideal solution for designers and developers to experiment with new software. It’s also handy for new website owners who want to build their websites offline. While it’s slightly more complex, you can install and configure WordPress on localhost fairly easily.

    To recap, here are five steps to install and configure WordPress on localhost:

    1. Download XAMPP.
    2. Run the modules.
    3. Add the WordPress files.
    4. Create your database.
    5. Complete the WordPress installation.

    Jetpack for Agencies is another useful development tool. You can monitor every action on your site with an activity log, access your websites from the mobile app, and get your own Jetpack partner manager. Get started today!

  • How to Improve First Input Delay (FID) in WordPress

    As your site traffic increases, you’ll want to ensure that things continue to run smoothly. If visitors have to wait more than a few seconds for your page to load, they’ll likely leave your site and may never come back.

    Fortunately, there are some simple tests to evaluate your performance and, if improvements are needed, there are solutions that can almost immediately improve your loading times

    In this post, we’ll discuss one aspect of site performance: First Input Delay. You’ll learn what it is, why it’s important, and how you can measure and improve the FID score on your WordPress site.

    An introduction to first input delay

    First Input Delay (FID) is the loading time a visitor experiences after interacting with your website for the first time. Essentially, when someone clicks on a link or taps a button, they have to wait for their browser to respond. If your site has a high FID score, visitors wait for longer periods.

    FID is one of the main metrics of Core Web Vitals. Created by Google, this report measures the performance of web pages.

    screenshot of Google Core Web Vitals assessment

    Here are the three main performance metrics that are included in the Core Web Vitals report:

    • Largest Contentful Paint (LCP): this measures the time it takes your website to load after a user requests the URL.
    • First Input Delay (FID): this is the time it takes your website to respond after a visitor interacts with a page.
    • Cumulative Layout Shift (CLS): this measures all the layout shifts that occur while a page is loading.

    Although all of these metrics evaluate your website’s user experience, your FID score is one of the most important. If your page doesn’t load quickly, it can leave a poor first impression. In fact, a one-second delay can decrease visitor satisfaction by 16 percent. 

    Here are some benefits of improving your FID score:

    Potential causes of a poor FID score

    When you run a Core Web Vitals test, the report will give you a First Input Delay score. An acceptable FID is 100 milliseconds or less.

    chart showing a breakdown of FID scores and meanings

    A poor FID score is anything higher than 300ms. This can be caused by a few different factors. 

    One of the most common causes of high First Input Delay is heavy JavaScript code. If a browser has to execute a large JavaScript file, it can be too busy to execute other requests.

    Having too many JavaScript-based plugins can negatively affect your loading times. Similarly, some themes can have complex files that cause the same problem.

    Another factor can be third-party scripts. If your website has many third-party analytics codes and tags, this can increase your page’s latency. Sometimes, browsers can prioritize these scripts, delaying the loading of other content on your site.

    How to measure your website’s FID score

    Now that you know what First Input Delay is, it’s time to put your website to the test.

    There are several Core Web Vitals tools you can use to check your FID. If you receive a poor report from any of these tools, you can take action to improve your website.

    1. PageSpeed Insights

    One well-known tool you can use is PageSpeed Insights. This enables you to assess your website’s performance on a variety of factors.

    After you enter your website’s URL, PageSpeed Insights will give you a detailed performance analysis. At the top of the page, you can see whether your site has passed the Core Web Vitals assessment.

    core web vitals assessment from Google PageSpeed

    Using this report, you can review your website’s FID score, which will be measured in milliseconds. As we mentioned earlier, any score under 100ms will pass the test.

    Note that you’ll need to check your site’s performance for both mobile and desktop browsers. You might notice slight differences in your FID score on these two devices.

    This is one of the fastest ways to measure the First Input Delay on your website. If you need a quick overview of your web performance, this could be the right tool for you. 

    2. Google Search Console

    Similar to PageSpeed Insights, Google Search Console is a free tool that you can use to evaluate site performance. With this service, you can view traffic data for your site and troubleshoot specific issues like First Input Delay.

    To start using Google Search Console, you’ll have to verify your website ownership. There are several ways to do this, but we’ll outline the HTML file upload method. Start by entering your domain or URL prefix.

    options to verify website with Google Search Console

    Then, download the HTML file that has been generated for you. You’ll need to upload this file to your site’s root directory before you can employ the features of Google Search Console.

    After verification, you’ll be able to access your dashboard. Here, you can navigate to the Core Web Vitals tab.

    Google Search Console dashboard

    Unlike PageSpeed Insights, it may take some time to access your report if you’re new to this tool. Also, you may not be able to see a report if your site doesn’t get enough visitors.

    Google Search Console can give you similar metrics on your FID score. You’ll receive an evaluation of Poor, Needs Improvement, or Good based on real-world usage data. 

    3. Lighthouse

    Lighthouse is a web development tool that you can use to audit the performance of any web page. Although it doesn’t directly measure First Input Delay, it will give you the Total Blocking Time (TBT). You can use this as a proxy for FID.

    Put simply, TBT evaluates how well your site responds to user input. It measures the total time your browser is too busy (completing tasks like running JavaScript or parsing CSS) to respond to user input between FCP and TTI.

    To view Lighthouse’s report on your website, you’ll need to right-click on your web page. Then, choose Inspect.

    inspecting with Google Lighthouse

    At the top of the generated code, find the double arrow icon. Then, click on it and select Lighthouse.

    On the next page, you’ll see an option to generate a report. When you click on this, Lighthouse will audit your website.

    generating a Lighthouse report

    After the audit is complete, you can view detailed analytics on your site’s performance. You’ll also see reports on your SEO and web accessibility.

    Then, scroll down until you see Metrics. In this section, you’ll see your Total Blocking Time.

    metrics shown from Google Lighthouse

    Although TBT and FID are similar, it’s important to note that FID is a field metric. Since it’s based on users in real-time, it can’t be measured in a lab setting. 

    Lighthouse is a lab metric tool, so its Total Blocking Time metric won’t assess real interactivity. Fortunately, improving your TBT score can also improve your First Input Delay.  

    How to reduce first input delay in WordPress

    When you test your website using one of the above tools, you might receive a poor First Input Delay score. Fortunately, you can improve your score by implementing a few effective strategies. 

    Let’s look at how to reduce First Input Delay in WordPress.

    1. Install an optimization plugin

    An easy way to get started is to install a plugin that focuses on Core Web Vitals. By doing this, you can improve your First Input Delay without any heavy lifting.

    Jetpack Boost is a powerful, easy-to-use plugin that you can use to optimize your Core Web Vitals. It provides many ways to boost your web performance and improve your FID score.

    After activating Jetpack Boost, the tool will automatically give your site a performance score. You can view how fast your pages load on both mobile and desktop views.

    Jetpack Boost page speed analysis

    Then, you can customize its settings to optimize your files for fast loading. Deferring JavaScript will likely be the most effective in improving FID, though optimizing CSS may also save parsing some large CSS files in certain circumstances. Enable both of these, and you’re likely to see an improvement in your FID score. 

    settings available with Jetpack Boost

    Jetpack Boost is a free plugin. If you already have Jetpack installed on your WordPress website, you can activate Jetpack Boost from the dashboard.

    2. Defer render‑blocking JavaScript

    Another effective way to optimize your FID score is by deferring render-blocking JavaScript. By default, all JavaScript on your website is render-blocking. This means that a browser will stop loading a certain page until it can download and execute these scripts.

    In this case, you can defer JavaScript execution. This will tell the browser to render the most relevant content first. 

    To identify this render-blocking JavaScript, you can use PageSpeed Insights. First, type your website’s URL into the search bar.

    Then, scroll down to the Opportunities section. Here, you’ll see suggestions for improving your web performance. Find where it says Eliminate render-blocking resources.

    list of render-blocking resources

    When you expand this section, there will be a list of resources that you can defer or eliminate altogether. On the right-hand side, PageSpeed Insights will show you how these changes can impact your loading time.

    Once you decide to defer non-essential JavaScript on your website, you can use a plugin to make this process simple. With Jetpack Boost, you can do this in just one step.

    In your WordPress dashboard, navigate to Jetpack → Boost. Then, find the setting labelled Defer Non-Essential JavaScript.

    deferring non-essential JavaScript with Jetpack Boost

    Finally, turn on this feature. When implemented, the switch will turn green. Now, try running your website through PageSpeed Insights again to see if your FID score has improved. 

    3. Defer non‑critical CSS

    When you evaluate your website in PageSpeed Insights, you may also see other render-blocking resources. Similar to JavaScript, certain coding can prevent your page from loading while the browser reads them.

    Just like with JavaScript, you can defer non-critical CSS. Start by running your website through a performance tool to see if your CSS needs to be optimized.

    list of render-blocking CSS

    Then, you can use the Jetpack Boost plugin to optimize your CSS. In your WordPress dashboard, navigate to Jetpack → Boost. Then, find the setting labelled Optimize CSS Loading.

    optimizing CSS loading with Jetpack Boost

    After you click on this option, the plugin will automatically generate the critical CSS for your website. It will move this important information to the beginning of the page, which can help your content load faster.

    Deferring non-critical CSS can enhance your overall performance. In some circumstances, it could also improve your FID score on PageSpeed Insights. 

    4. Eliminate unnecessary JavaScript

    If you installed a lot of plugins or a complex theme, your website could be running too many scripts. If a browser needs to execute a long list of scripts to load your website, it can lead to slow speeds. 

    Many scripts are necessary to display your website, but chances are, you have some unnecessary CSS and JavaScript. If you’re not certain how to tell the difference, you can go back to PageSpeed Insights.

    Like you did with the first three methods, scroll to the Opportunities section. This time, look for unused JavaScript and CSS.

    list of unused JavaScript on a website

    Next to each unused script, there will be a URL that tells you where it’s coming from. In this example, Google Analytics and Google Tag Manager were creating some unnecessary JavaScript.

    If you know which theme or plugins are causing the problem, you might consider deleting them. Then, you can install different versions that are well-coded and more lightweight. 

    Alternatively, you can use a plugin like Asset CleanUp to remove unused CSS and JavaScript. This tool can eliminate render-blocking resources to decrease your site’s number of HTTP requests.

    Once you’ve installed and activated Asset Cleanup on your site, go to Asset CleanUp → CSS/JS Manager in your dashboard. On this page, you can select different elements of your website to view its CSS and JavaScript. 

    For example, you can click on Homepage, and it will display all the loaded files on this page.

    Asset Cleanup dashboard

    This information will be listed based on location. You can scroll down the page to see scripts from your plugins, themes, core software, and third-party sources.

    There are two ways to remove a piece of script. You can unload it on this specific page or site-wide.

    options for removing a script

    Once you remove unused scripts, click on Update. After this, you can clear your cache to immediately apply these changes.  

    5. Minify CSS and JavaScript

    Although you can easily remove scripts from your site, you’ll only want to get rid of the ones you’re not using. For necessary CSS and JavaScript, you can simply minify them instead.

    Jetpack Boost makes this process easy, with toggles that you can just turn on. After installing and activating the plugin, go to Jetpack → Boost in your WordPress dashboard. 

    additional settings from Jetpack Boost

    Then, turn on the options for Concatenate JS and Concatenate CSS. These tools will group your code and minify it for optimal performance.

    6. Delay JavaScript execution time

    To optimize your JavaScript even further, you can delay its execution time. This involves telling the browser to only load the JavaScript after a user interacts with your content. Unless a visitor scrolls down the page or clicks on a button, these scripts won’t be processed.

    Note: This could potentially have the opposite effect (while helping improve your LCP score) so you may want to try other tips in this article first. If you do proceed with this, check your score right away and determine if it’s improved before proceeding with other optimization tasks. 

    To do this, you can use a plugin like Flying Scripts. With this tool, you can delay the execution of JavaScript files until there’s visitor activity on your site.

    After you activate Flying Scripts, go to Settings → Flying Scripts. This will open the settings page for the plugin, where you can start implementing JavaScript delays.

    Flying Scripts settings

    Start by writing keywords that identify the scripts you want to delay. For example, you can use “gtag” for a Google Tag Manager script.

    Then, you can implement a timeout. Essentially, this will execute the JavaScript when there has been no activity for a certain period of time. You can set a timer for up to ten seconds. Once you’re finished, click on Save Changes.

    7. Implement a content delivery network

    Another effective option for improving your First Input Delay is to use a Content Delivery Network (CDN). This is a group of connected servers that can distribute your online content to users across the world. 

    When using a CDN, you can decrease the distance between your server and online visitors. This is because when someone visits your site, the content is delivered from the server that’s closest to their location. If you only have a single server in one location, it can take a long time to send data to international users.

    Luckily, sites that utilize Jetpack already come with a free CDN. If you navigate to Jetpack → Settings → Performance, you can turn on the Site Accelerator.

    Jetpack will optimize your images and static files. Unlike with other CDN providers, there’s no file limit. Plus, you won’t have to worry about extra monthly fees or a complicated management process. 

    Frequently asked questions about First Input Delay

    So far, we’ve looked at how First Input Delay works and how you can improve your score. Now, let’s look at some common questions about FID. 

