Imagine you’ve brought your young, new company to its first conference and it’s a smashing success. People are lined up at your booth, asking for your social media username, so they can connect with you when they get back home.
Adding social media icons to your site gives people this same opportunity to follow you on the social platforms they use the most. If you don’t include these icons on your site where visitors tend to find them — like your footer or header — it would be like refusing to give people at the conference a way to find you on social media. Unimaginable!
In this article, we’ll dive into the world of social media icons, explore their benefits, and walk you through how to add them to the sidebars, header, or footer of your site.
Plus, you’ll find out about Jetpack Social, a social media automation suite for WordPress.
What are the benefits of having social media icons on your WordPress site?
Adding social media icons to your WordPress site opens the door to a whole new world of promotional possibilities. Let’s explore some of the benefits.
Increased engagement. You have the opportunity to reach your site visitors in other places that they spend time, increasing their opportunity to connect with you.
Broader audience reach. When you gain social media followers, you have the opportunity to reach more people as they share and engage with your content.
Social proof. When people see others sharing and engaging with your content, they’re more likely to trust your brand and join the party. People have lots of options for spending their time, energy, and money than ever, and they’re more skeptical than ever before. A social media recommendation from their friends instantly transfers credibility to your organization.
A streamlined user experience. Many website visitors simply expect to find social media icons on your site, hoping to connect with you on more than one platform. By providing them with an easy way to do so — rather than forcing them to click through page after page to find your social accounts — you provide a much better user experience.
What is the Social Icons block on WordPress?
If you want to add social icons to your WordPress site, you can quickly do so using the Social Icons block. This simple-but-powerful tool allows your visitors to quickly recognize your presence on certain social media platforms and visit your corresponding profiles. There, they can engage with your brand, ask questions, follow you, and keep up-to-date with your latest posts.
Which icons are available on the Social Icons block for WordPress?
There are seemingly endless choices for where to spend your social media efforts. Choosing the right platforms is important because you want to go where an interested audience is most likely to engage. Spread yourself too thin, and you’re less likely to find success on any one platform. A tool like Jetpack Social can help, though. It allows you to spend more time creating great content and less time on the logistics.
Once you’ve decided where to focus your time, there are more than 40 icons available to represent any custom link you want to insert. They are:
Amazon
BandCamp
Behance
CodePen
DeviantArt
Dribble
Dropbox
Etsy
Facebook
RSS Feed
Flickr
Foursquare
Goodreads
Google
GitHub
Instagram
Last.FM
LinkedIn
Mail
Mastodon
Meetup
Medium
Patreon
Pinterest
Pocket
Reddit
Skype
Snapchat
SoundCloud
Spotify
Telegram
TikTok
Tumblr
Twitch
Twitter
Vimeo
VK
WhatsApp?
WordPress
Yelp
YouTube
How to add the Social Icons block to your WordPress site
Here are several areas you can add the Social Icons block:
Content like pages and posts, using the Block Editor
Global site elements, like your header and footer, using the Site Editor (for block themes)
Widgetized areas, like your sidebar (for classic themes)
Let’s take a closer look at all three of these.
Adding the Social Icons block to pages and posts
There are a lot of reasons you might want to add social media icons to a page or blog post. Perhaps you want to add a call to action to a blog post, encouraging readers to follow you on social media. Or maybe you want to include social icons on your Contact page, so visitors have another way to connect with you.
Your first step is to open up the page or post you’re working on and decide where you want to add your social media icons. Then, click the blue + icon at the top right to open the Block Inserter. Search for “Social Icons,†then drag and drop the block into your page.
The block will be blank initially, and simply say, “Click plus to add.†Click the + icon at the right of the Social Icons block.
This will open up a new window that has several social media platforms listed, along with a search bar. You can add your social platforms here, or click the button that says Browse All to see a full list of options.
Add any platforms that you’d like, simply by clicking on their name. They’ll appear horizontally across the Social Icons block.
Select one of the individual icons to add a link to your social media account. You can also use the toolbar above the block to move icons left or right, change their alignment, and more.
For even more options, click the Social Icons block and open the Settings panel on the right. Here, you can adjust the icon colors, display their labels, change their shape, and more.
Once you’re happy with the way your social icons look, simply save your page or post. And that’s it!
Adding the Social Icons block to global site elements
Including your social media icons in global site areas like your header, footer, and sidebar can be extremely beneficial. It means that visitors can easily find your accounts, and they’ll show up on the majority (or all) of your website pages.
If you’re using a block theme, you can easily add the Social Icons block to global site areas (called “template partsâ€) using the Site Editor. In your WordPress dashboard, go to Appearance → Editor. Open Template Parts, and you’ll see a list of elements that you can edit. Choose the one you want to work with (in this example, the header).
Here, you can make any changes you’d like to your header using blocks, and those changes will be reflected across your entire site. When you click on the header, you’ll see a black + icon at the bottom right, which will open a list of blocks, along with a search bar. Here, choose the Social Icons block.
This will add the Social Icons block to the right of your header. Now, you can click the + icon to add your social media accounts to the list. Click on each individual icon to add the link to your profile, then use the block settings to customize the look and functionality of your icons, just as you did in the section above.
If you want to move the icons somewhere else in your header, simply click on the Social Icons block and use the left and right arrows that appear in the toolbar to change their position.
Once you’re happy with how things look, click the blue Save button at the top right of the Site Editor. And you’re done!
Adding the Social Icons block to widgetized areas
If you’re using a classic theme rather than a block theme, you can add the Social Icons block to any widgetized area on your website. These will vary based on the theme you’re using, but typically include global site areas like the sidebar.
In your WordPress dashboard, go to Appearance → Widgets. Here, you’ll see a list of widgetized areas on your website, and you can expand the one you want to edit. In this example, we’ll be editing the Main Sidebar.
Click the + icon at the bottom of the widgetized area to see a list of blocks, along with a search bar that will allow you to search for more. Click the Social Icons block. Now, you can add your social media icons, include your profile links, and style the Social Icons block just as you would in the previous two sections of this post. If you want to move the icons to another part of the sidebar, simply drag and drop the block.
When you’re done, click the blue Update button at the top right to save your changes.
Need more social media features? Try Jetpack Social
If you’re ready to level up your social media game and gain access to even more fantastic features, Jetpack Social is the answer.
It’s like upgrading from economy to first class on your favorite airline. Jetpack Social is a powerful plugin that offers a comprehensive social media sharing solution for WordPress. It’s developed by the same team behind WordPress.com and the multi-faceted, popular WordPress plugin — Jetpack. They’ve designed a suite of tools for WordPress security, performance, and growth.
Social media scheduling. Plan and schedule your social media posts in advance for better organization and consistency.
Video sharing, engagement optimization, and more. Get more from each post by maximizing engagement and sharing craveable video content with your followers.
Jetpack Social offers a variety of plans, including a free option to help you get started.
Spread the word while you sleep
Adding social media icons to your WordPress site is a must for anyone who wants to grow their online presence.
Sometimes, finding success involves working longer hours or making temporary sacrifices for long-term gain. But other times? It’s just a matter of finding the right tools. With the Social Icons block and Jetpack Social, you have everything you need to supercharge your social media strategy and take your website to new heights.
Since the launch of the Jetpack AI Assistant, we’ve been listening closely to your feedback, and we’re excited to announce that now, in addition to creating fresh content, you can use the AI Assistant to revise and enhance your existing blocks in the WordPress Editor. This release also introduces the new Tock Block for easy on-site bookings, alongside numerous enhancements and bug fixes.
Enhance your editing experience with the Jetpack AI Assistant
The AI Assistant is designed to make your content editing process more efficient and tailored to your needs. Let’s say you have a paragraph or a block of content that you think could be more engaging or could better represent your ideas. Now, with a simple click, Jetpack AI Assistant can step in and help you to enhance that content, all within the familiar environment of the WordPress Editor.
The introduction of this new feature comes with several benefits:
Efficient Content Refinement: Instead of starting from scratch, let the AI Assistant help you improve your existing content, saving you both time and effort.
Quality Enhancement: AI-assisted editing can help fine-tune the language and tone of your content, making it more engaging for your readers.
Multiple Block Editing: The updated Jetpack AI is designed to work when you select more than one paragraph, making it much more convenient to edit larger sections of your content in one go.
Are you ready to explore the AI-powered content editing feature? Here’s what you need to do:
Head to the WordPress Editor within your wp-admin.
Select the paragraph or block you want to edit and find the AI Assistant logo in the “tools” group.
Seamless bookings now a click away: Introducing the new Tock Block
Introducing the all-new Tock Block powered by Jetpack! Redefine the way your customers book reservations with your business. Utilizing the lightweight and efficient Tock, this block provides an intuitive, in-line booking experience directly from your website. With a simple click, your customers can access a neatly organized calendar and booking form.
And More
This release also includes several new features and improvements:
Utilizing a localhost for your WordPress site enables you to run updates, test plugins, or build your site in private. This means you can make changes without affecting the user experience (UX) or worrying about mistakes that could disrupt operations.
Sounds pretty great, right? Even better is that most moderately-experienced developers will find it straightforward to get started.
By following this step-by-step guide, you should be able to download the localhost software, add WordPress files, and create a database without any issues.
In this post, we’ll take a closer look at WordPress localhost and its benefits. Then, we’ll show you how to configure WordPress on localhost and run through some common errors.
What is localhost, and why is it useful for WordPress?
When you create a WordPress site, you typically purchase a domain name and choose a web hosting provider. Your site resides on your web host’s server and is accessible to anybody with the correct URL.
With localhost, you can run a website from your own operating system like a PC. This means it will have a different hardware configuration than a live website. Plus, your site won’t be available online.
You’ll create a private and remote environment, using your PC storage as the host. Then, you’ll download third-party software like XAMPP to install WordPress.
There are many reasons why you might want to use localhost. First, it enables you to create a development site that you can use for testing and experimentation.
In this instance, WordPress will function as a staging site. This is a popular option for designers and developers since you can detect issues before you launch your live application. Better yet, localhost enables you to work on your website even if you don’t have an internet connection.
Additionally, a local website provides a safe environment for trying new things. This can prevent downtime on your live website in the event that a change introduced breaks something.
Localhost can also be a safer way to test new software or run updates. You won’t need to worry about breaking your site. If something goes wrong, your live site will remain completely unaffected.