    How can I measure my WordPress site’s FID score?

    You can easily measure your website’s First Input Delay score using a tool for Core Web Vitals. PageSpeed Insights is an easy-to-use option. All you have to do is enter your site’s URL and the tool will generate a detailed report on your site’s performance.

    Google Search Console functions very similarly. After you verify that you own a website, you can view your FID report based on real-world visitor data.

    You can also use Lighthouse. This tool gives you your site’s Total Blocking Time (TBT). Although this won’t display results from real visitors, it can give you a better understanding of your page responsiveness.

    What is a good FID score?

    Put simply, your site will fall into one of three scores:

    • Good: 100 milliseconds or less
    • Needs Improvement: ranges from 100ms to 300ms
    • Poor: greater than 300ms

    After you measure your FID score, any results over 100 milliseconds will require some adjustments. 

    How can I easily optimize my FID score?

    You can improve your FID score by optimizing the scripts on your website. Usually, complex JavaScript and CSS files will prompt a browser to stop loading until it processes them. By removing, deferring, or minifying scripts, you can boost your site’s speed.

    Although you can use different tools for this process, Jetpack Boost can help you implement multiple solutions at once. Using this plugin, you can optimize your CSS structure and defer non-essential JavaScript.

    Improve your first impression

    When a new visitor interacts with your website, they expect their browser to respond quickly. If your site has a high First Input Delay (FID), it can cause users to leave the page without reading your content. By focusing on your site’s response time, you can improve the user experience and retain more visitors.

    Your website can have a poor FID score due to heavy and inefficient JavaScript and CSS coding. Fortunately, you can easily identify these issues using a tool like Google’s PageSpeed Insights. Then, you can install a plugin like Jetpack Boost to minify or defer CSS and JavaScript.

  • How to Choose the Best Hosting for WordPress (2023 Guide)

    A website is like your physical storefront — it’s your virtual chance to showcase your business, welcome customers, and close deals. But just as the foundation of a building must be strong and secure, the hosting of your WordPress website must be, too.

    Whether you’re a one-person business or a rapidly-expanding startup, choosing a hosting solution is a vital decision that can significantly impact your website’s performance, security, and overall success. In this comprehensive guide, we’ll walk you through the essential considerations and factors to help you navigate the maze of options and find the perfect match for your business.

    In addition to the guide below, take a look at the list of our recommended WordPress hosting providers.

    1. Understand the types of WordPress hosting

    Finding the perfect host for your WordPress website requires an understanding of each type of hosting solution. In this section, we’ll demystify the options, so you can make a solid choice.

    Shared hosting

    Shared hosting is the equivalent of renting a room in a house full of tenants. You share the server’s resources with other websites. It’s an economical option for startups and small businesses. However, if one website on the server experiences a surge in traffic or a security breach, it could affect the performance and security of your website. You also tend to have fewer resources allocated to your site, since you’re sharing a finite number with everyone else.

    Virtual private server (VPS) hosting

    VPS hosting is like upgrading to a townhouse from a cramped apartment. You still share the server, but resources are divided into separate virtual environments. This provides better performance and more control over your website. VPS is ideal for businesses that have outgrown shared hosting but aren’t quite ready for dedicated server hosting.

    Managed WordPress hosting

    Managed WordPress hosting is like having a personal butler for your website. The hosting provider takes care of technical aspects like updates, backups, and security. This allows you to focus on growing your business. Managed hosting is best for those who want a hands-off approach to website maintenance.

    Dedicated server hosting

    Dedicated server hosting is the equivalent of owning a single-family home. You have an entire server to yourself, with unparalleled control, performance, and security. However, it comes with a hefty price tag and is best suited for large businesses or high-traffic websites. And it typically requires more maintenance, so you’ll either need to have some server management experience or hire someone who does.

    Cloud hosting

    Cloud hosting is like having an ever-expanding floor plan. Your website is hosted on a network of servers, allowing you to scale resources as needed. This offers flexibility and performance without the need for a dedicated server. Cloud hosting is ideal for businesses with fluctuating traffic or those anticipating rapid growth.

    2. Determine your WordPress hosting needs and budget

    Before diving into the sea of hosting providers, it’s essential to assess your needs and budget. This will help you narrow down your options and find the best fit for your business.

    Traffic and bandwidth requirements

    Estimate your website’s traffic to determine the amount of bandwidth needed. High-traffic websites require more resources, so look for hosting plans that offer generous bandwidth allowances or even unmetered bandwidth. 

    If you’re just starting, it’s unlikely that you’ll need to account for massive amounts of traffic. However, if you have an aggressive marketing plan or expect national exposure, you may want to plan accordingly. It’s somewhat common for unprepared sites to crash when they get sudden, unexpected exposure from major influencers or national press.

    If you’re moving your site from another platform or buying an existing property, you can reference Google Analytics or Jetpack Stats data to help you make a more informed decision.

    Storage space requirements

    Consider the amount of storage needed for your website’s files, databases, and emails. Websites with large media files or extensive databases may require more storage space than others. Ensure the hosting plan you choose offers enough to accommodate your needs, and allows you to easily scale as you grow.

    Images are often the biggest offenders when it comes to taking up website space. Learn how to optimize and compress images in WordPress

    Memory needs

    Memory is different from storage in the sense that it’s space used temporarily to process data. Once that’s complete, the data no longer takes up space unless it’s moved to storage. 

    WooCommerce, for example, recommends a minimum WordPress memory limit of 256MB, though it’s possible to run with less if you’re willing to sacrifice performance (you shouldn’t be). 

    Popular sites can receive numerous requests simultaneously, and a lack of memory can overwhelm its ability to process data. This can crash a site or, at the very least, make it run very slowly. 

    Ensuring your host allocates enough memory to process all the plugins and features on your website is just as important as having enough storage.

    Website security requirements

    Security should be a top priority for every business. Assess the level of security your website needs, including protection against hackers, malware, and DDoS attacks. Some hosting providers offer built-in security plugins such as Jetpack Security, while others may let you figure out security on your own.

    Technical expertise and control requirements

    Determine how much control you want over your server environment. If you have the technical expertise, you may prefer a hosting solution that allows for more customization. On the other hand, if you prefer a hands-off approach, managed hosting may be a better fit.

    Budget constraints

    Evaluate your budget to ensure that you choose a hosting plan that offers the features you need at a price you can afford. Keep in mind that some providers offer promotional pricing for the first term, which may increase dramatically upon renewal.

    3. Look for reliability and uptime guarantees

    A website that’s constantly down is like a store with its doors locked — customers can’t access it, and you lose potential sales. Reliability and uptime are crucial factors when choosing a hosting provider.

    Service Level Agreements (SLAs)

    Examine the hosting provider’s Service Level Agreement (SLA) to understand their uptime guarantees and the compensation offered for any downtime. A good SLA should guarantee at least 99.9% uptime, ensuring your website is accessible the vast majority of the time.

    Historical uptime performance

    Review the provider’s historical uptime performance to determine if they consistently meet their SLA guarantees. Look for third-party downtime monitoring services or independent reviews that track uptime data for a less biased view.

    Redundancy and backup measures

    Inquire about the hosting provider’s redundancy and backup measures to ensure your website’s data is safe and recoverable in the event of a disaster. A robust backup solution should include daily or weekly backups, offsite storage, and easy restoration options.

    You’ll also want an independent, real-time WordPress backup solution from a third party. This way, your investment is protected in case your host is compromised. 

    Jetpaack VaultPress Backup homepage with info about the tool

    4. Consider server performance and speed

    People won’t stick around for a slow-loading site. In addition to strong WordPress performance optimization for your site, ensuring your hosting provider offers excellent server performance and speed is vital for a positive user experience and improved search engine rankings.

    Server hardware and infrastructure

    Investigate the hosting provider’s server hardware and infrastructure to ensure that they use up-to-date, high-quality components. Look for providers that use solid-state drives (SSDs), as they offer faster data retrieval compared to traditional hard drives.

    Content delivery networks (CDNs)

    Instead of serving your website to everyone around the world from a single location, a content delivery network (CDN) stores your website’s content in locations around the world and serves it to visitors from the location nearest to them. CDNs help reduce latency and improve page load times. Check if the hosting provider offers CDN integration or if you can easily set up a free third-party CDN such as Jetpack CDN

    Caching technologies

    Caching technologies store and serve frequently-accessed data, reducing server load and improving website performance. Look for hosting providers that offer built-in caching solutions or support popular caching plugins.

    Server location and latency

    Choose a hosting provider with data centers located near your target audience to reduce latency and improve page load times. If your audience is spread across multiple regions, consider using a CDN to further enhance performance.

    5. Check the hosting provider’s security measures

    Your site and host should be like a fortress, keeping unwanted visitors out to protect valuable contents inside. Evaluating the hosting provider’s security measures is essential for safeguarding your website and customer data.

    Firewalls and intrusion detection systems

    Ensure the hosting provider uses firewalls and intrusion detection systems to protect your website from hackers and other security threats. These security measures act as a barrier, preventing unauthorized access to your server environment.

    Secure Socket Layer (SSL) certificates

    An SSL certificate encrypts data exchanged between your site and visitors. They’re essential for protecting sensitive customer data. In fact, they’re so important that Google includes SSL certificates in their ranking factors and some browsers will display bright red warning labels on sites that don’t have them. Look for hosting providers that offer free SSL certificates or support third-party SSL installation. 

    If you need one, learn how to get your own free SSL certificate

    Malware and virus scanning

    Check if the hosting provider performs regular malware and virus scanning to protect your website from threats. Some providers offer built-in scanning tools, while others may require additional plugins or services.

    Data encryption and backup

    Data encryption and backup are crucial for protecting your website’s data from unauthorized access or loss. Look for hosting providers that offer encryption options and robust backup solutions. Ideally, you’ll also install a WordPress backup plugin that provides more control and keeps your backups safe if your server is compromised.

    6. Evaluate technical support and customer service

    Choosing a hosting provider with exceptional support and customer service is essential for resolving issues quickly and efficiently.

    If you’re not an experienced developer — and aren’t working with someone who is — this becomes even more important. Without good support, your site could go down for long periods of time during an emergency. 

    Available support channels

    Evaluate the hosting provider’s support channels, such as live chat, email, phone, or ticket systems. Multiple support options ensure you can reach out for help in a way that’s convenient for you.

    Response times and availability

    Inquire about the hosting provider’s response times and availability. Look for providers that offer 24/7 support and quick response times to minimize downtime and frustration.

    Technical expertise and knowledge base

    Assess the technical expertise of the hosting provider’s support team to ensure they can effectively assist you with any issues. Additionally, a comprehensive knowledge base with tutorials, guides, and FAQs is invaluable for self-help and troubleshooting.

    Customer reviews and satisfaction

    Read customer reviews and testimonials to gauge overall satisfaction with the hosting provider’s support and customer service. Look for patterns in feedback, such as consistently slow response times or unresolved issues.

    7. Review pricing plans and add-ons

    Carefully review each hosting provider’s pricing options to ensure you’re getting the best value for your money. Remember to account for introductory offers that may expire after your initial commitment period. 

    Plan features and limitations

    Examine the features and limitations of each hosting plan to ensure it meets your needs. Look for any restrictions on bandwidth, storage, or the number of websites you can host.

    Payment terms and renewal rates

    Review the hosting provider’s payment terms and renewal rates. Some providers offer discounted pricing for the first term, which may increase significantly upon renewal. Understand these pricing changes to avoid unpleasant surprises.

    Additional services and features

    Investigate the hosting provider’s additional services and features, such as website migration, domain registration, or email hosting. These extras may be included in your hosting plan or available as paid add-ons.

    8. Check for user-friendly interfaces and control panels

    Choose a hosting provider that offers an intuitive control panel and website management tools.

    Control panel features and customization

    Evaluate the hosting provider’s control panel features and customization options. Popular control panels like cPanel or Plesk offer extensive functionality and are widely supported.

    screenshots of cPanel dashboard

    Access and permissions management

    Examine the hosting provider’s access and permissions management options. This is especially important if you have a team working on your website and need to grant varying levels of access to different users.

    Website management tools and applications

    Explore the website management tools and applications offered by the hosting provider. Look for an automated installation for WordPress, as well as tools for managing databases, email accounts, and domains.

    9. Look for WordPress-specific features and compatibility

    Since WordPress powers your website, it’s crucial to choose a hosting provider that offers features and compatibility tailored to the platform.

    WordPress installation and configuration

    Ensure the hosting provider offers a one-click WordPress installation or streamlined setup process to simplify the installation and configuration of your WordPress site.

    WordPress security

    Implementing strong security measures is paramount for protecting your website from threats. Consider hosting providers that offer built-in security features or include popular security plugins. 

    Jetpack, for example, is considered to be the best all-around WordPress security plugin. Jetpack’s Security plan includes a comprehensive array of prevention, detection, and recovery options for a wide variety of threats. From brute force attack prevention and malware scanning with one-click fixes to downtime monitoring and real-time backups with quick restore options, it provides unparalleled peace of mind.

    WordPress backups

    Regular backups are essential for safeguarding your website’s data and ensuring quick recovery in case of data loss or corruption. Consider hosting providers that offer automatic backups. 