Can you install WordPress locally on any operating system?
What’s more, XAMPP is open-source and free, and it supports all operating systems including Mac, Windows, and Linux. When you visit the official XAMPP website, you’ll see all the different versions of the software. Then, you can download the version that’s compatible with your operating system.
What are the requirements to install WordPress on localhost?
To install WordPress on localhost, you’ll need a fully-functioning operating system like a PC to store your website files. This will work as a virtual server, which is equivalent to a web host’s server that you’d use for a live site.
You’ll also need to download software like XAMPP. There are plenty of tools that enable you to create a local environment. WAMP, MAMP, LAMP, and Vagrant are other popular options.
XAMPP tends to be an excellent choice for WordPress, since it’s free and open-source. Plus, it works on a variety of systems including Windows, OS X, and Linux.
Once you’ve downloaded the XAMPP software, you can install it along with WordPress. You’ll also need to make sure to select three modules from the control panel. These are Apache, MySQL, and PHP.
How to install WordPress on localhost
Now that you know a bit more about localhost, let’s take a look at how to install WordPress on Localhost using XAMPP.
Step 1: Download XAMPP
The first step is to download the XAMPP software from Apache Friends. You can access XAMPP for Windows, Linux, or OS X.
Choose the version that matches your operating system. The download will start automatically and may take a few minutes.
Once downloaded, run the file to launch the XAMPP importer. If you have an antivirus program installed, you might see a warning, but you can proceed with the installation.
You might also get a warning about User Account Control (UAC). In most cases, you should just continue through that prompt and any others that come up.
Then, you should see the installer screen. Here, click on Next.
Now choose which components you want to install. It’s important to note that you don’t need all the components for WordPress. Instead, you’ll need the required ones plus MySQL and phpMyAdmin.
You can install additional components. For instance, you might want email-related features if you plan to send or debug transactional emails. So, go ahead and uncheck everything you don’t need. Then, hit Next.
Now, choose which folder to install XAMPP into and select your preferred language.
You’ll be notified that you can opt to install Bitnami for XAMPP. This is not needed for WordPress, but it can make the process slightly simpler.
If you continue without Bitnami, click on Next to run the installation.
When this is complete, you can launch the control panel and start working with XAMPP.
Step 2: Run the modules
To install XAMPP and WordPress, you’ll need three specific modules:
Apache (the web server that XAMPP relies on)
MySQL (the database that WordPress uses)
PHP (the programming language that WordPress is built on)
You can start these modules from the XAMPP control panel. The status of each one should turn green once it’s launched.
Then, test to see that the local server is working properly by going to http://localhost in a web browser.
If it was successful, you’ll now have a functioning XAMPP server on your operating system.
Step 3: Add the WordPress files
Now that you’ve downloaded XAMPP and run the modules, it’s time to install WordPress. To do this, navigate to the official WordPress website and download the latest version of the software by clicking on Get WordPress.
You’ll see that there’s an option to get set up with a hosting provider. This only concerns users who want to create a live WordPress site.
Since you want to install WordPress on localhost, click on Download WordPress 6.2.
At this point, WordPress will download to your computer.
Now, on your computer, head to the folder where you installed XAMPP. This might be named something like C://xampp.
Open the folder and locate the htdocs subfolder:
In htdocs,create a new folder for your site. The name of this folder will become the sub-name used to access your site. You might name the folder “testsite†if you’re using WordPress localhost as a staging site.
Then, you would access your site by going to http://localhost/testsite. When you’ve created the folder, extract the WordPress zip file that you downloaded at the start of this step.
Step 4: Create your database
At this point, you’ve downloaded XAMPP, run the modules, and downloaded WordPress. Now, it’s time to create a MySQL database for your WordPress installation.
First, you’ll need to launch phpMyAdmin from your XAMPP control panel. To do this, click on the Admin button for MySQL.
Inside phpMyAdmin, select the Databases tab.
Then, enter a name for your database and select Create.
That’s it! You can now move on to the last step.
Step 5: Complete the WordPress installation
The final step only requires a few tasks to complete the WordPress installation. First, visit your local website, where you should see the normal WordPress installer. You can find your website by typing http://localhost/urlinto the address bar.
Everything is the same as it would be for any other WordPress site except for the database details. Instead, you’ll need to enter the database details like this:
Database name: name of the database you created in phpMyAdmin (you set this up in Step 4 of this guide)
Username: “rootâ€
Password: leave blank
Complete the rest of the process. Now, you should see a fresh WordPress install running on your localhost.
How to move WordPress from localhost to a live server
To move WordPress from localhost to a live server, you can use a WordPress migration plugin like Duplicator. This will export your files from the local installation. Then, you’ll need to create a database on your live server and copy over your files using an SFTP client like FileZilla.
How to transfer WordPress localhost to another computer
You can transfer WordPress localhost to another computer by exporting your website and database to another system. There are plenty of plugins to help you do this, like All-in-One WP Migration.
You can also use the built-in WordPress import and export tools. You can find these in your WordPress dashboard by going to Tools → Export.
If you’re an experienced WordPress user, you can also transfer WordPress localhost to another computer using phpMyAdmin. This process requires you to export your old database and create a new one on the new PC.
How to uninstall WordPress on localhost
Once you’ve completed your tests, updates, or experiments in the local environment, you might want to uninstall XAMPP. To do this on Windows, open the Control Panel and navigate to Programs and Features. Then, locate the XAMPP app and right-click on it to delete it.
Now, navigate to the C:/xampp folder (or whichever folder you used for XAMPP) and delete any remaining files and folders on your computer.
Common WordPress localhost issues and how to resolve them
So far, we’ve tried to provide as much detail as possible to help you install and configure WordPress on localhost. But there are some WordPress localhost issues that you might encounter.
So, in this section, we’ll discuss some of the most common issues and show you how to fix them.
1. Installation failed: Could not create directory
The first WordPress localhost issue that you may encounter is when the installation fails. There are three situations when you might see this error:
You install a theme or plugin in the WordPress dashboard.
You update a plugin or theme.
You upload files directly to the wp-content folder.
Typically, the “installation failed†error occurs on new WordPress sites. You might be seeing the message because the permission settings are incorrect. Or, you might not have enough free space on your system.
Therefore, you can clear the error by checking your file permissions. In your WordPress dashboard, go to Tools → Site Health. Then,click on the Info tab and scroll down to Filesystem permissions.
Ideally, all the files will be listed as “Writable.â€
If they say “Not Writable,†your permissions aren’t configured correctly.
Fortunately, you can change the permissions by accessing your site files. To do this, you can connect to your site via FTP. Then, go to public_html and locate the following folders:
wp_content
wp_includes
wp_admin
Right-click on each of the folders (one at a time) and choose File Permissions.
Check that the options are set to the following values:
Owner permissions: Read, Write, Execute
Group permissions: Read, Execute
Public permissions: Read, Execute
Numeric value: 755
Recurse into subdirectories
Apply to directories only
Click on OK and return to your site to see if the error has cleared.
2. Login not working
Another common WordPress localhost issue is that the login procedure doesn’t work. In this case, you’ll need to navigate to phpMyAdmin to resolve it.
First, it’s important to make a backup of your website since this might require you to edit important site files. Therefore, if you make a mistake, you won’t need to worry about losing your work.
The easiest way to create a backup of your site is to use a reliable plugin like Jetpack VaultPress Backup.
VaultPress Backup makes real-time backups that are stored securely in the cloud. The tool will store your backups for 30 days, and you can restore your site to a previous version in just one click.
Not only does VaultPress backup save your website, but it also secures all your database tables. Plus, the plugin also saves a copy of all WooCommerce customer and order data.
Once you’ve installed and activated your backup plugin, open phpMyAdmin and find the config.inc.php file. Here, you can check your login details. Then, return to the login screen and enter the values.
3. This site can’t be reached
If you see an error message that reads “This site can’t be reached,†it means there’s something stopping the browser from accessing the website. For example, you might be lacking an internet connection, or you might be facing DNS (Domain Name System) issues.
First, you’ll need to temporarily disable any antivirus software, firewall, or proxy service, since this can interrupt the connection. Then, you can check your internet connection and clear your browser cache.
In Google Chrome, click on the three dots in the top-right corner. Then, choose More Tools → Clear Browsing Data.
If this doesn’t work, it can be useful to flush your DNS settings. To do this, check out Error 6: error_err_connection_refused further down.
Alternatively, you might simply need to change your DNS provider. Google Public DNS tends to be a safe solution.
The method for doing this varies depending on which operating system you use. For Mac users, you can change your DNS provider by going to System Preferences.
Then, click on Network → Advanced.
Open the DNS tab and click on +.
Now, type in the numbers for the public server you want to use. Click on OK → Apply to change the settings.
4. Error establishing a database connection
When you install and configure WordPress on localhost, you can often run into database connection issues. This usually indicates that there’s incorrect database information in your WordPress settings or an unresponsive database server.
To resolve this error, you can check your database credentials. These are stored in your wp-config.php file, so you can access the file through SFTP.
Once you’ve opened the file, make sure that the following credentials are correct:
Database name
Username
Password
Database host
You can also check your database credentials using phpMyAdmin. Once you’ve opened phpMyAdmin, click on wp_users.
Then, find the user listing and click on the Edit link. Here, you can see the user ID, password, and more for each user on the site.
If these values aren’t correct, you can change them here. Simply delete the existing values and enter new ones. Then, click on Go to apply your changes.
You can also reboot your server. To do this, all you need to do is start and stop the server from your XAMPP control panel.
5. Error err_ssl_protocol_error
The err_ssl_protocol_error can present itself in a number of different ways. For instance, you might be told that your site can’t provide a secure connection or that localhost sent an invalid response.
Sometimes this issue can be easily resolved by clearing your browser cache. To do this in Google Chrome, see Error 3: This site can’t be reached.
You can also try using your site’s DNS entry instead of the URL. So, in this case, you’d type something like: http://127.0.0.1:8080into your browser instead of http://localhost:8080.
6. Error err_connection_refused
The err_connection_refused error is another common localhost issue. It’s likely due to a misconfigured port. It might also indicate incorrect permissions or alert you to the fact that the Apache web server is not running properly.
If it’s an issue with WordPress permissions, see Error 1: Installation failed. If you want to change the port number, go to Error 13: XAMPP Apache shutdown unexpectedly. You can also disable your firewall or antivirus program since this might be blocking the connection.