    However, you shouldn’t solely rely on your host’s backups as an issue that takes down your site may have also compromised your servers, rendering those backups useless.

    Jetpack VaultPress Backup plugin page

    Jetpack VaultPress Backup is a reliable plugin, providing real-time backup and easy restoration features. It’s also included as part of the comprehensive Security plan for Jetpack. 

    WordPress performance optimization

    Optimizing your WordPress site’s performance can improve user experience and search engine rankings. Look for hosting providers that offer built-in performance optimization features or support plugins that help enhance your site’s speed. 

    Jetpack Boost is one such solution, offering features such as critical CSS generation, deferring of non-essential JavaScript, and lazy image loading. Discover more about Jetpack Boost here: https://jetpack.com/boost/

    Jetpack Boost homepage with information about the tool

    10. Read reviews and compare hosting providers

    Before making a decision, it’s essential to gather as much information as possible about your top hosting provider candidates. Reading reviews and comparing providers can help you make an informed choice.

    Independent reviews and ratings

    Examine independent reviews and ratings of the hosting providers you’re considering. Look for unbiased opinions from reputable sources, such as industry experts, bloggers, or publications.

    Social media feedback and recommendations

    Social media can be a treasure trove of customer feedback and recommendations. Browse the hosting providers’ social media pages and search for mentions of their services to gain insight into customer satisfaction and common issues.

    Direct comparison of features and pricing

    Create a side-by-side comparison of the features and pricing offered by each hosting provider. This will help you visualize the differences and make a more informed decision based on your needs and budget.

    Word-of-mouth recommendations and referrals

    Don’t underestimate the power of word-of-mouth recommendations and referrals. Consult your professional network, friends, or online communities to gather personal experiences and opinions about the hosting providers you’re considering.

    Make an informed decision 

    Finding the best hosting for your WordPress website is a critical decision that can impact your business’s online presence and growth. By understanding the different types of hosting, assessing your needs and budget, and carefully researching and comparing hosting providers, you can find a solution that serves your needs and protects your investment for years to come.  

    Want to get recommendations from a trusted source? See the hosts recommended by Jetpack.

    Frequently asked questions about WordPress hosting

    Where can I find recommended WordPress hosting providers?

    There are several sources to find recommended WordPress hosting providers, such as independent reviews, community forums, and industry experts’ opinions.

    Additionally, you can explore the hosting providers recommended by trusted WordPress partners, such as Jetpack. Jetpack’s recommended hosting providers have been vetted for their compatibility, performance, and reliability.

    Discover Jetpack’s recommended hosting partners.

    Jetpack's page of recommended hosting providers

    How can I migrate my existing WordPress site to a new hosting provider?

    Migrating your WordPress site to a new hosting provider typically involves the following steps:

    1. Create a full backup of your existing site, including all files and databases.
    2. Set up an account with the new hosting provider.
    3. Upload your site files and import the database to the new hosting environment.
    4. Update the DNS settings of your domain to point to the new hosting provider’s servers.
    5. Test your site to ensure everything is working correctly and resolve any issues.

    Some hosting providers offer free website migration services.  

    Ready to make a change? Read our full guide to migrating a WordPress site

    How often should I back up my WordPress site?

    To be safe, you should always have an off-site, real-time WordPress backup solution in place. This way, every time you make a change on your site, it will be safely stored, and you’ll never lose your work again. 

    Should I back up my site with my hosting provider or a third-party service?

    For maximum safety, you should have backups from both your hosting provider and a third-party backup plugin. Many hosting providers include automated backups as part of their hosting plans, while others may charge extra for this service. The frequency of backups, how securely they’re stored, and what they include can vary. 

    Third-party backup services, such as Jetpack VaultPress Backup, provide specialized features and options tailored for WordPress sites. Consider factors such as cost, ease of use, and restoration options when selecting a backup solution.

    It’s also important to understand that if your server is compromised in any way, such as an error from your provider or a hack, you may also lose your backups. That’s just one reason that also using a third-party plugin is critical.

    How important is website security for a WordPress site?

    Website security is crucial for any WordPress site, as it helps protect your site from hackers, malware, and other potential threats. This allows you to safeguard your customers’ data, maintain your online reputation, and prevent downtime or data loss. Learn more about WordPress security

    What security features should I look for in a hosting provider?

    When evaluating a hosting provider’s security features, look for the following:

    • Firewalls and intrusion detection systems to prevent unauthorized access.
    • Regular malware and virus scanning.
    • SSL certificate support to encrypt data exchanged between your site and its visitors.
    • Secure data encryption and backup solutions.
    • Support for security plugins, such as Jetpack Protect, to enhance your site’s security.
    • High-quality customer support services.

    How can I protect my WordPress site from malware and viruses?

    To protect your WordPress site from malware and viruses, follow these best practices:

    What are uptime guarantees, and why are they important?

    Uptime guarantees refer to the percentage of time a hosting provider promises to keep your website accessible and online. These guarantees are essential, as they indicate the hosting provider’s commitment to maintaining the availability and reliability of your site. A higher uptime guarantee, such as 99.9%, minimizes the chances of your website experiencing downtime, ensuring a positive user experience and protecting your online reputation.

    How can I monitor my WordPress site for uptime and performance?

    Monitoring your WordPress site for uptime and performance can be done through various methods, including:

    • Using website monitoring tools and services, such as Jetpack, which check your site at regular intervals and notify you in case of downtime or performance issues.
    • Installing performance monitoring plugins, like Jetpack Boost, which provide features such as site performance metrics and one-click enhancements.

    Regularly monitoring your site’s uptime and performance helps you identify and address issues promptly, ensuring a smooth and satisfying user experience for your visitors.

    Jetpack: Enterprise-grade security and backups for all WordPress sites

    It’s essential to emphasize the critical role that security and backups play in the success and safety of your website. Jetpack offers powerful, enterprise-grade solutions accessible to all WordPress websites.

    Jetpack Protect offers features such as malware scanning with one-click fixes, instant threat notifications, and a robust web application firewall (WAF), ensuring your website remains safe from cyber threats. By choosing Jetpack Protect, you can confidently secure your site without breaking the bank. Learn more about Jetpack Protect here: https://jetpack.com/protect/ 

    Jetpack VaultPress Backup is a robust backup solution that safeguards your site’s data and offers seamless restoration in case of data loss or corruption. With real-time backups and easy-to-use restoration features, VaultPress Backup ensures that your website’s precious data is always protected and recoverable. Discover more about VaultPress Backup here: https://jetpack.com/upgrade/backup/

    For those seeking a comprehensive solution that combines the best of both worlds, Jetpack Security is the answer. This all-in-one option bundles Jetpack Protect, VaultPress Backup, and additional features to provide a complete security suite for your WordPress site. By choosing Jetpack Security, you can rest assured that your website is protected by a powerful and reliable solution that offers enterprise-grade security and backups tailored for WordPress. Explore Jetpack Security here: https://jetpack.com/features/security/

    Choosing the best WordPress hosting is just the beginning of your journey to building a secure, high-performing, and reliable website. By complementing your hosting solution with Jetpack’s suite of plugins, you can elevate your site’s security and backup capabilities, giving you the peace of mind to focus on what truly matters: growing your business and providing an exceptional online experience for your visitors. 

    Don’t wait; fortify your WordPress site today with Jetpack’s unparalleled security and backup solutions.

  • How to Improve Largest Contentful Paint (LCP) on WordPress

    Measuring a website’s user experience (UX) can be a tough challenge. But that’s what Google’s attempting to do with the Core Web Vitals metrics. And scoring well on these is important because Google weighs user experience when determining search engine rankings. 

    There are several metrics that are part of Core Web Vitals, and they could sound a bit intimidating. The good news is that there are several tools that make it easier to understand your score and how to improve. 

    In this article, we’ll look at one particular metric: Largest Contentful Paint (LCP). This measures how long it takes your website to show the largest element that you see on the screen. 

    We’ll discuss how it impacts the user experience and what causes a poor LCP score. Then, we’ll show you how to improve it.

    What is Largest Contentful Paint (LCP)?

    LCP is a metric that measures how long it takes for the largest element on a page to render. For most pages, the largest element is a big image or a hero section at the top of the screen.

    By itself, an LCP score helps you understand how quickly your site loads visual elements. Your page can continue to load scripts in the background without impacting this metric. In a nutshell, LCP scores only relate to media and text on a given page.

    LCP is one of the three Core Web Vitals that Google uses to measure a page’s UX. The other two are:

    1. First Input Delay (FID): FID measures how long it takes from the time a visitor takes their first action (clicking a link, for example) and when the site responds. 
    2. Cumulative Layout Shift (CLS): This metric effectively measures the degree to which your site shifts when loading. Text might appear first, but then jump down the screen when an image loads, causing visitors to lose their place. 

    As a rule of thumb, you want all three Core Web Vitals scores to be as low as possible. Low scores mean that a page loads quickly and smoothly. 

    In terms of numbers, here’s what Google considers to be good, acceptable, and poor Core Web Vital scores:

    three Google core web vitals scores shown side by side

    Keep in mind that measuring page loading times is not the same as checking your website’s Core Web Vitals. Your site might load relatively fast, but it could have poor CLS or FID scores. Ideally, you’ll measure both overall loading times and Core Web Vitals to get an accurate assessment of your site’s performance.

    How does LCP impact user experience on a WordPress site?

    A poor largest contentful paint score means that your pages might be taking too long to load. Keep in mind that you need to measure Core Web Vitals on a page-by-page basis. While one page might have a poor LCP score, others may be just fine.

    But generally, a site will see a trend in their LCP scores because results are often tied to optimization practices that are implemented site-wide. If a site has been created with no regard for best practices, every page will likely have a score on the low side. If a site has been carefully optimized, most pages will usually score pretty well. Thoughtful developers will identify pages that score below average and make specific adjustments to improve that page’s performance. 

    Overall, a poor LCP score means that visitors might have to wait too long for your pages to fully load visually, and visitors don’t like waiting. If your pages take over two or three seconds to load, you can start turning around a lot of visitors.

    It’s also worth noting that Core Web Vitals are a ranking factor in Google. Poor LCP scores can decrease rankings in the search engine results pages (SERPs), which means you’ll get less organic traffic. 

    How to measure LCP scores

    There are several tools that you can use to measure LCP scores. The simplest one is PageSpeed Insights. With this service, you can enter the URL for any page, and get a full report on its overall performance in a matter of seconds.

    PageSpeed Insights dashboard

    Once you enter a URL and click on Analyze, PageSpeed Insights will generate two reports for that page, one for mobile and the other for desktop performance. You can see your Core Web Vitals scores, including LCP, at the top of the report.

    If you scroll down, the report also displays potential performance improvements that you can make for your website. For each suggested improvement, PageSpeed Insights gives you an estimate of the loading times that can be saved.

    speed optimization tip from PageSpeed Insights

    If you use Google Search Console, you can get access to the PageSpeed Insights reports without leaving the platform. And some WordPress plugins like Site Kit enable you to display Core Web Vitals scores right within the dashboard.

    What causes a poor LCP score?

    There are a lot of potential causes for a poor LCP score and long loading times. Usually, it comes down to issues with your server or a lack of optimization on your website. Let’s go over each potential cause:

    1. Slow server response times. If your web host doesn’t offer good performance at the server level, there’s little that you can do to decrease your LCP scores. Slow server response times mean long waits for visitors —  even if your site is properly optimized. In this case, you might want to consider switching to a different WordPress hosting provider
    2. Render-blocking JavaScript and CSS. In some cases, JavaScript and CSS scripts can prevent other assets on a page from rendering until they’re done loading. This is called “render-blocking” and it can increase your overall loading times.
    3. Heavy files and images. If you use images with large file sizes, these may take a while to load. Ideally, you should compress and optimize the images you upload to your site.
    4. Not leveraging browser caching. Browser caching saves a copy of your site’s static content in visitors’ browsers to speed up your load time for future visits. If you’re not leveraging browser caching, users will have to reload pages in full every time they stop by.
    5. Not using GZIP or Brotli compression. These are software applications that compress HTTP requests and files at the server level. Most reputable web hosts should offer one of these right out of the box. Brotli tends to be more effective than GZIP, but either can improve your LCP score.

    How to improve largest contentful paint in WordPress

    There are several ways to reduce your WordPress website’s LCP score and improve its overall performance. Let’s take a look at the most effective methods. 

    1. Use a plugin designed to help improve Core Web Vitals in WordPress

    There are several plugins that are designed to help you improve your Core Web Vitals scores. One of the most powerful solutions is Jetpack Boost.

    Jetpack Boost homepage

    Jetpack Boost can help you implement multiple performance optimizations simply by toggling the corresponding settings. You can defer render-blocking JavaScript, enable lazy loading, and optimize CSS code within your website.

    Jetpack Boost analysis and settings

    While using Jetpack Boost will help improve your LCP scores, it doesn’t mean that you should skimp on other performance optimizations. After enabling the plugin, we recommend that you also implement other strategies to improve your Core Web Vitals even further.

    Learn more about Jetpack Boost here.