The next solution is to flush your DNS, since this can fail if it’s storing too many records. To do this, open the command prompt by typing “cmd†in the search bar next to the start menu.
Now, enter the following command: ipconfig/flushdns
You can also make sure that Apache is definitely running. Go to the XAMPP control panel. If it says Start then the server must have stopped running and was likely the cause of the err_connection_refused error.
7. 404 page not found error
If you see the 404 page not found error when you try to install and configure WordPress on localhost, it means that the requested page can’t be found on the web server. Typically, this indicates that another program is on the port (port 80).
Fortunately, you can clear the error by changing the port number. To do this, see Error 13: XAMPP Apache shutdown unexpectedly.
If you’ve already tried this solution, and you’re still seeing the 404 page not found error, the problem may be that you’re not adding the port number to every URL that you type in the browser. For example, you might need to enter: http://localhost:8080instead of just http://localhost.
8. WordPress localhost asking for FTP credentials
Another common issue with WordPress localhost is that your site might start asking for your FTP credentials. Typically, this occurs when you try to run an update or install a new theme or plugin.
It’s generally the result of WordPress having insufficient permissions. Therefore, you can try changing the permissions. To do this, see Error 1: Installation failed.
You can also try to force WordPress to use the direct PHP method for updates (rather than using FTP). You can do this through your wp-config.php file, using SFTP.
Once you’ve opened the wp-config.php file, add the following line of code:
define(‘FS_METHOD’,’direct’);
Make sure to save your changes. Then, head back to WordPress to see if the error has cleared.
9. Images not showing
Whether you’re using WordPress on localhost or a live WordPress site, you might encounter an error that prevents images from showing. This means that the path toward the images is broken.
The first step is to check that your WordPress Address (URL) and Site Address (URL) match. All you need to do is go to your WordPress dashboard and click on Settings → General.
Then, check to see whether the name of the folder where your images are stored is added to the URL. This folder might be named uploads or images.
Now, navigate to Settings → Permalinks.
Here, you can select Post name for the permalink structure. Then, save the changes and see whether your images are now showing.
10. WordPress localhost is very slow
Your WordPress localhost website may be slow if you have too many plugins or poor code on your site. Therefore, it’s a good idea to make sure you only have the resources you need.
Slow websites and poor code can leave your website more susceptible to security threats. The best way to stay ahead of these issues is to use a plugin like Jetpack Protect.
Once installed, you’ll get access to automated security and malware scans to keep your website safe. Better yet, the plugin can pick up vulnerabilities in the core software and any plugins and themes on your site.
If you want even more protection, check out the Security bundle available with Jetpack. It comes with all the benefits of Jetpack Protect, plus real-time backups and additional features.
If WordPress localhost is running very slow, you can also try using the raw IP address for localhost. This can be effective as some systems (like Windows) don’t directly support the type of connection that MySQL uses when localhost is specified.
To get started, you’ll need to access your wp-config.php file. Here, make sure DB_HOST is not set to localhost.
Instead, change it to define(‘DB_HOST’,’127.0.0.1’);
Then, save the changes and return to your site to see if the problem has been resolved.
11. XAMPP maximum PHP execution time exceeded
The “XAMPP maximum PHP execution time exceeded†error is quite easy to fix. You’ll just need to edit a line of code in one of the XAMPP configuration files.
Open the XAMPP control panel and click on the Config button next to Apache. In the dropdown list, choose the option for PHP (php.ini).
This will open the php.ini file where you can search for the following line:
Max_execution_time
The value should be set to 120. To clear the error, you can increase the value.You might try doubling it to 240.
12. XAMPP maximum file size exceeded
Another common XAMPP localhost issue is the “XAMPP maximum file size exceeded†error. You might see this error when you try to upload a file to the local WordPress site that you created with XAMPP.
Again, you’ll need to find the php.ini file within your XAMPP configuration file. But this time, search for the following line: upload_max_filesize
Typically, this is set to 40M. To resolve the error, you can try increasing this value. It’s also important to note that when you edit the php.ini file, you’ll also want to make the same change to the post_max_size number.
13. XAMPP Apache shutdown unexpectedly
When you see the “XAMPP Apache shutdown unexpectedly†error, the likelihood is that something has gone wrong with Apache, causing it to crash. Apache is the web server that XAMPP relies on, so this error will mean that your local site will also stop working.
This error suggests that another program might be using the same port as XAMPP. Since ports only support one program at a time, Apache will stop working.
Skype is one program that uses the same default port as XAMPP. The good news is that the error is easy to fix as long as you have access to your XAMPP dashboard.
First, you’ll need to launch XAMPP. Then, go to Apache → Config. Here, choose the option Apache (httpd:conf).
The default port for XAMPP is 80 (this is used for most HTTP programs), so you can redirect Apache to port 8080. In the Apache file, press Ctrl + F and enter “80†to search for every instance of 80.
Then, change the following values:
Port 80 to Port 8080
Listen 80 to Listen 8080
Change servername localhost: 80 to servername localhost: 8080
Now, go back to your XAMPP control panel and revisit Apache → Config. This time,select the file Apache (httpd-ssl.conf).
Open the file and press Ctrl + F to search for 443. Port 443 is typically used for secure web transactions, but Apache also needs it.
In this file, you need to change two instances of 443:
Listen 443 to Listen 4433
<VirtuaHost_default_:443> to <VirtualHost_default_:4433>
Then, restart Apache by clicking on the Stop and Start buttons in XAMPP.
14. XAMPP 403 access forbidden error
The final WordPress localhost issue to discuss is the XAMPP 403 access forbidden error. Typically, this occurs when you try to access your database using phpMyAdmin.
One of the most common causes of the 403 forbidden error is a misconfiguration in one of the XAMPP configuration files. So, to resolve the issue, you’ll need to open your XAMPP control panel. Then, click on Apache → Config.
From the dropdown list, select httpd-xampp.config file.
Once you’ve opened the file, look out for the following line of code that starts with: Alias/phpmyadmin
Within that code block, you should see a line that reads: Require local
Now, change that line to say: Require all granted
At this point, the 403 access forbidden error should clear, giving you access to phpMyAdmin.
Frequently asked questions about configuring WordPress on localhost
Although we’ve tried to cover the basics of how to install and configure WordPress on localhost, you might still have some questions. Let’s take a look at the most common ones.
Is localhost a web server?
Localhost is the hostname or computer that runs the program. In this instance, the computer becomes the virtual server for your application. This virtual server is offline and stores your site data the same way that a web host’s server would if you were running a live website.
Can someone access your localhost?
You can share your web server with someone else, but they’d need to have your IP address or your hostname. You can find this information on Windows with ipconfig/all on a command line.
WordPress localhost vs live server: what are the main differences?
Localhost is a virtual server that can be stored on your computer. Plus, it’s kept offline, so it isn’t accessible to the public.Â
On the other hand, a live server generally requires a web host that stores your website’s data. Meanwhile, you’ll need to purchase a domain name. This way, anyone on the internet can find your site by typing the URL into the browser.
What are the benefits of using localhost for WordPress development?
There are many benefits to using localhost for WordPress development. Since the website is kept offline, it creates a private space for you to test out functionality or experiment with new features.
What’s more, any changes that you make in localhost will leave your live website completely unaffected. Therefore, you can experiment freely without worrying about things going wrong. Then, once you’ve verified that updates or plugins are working (and safe), you can easily push them to your live website.
This enables you to preserve your UX. So, while you get creative in your local environment, people can still visit and interact with your live website.
How do you access WordPress on localhost?
To access WordPress on localhost, you’ll need to have a local server like XAMPP set up on your computer. Then, you can install the WordPress files. For full details, check out the tutorial above.
Once you’ve successfully installed and configured WordPress on localhost, open a web browser and enter this address: http://localhost/filename.
In this case, “filename†refers to the directory of your local server where you installed WordPress. Here, you should see the WordPress login page where you can enter your username and password to access your site.
How do you log into WordPress on localhost?
You can log into WordPress on localhost in the same way that you’d log into a live WordPress website. All you need to do is enter the correct URL into the browser.
Usually, it looks something like this: http://localhost/yoursitename. Then, add the login page suffix like /admin or wp-login.php at the end of the address.
How do you reset a localhost WordPress password?
You can’t reset your localhost WordPress password by email (unless you’ve enabled the mail function on your server). This is because the mail function is turned off by default on local servers.
Therefore, to reset your password, you’ll need to open phpMyAdminby typing the following URL: http://localhost/phpmyadmin. Then, you’ll need to provide your MySQL password and username. Generally, the username is “root†and no password.
Then, select your WordPress database and find the wp-users table. Here, click on the Edit link next to the username of the administrator.
This opens a form where you can edit the information for that user.
Scroll down to user_pass and type a new password in the valuecolumn. Then, select MD5 in the Function column and click on Go to save your changes.
Can you send an email from WordPress on localhost?
By default, the mail function is disabled in localhost, so you can’t send an email from WordPress. But you can enable emails by installing a plugin like WP Mail SMTP.
In this instance, the plugin will take over the default email delivery function and route emails through an SMTP provider. You’ll need to choose an SMTP provider like Sendinblue, which works particularly well for WordPress websites. Then, you can follow the installation wizard in the WP Mail SMTP to set this up successfully.
Can you access WordPress localhost from another computer?
Yes, you can access WordPress localhost from another computer, but you’ll need the local IP address and the port number. So, instead of simply entering the website’s address, it will look something like this: http://192.168.0.4:80/wordpress.
Is XAMPP safe?
Yes. XAMPP is open-source, free, and safe to use as a local server for your WordPress website.
Does XAMPP install PHP?
XAMPP is one of the most popular PHP development environments. It’s an Apache distribution containing PHP, Pearl, and MariaDB so yes, it does install PHP. But you’ll still need to install WordPress separately to set up WordPress on localhost.
Can you run multiple local WordPress sites under XAMPP?
Multisite is a network of more than one website that operates off the same WordPress installation. Even if you run your website on a local computer under XAMPP, you can install WordPress Multisite.
You’ll need to have a standard WordPress installation running first. Then, you can add more sites under a subdomain or a subdirectory.
Localhost: A powerful tool for WordPress developers
WordPress on localhost is a great tool for designers and developers since it enables you to create a safe, private environment to test out new features and functionality. Better yet, the live website will still be available for visitors and remains completely unaffected by the changes you make in the local environment.