    2. Minify your website’s CSS

    When you work with code, it’s considered good practice to format it in a way that’s easy for other people to understand. This means using spaces, spreading the code over multiple lines, and structuring it in a way that makes it easier to read.

    The problem with that approach is that every space and character takes up additional disk space. If we’re only talking about a few lines of code, that doesn’t have much of an impact. But when you’re dealing with dozens or hundreds of CSS files, each with hundreds of lines of code, those scripts can affect your website’s loading times and LCP scores.

    One way to minimize the impact of CSS is to “minify” the code. This involves removing unnecessary characters and white spaces to reduce file size. To see how that works, here’s an example of some CSS code for styling several div elements:

    div{
    
      border: 3px solid currentColor;
    
    }
    
    #div1{
    
      color: green;
    
    }
    
    #div2{
    
      color: blue;
    
    }

    Now, here’s how that code looks after you minify it:

    div{border:3px solid currentColor}#div1{color:green}#div2{color:#00f}

    Depending on the minification tool you use, it might also replace values with optimized alternatives. We mention minification tools because formatting code by hand takes too long and can lead to errors.

    There are plenty of free minification tools that you can use on the web, including options like Toptal’s CSS minifier.

    code minifying tool before and after

    The free Jetpack Boost plugin can also handle this automatically for you. This allows you to simply toggle a setting rather than work directly with code or external tools.

    3. Defer render‑blocking JavaScript and CSS

    When you visit a website, it might not load resources in a way that reduces loading times as much as possible. In some cases, JavaScript files might cause your browser to wait until those scripts are finished loading before it continues to render other elements.

    That render-blocking code increases your page’s LCP score. There are two ways to deal with this problem:

    1. Eliminate render-blocking scripts.
    2. Defer render-blocking scripts until other elements finish loading.

    The second option is ideal if you’re handling code that your website needs for critical features. By deferring the necessary scripts, pages will finish visually rendering, and then the code will load in the background. As far as users are concerned, everything will load faster.

    The easiest way to figure out what scripts block rendering is to use PageSpeed Insights. Every PageSpeed Insights report includes a section that covers recommended performance tweaks. 

    After you run a test, look under the tab that says Remove render-blocking resources. Inside, you’ll see a list of JavaScript and CSS scripts that block rendering. This section will also give you an estimate of how much loading time you can shave off by deferring each one.

    list of render-blocking resources from Google PageSpeed

    You can use the web.dev tool if you don’t mind editing code. Alternatively, you can once again turn to Jetpack Boost to defer render-blocking scripts. It handles multiple elements of improving Core Web Vitals all at once.

    There are also several standalone plugins that defer render-blocking scripts and minify them. These include:

    1. Autoptimize: You can defer render-blocking JavaScript and CSS, and enable image lazy loading for your website.
    2. Fast Velocity Minify: This plugin can defer, minify, and combine JavaScript and CSS files on your website.
    3. Hummingbird: This WPMU DEV plugin enables you to leverage browser caching, defer render-blocking scripts, and minify JavaScript and CSS. 

    When dealing with plugins that can minify your website’s code, we recommend that you fully back up your WordPress site before activating them. That way, if the minification process breaks any core functionality within your website, you can revert to an earlier version without losing any data.

    4. Optimize your site’s images

    One of the main culprits behind poor LCP scores in WordPress is large image files. High-resolution images look amazing, but they also take up a lot of resources. If you’re dealing with large files and have multiple images in a single page, loading times can quickly spiral out of control.

    The best way to solve this problem is to optimize your images. You can do this either before or after uploading them to WordPress. 

    Optimizing images means converting them to a more efficient format or compressing them. Depending on the compression tool that you use, the process should have minimal impact on image quality, but it can greatly reduce file sizes and overall loading times.

    Jetpack CDN is a great way to optimize your images, which you can enable directly in WordPress. It also automatically resizes images for mobile devices, speeding up your site across the board. 

    If you want to optimize images before uploading them to WordPress, you can use free online tools like TinyPNG.

    TinyPNG tool homepage with illustrations of pandas and bamboo

    With TinyPNG, you can upload and optimize JPG and PNG files manually. The service compresses the images and then lets you download them to your computer. Afterward, you can proceed to upload the compressed images to WordPress.

    5. Use a content delivery network (CDN)

    A CDN is a service that provides you with access to data centers spread across strategic regions. These data centers store cached copies of your website and intercept connections for people who want to visit it.

    A CDN automatically routes those connections to the data center that’s nearest each visitor. Since the site content has less distance to travel, the page will load faster. 

    Moreover, CDNs are designed to serve requests as quickly as possible. This means that they usually load content much faster than the servers run by your hosting provider.

    Services like Cloudflare offer limited free CDN plans that can cache a few of your site’s pages. Some managed WordPress web hosts offer built-in CDN integrations, so you don’t have to pay for a separate service. But if you use Jetpack, you also get access to a free, WordPress-specific CDN, which you can use to speed up images and website files.

    Jetpack CDN settings

    Frequently asked questions about Largest Contentful Paint in WordPress

    If you still have questions about how to measure and optimize your LCP score, this section will answer them. 

    How can I measure my WordPress site’s LCP score?

    Since LCP scores are part of the Core Web Vitals metrics, you need to use Google tools to measure them. Google offers three ways to measure your LCP score:

    1. PageSpeed Insights: You can use this online service to measure any page’s Core Web Vitals on demand. When you analyze a page, PageSpeed Insights will also return suggestions for improving performance and overall UX.
    2. Google Search Console: This service enables you to monitor your website’s search engine optimization (SEO) and overall health. Google Search Console also includes built-in recommendations and scores from PageSpeed Insights.
    3. Lighthouse: You can use this Chrome extension to get access to advanced features when using the browser’s dev tools.

    Google also offers an official plugin called Site Kit that you can use to access several of its services from within WordPress. With Site Kit, you can get access to PageSpeed Insights reports, including LCP scores, without leaving the dashboard.

    What is a good LCP score?

    According to Google, anything below 2.5 seconds is a good LCP score. Even if your website does meet that criteria, it doesn’t mean you shouldn’t optimize it further.

    Ideally, you’ll want to reduce website loading times as much as possible. If you can aim for overall loading times of less than one or two seconds, you can offer a much better user experience.

    How can I easily optimize my LCP score on WordPress?

    The easiest and quickest way to optimize your LCP score on WordPress is to install Jetpack Boost. This plugin will also help you improve your other Core Web Vitals scores, including First Input Delay and Cumulative Layout Shift. 

    Start by installing and activating Jetpack Boost on your site:

    Jetpack Boost listing in WordPress

    Then, navigate to Jetpack → Boost in your dashboard. Here, you’ll see options for optimizing CSS loading, deferring non-essential JavaScript, and activating lazy image loading. We recommend that you enable all options. 

    Jetpack Boost settings toggled on

    Enabling lazy loading is a great way to improve your website’s LCP scores. WordPress includes lazy loading as a built-in feature, which works automatically.

    By deferring the largest elements on every page, your LCP score should improve immediately.

    Improve your website’s Core Web Vitals

    Improving your website’s Core Web Vitals can help you offer a better user experience. LCP scores, in particular, greatly affect how happy visitors are with your site’s performance. A low score means that your website loads fast, and a fast-loading website means fewer frustrated visitors.

    Let’s recap the most effective methods that you can use to improve your LCP score in WordPress:

    1. Use a plugin designed to help improve Core Web Vitals.
    2. Minify your CSS.
    3. Defer render-blocking JavaScript and CSS.
    4. Optimize your website’s images.
    5. Use a content delivery network.

    With Jetpack Boost, you can quickly optimize your website’s Core Web Vitals, including its LCP scores. Jetpack Boost enables you to implement multiple performance optimizations simply by toggling their corresponding settings. Plus, it’s free and works seamlessly with the rest of the Jetpack family of tools.

  • 10 Best Tools to Check a Website for Malware & Viruses

    As a website owner, you’ve worked hard to develop your website and build your business. But, with Google issuing over three million safe browsing warnings a day, it’s clear that you have to be vigilant against the ever-present threat of malware.

    A single malware infection can cripple your website, damage your reputation, and even steal your customers’ data. That’s why it’s essential to have a reliable malware scanner in place to help you spot an infection as soon as it happens, so you can take steps to secure your site and get it back up and running.

    With so many malware scanners available, it can be challenging to know which one to choose. However, thanks to our comprehensive review of the best website malware scanners, you’ll be able to determine the right option for you.

    The top ten tools to scan a website for viruses and malware

    Jetpack Protect Plugin

    1. Jetpack Protect

    Jetpack Protect is one of the best ways to check your WordPress website for malware and keeps you one step ahead of security threats. This free plugin can be set up in just one click, and it’ll get to work checking your site daily for vulnerabilities that hackers could exploit to inject malware — so you can prevent issues before they start. And, with a paid upgrade, it will check your entire site for tens of thousands of known malware definitions and immediately alert you if something’s found.

    Jetpack Protect allows you to secure your site without slowing it down, as it uses state-of-the-art decentralized scanning technology which can search your entire site — including the admin area, themes, and plugins — using Jetpack’s servers.

    The plugin scans your site against an extensive database that is updated by dedicated WordPress security experts as soon as new vulnerabilities, viruses, or malware are discovered. If Jetpack Protect does detect an issue on your site, it will notify you via your Jetpack dashboard and will provide straightforward guidance to help you secure your site and remove malware from your WordPress site.

    Jetpack Protect is made by Automattic, the team behind WordPress.com, which means it seamlessly integrates with any WordPress site. The tool uses the same technology used to guard some of the world’s leading brands, so you know you’re in good hands. 

    Key features of Jetpack Protect:

    • A simple one-click setup 
    • Automatic ‘set it and forget it’ daily scans for vulnerabilities that keep your site secure 
    • Scans of plugins, themes, and WordPress core for potential vulnerabilities 
    • Recommended actions to help you resolve any issues that are found
    • Automated daily malware scanning against over 37,000 definitions (paid)
    • A Web Application Firewall (paid)
    • Instant email notifications (paid)

     Pros of Jetpack Protect:

    • As the automatic malware scans run on Jetpack’s servers, Jetpack Protect can scan your entire site without slowing it down.
    • The plugin uses the same malware database as the advanced enterprise-level tool, WPScan, which is constantly updated by experienced online security experts.
    • You can start protecting your site with just a single click, and it’ll run scans daily and notify you of any issues through your dashboard.

    Cons of Jetpack Protect:

    • Jetpack Protect was designed specifically for WordPress websites, so if your site doesn’t use WordPress, you’ll need to explore one of the other options on our list.
    • While the plugin offers advice on resolving any security issues, it doesn’t provide automatic malware removal without a paid upgrade.

    Ease of use:

    Jetpack Protect is super simple to use, as it only takes one click to activate its advanced scanning tools. There is also no need to remember to run scans, as the plugin will protect your site automatically in the background. Detailed documentation is available, and if you need support, you can access Jetpack’s team of WordPress Happiness Engineers.

    Pricing of Jetpack Protect:

    Jetpack Protect is available for free from the WordPress plugin directory. 

    Wordfence Security Plugin

    2. Wordfence

    Wordfence is a WordPress security plugin that offers a range of features to protect your website from malware, viruses, and other threats. One of the key features of Wordfence is its malware scanner, which automatically checks your website for malware and other vulnerabilities.

    Wordfence is a server-side malware scanner (so it will use resources from your host) that allows you to check your entire website, including plugins and themes. The scanner looks for a wide range of vulnerabilities and signs of malware or viruses, including malicious redirects, backdoors, and code injections. 

    In addition, Wordfence has a dedicated team of website security experts who regularly update its database with new malware and virus definitions, which are immediately available to premium customers so that your site is protected against the latest threats.

    If Wordfence detects malware, it will automatically quarantine infected files, prevent them from being executed, and alert you via email. Wordfence can help you recover from simple malware attacks by replacing damaged core WordPress files with a clean version and deleting any malicious ones. Complete malware removal is included at some of the higher-tier subscription levels.

    Key features of Wordfence:

    • Automated malware and virus scanning
    • Daily email alerts
    • Basic repair and deletion functions for removing simple malware
    • A range of other security features, including a firewall and access logging
    • Regular malware definition updates (premium)
    • Malware removal by a security expert (premium)

    Pros of Wordfence:

    • Wordfence conducts daily scans of your site and will email you if it notices any issues.
    • Alongside the malware scanner, Wordfence also includes various other security features, including a Web Application Firewall (WAF) and two-factor authentication.

    Cons of Wordfence:

    • The free version of Wordfence only updates its malware definition 30 days after a new piece of malware is identified, meaning you have to upgrade to a paid plan if you want to detect the latest threats.
    • Wordfence uses your server’s resources to conduct its scans, which could impact your site’s performance.
    • Wordfence only works with WordPress websites.

    Ease of use:

    Wordfence requires configuration to ensure that it fully protects your site, but when it’s set up, its automatic scanning and notifications mean things are pretty hands-off. Sometimes the email alerts sent by Wordfence flag legitimate changes as a concern, which could cause confusion if you’re unfamiliar with website security and the WordPress ecosystem. 