What’s more, it’s simple to install and configure WordPress on localhost when you use software like XAMPP. Once you’ve installed XAMPP, you can run the necessary modules and then download the latest version of WordPress. Then, you’re ready to add the WordPress files and create your database.
For most developers, it’s also important to find a reliable backup plugin like Jetpack VaultPress Backup so that it’s easy to restore your website in case anything goes wrong. Plus, you can use Jetpack Protect to access a powerful security and malware scanner.
This is an all-in-one platform that enables you to manage site security, plugins, and licenses. Additionally, you can get your very own Jetpack partner manager to help you grow your business. Meanwhile, you can access your websites from any location using the user-friendly mobile app.
Get started with localhost for WordPress
WordPress on localhost is an ideal solution for designers and developers to experiment with new software. It’s also handy for new website owners who want to build their websites offline. While it’s slightly more complex, you can install and configure WordPress on localhost fairly easily.
To recap, here are five steps to install and configure WordPress on localhost:
Download XAMPP.
Run the modules.
Add the WordPress files.
Create your database.
Complete the WordPress installation.
Jetpack for Agencies is another useful development tool. You can monitor every action on your site with an activity log, access your websites from the mobile app, and get your own Jetpack partner manager. Get started today!
Traditionally, creating unique and engaging imagery for social media platforms often required a basic understanding of image editing tools. Adding text to images, changing photo orientation, and tinkering with different visual styles for each social network was tedious and frustrating. But not anymore.
With Jetpack Social Advanced, you can overlay custom text onto your images and choose from a variety of styles to increase engagement on your social posts. Most importantly, you’ll save time by doing it all within the WordPress editor.
Choose your image & add custom text
Jetpack Social Advanced gives you the freedom to create social images with custom text applied to them. This is handy if you often have long blog post titles for SEO purposes, but prefer to use specific calls-to-action with your social media post images.
Sometimes the featured image of your blog post may not be the best fit to share on social platforms. With the Jetpack Social Image Generator, you can choose to share your featured image, select a different image from your media library, upload a new image, or select “no image†if you just want to create a text-based image for your socials.
Pick a template to make it your own
Tie everything together by exploring creative templates with various fonts and text placement around your image. Choose from full width images with text overlays or images with text aligned to either side.
Preview before you share
Finally, use the built-in Jetpack social preview tool to see exactly how your image will look on each of your connected social media platforms. Publish right away or schedule your posts to be shared when your audience is most active on social media.
With Jetpack Social, it’s never been easier to share your WordPress content to social media.
As your site traffic increases, you’ll want to ensure that things continue to run smoothly. If visitors have to wait more than a few seconds for your page to load, they’ll likely leave your site and may never come back.
Fortunately, there are some simple tests to evaluate your performance and, if improvements are needed, there are solutions that can almost immediately improve your loading times.
In this post, we’ll discuss one aspect of site performance: First Input Delay. You’ll learn what it is, why it’s important, and how you can measure and improve the FID score on your WordPress site.
An introduction to first input delay
First Input Delay (FID) is the loading time a visitor experiences after interacting with your website for the first time. Essentially, when someone clicks on a link or taps a button, they have to wait for their browser to respond. If your site has a high FID score, visitors wait for longer periods.
FID is one of the main metrics of Core Web Vitals. Created by Google, this report measures the performance of web pages.
Here are the three main performance metrics that are included in the Core Web Vitals report:
Largest Contentful Paint (LCP): this measures the time it takes your website to load after a user requests the URL.
First Input Delay (FID): this is the time it takes your website to respond after a visitor interacts with a page.
Cumulative Layout Shift (CLS): this measures all the layout shifts that occur while a page is loading.
Although all of these metrics evaluate your website’s user experience, your FID score is one of the most important. If your page doesn’t load quickly, it can leave a poor first impression. In fact, a one-second delay can decrease visitor satisfaction by 16 percent.
Here are some benefits of improving your FID score:
When you run a Core Web Vitals test, the report will give you a First Input Delay score. An acceptable FID is 100 milliseconds or less.
A poor FID score is anything higher than 300ms. This can be caused by a few different factors.
One of the most common causes of high First Input Delay is heavy JavaScript code. If a browser has to execute a large JavaScript file, it can be too busy to execute other requests.
Having too many JavaScript-based plugins can negatively affect your loading times. Similarly, some themes can have complex files that cause the same problem.
Another factor can be third-party scripts. If your website has many third-party analytics codes and tags, this can increase your page’s latency. Sometimes, browsers can prioritize these scripts, delaying the loading of other content on your site.
How to measure your website’s FID score
Now that you know what First Input Delay is, it’s time to put your website to the test.
There are several Core Web Vitals tools you can use to check your FID. If you receive a poor report from any of these tools, you can take action to improve your website.
1. PageSpeed Insights
One well-known tool you can use is PageSpeed Insights. This enables you to assess your website’s performance on a variety of factors.
After you enter your website’s URL, PageSpeed Insights will give you a detailed performance analysis. At the top of the page, you can see whether your site has passed the Core Web Vitals assessment.
Using this report, you can review your website’s FID score, which will be measured in milliseconds. As we mentioned earlier, any score under 100ms will pass the test.
Note that you’ll need to check your site’s performance for both mobile and desktop browsers. You might notice slight differences in your FID score on these two devices.
This is one of the fastest ways to measure the First Input Delay on your website. If you need a quick overview of your web performance, this could be the right tool for you.
2. Google Search Console
Similar to PageSpeed Insights, Google Search Console is a free tool that you can use to evaluate site performance. With this service, you can view traffic data for your site and troubleshoot specific issues like First Input Delay.
To start using Google Search Console, you’ll have to verify your website ownership. There are several ways to do this, but we’ll outline the HTML file upload method. Start by entering your domain or URL prefix.
Then, download the HTML file that has been generated for you. You’ll need to upload this file to your site’s root directory before you can employ the features of Google Search Console.
After verification, you’ll be able to access your dashboard. Here, you can navigate to the Core Web Vitals tab.
Unlike PageSpeed Insights, it may take some time to access your report if you’re new to this tool. Also, you may not be able to see a report if your site doesn’t get enough visitors.
Google Search Console can give you similar metrics on your FID score. You’ll receive an evaluation of Poor, Needs Improvement, or Good based on real-world usage data.
3. Lighthouse
Lighthouse is a web development tool that you can use to audit the performance of any web page. Although it doesn’t directly measure First Input Delay, it will give you the Total Blocking Time (TBT). You can use this as a proxy for FID.
Put simply, TBT evaluates how well your site responds to user input. It measures the total time your browser is too busy (completing tasks like running JavaScript or parsing CSS) to respond to user input between FCP and TTI.
To view Lighthouse’s report on your website, you’ll need to right-click on your web page. Then, choose Inspect.
At the top of the generated code, find the double arrow icon. Then, click on it and select Lighthouse.
On the next page, you’ll see an option to generate a report. When you click on this, Lighthouse will audit your website.
After the audit is complete, you can view detailed analytics on your site’s performance. You’ll also see reports on your SEO and web accessibility.
Then, scroll down until you see Metrics. In this section, you’ll see your Total Blocking Time.
Although TBT and FID are similar, it’s important to note that FID is a field metric. Since it’s based on users in real-time, it can’t be measured in a lab setting.
Lighthouse is a lab metric tool, so its Total Blocking Time metric won’t assess real interactivity. Fortunately, improving your TBT score can also improve your First Input Delay.
How to reduce first input delay in WordPress
When you test your website using one of the above tools, you might receive a poor First Input Delay score. Fortunately, you can improve your score by implementing a few effective strategies.
Let’s look at how to reduce First Input Delay in WordPress.
1. Install an optimization plugin
An easy way to get started is to install a plugin that focuses on Core Web Vitals. By doing this, you can improve your First Input Delay without any heavy lifting.
Jetpack Boost is a powerful, easy-to-use plugin that you can use to optimize your Core Web Vitals. It provides many ways to boost your web performance and improve your FID score.
After activating Jetpack Boost, the tool will automatically give your site a performance score. You can view how fast your pages load on both mobile and desktop views.
Then, you can customize its settings to optimize your files for fast loading. Deferring JavaScript will likely be the most effective in improving FID, though optimizing CSS may also save parsing some large CSS files in certain circumstances. Enable both of these, and you’re likely to see an improvement in your FID score.Â
Jetpack Boost is a free plugin. If you already have Jetpack installed on your WordPress website, you can activate Jetpack Boost from the dashboard.
2. Defer render‑blocking JavaScript
Another effective way to optimize your FID score is by deferring render-blocking JavaScript. By default, all JavaScript on your website is render-blocking. This means that a browser will stop loading a certain page until it can download and execute these scripts.
In this case, you can defer JavaScript execution. This will tell the browser to render the most relevant content first.
To identify this render-blocking JavaScript, you can use PageSpeed Insights. First, type your website’s URL into the search bar.
Then, scroll down to the Opportunities section. Here, you’ll see suggestions for improving your web performance. Find where it says Eliminate render-blocking resources.
When you expand this section, there will be a list of resources that you can defer or eliminate altogether. On the right-hand side, PageSpeed Insights will show you how these changes can impact your loading time.
Once you decide to defer non-essential JavaScript on your website, you can use a plugin to make this process simple. With Jetpack Boost, you can do this in just one step.
In your WordPress dashboard, navigate to Jetpack → Boost. Then, find the setting labelled Defer Non-Essential JavaScript.
Finally, turn on this feature. When implemented, the switch will turn green. Now, try running your website through PageSpeed Insights again to see if your FID score has improved.
3. Defer non‑critical CSS
When you evaluate your website in PageSpeed Insights, you may also see other render-blocking resources. Similar to JavaScript, certain coding can prevent your page from loading while the browser reads them.
Just like with JavaScript, you can defer non-critical CSS. Start by running your website through a performance tool to see if your CSS needs to be optimized.
Then, you can use the Jetpack Boost plugin to optimize your CSS. In your WordPress dashboard, navigate to Jetpack → Boost. Then, find the setting labelled Optimize CSS Loading.
After you click on this option, the plugin will automatically generate the critical CSS for your website. It will move this important information to the beginning of the page, which can help your content load faster.
Deferring non-critical CSS can enhance your overall performance. In some circumstances, it could also improve your FID score on PageSpeed Insights.