    Wordfence has comprehensive documentation and a learning center. Support is offered for free users through the plugin’s support forum and via email for premium subscribers. 

    Pricing of Wordfence:

    Wordfence offers a free plan, but there’s a 30-day delay between new discoveries of malware and when the free plan updates the database to include those discoveries in scans. 

    Wordfence Premium costs $119 a year and includes daily malware database updates. 

    Wordfence Care costs $490 a year, including installation and optimization of the plugin and malware removal by a WordPress security expert.

    Sucuri Security Plugin

    3. Sucuri

    Sucuri is a well-known name in website security that offers a free malware scanner alongside several premium services that can help keep your site safe, including a web application firewall, DDoS protection, and malware removal.

    Sucuri’s free SiteCheck external malware scanner allows you to scan the front end of your site for malware by entering its URL. If your website is built using WordPress, Sucuri offers a basic plugin that will check your site’s WordPress core files for any changes. 

    Sucuri also offers premium plans, including automatic malware and virus scanning and access to a server-side scanner to check all your website files.

    Key features of Sucuri:

    • A free external malware scanner
    • File integrity scanning 
    • Security event logs 
    • Automated malware scanning (premium)
    • Server-side malware scanning (premium)
    • Malware removal (premium)
    • Blocklist monitoring (premium)
    • A web application firewall (premium)

    Pros of Sucuri:

    • Sucuri’s SiteCheck scanner is free and doesn’t require an account.
    • Sucuri is platform-agnostic, so it will work regardless of how your website is built.

    Cons of Sucuri:

    • Sucuri’s free malware scanner does not offer automatic scanning, so you must regularly visit the SiteCheck website and enter your URL to check your site for malware.
    • Sucuri’s free SiteCheck scanner may not be able to spot all malware on your site. This is because the malware scan is conducted remotely, so it can only check for malware in the source code of the public-facing pages on your site. 
    • If your site is built on WordPress, Sucuri says that their free WordPress malware scanner isn’t 100% accurate. Malware could be inserted into plugin files or other admin areas and, therefore, wouldn’t appear on your site’s front end.

    Ease of use:

    Sucuri’s free malware scanner is simple to use as it only requires your website URL. However, unless you subscribe to a premium plan, you need to remember to manually run the scan to ensure you spot any malware or virus infections. 

    The server-side scanner could be confusing for non-technical website owners to set up, as it requires FTP/SFTP credentials. Sucuri offers a range of guides and documentation, and its premium customers are offered email support.

    Pricing of Sucuri:

    Sucuri SiteCheck and their WordPress plugin are free of charge. Premium subscriptions start at $199 a year and include a range of features, including server-side automatic malware scanning, a web application firewall, and unlimited malware removal. 

    MalCare Security Plugin

    4. MalCare

    MalCare is a malware scanning and removal service specifically for WordPress websites. The plugin offers automatic malware scanning alongside other security features, including a web application firewall to prevent attackers from accessing your site.

    MalCare’s malware scanner will automatically scan your entire site, including admin files, plugins, and themes. The plugin temporarily and securely copies your files to its servers to conduct each malware scan, meaning that scans won’t slow down your site. 

    MalCare also monitors your website’s files and databases and will let you know if it spots a change that it thinks could be the result of malware. If it thinks you have a malware or virus infection, it will alert you by email, and the plugin’s premium version offers automatic malware removal.

    Key features of MalCare:

    • A malware scanner with automatic daily scanning
    • Vulnerability detection
    • Monitoring for suspicious file changes
    • A web application firewall
    • Automated malware cleaning (premium)

    Pros of MalCare:

    • MalCare offers automatic daily malware scans, which can check your entire site.
    • The plugin uses MalCare’s servers to carry out its malware scanning, meaning it won’t slow down your site.
    • MalCare will send you an alert by email if it finds any signs of a malware infection, so you can take action to secure your site.

    Cons of MalCare:

    • While the free version of the plugin will tell you if your site is infected with malware, it won’t let you know where it is. Instead, you must upgrade to a premium plan to locate and remove the infection.
    • MalCare is a solution specifically designed for WordPress website owners to check their site for malware, so if your site does not use WordPress, you’ll need to explore one of the other options on our list.

    Ease of use:

    MalCare is easy to install and set up, and its automatic scans mean you don’t need to remember to scan your site. The automated malware removal in its premium version makes it simple to recover your site from most infections. MalCare offers email support for all users and live chat support for premium users.

    Pricing of MalCare:

    There’s a free version available from the WordPress plugin directory. Premium plans include malware removal and start at $99 a year.

    5. Jetpack Scan 

    Jetpack Scan is one of the best ways for WordPress website owners to check their sites for malware and viruses. Jetpack Scan acts as a security guard who constantly watches over your site, taking all the stress out of protecting your site from the latest security threats.

    Jetpack Scan is a premium feature of the Jetpack plugin, which is maintained by Automattic — the same people who are behind WordPress.com, WPScan, and WooCommerce. This means you’ll benefit from the expertise of dedicated WordPress security specialists, who ensure that the vulnerability database used by Jetpack Scan is kept up to date with the latest malware, viruses, and exploits.

    As soon as it’s installed, Jetpack Scan gets to work, scouring your site for malware and vulnerabilities. 

    If an issue is detected, it’ll notify you immediately and provide clear guidance about any identified threats. And, in most cases, Jetpack Scan will offer simple, one-click fixes, so you can get back to running your site.

    Even if your site has been taken offline by a malware attack, you can still see the results of the latest malware scan and implement most one-click fixes from the cloud, meaning you’ll be able to quickly get your site back up and running.

    Jetpack Scan uses clever decentralized scanning technology to scan your entire website, including admin pages, themes, and plugins. It does so with Automattic’s servers, allowing you to benefit from the same protection enjoyed by millions of WordPress websites without slowing down your site. You’ll also get access to other security features, including a web application firewall. You can benefit from even more features, including automated backups and spam protection, by purchasing the Jetpack Security bundle.  

     Key features of Jetpack Scan:

    • Automated daily scanning
    • Instant email notifications if any issues are found
    • One-click fixes to resolve the majority of security threats
    • The ability to access your scan results and one-click fixes even if your site is down
    • A vulnerability database updated by WordPress security experts
    • A web application firewall to help keep hackers out of your site 
    • Priority support from Jetpack’s WordPress Happiness Engineers

    Pros of Jetpack Scan:

    • As Jetpack Scan keeps watch over your site through its automated daily scans, you can ‘set it and forget it’ and rest easy knowing that you’ll be notified immediately if anything’s ever found.
    • Jetpack Scan offers one-click fixes for most malware infections and security vulnerabilities.
    • Jetpack Scan integrates seamlessly with WordPress and WooCommerce and works alongside other Jetpack features, including VaultPress Backup.

    Cons of Jetpack Scan:

    • Jetpack Scan was designed specifically for WordPress websites, so if your site doesn’t use WordPress, you’ll need to explore another option on this list.

    Ease of use:

    Jetpack Scan is simple to set up and use. Its automated scans mean you don’t have to worry about remembering to scan your site, and one-click fixes make solving the majority of security issues simple. Plus, detailed documentation and priority support from Jetpack’s team of Happiness Engineers is available for all Jetpack Scan users.

    Pricing of Jetpack Scan:

    Jetpack Scan is available through the Jetpack plugin or as an upgrade to the Jetpack Protect plugin for just $10 a month. You can also benefit from Jetpack Scan by purchasing Jetpack’s Security or Complete bundles.

    Jetpack Scan

    6. IsItWP Security Scanner

    IsItWP provides a range of tools for site owners, including a website malware scanner, which can check any website for malware and other security vulnerabilities. IsItWP’s scanner is powered by Sucuri, allowing you to scan your site’s front end pages for malware by entering its URL.

    In addition to checking your site for malware and viruses, IsItWP’s scanner also checks if your site is listed in Google’s Safe Browsing and other malware blocklists.

    Key features of IsItWP Security Scanner:

    • The ability to check any website’s public-facing pages for malware and viruses
    • Reports that outline if malware is found or if the website is on Google’s Safe Browsing or other malware blocklists

    Pros of IsItWP Security Scanner:

    • It allows you to check any website for malware by simply entering its URL.

    Cons of IsItWP Security Scanner:

    • There’s no automated scanning option, meaning you must remember to visit IsItWP to check your site for malware.
    • The scanner can only find malware that is present on the front end pages of your website.
    • If malware or viruses are detected, IsItWP doesn’t provide any guidance or tools to help you remove the malware and restore your site.
    • The online scanner is slower than many others on this list.

    Ease of use:

    IsItWP Security Scanner is easy to use as it only requires you to enter your website’s URL to check it for malware.

    Pricing of IsItWP Security Scanner:

    IsItWP Security Scanner is free to use.

    Sitelock Security

    7. SiteLock

    SiteLock offers a range of malware detection and removal services, including a free online malware scanner.

    SiteLock’s free scanner allows you to check the public-facing pages of any website for malware. The web-based scanner returns results in under 60 seconds and also checks for any known viruses or other vulnerabilities.

    SiteLock also offers a number of premium plans which offer automated scans, notifications, and automatic malware removal. Premium customers can also scan their entire website, including admin pages, plugins, and files, using SiteLock’s cloud servers so that website performance is not impacted. 

    Premium scans also check for additional security concerns, including SQL injections and cross-site scripting, as well as your website’s status on malware blacklists.

    Key features of SiteLock:

    • A free, web-based malware scanner
    • Automated daily scans (premium)
    • Automatic malware removal (premium)
    • Additional security features including a web application firewall and DDoS protection (premium)

    Pros of SiteLock:

    • SiteLock’s free online malware scanner is quicker than many others and provides results in an easy-to-understand format.
    • SiteLock’s premium plans feature automated malware removal, so malware is removed from your site as soon as it’s identified.

    Cons of SiteLock:

    • Automated scanning is only available on premium plans.
    • While SiteLock supports WordPress and other content management systems, its plugin is not widely used.

    Ease of use:

    The web-based scanner is easy to use and returns results quickly. For SiteLock’s premium features to work, you must provide FTP/SFTP details, which could be confusing for some users. Email support, with a guaranteed 30-hour response time, is provided to all premium customers.

    Pricing of SiteLock:

    SiteLock’s online scanner is free. Premium plans, which include automated scans of all areas of your site and malware removal, start at $15 a month.

    Complete External Check

    8. Detectify

    Detectify is a cybersecurity company that offers a range of options to check websites and web apps for malware and viruses. Detectify is designed specifically for complex DevOps environments. It can be configured to run either on-demand or scheduled security scans that look at your entire website, including back-end resources.

    In addition to malware, Detectify will scan your server for a wide range of other security risks and vulnerabilities, including SQL injections, authentication vulnerabilities, and SSL issues. Scans also check your site against a unique list of exploits gathered from the hacker community to help keep your site secure from the latest threats.

    Detectify will integrate into your existing workflow to inform you of the results of its scans through tools such as Slack or Jira so that you can take action to address any issues it has identified. 

    Key features of Detectify:

    • Enterprise-grade malware and vulnerability scanning
    • Scans for a wide range of potential security issues
    • Scans of your entire website
    • Multiple scan profiles

    Pros of Detectify:

    • Detectify offers a high level of security for complex web apps and websites that checks for a range of vulnerabilities, including malware and viruses.

    Cons of Detectify:

    • Detectify is an enterprise-grade service, and therefore it offers many features that most website owners may not need.
    • Due to its advanced features, Detectify is significantly more expensive than any other option on this list.

    Ease of use:

    Due to its range of options and scan profiles, Detectify is more complex to set up than many other options on this list. It may require the support of a DevOps specialist to integrate with your website.

    Pricing of Detectify:

    Detectify plans are customizable, but start at around $80 per month.

    Scan Your WordPress Website

    9. Quttera

    Quttera is an established name in website security, and they offer a number of different solutions to check your website for malware, including a free online malware scanner. All of Quttera’s solutions use a patented malware-detection algorithm that it claims can detect previously unknown malware rather than checking your site’s files against a list of malware definitions.

    Quttera’s online malware scanner can only check the front end of your website. But, if your website is built using WordPress, then Quttera’s free plugin will scan your entire site for malware, including admin pages and plugins. A detailed report is provided after each scan, which identifies any malicious or suspicious files, and lets you know your site’s status on several common malware blocklists.

    Quttera’s premium ThreatSign! product offers automated malware scanning, including server-side scanning for all websites, and automated malware removal is provided with some plans.

    Key features of Quttera:

    • A web-based malware scanner
    • A WordPress plugin that checks all website files
    • Malware blocklist checking
    • Automated scanning (premium only)
    • Malware removal (premium only)
    • Additional security features, including a web application firewall and DDoS protection (premium only)

    Pros of Quttera:

    • The free report provided by Quttera is more detailed than the reports provided by other free tools on this list.
    • Quttera’s server-side scanning, available via their WordPress plugin and premium plans, uses their cloud servers to conduct the scan, meaning it won’t slow down your site.
    • Quttera’s malware detection algorithm can detect previously unknown malware.

    Cons of Quttera:

    • It scans using the free web-based tool can only check the front end of your site.
    • Automatic scanning is only available on premium plans.