4. Eliminate unnecessary JavaScript
If you installed a lot of plugins or a complex theme, your website could be running too many scripts. If a browser needs to execute a long list of scripts to load your website, it can lead to slow speeds.
Many scripts are necessary to display your website, but chances are, you have some unnecessary CSS and JavaScript. If you’re not certain how to tell the difference, you can go back to PageSpeed Insights.
Like you did with the first three methods, scroll to the Opportunities section. This time, look for unused JavaScript and CSS.
Next to each unused script, there will be a URL that tells you where it’s coming from. In this example, Google Analytics and Google Tag Manager were creating some unnecessary JavaScript.
If you know which theme or plugins are causing the problem, you might consider deleting them. Then, you can install different versions that are well-coded and more lightweight.
Alternatively, you can use a plugin like Asset CleanUp to remove unused CSS and JavaScript. This tool can eliminate render-blocking resources to decrease your site’s number of HTTP requests.
Once you’ve installed and activated Asset Cleanup on your site, go to Asset CleanUp → CSS/JS Manager in your dashboard. On this page, you can select different elements of your website to view its CSS and JavaScript.
For example, you can click on Homepage, and it will display all the loaded files on this page.
This information will be listed based on location. You can scroll down the page to see scripts from your plugins, themes, core software, and third-party sources.
There are two ways to remove a piece of script. You can unload it on this specific page or site-wide.
Once you remove unused scripts, click on Update. After this, you can clear your cache to immediately apply these changes.
5. Minify CSS and JavaScript
Although you can easily remove scripts from your site, you’ll only want to get rid of the ones you’re not using. For necessary CSS and JavaScript, you can simply minify them instead.
Jetpack Boost makes this process easy, with toggles that you can just turn on. After installing and activating the plugin, go to Jetpack → Boost in your WordPress dashboard.
Then, turn on the options for Concatenate JS and Concatenate CSS. These tools will group your code and minify it for optimal performance.
6. Delay JavaScript execution time
To optimize your JavaScript even further, you can delay its execution time. This involves telling the browser to only load the JavaScript after a user interacts with your content. Unless a visitor scrolls down the page or clicks on a button, these scripts won’t be processed.
Note: This could potentially have the opposite effect (while helping improve your LCP score) so you may want to try other tips in this article first. If you do proceed with this, check your score right away and determine if it’s improved before proceeding with other optimization tasks.
To do this, you can use a plugin like Flying Scripts. With this tool, you can delay the execution of JavaScript files until there’s visitor activity on your site.
After you activate Flying Scripts, go to Settings → Flying Scripts. This will open the settings page for the plugin, where you can start implementing JavaScript delays.
Start by writing keywords that identify the scripts you want to delay. For example, you can use “gtag†for a Google Tag Manager script.
Then, you can implement a timeout. Essentially, this will execute the JavaScript when there has been no activity for a certain period of time. You can set a timer for up to ten seconds. Once you’re finished, click on Save Changes.
7. Implement a content delivery network
Another effective option for improving your First Input Delay is to use a Content Delivery Network (CDN). This is a group of connected servers that can distribute your online content to users across the world.
When using a CDN, you can decrease the distance between your server and online visitors. This is because when someone visits your site, the content is delivered from the server that’s closest to their location. If you only have a single server in one location, it can take a long time to send data to international users.
Luckily, sites that utilize Jetpack already come with a free CDN. If you navigate to Jetpack → Settings → Performance, you can turn on the Site Accelerator.
Jetpack will optimize your images and static files. Unlike with other CDN providers, there’s no file limit. Plus, you won’t have to worry about extra monthly fees or a complicated management process.
Frequently asked questions about First Input Delay
So far, we’ve looked at how First Input Delay works and how you can improve your score. Now, let’s look at some common questions about FID.
How can I measure my WordPress site’s FID score?
You can easily measure your website’s First Input Delay score using a tool for Core Web Vitals. PageSpeed Insights is an easy-to-use option. All you have to do is enter your site’s URL and the tool will generate a detailed report on your site’s performance.
Google Search Console functions very similarly. After you verify that you own a website, you can view your FID report based on real-world visitor data.
You can also use Lighthouse. This tool gives you your site’s Total Blocking Time (TBT). Although this won’t display results from real visitors, it can give you a better understanding of your page responsiveness.
What is a good FID score?
Put simply, your site will fall into one of three scores:
Good: 100 milliseconds or less
Needs Improvement: ranges from 100ms to 300ms
Poor: greater than 300ms
After you measure your FID score, any results over 100 milliseconds will require some adjustments.
How can I easily optimize my FID score?
You can improve your FID score by optimizing the scripts on your website. Usually, complex JavaScript and CSS files will prompt a browser to stop loading until it processes them. By removing, deferring, or minifying scripts, you can boost your site’s speed.
Although you can use different tools for this process, Jetpack Boost can help you implement multiple solutions at once. Using this plugin, you can optimize your CSS structure and defer non-essential JavaScript.
Improve your first impression
When a new visitor interacts with your website, they expect their browser to respond quickly. If your site has a high First Input Delay (FID), it can cause users to leave the page without reading your content. By focusing on your site’s response time, you can improve the user experience and retain more visitors.
Your website can have a poor FID score due to heavy and inefficient JavaScript and CSS coding. Fortunately, you can easily identify these issues using a tool like Google’s PageSpeed Insights. Then, you can install a plugin like Jetpack Boost to minify or defer CSS and JavaScript.
A website is like your physical storefront — it’s your virtual chance to showcase your business, welcome customers, and close deals. But just as the foundation of a building must be strong and secure, the hosting of your WordPress website must be, too.
Whether you’re a one-person business or a rapidly-expanding startup, choosing a hosting solution is a vital decision that can significantly impact your website’s performance, security, and overall success. In this comprehensive guide, we’ll walk you through the essential considerations and factors to help you navigate the maze of options and find the perfect match for your business.
Finding the perfect host for your WordPress website requires an understanding of each type of hosting solution. In this section, we’ll demystify the options, so you can make a solid choice.
Shared hosting
Shared hosting is the equivalent of renting a room in a house full of tenants. You share the server’s resources with other websites. It’s an economical option for startups and small businesses. However, if one website on the server experiences a surge in traffic or a security breach, it could affect the performance and security of your website. You also tend to have fewer resources allocated to your site, since you’re sharing a finite number with everyone else.
Virtual private server (VPS) hosting
VPS hosting is like upgrading to a townhouse from a cramped apartment. You still share the server, but resources are divided into separate virtual environments. This provides better performance and more control over your website. VPS is ideal for businesses that have outgrown shared hosting but aren’t quite ready for dedicated server hosting.
Managed WordPress hosting
Managed WordPress hosting is like having a personal butler for your website. The hosting provider takes care of technical aspects like updates, backups, and security. This allows you to focus on growing your business. Managed hosting is best for those who want a hands-off approach to website maintenance.
Dedicated server hosting
Dedicated server hosting is the equivalent of owning a single-family home. You have an entire server to yourself, with unparalleled control, performance, and security. However, it comes with a hefty price tag and is best suited for large businesses or high-traffic websites. And it typically requires more maintenance, so you’ll either need to have some server management experience or hire someone who does.
Cloud hosting
Cloud hosting is like having an ever-expanding floor plan. Your website is hosted on a network of servers, allowing you to scale resources as needed. This offers flexibility and performance without the need for a dedicated server. Cloud hosting is ideal for businesses with fluctuating traffic or those anticipating rapid growth.
2. Determine your WordPress hosting needs and budget
Before diving into the sea of hosting providers, it’s essential to assess your needs and budget. This will help you narrow down your options and find the best fit for your business.
Traffic and bandwidth requirements
Estimate your website’s traffic to determine the amount of bandwidth needed. High-traffic websites require more resources, so look for hosting plans that offer generous bandwidth allowances or even unmetered bandwidth.
If you’re just starting, it’s unlikely that you’ll need to account for massive amounts of traffic. However, if you have an aggressive marketing plan or expect national exposure, you may want to plan accordingly. It’s somewhat common for unprepared sites to crash when they get sudden, unexpected exposure from major influencers or national press.
If you’re moving your site from another platform or buying an existing property, you can reference Google Analytics or Jetpack Stats data to help you make a more informed decision.
Storage space requirements
Consider the amount of storage needed for your website’s files, databases, and emails. Websites with large media files or extensive databases may require more storage space than others. Ensure the hosting plan you choose offers enough to accommodate your needs, and allows you to easily scale as you grow.
Memory is different from storage in the sense that it’s space used temporarily to process data. Once that’s complete, the data no longer takes up space unless it’s moved to storage.
WooCommerce, for example, recommends a minimum WordPress memory limit of 256MB, though it’s possible to run with less if you’re willing to sacrifice performance (you shouldn’t be).
Popular sites can receive numerous requests simultaneously, and a lack of memory can overwhelm its ability to process data. This can crash a site or, at the very least, make it run very slowly.
Ensuring your host allocates enough memory to process all the plugins and features on your website is just as important as having enough storage.
Website security requirements
Security should be a top priority for every business. Assess the level of security your website needs, including protection against hackers, malware, and DDoS attacks. Some hosting providers offer built-in security plugins such as Jetpack Security, while others may let you figure out security on your own.
Technical expertise and control requirements
Determine how much control you want over your server environment. If you have the technical expertise, you may prefer a hosting solution that allows for more customization. On the other hand, if you prefer a hands-off approach, managed hosting may be a better fit.
Budget constraints
Evaluate your budget to ensure that you choose a hosting plan that offers the features you need at a price you can afford. Keep in mind that some providers offer promotional pricing for the first term, which may increase dramatically upon renewal.
3. Look for reliability and uptime guarantees
A website that’s constantly down is like a store with its doors locked — customers can’t access it, and you lose potential sales. Reliability and uptime are crucial factors when choosing a hosting provider.
Service Level Agreements (SLAs)
Examine the hosting provider’s Service Level Agreement (SLA) to understand their uptime guarantees and the compensation offered for any downtime. A good SLA should guarantee at least 99.9% uptime, ensuring your website is accessible the vast majority of the time.
Historical uptime performance
Review the provider’s historical uptime performance to determine if they consistently meet their SLA guarantees. Look for third-party downtime monitoring services or independent reviews that track uptime data for a less biased view.
Redundancy and backup measures
Inquire about the hosting provider’s redundancy and backup measures to ensure your website’s data is safe and recoverable in the event of a disaster. A robust backup solution should include daily or weekly backups, offsite storage, and easy restoration options.
You’ll also want an independent, real-time WordPress backup solution from a third party. This way, your investment is protected in case your host is compromised.
4. Consider server performance and speed
People won’t stick around for a slow-loading site. In addition to strong WordPress performance optimization for your site, ensuring your hosting provider offers excellent server performance and speed is vital for a positive user experience and improved search engine rankings.
Server hardware and infrastructure
Investigate the hosting provider’s server hardware and infrastructure to ensure that they use up-to-date, high-quality components. Look for providers that use solid-state drives (SSDs), as they offer faster data retrieval compared to traditional hard drives.
Content delivery networks (CDNs)
Instead of serving your website to everyone around the world from a single location, a content delivery network (CDN) stores your website’s content in locations around the world and serves it to visitors from the location nearest to them. CDNs help reduce latency and improve page load times. Check if the hosting provider offers CDN integration or if you can easily set up a free third-party CDN such as Jetpack CDN.
Caching technologies
Caching technologies store and serve frequently-accessed data, reducing server load and improving website performance. Look for hosting providers that offer built-in caching solutions or support popular caching plugins.
Server location and latency
Choose a hosting provider with data centers located near your target audience to reduce latency and improve page load times. If your audience is spread across multiple regions, consider using a CDN to further enhance performance.
5. Check the hosting provider’s security measures
Your site and host should be like a fortress, keeping unwanted visitors out to protect valuable contents inside. Evaluating the hosting provider’s security measures is essential for safeguarding your website and customer data.
Firewalls and intrusion detection systems
Ensure the hosting provider uses firewalls and intrusion detection systems to protect your website from hackers and other security threats. These security measures act as a barrier, preventing unauthorized access to your server environment.
Secure Socket Layer (SSL) certificates
An SSL certificate encrypts data exchanged between your site and visitors. They’re essential for protecting sensitive customer data. In fact, they’re so important that Google includes SSL certificates in their ranking factors and some browsers will display bright red warning labels on sites that don’t have them. Look for hosting providers that offer free SSL certificates or support third-party SSL installation.
Check if the hosting provider performs regular malware and virus scanning to protect your website from threats. Some providers offer built-in scanning tools, while others may require additional plugins or services.
Data encryption and backup
Data encryption and backup are crucial for protecting your website’s data from unauthorized access or loss. Look for hosting providers that offer encryption options and robust backup solutions. Ideally, you’ll also install a WordPress backup plugin that provides more control and keeps your backups safe if your server is compromised.
6. Evaluate technical support and customer service
Choosing a hosting provider with exceptional support and customer service is essential for resolving issues quickly and efficiently.
If you’re not an experienced developer — and aren’t working with someone who is — this becomes even more important. Without good support, your site could go down for long periods of time during an emergency.
Available support channels
Evaluate the hosting provider’s support channels, such as live chat, email, phone, or ticket systems. Multiple support options ensure you can reach out for help in a way that’s convenient for you.
Response times and availability
Inquire about the hosting provider’s response times and availability. Look for providers that offer 24/7 support and quick response times to minimize downtime and frustration.
Technical expertise and knowledge base
Assess the technical expertise of the hosting provider’s support team to ensure they can effectively assist you with any issues. Additionally, a comprehensive knowledge base with tutorials, guides, and FAQs is invaluable for self-help and troubleshooting.
Customer reviews and satisfaction
Read customer reviews and testimonials to gauge overall satisfaction with the hosting provider’s support and customer service. Look for patterns in feedback, such as consistently slow response times or unresolved issues.
7. Review pricing plans and add-ons
Carefully review each hosting provider’s pricing options to ensure you’re getting the best value for your money. Remember to account for introductory offers that may expire after your initial commitment period.
Plan features and limitations
Examine the features and limitations of each hosting plan to ensure it meets your needs. Look for any restrictions on bandwidth, storage, or the number of websites you can host.
Payment terms and renewal rates
Review the hosting provider’s payment terms and renewal rates. Some providers offer discounted pricing for the first term, which may increase significantly upon renewal. Understand these pricing changes to avoid unpleasant surprises.
Additional services and features
Investigate the hosting provider’s additional services and features, such as website migration, domain registration, or email hosting. These extras may be included in your hosting plan or available as paid add-ons.
8. Check for user-friendly interfaces and control panels
Choose a hosting provider that offers an intuitive control panel and website management tools.
Control panel features and customization
Evaluate the hosting provider’s control panel features and customization options. Popular control panels like cPanel or Plesk offer extensive functionality and are widely supported.
Access and permissions management
Examine the hosting provider’s access and permissions management options. This is especially important if you have a team working on your website and need to grant varying levels of access to different users.
Website management tools and applications
Explore the website management tools and applications offered by the hosting provider. Look for an automated installation for WordPress, as well as tools for managing databases, email accounts, and domains.
9. Look for WordPress-specific features and compatibility
Since WordPress powers your website, it’s crucial to choose a hosting provider that offers features and compatibility tailored to the platform.
WordPress installation and configuration
Ensure the hosting provider offers a one-click WordPress installation or streamlined setup process to simplify the installation and configuration of your WordPress site.
WordPress security
Implementing strong security measures is paramount for protecting your website from threats. Consider hosting providers that offer built-in security features or include popular security plugins.
Jetpack, for example, is considered to be the best all-around WordPress security plugin. Jetpack’s Security plan includes a comprehensive array of prevention, detection, and recovery options for a wide variety of threats. From brute force attack prevention and malware scanning with one-click fixes to downtime monitoring and real-time backups with quick restore options, it provides unparalleled peace of mind.
WordPress backups
Regular backups are essential for safeguarding your website’s data and ensuring quick recovery in case of data loss or corruption. Consider hosting providers that offer automatic backups.
However, you shouldn’t solely rely on your host’s backups as an issue that takes down your site may have also compromised your servers, rendering those backups useless.
Jetpack VaultPress Backup is a reliable plugin, providing real-time backup and easy restoration features. It’s also included as part of the comprehensive Security plan for Jetpack.
WordPress performance optimization
Optimizing your WordPress site’s performance can improve user experience and search engine rankings. Look for hosting providers that offer built-in performance optimization features or support plugins that help enhance your site’s speed.
Jetpack Boost is one such solution, offering features such as critical CSS generation, deferring of non-essential JavaScript, and lazy image loading. Discover more about Jetpack Boost here: https://jetpack.com/boost/
10. Read reviews and compare hosting providers
Before making a decision, it’s essential to gather as much information as possible about your top hosting provider candidates. Reading reviews and comparing providers can help you make an informed choice.
Independent reviews and ratings
Examine independent reviews and ratings of the hosting providers you’re considering. Look for unbiased opinions from reputable sources, such as industry experts, bloggers, or publications.
Social media feedback and recommendations
Social media can be a treasure trove of customer feedback and recommendations. Browse the hosting providers’ social media pages and search for mentions of their services to gain insight into customer satisfaction and common issues.
Direct comparison of features and pricing
Create a side-by-side comparison of the features and pricing offered by each hosting provider. This will help you visualize the differences and make a more informed decision based on your needs and budget.
Word-of-mouth recommendations and referrals
Don’t underestimate the power of word-of-mouth recommendations and referrals. Consult your professional network, friends, or online communities to gather personal experiences and opinions about the hosting providers you’re considering.
Make an informed decision
Finding the best hosting for your WordPress website is a critical decision that can impact your business’s online presence and growth. By understanding the different types of hosting, assessing your needs and budget, and carefully researching and comparing hosting providers, you can find a solution that serves your needs and protects your investment for years to come.
Frequently asked questions about WordPress hosting
Where can I find recommended WordPress hosting providers?
There are several sources to find recommended WordPress hosting providers, such as independent reviews, community forums, and industry experts’ opinions.
Additionally, you can explore the hosting providers recommended by trusted WordPress partners, such as Jetpack. Jetpack’s recommended hosting providers have been vetted for their compatibility, performance, and reliability.
To be safe, you should always have an off-site, real-time WordPress backup solution in place. This way, every time you make a change on your site, it will be safely stored, and you’ll never lose your work again.
Should I back up my site with my hosting provider or a third-party service?
For maximum safety, you should have backups from both your hosting provider and a third-party backup plugin. Many hosting providers include automated backups as part of their hosting plans, while others may charge extra for this service. The frequency of backups, how securely they’re stored, and what they include can vary.
Third-party backup services, such as Jetpack VaultPress Backup, provide specialized features and options tailored for WordPress sites. Consider factors such as cost, ease of use, and restoration options when selecting a backup solution.
It’s also important to understand that if your server is compromised in any way, such as an error from your provider or a hack, you may also lose your backups. That’s just one reason that also using a third-party plugin is critical.
How important is website security for a WordPress site?
Website security is crucial for any WordPress site, as it helps protect your site from hackers, malware, and other potential threats. This allows you to safeguard your customers’ data, maintain your online reputation, and prevent downtime or data loss. Learn more about WordPress security.
What security features should I look for in a hosting provider?
When evaluating a hosting provider’s security features, look for the following:
Firewalls and intrusion detection systems to prevent unauthorized access.
Regular malware and virus scanning.
SSL certificate support to encrypt data exchanged between your site and its visitors.
Secure data encryption and backup solutions.
Support for security plugins, such as Jetpack Protect, to enhance your site’s security.
High-quality customer support services.
How can I protect my WordPress site from malware and viruses?
To protect your WordPress site from malware and viruses, follow these best practices:
Keep your WordPress core, themes, and plugins up to date.
Only download plugins and themes from trusted sources.
What are uptime guarantees, and why are they important?
Uptime guarantees refer to the percentage of time a hosting provider promises to keep your website accessible and online. These guarantees are essential, as they indicate the hosting provider’s commitment to maintaining the availability and reliability of your site. A higher uptime guarantee, such as 99.9%, minimizes the chances of your website experiencing downtime, ensuring a positive user experience and protecting your online reputation.
How can I monitor my WordPress site for uptime and performance?
Monitoring your WordPress site for uptime and performance can be done through various methods, including:
Using website monitoring tools and services, such as Jetpack, which check your site at regular intervals and notify you in case of downtime or performance issues.