    Ease of use:

    Quttera’s web-based scanner and WordPress plugin are both easy to use, but the lack of automation means that you need to remember to check your site regularly for malware. Support is only available to premium subscribers.

    Pricing of Quttera:

    Quttera’s web-based scanner and WordPress plugin are free. Premium plans offer automatic scanning and other security features for $10 a month, with plans that offer malware removal starting at $179 a year.

    Safe Browsing site status.

    10. Google Transparency Report

    Google’s Transparency Report provides information on Google’s services, and has a section dedicated to its Safe Browsing technology. Site owners can enter their URL and check its Safe Browsing status to see if it has been flagged as unsafe by Google.

    Safe Browsing is Google’s technology that checks websites for malware and phishing attacks and flags them as unsafe for visitors if they’re potentially malicious. 

    Key features of Google’s Transparency Report:

    • Includes a tool that checks if a site has been identified as unsafe
    • Reports that offer a basic reason for the site being listed as unsafe

    Pros of Google’s Transparency Report:

    • The Safe Browsing status check allows website owners to see if Google has identified signs of malware on their site.
    • The service is free of charge and can be used by anyone to check the status of a site.

    Cons of Google’s Transparency Report:

    • The Safe Browsing status check is not automatic, meaning you must remember to check your site’s status.
    • Google Transparency Report’s Safe Browsing status check section is not a substitute for a comprehensive malware scanning solution because it’s not proactive and only reports issues after visitors are likely to have been affected.
    • Google’s Safe Browsing technology does not scan every website, and the frequency of scans is not publicly available.
    • The Safe Browsing status check does not provide any guidance on how to remove malware if it’s identified on your site.

    Ease of use:

    The Google Transparency Report Safe Browsing status check is easy to use and quickly returns the Safe Browsing status for the URL you enter.

    Pricing of Google’s Transparency Report:

    Google’s Transparency Report is free to use.

    A comparison of the best website malware scanners

      Jetpack Protect Wordfence Sucuri MalCare Over 44,000 IsItWP Security Scanner SiteLock Detectify Quttera  Google Transparency Report
    Made especially for WordPress websites Yes Yes No Yes Yes No No No No No
    Number of malware definitions your site is checked against. Over 37,000 Yes (with a paid plan) Not stated Not stated Over 37,000 Not stated Not stated Not stated Uses proprietary algorithm Not stated
    Automated scans Yes Yes Premium only Yes Yes No Premium Only Yes Premium only No
    Scans your full site, including admin files Yes Yes Premium only Yes Yes No – checks front end files only. Premium Only Yes Premium only No – checks front end files only
    Can scans impact website performance? No Yes No- external scanner Yes No No No Yes No No
    Frequency of malware definition updates Daily Every 30 days (free version)
    Daily (pro version)
    Daily Daily Unknown Daily Daily Daily N/A Daily
    Malware removal if malware is found Yes (with a paid plan) Limited removal in the premium version. Full removal in Care version. Premium only Premium only Yes (with paid plan) No Premium Only No Premium only No
    Price Free with paid upgrades. Limited free version. Premium plans start at $99/year. Limited free online scanner. Premium plans start at $199/year. Limited free version.Premium plans start at $69/year. $10 / month Free Free online front end scanner. Premium plans start at $15 a month. From $80/ month. Limited free online scanner and plugin. Premium plans start at $10 a month. Plans including malware removal start at $179 a year. Free

     Frequently asked questions about malware scanners

    What is the best website scanner to check for viruses and malware?

    The best website scanner to check for viruses and malware will depend on the platform or CMS your site is built on.

    For example, WordPress site owners should opt for a malware scanner that’s built specifically for WordPress, and it’s clear from our review that Jetpack Protect is the best option. It offers automated scans for vulnerabilities with premium access to a malware database that’s constantly updated by a team of WordPress security experts, so you can be sure your site is being checked for the latest issues. 

    Or you could use the premium Jetpack Scan feature available with the Jetpack plugin

    Both Jetpack Scan and the paid upgrade for Jetpack Protect offer clear guidance and one-click fixes if a security threat is identified, along with a web application firewall to keep malicious actors off of your site.

    Should I use an external or server-side malware scanner?

    Many of the free website scanners only search the external pages of your website for malware, and this means that they won’t spot issues that are hidden on the back end of your site. 

    In contrast, server-side malware scanners offer full protection, since they scan the entirety of your site. But, if the malware scanning happens on your server, it could temporarily slow down your website performance. This means the best option to scan your site for malware is to use a tool that uses decentralized scanning technology. 

    For example, Jetpack Protect uses Automattic’s cloud servers to securely scan the front and back ends of your site, meaning you don’t have to worry about the impact on performance while its comprehensive automated scans are being carried out.

    How do I scan a WordPress website for malware?

    To scan your WordPress site for malware, you’ll need to use a malware scanner such as Jetpack Protect that can scan your entire website, including your plugins and themes.

    You can install Jetpack Protect for free by going to Plugins → Add New inside of your WordPress dashboard. Then, search for “Jetpack Protect” and click Install Now → Activate.

    Jetpack Protect in Plugin Repository

    Then, choose either Jetpack Protect or upgrade to benefit from additional features, including one-click malware fixes and a web application firewall.

    Jetpack Protect will then get to work scanning your entire site for malware.

    Jetpack Protect - Your results will be ready soon.

    Once its scan is complete, you’ll be shown the results and told if any security threats have been identified on your site. If Jetpack Protect has identified any issues, it’ll give you a clear description of the issue and let you know where it’s located.

    Jetpack Dashboard - Don't worry about a thing.

    Jetpack Protect will automatically scan your site for vulnerabilities every day. You can see the results of your scans by going to your WordPress admin dashboard menu and selecting Jetpack →  Protect.

    Jetpack via WordPress Dashboard

    You can also run a manual scan at any time by clicking Scan Now.

    How can I prevent my website from being affected or hacked in the future?

    While regular automated scanning will help you detect a malware infection, keeping it secure is the best way to protect your site. Here are some ways you can do this:

    • Use strong passwords. The easier your password is to guess, the more likely it is that a malicious hacker will be able to guess it to get access to your website and install malware. Learn more about securing your WordPress login page.
    • Enable secure authentication. Secure authentication requires users to provide a code from their mobile device alongside their username and password, meaning that if someone does happen to crack your password, they still can’t log in and cause damage to your site.
    • Limit admin user accounts. By limiting the number of users who can have full access to your site, you reduce the number of accounts that could become compromised and used to infect your site with malware.
    • Keep your site up to date. By keeping the software up to date, including any plugins and themes, you’ll benefit from the latest security improvements and vulnerability patches.
    • Get protection against brute force attacks. Brute force protection stops bots who try to guess hundreds of username/password combinations each second until they find one that lets them into your site.
    • Use a web application firewall. Firewalls help prevent attackers from gaining access to your site and are essential for all website owners. For example, Jetpack Scan includes a firewall specifically designed for WordPress sites that uses a vast database to help it identify potentially malicious visitors. 

    WordPress site owners can help keep their site secure and prevent malware infections by using a complete WordPress security solution such as Jetpack Security, which includes advanced features including backups, Jetpack Scan, and protection from spam.

  • Is WordPress Secure? How Reliable and Safe is the Platform?

    If you’re thinking of starting a website, you’ll probably want to use WordPress to build it. This popular CMS and site builder enables you to create any type of site. However, you may be wondering: is WordPress safe?

    The answer is a resounding yes. The proof is in the unprecedented popularity of the tool. Still, there are some simple steps you can take to make your WordPress site more secure, like opting for a reliable web host and using the right plugins.

    In this article, we’ll show you what makes WordPress a reliable platform. Then, we’ll look at how to build a secure WordPress site in six steps. Finally, we’ll discuss some factors that can impact the security of your WordPress site and go over some frequently asked questions. 

    How reliable is WordPress?

    WordPress is one of the most secure CMSs available. Let’s look at five factors that demonstrate its safety and reliability.

    WordPress is the most popular website-building tool

    If you’re searching for evidence that WordPress is reliable, the statistics say it all. Over 43 percent of websites are powered by WordPress, which makes it the most popular website-building tool available.

    WordPress homepage with the words, "WordPress; Flex your freedom"

    This translates to about 835 million WordPress websites, a number that just keeps growing by the day. 

    It’s safe to say that users wouldn’t be flocking to WordPress if it wasn’t dependable. Such a vast market share serves as the ultimate customer testimonial. 

    WordPress has a large community

    WordPress has a large and thriving group of users and developers who continually contribute to expand, improve, and secure the technology for the good of the entire community. Since the software is free and open-source, users can download it at no cost.

    Additionally, WordPress is offered under the General Public License. This means you can use it for any purpose, redistribute the software, and modify it.

    pillars of open-source

    With this flexibility, you can use the CMS however you wish. Moreover, you can modify, build upon, and improve it as you see fit. 

    In fact, the contributors of WordPress encourage others to participate in any way they can.

    the Make WordPress website

    Since Matt Mullenweg, a founding developer of WordPress, organized the first WordCamp event in 2006, there have been over 1,100 WordCamp events in 65 countries. And that’s not the only way that the WordPress community comes together.

    Spanning 115 countries, there are more than 750 WordPress-focused groups on Meetup.com. These communities help support talented WordPress developers and designers who are continually working to improve the software. 

    WordPress is trusted by top enterprises

    WordPress isn’t limited to a specific type of user. While it started out as a blogging platform, today it’s used by a wide range of people and businesses.

    It’s even trusted by some of the top enterprises in the world, including:

    • eBay
    • Forbes
    • CNN
    • The New York Times
    • Mercedes-Benz

    There are many reasons that big businesses choose WordPress over other platforms. For instance, it’s highly customizable, giving users complete control over almost every aspect of the site. 

    Plus, you can easily expand upon its functionality with WordPress plugins. For example, the WooCommerce plugin enables you to transform any WordPress site into a fully functional online store. It even offers extra powerful plans for high-volume online stores.

    enterprise ecommerce plans through WooCommerce

    When it comes to ecommerce platforms, WooCommerce makes up nearly 39 percent of the market and 23 percent of the world’s top one million online stores.

    Experienced WordPress developers

    The first version of WordPress was released in 2003. Since then, thousands of the most highly talented and experienced developers have devoted themselves as both users and volunteer contributors.

    In addition to working on the core software, some WordPress developers may specialize in plugins, themes, or even security. 

    And the WordPress plugin and theme directories help verify the quality of plugins that extend WordPress by displaying accurate information about the plugin’s latest update, developer background and history, verified reviews, and number of users. 

    WooCommerce plugin page

    This way, you’ll be able to tell right away if the tool you’re interested in has been built by experienced developers. Alternatively, if you have the budget to work with a WordPress developer directly, you can easily find top-notch talent in a variety of WordPress niches.

    Solutions like Jetpack offer powerful security tools

    One of the best things about WordPress is that it enables you to use affordable yet robust security solutions like Jetpack.

    Jetpack Security homepage

    Jetpack offers both security and performance tools. It also offers a security plan that includes a backup tool, a malware scanner, and an anti-spam solution. With this powerful trio, you can create real-time backups of your site, run automatic scans for threats, stop spam in its tracks, and more.

    How to build a secure WordPress site (in 6 easy steps)

    By default, WordPress is a powerful and reliable tool. Still, cyber threats remain a universal reality, and strong WordPress security is crucial for every website. 

    So, let’s outline how to build a secure WordPress site in just six steps. 

    1. Choose a secure host for your website

    WordPress is free and open source, but there are still some costs associated with it. Primarily, when you’re using WordPress.org, you’ll need to pay for a domain name and web hosting. 

    Simply put, a domain name is your site’s web address. A web host provides the server space needed for your site and makes it available to view online.

    If you don’t choose your hosting provider carefully, your website may be set up in a way that makes it vulnerable to security threats and performance issues. So, the first step in building a secure WordPress site is choosing a reputable web host. 

    This choice will depend on your site’s unique needs, but any trustworthy web host should offer most of the following security features:

    You’ll also need to choose the right hosting plan. If you’re running a small professional site, a basic or mid-tier plan might be sufficient for your needs. On the contrary, ecommerce stores will likely need higher-tier plans that can accommodate increased web traffic and use of resources. 

    If you’re totally new to the CMS, it might be a good idea to go with a managed WordPress hosting plan. This can simplify the daily management that’s required for your site.

    Finding the right WordPress web host can be a little difficult. If you’re not sure where to look, you might try popular choices like Bluehost or DreamHost.

    DreamHost homepage

    2. Install WordPress using best practices (or use WordPress.com)

    Unless you’re an experienced developer, installing WordPress manually might be challenging. That’s because it requires you to create your own database and modify your site’s files.

    Fortunately, most high-quality web hosts will offer one-click installations. This means they’ll download and set up the software for you. 

    If you do decide to install it manually, here are some best practices to keep in mind: 

    • Make sure you’re downloading the latest version of WordPress
    • Use secure database usernames and passwords
    • Make sure your hosting provider uses the latest versions of PHP and MySQL 
    • Create secure FTP usernames and passwords 

    If you prefer a more streamlined approach, you might consider using WordPress.com.