Installing performance monitoring plugins, like Jetpack Boost, which provide features such as site performance metrics and one-click enhancements.
Regularly monitoring your site’s uptime and performance helps you identify and address issues promptly, ensuring a smooth and satisfying user experience for your visitors.
Jetpack: Enterprise-grade security and backups for all WordPress sites
It’s essential to emphasize the critical role that security and backups play in the success and safety of your website. Jetpack offers powerful, enterprise-grade solutions accessible to all WordPress websites.
Jetpack Protect offers features such as malware scanning with one-click fixes, instant threat notifications, and a robust web application firewall (WAF), ensuring your website remains safe from cyber threats. By choosing Jetpack Protect, you can confidently secure your site without breaking the bank. Learn more about Jetpack Protect here: https://jetpack.com/protect/
Jetpack VaultPress Backup is a robust backup solution that safeguards your site’s data and offers seamless restoration in case of data loss or corruption. With real-time backups and easy-to-use restoration features, VaultPress Backup ensures that your website’s precious data is always protected and recoverable. Discover more about VaultPress Backup here: https://jetpack.com/upgrade/backup/
For those seeking a comprehensive solution that combines the best of both worlds, Jetpack Security is the answer. This all-in-one option bundles Jetpack Protect, VaultPress Backup, and additional features to provide a complete security suite for your WordPress site. By choosing Jetpack Security, you can rest assured that your website is protected by a powerful and reliable solution that offers enterprise-grade security and backups tailored for WordPress. Explore Jetpack Security here: https://jetpack.com/features/security/
Choosing the best WordPress hosting is just the beginning of your journey to building a secure, high-performing, and reliable website. By complementing your hosting solution with Jetpack’s suite of plugins, you can elevate your site’s security and backup capabilities, giving you the peace of mind to focus on what truly matters: growing your business and providing an exceptional online experience for your visitors.
Measuring a website’s user experience (UX) can be a tough challenge. But that’s what Google’s attempting to do with the Core Web Vitals metrics. And scoring well on these is important because Google weighs user experience when determining search engine rankings.
There are several metrics that are part of Core Web Vitals, and they could sound a bit intimidating. The good news is that there are several tools that make it easier to understand your score and how to improve.
In this article, we’ll look at one particular metric: Largest Contentful Paint (LCP). This measures how long it takes your website to show the largest element that you see on the screen.
We’ll discuss how it impacts the user experience and what causes a poor LCP score. Then, we’ll show you how to improve it.
What is Largest Contentful Paint (LCP)?
LCP is a metric that measures how long it takes for the largest element on a page to render. For most pages, the largest element is a big image or a hero section at the top of the screen.
By itself, an LCP score helps you understand how quickly your site loads visual elements. Your page can continue to load scripts in the background without impacting this metric. In a nutshell, LCP scores only relate to media and text on a given page.
LCP is one of the three Core Web Vitals that Google uses to measure a page’s UX. The other two are:
First Input Delay (FID): FID measures how long it takes from the time a visitor takes their first action (clicking a link, for example) and when the site responds.
Cumulative Layout Shift (CLS): This metric effectively measures the degree to which your site shifts when loading. Text might appear first, but then jump down the screen when an image loads, causing visitors to lose their place.
As a rule of thumb, you want all three Core Web Vitals scores to be as low as possible. Low scores mean that a page loads quickly and smoothly.
In terms of numbers, here’s what Google considers to be good, acceptable, and poor Core Web Vital scores:
Keep in mind that measuring page loading times is not the same as checking your website’s Core Web Vitals. Your site might load relatively fast, but it could have poor CLS or FID scores. Ideally, you’ll measure both overall loading times and Core Web Vitals to get an accurate assessment of your site’s performance.
How does LCP impact user experience on a WordPress site?
A poor largest contentful paint score means that your pages might be taking too long to load. Keep in mind that you need to measure Core Web Vitals on a page-by-page basis. While one page might have a poor LCP score, others may be just fine.
But generally, a site will see a trend in their LCP scores because results are often tied to optimization practices that are implemented site-wide. If a site has been created with no regard for best practices, every page will likely have a score on the low side. If a site has been carefully optimized, most pages will usually score pretty well. Thoughtful developers will identify pages that score below average and make specific adjustments to improve that page’s performance.Â
Overall, a poor LCP score means that visitors might have to wait too long for your pages to fully load visually, and visitors don’t like waiting. If your pages take over two or three seconds to load, you can start turning around a lot of visitors.
It’s also worth noting that Core Web Vitals are a ranking factor in Google. Poor LCP scores can decrease rankings in the search engine results pages (SERPs), which means you’ll get less organic traffic.
How to measure LCP scores
There are several tools that you can use to measure LCP scores. The simplest one is PageSpeed Insights. With this service, you can enter the URL for any page, and get a full report on its overall performance in a matter of seconds.
Once you enter a URL and click on Analyze, PageSpeed Insights will generate two reports for that page, one for mobile and the other for desktop performance. You can see your Core Web Vitals scores, including LCP, at the top of the report.
If you scroll down, the report also displays potential performance improvements that you can make for your website. For each suggested improvement, PageSpeed Insights gives you an estimate of the loading times that can be saved.
If you use Google Search Console, you can get access to the PageSpeed Insights reports without leaving the platform. And some WordPress plugins like Site Kit enable you to display Core Web Vitals scores right within the dashboard.
What causes a poor LCP score?
There are a lot of potential causes for a poor LCP score and long loading times. Usually, it comes down to issues with your server or a lack of optimization on your website. Let’s go over each potential cause:
Slow server response times. If your web host doesn’t offer good performance at the server level, there’s little that you can do to decrease your LCP scores. Slow server response times mean long waits for visitors — even if your site is properly optimized. In this case, you might want to consider switching to a different WordPress hosting provider.
Render-blocking JavaScript and CSS. In some cases, JavaScript and CSS scripts can prevent other assets on a page from rendering until they’re done loading. This is called “render-blocking†and it can increase your overall loading times.
Heavy files and images. If you use images with large file sizes, these may take a while to load. Ideally, you should compress and optimize the images you upload to your site.
Not leveraging browser caching. Browser caching saves a copy of your site’s static content in visitors’ browsers to speed up your load time for future visits. If you’re not leveraging browser caching, users will have to reload pages in full every time they stop by.
Not using GZIP or Brotli compression. These are software applications that compress HTTP requests and files at the server level. Most reputable web hosts should offer one of these right out of the box. Brotli tends to be more effective than GZIP, but either can improve your LCP score.
How to improve largest contentful paint in WordPress
There are several ways to reduce your WordPress website’s LCP score and improve its overall performance. Let’s take a look at the most effective methods.
1. Use a plugin designed to help improve Core Web Vitals in WordPress
Jetpack Boost can help you implement multiple performance optimizations simply by toggling the corresponding settings. You can defer render-blocking JavaScript, enable lazy loading, and optimize CSS code within your website.
While using Jetpack Boost will help improve your LCP scores, it doesn’t mean that you should skimp on other performance optimizations. After enabling the plugin, we recommend that you also implement other strategies to improve your Core Web Vitals even further.
When you work with code, it’s considered good practice to format it in a way that’s easy for other people to understand. This means using spaces, spreading the code over multiple lines, and structuring it in a way that makes it easier to read.
The problem with that approach is that every space and character takes up additional disk space. If we’re only talking about a few lines of code, that doesn’t have much of an impact. But when you’re dealing with dozens or hundreds of CSS files, each with hundreds of lines of code, those scripts can affect your website’s loading times and LCP scores.
One way to minimize the impact of CSS is to “minify†the code. This involves removing unnecessary characters and white spaces to reduce file size. To see how that works, here’s an example of some CSS code for styling several div elements:
Depending on the minification tool you use, it might also replace values with optimized alternatives. We mention minification tools because formatting code by hand takes too long and can lead to errors.
There are plenty of free minification tools that you can use on the web, including options like Toptal’s CSS minifier.
The free Jetpack Boost plugin can also handle this automatically for you. This allows you to simply toggle a setting rather than work directly with code or external tools.
3. Defer render‑blocking JavaScript and CSS
When you visit a website, it might not load resources in a way that reduces loading times as much as possible. In some cases, JavaScript files might cause your browser to wait until those scripts are finished loading before it continues to render other elements.
That render-blocking code increases your page’s LCP score. There are two ways to deal with this problem:
Eliminate render-blocking scripts.
Defer render-blocking scripts until other elements finish loading.
The second option is ideal if you’re handling code that your website needs for critical features. By deferring the necessary scripts, pages will finish visually rendering, and then the code will load in the background. As far as users are concerned, everything will load faster.
The easiest way to figure out what scripts block rendering is to use PageSpeed Insights. Every PageSpeed Insights report includes a section that covers recommended performance tweaks.
After you run a test, look under the tab that says Remove render-blocking resources. Inside, you’ll see a list of JavaScript and CSS scripts that block rendering. This section will also give you an estimate of how much loading time you can shave off by deferring each one.
You can use the web.dev tool if you don’t mind editing code. Alternatively, you can once again turn to Jetpack Boost to defer render-blocking scripts. It handles multiple elements of improving Core Web Vitals all at once.
There are also several standalone plugins that defer render-blocking scripts and minify them. These include:
Autoptimize: You can defer render-blocking JavaScript and CSS, and enable image lazy loading for your website.
Fast Velocity Minify: This plugin can defer, minify, and combine JavaScript and CSS files on your website.
Hummingbird: This WPMU DEV plugin enables you to leverage browser caching, defer render-blocking scripts, and minify JavaScript and CSS.
When dealing with plugins that can minify your website’s code, we recommend that you fully back up your WordPress site before activating them. That way, if the minification process breaks any core functionality within your website, you can revert to an earlier version without losing any data.
4. Optimize your site’s images
One of the main culprits behind poor LCP scores in WordPress is large image files. High-resolution images look amazing, but they also take up a lot of resources. If you’re dealing with large files and have multiple images in a single page, loading times can quickly spiral out of control.
The best way to solve this problem is to optimize your images. You can do this either before or after uploading them to WordPress.
Optimizing images means converting them to a more efficient format or compressing them. Depending on the compression tool that you use, the process should have minimal impact on image quality, but it can greatly reduce file sizes and overall loading times.
Jetpack CDN is a great way to optimize your images, which you can enable directly in WordPress. It also automatically resizes images for mobile devices, speeding up your site across the board.