    WordPress.com homepage with the text, "Welcome to the world's most popular website builder"

    This is the hosted version of WordPress. Unlike WordPress.org, WordPress.com isn’t free, but it includes web hosting and a domain name. What’s more, WordPress.com has a wide variety of plans, ranging from personal to enterprise options. 

    3. Make sure all user accounts have a unique username and strong password

    Once your WordPress installation is complete, you’ll get access to the back end of your website. If you’re the site owner, you’ll need to create an ‘administrator’ account. This role will give you complete control over all the front and back-end elements of your site.

    It’s crucial that you create a unique username and a strong password. Otherwise, your website could become vulnerable to brute force attacks. You may even want to use a password manager like KeePass or 1Password.

    This way, you can regularly reset your WordPress password as an added layer of security and never have to worry about forgetting it.

    Depending on your website, you may also need to add users. For instance, if you have an online store, you’ll have to allow for customer accounts. If you have a marketing manager, they may need access to make periodic updates to landing pages or other parts of the site. Or, if you’re starting a blog, you may need to give authors and editors access.

    You’ll want to make sure that all of these users have strong usernames and passwords as well. To achieve this, you can use a tool like the Password Policy Manager plugin.

    Password Policy Manager plugin page

    This tool enables you to enforce strong passwords for your site. It also gives you lots of other features that enhance password security. Plus, it’s compatible with WooCommerce, which makes it an excellent option for ecommerce sites.

    Also, familiarize yourself with the user roles included with WordPress. Make sure that each person only has the minimal capabilities required to do their job. And if someone stops working with your organization, it’s best to change their login information.

    4. Keep your WordPress core version up to date

    With every release, WordPress is evolving and getting better. Each new version of the CMS can contain design updates, but also bug fixes and security improvements.

    Therefore, it’s crucial that you keep your WordPress core version up to date after your site is set up. If you don’t, you may leave your site vulnerable to attacks.

    You can easily check if your WordPress site is up-to-date by navigating to Dashboard → Updates.

    checking for WordPress updates in the dashboard

    If you’re not using the most recent version of WordPress, you’ll be able to update it from this page. Additionally, you can configure automatic updates here.

    5. Install a powerful security plugin like Jetpack Security

    WordPress is powerful enough for some of the world’s biggest companies. Still, even one security incident or data leak can destroy a brand’s reputation. That’s why organizations both large and small should find a WordPress security plugin to safeguard their work.

    One of the most trusted, and professionally supported, options is Jetpack Security.

    Jetpack Security homepage

    This plugin is the best on the market because it includes tools to protect you from every angle — like Jetpack VaultPress Backup, Jetpack Scan, and Akismet Anti-Spam. So while many other WordPress security plugins only provide protection for a singular type of threat, Jetpack Security gives you everything you need to safeguard your site.

    After you’ve purchased Jetpack Security, and it’s installed on your site, navigate to your WordPress dashboard and go to Jetpack → VaultPress Backup.

    Jetpack VaultPress Backup Dashboard

    From here, you can configure regular backups of your WordPress site. This way, you’ll always be able to restore a recent copy of your entire site in case of emergency.

    Keep in mind that backups may take a moment to complete. Once this process is done, and you’ve finished configuring the tool, you can return to this page to view or restore backups at any time.

    You can manage your anti-spam settings by going to Jetpack → Anti-Spam. Here, you’ll also be able to see how much spam the tool has helped you block.

    Akismet dashboard showing spam blocked

    Finally, you can go to Jetpack → Protect → Scan to set up the malware scanning feature. If you discover any instances in the Malware Threats Found section, you can easily eliminate malware by clicking on Remove Threat.

    6. Only install reliable plugins created by reputable developers

    The ability to extend WordPress with plugins is part of what makes the platform so powerful and flexible. Plus, these tools are easy to use, and you can install them directly from your WordPress dashboard.

    Still, it’s not a good idea to add just any plugin to your site. You should only install tools created by reputable developers. Otherwise, you might be putting your site at risk.

    You can easily vet plugins by viewing their details in the WordPress plugin directory.

    Jetpack plugin shown in the WordPress plugin directory

    You’ll want to make sure that the plugin is compatible with your current version of WordPress and has been updated recently. An out-of-date plugin can make your site vulnerable to threats.

    Additionally, the number of active installations is usually a good measure of a tool’s reliability. You can also check out its star rating to see what users are saying about it.

    Lastly, make sure to pay close attention to the By section beneath the plugin name:

    the developer information underneath a plugin name

    This will tell you who is behind the development of the tool, which can be another strong indicator of its dependability. 

    For example, Jetpack’s suite of plugins is developed and maintained by Automattic, the company behind WordPress.com. So, if you see that the plugin was created by a reputable company, you can probably assume that it’s safe to use.

    What factors can affect the reliability and security of a WordPress site?

    Now that you know how to build a secure WordPress site, let’s dive a little deeper into the factors that can negatively affect the reliability and security of WordPress.

    A low-quality hosting provider

    Low-quality web hosts don’t provide enough performance and security features to keep your site running smoothly. If you opt for a subpar web host, your site may suffer from slow loading times or even excessive downtime

    Moreover, a poor web hosting provider might not provide enough storage space or customer support. With this in mind, you’d be wise to avoid low-quality web hosts. 

    If you run a large site that gets high amounts of traffic, it’s best to avoid shared hosting plans. This type of hosting is often cheaper, but requires your site to share resources with other websites, which can lead to poor performance. And, if another site on the shared server is compromised, it’s possible that yours could be as well.

    It’s important to note that reliability is crucial when it comes to Search Engine Optimization (SEO). If your site is often down or glitchy, Google will notice this, and it can lower your rankings in search results.

    A good web hosting service will usually give you unlimited bandwidth, access to a private or cloud-hosted server, a Content Delivery Network (CDN), an SSL certificate, added security features, a server-level firewall, and more.

    An obsolete or outdated plugin or theme

    Any software that runs on your site can affect its reliability and security. This includes plugins and themes.

    Therefore, anytime you install either of these on your site, you’ll want to vet the developers and check out the version details and user reviews. This can help ensure that you only download and install high-quality themes and plugins.

    plugin information in the WordPress plugin repository

    When it comes to themes, always check to see if the design is compatible with your current tools and WordPress version. Most obsolete themes or plugins will just mess with your site’s layouts, but some may be intentionally infiltrated by hackers. 

    It’s also important that you keep your existing themes and plugins up to date. As long as you’re regularly monitoring your site for issues, you can set up automatic updates to immediately take advantage of the latest security patches.

    An outdated version of WordPress

    As we discussed earlier, keeping your WordPress core version up to date is essential. You can do this by navigating to Dashboard → Updates. 

    If you don’t update your WordPress version, you could miss out on key bug fixes and maintenance improvements, leaving your site vulnerable. Plus, running an outdated version of the CMS could lead to compatibility issues with your active plugins and theme.

    WordPress accounts with weak login credentials

    Even if you use strong passwords for your own account, a single user with weak credentials can present a safety risk. This situation is especially possible for large ecommerce sites with lots of customers, blogs with multiple authors, and marketing agencies with large teams.

    Therefore, it’s best to use a trusted password policy plugin to help you manage your user accounts. These kinds of plugins enable you to enforce strong passwords, show a password strength score, and more.

    Lack of security protection 

    In addition to strong login credentials, you’ll want to make sure that your site has some extra security measures in place. These should protect it against the most common risks, like brute force attacks.

    This is when a hacker uses trial and error to guess someone’s login credentials. Strong passwords and usernames are the first defense against this type of attack, but there’s more you can do. As an added layer of security, you can install a plugin like Jetpack and enable the brute force protection feature.

    Incorrect user permissions or unnecessary accounts

    WordPress lets you assign a different user role to each account. Each role has a unique set of permissions, which you can then customize.

    If you’re not familiar with the default permissions for each role, you can end up giving certain users too much control over your website. As a result, inexperienced WordPress users could end up breaking your site.

    Let’s go over the major WordPress roles in descending order:

    • Administrator
    • Editor
    • Author
    • Contributor
    • Subscriber

    Some of these roles were originally developed for collaborative blogging purposes, so they can come in handy if you run a blog. If you manage an ecommerce store or WordPress Multisite, you’ll likely have additional roles like customer, shop manager, or super admin. 

    As a general rule, there should only be one administrator per site. This user has access to all the administration features on a site. 

    The other roles are pretty self-explanatory, but it’s probably best to review the details of WordPress user roles and capabilities before you start assigning them. It’s also a good idea to audit your site’s users from time to time. Dormant accounts can be hacked and utilized for nefarious purposes, so you’ll want to delete them before it’s too late. 

    An insecure login form

    Users will need to use a login form to access your site. Unless you use a third-party tool, WordPress generates this page form for you.

    By default, it only has fields for ‘username’ and ‘password.’ A simple form makes it easy for users to log in, but it’s not the most secure login process. 

    Therefore, you may want to enable Two-Factor Authentication (2FA) to make the login page more secure. This requires users to produce a unique, one-time code that’s sent to them via text message.

    Lack of spam filters

    Unfortunately, if you have a website, you’re likely going to have to deal with spam. With WordPress, this will most likely come in the form of comment spam.

    To prevent this, WordPress gives you the option to turn off comments completely. This might not be ideal if you want to use the comments section to engage with your followers.

    Therefore, you may want to use a spam filter. With over five million active installations, Akismet Anti-Spam is one of the most widely used spam solutions for WordPress. You can download a free version of the tool from the WordPress plugin directory, or you can get Jetpack Security, which includes a premium version of the Akismet plugin.

    Frequently asked questions about WordPress security and reliability

    At this point, you hopefully have a good understanding of how to secure your WordPress website. Still, just in case you have any lingering doubts, let’s go over some of the most frequently asked questions on the matter.

    Is WordPress suitable for large and enterprise-level websites?

    Yes, WordPress is an excellent platform for large and enterprise-level websites. That’s because you can customize every element of your site to support any amount of content and traffic. And if you run an ecommerce store, WooCommerce is highly scalable and grows with you. 

    Can WordPress reliably handle high-traffic sites?

    Yes, WordPress can easily handle high-traffic sites without issue, but this is largely dependent on your site’s hosting provider.

    If you know your website is going to receive a lot of traffic, it’s best to avoid shared hosting and opt for a private or cloud-hosted server instead. You’ll also want to look for unlimited bandwidth and performance optimization tools that will help keep your website running smoothly at all times.

    Is WordPress core secure?

    Yes, WordPress core is highly secure. In fact, it’s getting better all the time. Since it was created in 2003, it has undergone continual “hardening” to reduce the number of threats.

    Are WordPress plugins secure?

    Most WordPress plugins are secure. But outdated tools can put your site at risk.

    Fortunately, it’s easy to check if a plugin is reputable and safe. All you have to do is find its listing in the WordPress plugin directory and view its version details and ratings.

    Unfortunately, premium plugins without free versions are not listed here. That means you’ll need to dig a little deeper.

    In this scenario, your best bet is to look into the developers who created the plugin. For starters, you could look for an official website to learn more about them. If you discover that the same developers have made other tools, you can also cross-reference those. Make sure to read real reviews and testimonials from users as well, which will provide the most accurate assessment of the plugin.

    Are WordPress themes secure?

    Most WordPress themes are secure, but you should always vet them the same way you would plugins.

    What are some common security threats faced by WordPress websites?

    Some of the most common security threats for WordPress sites are brute force attacks, Direct Denial of Service (DDoS) attacks, malware, and comment spam.

    Here are some additional resources on these topics:

    You can greatly reduce the threat of these attacks by following the best practices we discussed in this article, and by using the right security plugins.

    What measures can I take to improve the security of a WordPress site?

    Here are a few things you can do to improve the security of your WordPress website:

    • Choose a high quality WordPress web host.
    • Safely install WordPress (or use WordPress.com).
    • Implement strong usernames and passwords.
    • Only install reliable themes and plugins.
    • Keep your WordPress core, plugins, and themes up to date.

    Even if you do all of the above, it might not be enough to provide the level of security your website needs. Therefore, the best thing you can do to protect your site is to use a robust WordPress plugin like Jetpack Security.

    What is Jetpack Security, and where can I learn more about it?

    Jetpack Security is a plugin that provides you with everything you need to safeguard your WordPress site. It includes the following tools:

    With these powerful security tools, you can create and manage backups, scan for malware, and block spam comments. You can learn more about Jetpack Security here.

    Build and manage a secure website with WordPress

    Choosing the right platform for your website is crucial, especially if you run a business. When your site is built on a solid foundation, you’ll be able to safeguard sensitive data and user information more easily.

    The good news is that WordPress is a highly-secure CMS. As long as you select a reliable hosting provider and follow some best practices, you should have nothing to worry about. You can start by installing WordPress safely and vetting any themes and plugins that you add to your site. It’s also important that you manage your user roles and permissions carefully. 

    Are you ready to take your WordPress security to the next level? With Jetpack Security, you’ll get a comprehensive web security tool that includes automatic backups, real-time malware scanning, spam protection, and much more!

  • How to Serve Static Assets with an Efficient Cache Policy on WordPress

    One of the hallmarks of a user-friendly website is that it doesn’t keep visitors waiting too long while loading. Caching static assets is a critical step to improving site performance, but it doesn’t help much to simply set this up and move on. Without an efficient WordPress caching policy, you might struggle to provide fast loading times.

    Fortunately, learning how to leverage browser caching on WordPress is easier than you might think. You can configure browser caching manually, and the Content Management System (CMS) also enables you to use tools that do it for you.

    In this article, we’ll explain how browser caching works and discuss its benefits. We’ll also show you how to check if caching is enabled on your site and look at different ways to turn it on. 

    What is browser caching?

    Browser caching is a process that saves copies of a website’s elements on your computer. When you visit a website, your browser downloads different pieces of content, like images and text. Instead of downloading this content every time you visit the site, your browser “caches” or stores some of it in case you need it later.

    The next time you visit the site, your browser will check what elements are stored locally. It will then load these elements from the cache instead of requesting them from the site’s server. This can make the page load significantly faster, depending on the number of assets that are stored in the cache. 

    If you had to check your browser’s cache right now, you’ll likely find a few hundred megabytes of files inside it. Most modern browsers enable you to see an overview of cached files if you go into the privacy settings.

    browsing data shown in Google Chrome

    The thing about caching is that a browser can’t decide to do it on its own. To leverage browser caching in WordPress, you’ll need to configure your website or server to do so. This means that your site controls which assets the browser caches and for how long.

    What are the benefits of caching static assets?

    The primary benefit of browser caching is that it can help visitors load pages faster upon returning to your site. We talk about “static assets” because it’s not possible to cache every element on a website.

    Dynamic assets are elements that change every time you load a page. For example, if you log into an app that shows you a post feed in real time, like Twitter or Instagram, those assets are dynamic.

    Since dynamic assets can change frequently, caching them might not serve any purpose. After all, the next time you log into Twitter or Instagram, you’ll see entirely new posts. 

    Caching provides the best possible results when it’s limited to static assets. Learning how to serve static assets with an efficient cache policy in WordPress can have several benefits:

    • Reducing bandwidth usage. Since cached assets are loaded from local storage, there’s less data being transferred between the server and the visitor’s device. This helps visitors with limited internet plans save on data usage.
    • Decreasing the load on your server. When browsers use cached assets, the server receives fewer requests for those files. This reduces the server’s workload and can help prevent server overloads during periods of high traffic.
    • Enabling partial offline browsing. In some cases, caching static assets can enable visitors to access certain parts of a website even when they’re offline. If the browser has previously cached the necessary files, it can display the content without needing an active internet connection.

    Caching static assets enables you to make better use of server resources and improve the experience for visitors. All of this works by instructing your server on what assets it should tell browsers to cache.

    How to check if browser caching is enabled on your site

    The easiest way to check if a website leverages caching is to use browser developer tools, like the ones you find in Firefox and Google Chrome. This approach requires you to look at some code, but you don’t need to be a developer to understand it.

    To do this in Google Chrome, visit the website you want to check, right-click anywhere on the page, and select the Inspect option. This will open the developer tools tab within the browser, which should look like this:

    inspecting a page in Google Chrome

    Click on the Network tab. If you see an empty list, you’ll need to reload the page with the developer tools tab open. The Network tab will display all the requests and assets the browser loads while accessing the page.

    The element we’re interested in should be the first on the list. In our case, it’s Jetpack.com, and it contains the page’s headers. Select that file, and it will open a new tab to the right, jumping straight into the Headers section.

    the headers section of the Inspect tool of Google Chrome

    Some headers will tell us whether the site uses caching and how it’s implemented. These are:

    • Cache-Control. This header specifies caching directives, like max-age (the maximum time a resource is considered fresh) or no-cache (forces caches to submit the request to the origin server for validation before releasing a cached copy).
    • Expires. This header provides an expiration date and time for the resource. After this, the resource is considered stale, and the browser will revalidate it.
    • ETag. This header is an identifier for a specific version of a resource. When the resource changes, the ETag changes as well, allowing browsers to determine if a cached resource is still valid.
    • Last-Modified. This header indicates the last modification date of the resource. Browsers can use this information to validate if their cached version is still up-to-date.

    If you can find these headers in the file, then the website uses caching. Keep in mind that specific caching configurations can vary from site to site. Some sites might tell browsers to store static files for a day, whereas others will tell them to store files for months or longer periods.

    How to leverage browser caching with a plugin

    The easiest way to leverage browser caching on a WordPress site is by using a plugin. There are a lot of caching plugins you can use. One great option is WP Super Cache.

    WP Super Cache plugin page

    Once you’ve installed and activated WP Super Cache on your site, you can implement caching using several approaches. The simplest way is to go to Settings → WP Super Cache and select the Caching On option next to Caching.

    WP Super Cache settings

    The plugin’s default settings enable caching for logged-out visitors and set a lifetime of 30 minutes for stored assets. If you want to change these settings, you’ll need to go into the Advanced tab. 

    Here, you can decide which visitors to enable caching for, whether to enable dynamic caching, if the plugin should clear the cache when you update pages, and more. The plugin helps you out by recommending the most effective options.

    advanced settings available with WP Super Cache

    If you don’t have a firm grasp of caching, you might want to stick with the default settings. Configuring caching settings without fully understanding how they work can lead to problems with your website.

    How to leverage browser caching without a plugin

    If you don’t want to use a plugin, you can enable browser caching on your website manually. This process might involve dealing with code at the server or at the site level, depending on the implementation method that you choose. 

    1. Add “Cache-Control” and “Expires” Headers in NGINX

    To add “Cache-Control” and “Expires” headers in NGINX, you’ll need to modify the server configuration file. This file is usually called nginx.conf, and it’s located in the main nginx directory.

    The easiest way to connect to your site’s server is to use a File Transfer Protocol (FTP) client. Then, you’ll need to locate the nginx.conf file, which should be in either 

    /etc/nginx/nginx.conf or /etc/nginx/sites-available/default. 

    Open the file using a text editor and look for the server block of code within nginx.conf. Here, we’re going to add the following new block of code, which specifies what files the server should tell browsers to cache and how long that cache should last before it expires:

    location ~* \.(jpg|jpeg|png|gif)$ {
    
        expires 30d;
    
        add_header Cache-Control "public, no-transform";
    
    }

    This code includes both the “Cache-Control” and “Expires” headers. You can modify both the expiration time range and the file types that browsers should cache.

    If you can’t decide what types of files to cache, take a look at what’s in your WordPress media folder. Any static files that visitors access regularly should be cached. As for the expiration header, 30 days is generally a good timeframe for most websites.

    Once you add the code, save the changes to the file and exit the editor. You’ll need to restart NGINX to apply the changes.

    2. Add “Cache-Control” and “Expires” Headers in Apache

    Using “Cache-Control” and “Expires” headers in Apache requires you to enable their corresponding modules. You can enable these modules by opening the terminal and running the following commands:

    sudo a2enmod expires
    
    sudo a2enmod headers
    
    sudo systemctl restart apache2

    The final command will restart Apache with both modules active. Next, you’ll need to modify the Apache configuration file, which is usually called either httpd.conf or apache2.conf

    You can find this file in either /etc/httpd/conf/httpd.conf, /etc/apache2/apache2.conf, or 

    /etc/apache2/sites-available/000-default.conf, depending on the server configuration.

    Then, look for the <Directory> block within the Apache configuration file and add the following code inside it:

    <IfModule mod_expires.c>
    
        ExpiresActive On
    
        ExpiresDefault "access plus 1 month"
    
        ExpiresByType image/jpg "access plus 1 month"
    
        ExpiresByType image/jpeg "access plus 1 month"
    
        ExpiresByType image/gif "access plus 1 month"
    
        ExpiresByType image/png "access plus 1 month"
    
    </IfModule>
    
    <IfModule mod_headers.c>
    
        <FilesMatch "\.(jpg|jpeg|png|gif)$">
    
            Header set Cache-Control "public, no-transform"
    
        </FilesMatch>
    
    </IfModule>

    The first part of that code governs the expiration settings for cached files. The second part indicates what file types browsers should cache. As with NGINX, you can modify these settings depending on the files you want browsers to store.

    When you’re done, save the changes to the Apache configuration file and close it. You’ll need to restart Apache for the changes to take effect.

    3. Use a Content Delivery Network (CDN)

    A Content Delivery Network (CDN) is a network of servers that you can use to store cached copies of your website in key regions. CDNs tend to be paid services, and they help by serving cached copies of your site from the server that’s geographically closest to the visitor.

    This approach lessens the load on your own servers. Moreover, CDNs tend to be optimized for top-of-the-line performance and are typically distributed across the globe, so they can serve websites from the best possible location for each visitor.

    Jetpack CDN is an option that integrates seamlessly with WordPress, is easy to use, and highly effective.

    Best of all, it’s a free CDN that stores images and other types of static assets from your website. Once you install and activate it, you can enable the CDN by going into Jetpack → Settings in the WordPress dashboard. 

    Then, locate the Performance & Speed settings and toggle the Enable site accelerator option.

    turning on Jetpack CDN

    4. Host third-party scripts and assets locally (whenever possible)

    Third-party scripts are elements like code from external sites, tracking pixels, fonts, and other assets that require loading to work. The more scripts and assets you load from third-party sources, the longer the process will take, which can slow down your site.

    Ideally, you should look to eliminate any third-party scripts and assets you don’t use. Alternatively, you can host code and assets on your local server to reduce loading times.

    You can identify third-party scripts, as well as unused JavaScript, using PageSpeed Insights. This tool highlights opportunities for improving site performance, including lists of unused code and third-party scripts that can be removed from your pages.

    report from PageSpeed Insights

    You can safely delete any unused third-party scripts on your website. For important scripts, you may want to consider the option of hosting them locally. 

    Final step: Install a free plugin to improve Core Web Vitals

    Learning how to leverage browser caching in WordPress is a key step to improving site performance. Fortunately, it’s not the only thing you can do to make the user experience better.

    Google measures the quality of a site’s user experience with a set of metrics called Core Web Vitals. Key performance metrics include:

    • Largest Contentful Paint (LCP). This metric measures how long it takes to load the largest asset on a page. Typically, it’s a good indicator of a page’s overall loading time.
    • First Input Delay (FID). There is a delay between loading a page and it becoming interactive. You might think a page is done loading, but if it doesn’t enable you to interact with elements like forms or links, it might have a high FID.
    • Cumulative Layout Shift (CLS). While a page is loading, its layout can shift, moving elements around on the browser. The more elements there are moving around, the higher the CLS score is. Ideally, this should be zero.

    There are a lot of ways to improve Core Web Vitals in WordPress. The easiest approach is to use a plugin that optimizes all the variables behind these metrics.

    Jetpack Boost can help you implement several strategies to improve Core Web Vitals. You can optimize CSS delivery, defer non-essential JavaScript, and enable lazy loading.

    Jetpack Boost settings

    Typically, you would need to use multiple plugins to implement these configurations or do so manually. After you install and activate Jetpack Boost, you can simply enable every setting by navigating to Jetpack → Boost and toggling the corresponding options.

    Frequently asked questions about WordPress browser caching

    While we’ve covered the essentials of browser caching in WordPress, you may still have some questions about the process. Let’s look at some of the most common ones. 

    Is browser caching secure?

    Browser caching is very secure. Most of the websites you visit probably use some type of caching policy to improve performance for visitors. As a visitor, you won’t even notice it unless you go digging into the website’s headers, or you need to clear the cache.

    The only way in which browser caching might not be secure is through bad implementation. If it’s not configured properly, browsers won’t be able to store assets the right way, or a page might fail to load (although this is very rare).

    Browser caching vs. server caching: How do they differ?

    Browser and server caching work very similarly. The only difference is that one method stores files locally, whereas the other does it on the server side.

    The best example of server caching in action is a CDN. With CDNs, you can store cached copies of your site on a third-party server (or a cluster of them). When visitors try to access the website, the CDN intercepts that connection and serves the stored copy of the site.

    In that scenario, visitors can still cache static content through their browsers. The experience for end users shouldn’t change in any way, except that CDNs often deliver much better loading times than traditional servers.

    What else can I do to improve my site’s performance?

    There are a lot of things you can do to improve your site’s performance (beyond leveraging browser caching). Some other changes you can make include eliminating render-blocking resources, minifying CSS, using a CDN, making fewer HTTP requests, and reducing TTFB and server response times.

    When it comes to site performance, some changes are more effective than others. Improvements in loading times can have a significant impact on the user experience, which can lead to a higher conversion rate for your business.

    Start serving static assets on your WordPress site

    Leveraging browser caching in WordPress is one of the most effective ways to improve loading times. An efficient strategy will focus on static files and configure them to reload periodically. This way, visitors aren’t stuck with outdated elements.

    The easiest way to implement browser caching in WordPress is by using a plugin like WP Super Cache. This plugin enables you to leverage browser caching using a set of default configurations or control every setting manually. Plus, it’s free to use.

    Additionally, when you install Jetpack Boost, you can further improve your site’s performance. Check out the plugin to learn more!