If you want to optimize images before uploading them to WordPress, you can use free online tools like TinyPNG.
With TinyPNG, you can upload and optimize JPG and PNG files manually. The service compresses the images and then lets you download them to your computer. Afterward, you can proceed to upload the compressed images to WordPress.
5. Use a content delivery network (CDN)
A CDN is a service that provides you with access to data centers spread across strategic regions. These data centers store cached copies of your website and intercept connections for people who want to visit it.
A CDN automatically routes those connections to the data center that’s nearest each visitor. Since the site content has less distance to travel, the page will load faster.
Moreover, CDNs are designed to serve requests as quickly as possible. This means that they usually load content much faster than the servers run by your hosting provider.
Services like Cloudflare offer limited free CDN plans that can cache a few of your site’s pages. Some managed WordPress web hosts offer built-in CDN integrations, so you don’t have to pay for a separate service. But if you use Jetpack, you also get access to a free, WordPress-specific CDN, which you can use to speed up images and website files.
Frequently asked questions about Largest Contentful Paint in WordPress
If you still have questions about how to measure and optimize your LCP score, this section will answer them.
How can I measure my WordPress site’s LCP score?
Since LCP scores are part of the Core Web Vitals metrics, you need to use Google tools to measure them. Google offers three ways to measure your LCP score:
PageSpeed Insights: You can use this online service to measure any page’s Core Web Vitals on demand. When you analyze a page, PageSpeed Insights will also return suggestions for improving performance and overall UX.
Google Search Console: This service enables you to monitor your website’s search engine optimization (SEO) and overall health. Google Search Console also includes built-in recommendations and scores from PageSpeed Insights.
Lighthouse: You can use this Chrome extension to get access to advanced features when using the browser’s dev tools.
Google also offers an official plugin called Site Kit that you can use to access several of its services from within WordPress. With Site Kit, you can get access to PageSpeed Insights reports, including LCP scores, without leaving the dashboard.
What is a good LCP score?
According to Google, anything below 2.5 seconds is a good LCP score. Even if your website does meet that criteria, it doesn’t mean you shouldn’t optimize it further.
Ideally, you’ll want to reduce website loading times as much as possible. If you can aim for overall loading times of less than one or two seconds, you can offer a much better user experience.
How can I easily optimize my LCP score on WordPress?
The easiest and quickest way to optimize your LCP score on WordPress is to install Jetpack Boost. This plugin will also help you improve your other Core Web Vitals scores, including First Input Delay and Cumulative Layout Shift.
Start by installing and activating Jetpack Boost on your site:
Then, navigate to Jetpack → Boost in your dashboard. Here, you’ll see options for optimizing CSS loading, deferring non-essential JavaScript, and activating lazy image loading. We recommend that you enable all options.
Enabling lazy loading is a great way to improve your website’s LCP scores. WordPress includes lazy loading as a built-in feature, which works automatically.
By deferring the largest elements on every page, your LCP score should improve immediately.
Improve your website’s Core Web Vitals
Improving your website’s Core Web Vitals can help you offer a better user experience. LCP scores, in particular, greatly affect how happy visitors are with your site’s performance. A low score means that your website loads fast, and a fast-loading website means fewer frustrated visitors.
Let’s recap the most effective methods that you can use to improve your LCP score in WordPress:
Use a plugin designed to help improve Core Web Vitals.
Minify your CSS.
Defer render-blocking JavaScript and CSS.
Optimize your website’s images.
Use a content delivery network.
With Jetpack Boost, you can quickly optimize your website’s Core Web Vitals, including its LCP scores. Jetpack Boost enables you to implement multiple performance optimizations simply by toggling their corresponding settings. Plus, it’s free and works seamlessly with the rest of the Jetpack family of tools.
As a website owner, you’ve worked hard to develop your website and build your business. But, with Google issuing over three million safe browsing warnings a day, it’s clear that you have to be vigilant against the ever-present threat of malware.
A single malware infection can cripple your website, damage your reputation, and even steal your customers’ data. That’s why it’s essential to have a reliable malware scanner in place to help you spot an infection as soon as it happens, so you can take steps to secure your site and get it back up and running.
With so many malware scanners available, it can be challenging to know which one to choose. However, thanks to our comprehensive review of the best website malware scanners, you’ll be able to determine the right option for you.
The top ten tools to scan a website for viruses and malware
Jetpack Protect is one of the best ways to check your WordPress website for malware and keeps you one step ahead of security threats. This free plugin can be set up in just one click, and it’ll get to work checking your site daily for vulnerabilities that hackers could exploit to inject malware — so you can prevent issues before they start. And, with a paid upgrade, it will check your entire site for tens of thousands of known malware definitions and immediately alert you if something’s found.
Jetpack Protect allows you to secure your site without slowing it down, as it uses state-of-the-art decentralized scanning technology which can search your entire site — including the admin area, themes, and plugins — using Jetpack’s servers.
The plugin scans your site against an extensive database that is updated by dedicated WordPress security experts as soon as new vulnerabilities, viruses, or malware are discovered. If Jetpack Protect does detect an issue on your site, it will notify you via your Jetpack dashboard and will provide straightforward guidance to help you secure your site and remove malware from your WordPress site.
Jetpack Protect is made by Automattic, the team behind WordPress.com, which means it seamlessly integrates with any WordPress site. The tool uses the same technology used to guard some of the world’s leading brands, so you know you’re in good hands.
Key features of Jetpack Protect:
A simple one-click setup
Automatic ‘set it and forget it’ daily scans for vulnerabilities that keep your site secure
Scans of plugins, themes, and WordPress core for potential vulnerabilities
Recommended actions to help you resolve any issues that are found
Automated daily malware scanning against over 37,000 definitions (paid)
A Web Application Firewall (paid)
Instant email notifications (paid)
Pros of Jetpack Protect:
As the automatic malware scans run on Jetpack’s servers, Jetpack Protect can scan your entire site without slowing it down.
The plugin uses the same malware database as the advanced enterprise-level tool, WPScan, which is constantly updated by experienced online security experts.
You can start protecting your site with just a single click, and it’ll run scans daily and notify you of any issues through your dashboard.
Cons of Jetpack Protect:
Jetpack Protect was designed specifically for WordPress websites, so if your site doesn’t use WordPress, you’ll need to explore one of the other options on our list.
While the plugin offers advice on resolving any security issues, it doesn’t provide automatic malware removal without a paid upgrade.
Ease of use:
Jetpack Protect is super simple to use, as it only takes one click to activate its advanced scanning tools. There is also no need to remember to run scans, as the plugin will protect your site automatically in the background. Detailed documentation is available, and if you need support, you can access Jetpack’s team of WordPress Happiness Engineers.
Wordfence is a WordPress security plugin that offers a range of features to protect your website from malware, viruses, and other threats. One of the key features of Wordfence is its malware scanner, which automatically checks your website for malware and other vulnerabilities.
Wordfence is a server-side malware scanner (so it will use resources from your host) that allows you to check your entire website, including plugins and themes. The scanner looks for a wide range of vulnerabilities and signs of malware or viruses, including malicious redirects, backdoors, and code injections.
In addition, Wordfence has a dedicated team of website security experts who regularly update its database with new malware and virus definitions, which are immediately available to premium customers so that your site is protected against the latest threats.
If Wordfence detects malware, it will automatically quarantine infected files, prevent them from being executed, and alert you via email. Wordfence can help you recover from simple malware attacks by replacing damaged core WordPress files with a clean version and deleting any malicious ones. Complete malware removal is included at some of the higher-tier subscription levels.
Key features of Wordfence:
Automated malware and virus scanning
Daily email alerts
Basic repair and deletion functions for removing simple malware
A range of other security features, including a firewall and access logging
Regular malware definition updates (premium)
Malware removal by a security expert (premium)
Pros of Wordfence:
Wordfence conducts daily scans of your site and will email you if it notices any issues.
Alongside the malware scanner, Wordfence also includes various other security features, including a Web Application Firewall (WAF) and two-factor authentication.
Cons of Wordfence:
The free version of Wordfence only updates its malware definition 30 days after a new piece of malware is identified, meaning you have to upgrade to a paid plan if you want to detect the latest threats.
Wordfence uses your server’s resources to conduct its scans, which could impact your site’s performance.
Wordfence only works with WordPress websites.
Ease of use:
Wordfence requires configuration to ensure that it fully protects your site, but when it’s set up, its automatic scanning and notifications mean things are pretty hands-off. Sometimes the email alerts sent by Wordfence flag legitimate changes as a concern, which could cause confusion if you’re unfamiliar with website security and the WordPress ecosystem.
Wordfence offers a free plan, but there’s a 30-day delay between new discoveries of malware and when the free plan updates the database to include those discoveries in scans.
Wordfence Premium costs $119 a year and includes daily malware database updates.
Wordfence Care costs $490 a year, including installation and optimization of the plugin and malware removal by a WordPress security expert.
Sucuri is a well-known name in website security that offers a free malware scanner alongside several premium services that can help keep your site safe, including a web application firewall, DDoS protection, and malware removal.
Sucuri’s free SiteCheck external malware scanner allows you to scan the front end of your site for malware by entering its URL. If your website is built using WordPress, Sucuri offers a basic plugin that will check your site’s WordPress core files for any changes.
Sucuri also offers premium plans, including automatic malware and virus scanning and access to a server-side scanner to check all your website files.
Key features of Sucuri:
A free external malware scanner
File integrity scanning
Security event logs
Automated malware scanning (premium)
Server-side malware scanning (premium)
Malware removal (premium)
Blocklist monitoring (premium)
A web application firewall (premium)
Pros of Sucuri:
Sucuri’s SiteCheck scanner is free and doesn’t require an account.
Sucuri is platform-agnostic, so it will work regardless of how your website is built.
Cons of Sucuri:
Sucuri’s free malware scanner does not offer automatic scanning, so you must regularly visit the SiteCheck website and enter your URL to check your site for malware.
Sucuri’s free SiteCheck scanner may not be able to spot all malware on your site. This is because the malware scan is conducted remotely, so it can only check for malware in the source code of the public-facing pages on your site.
If your site is built on WordPress, Sucuri says that their free WordPress malware scanner isn’t 100% accurate. Malware could be inserted into plugin files or other admin areas and, therefore, wouldn’t appear on your site’s front end.
Ease of use:
Sucuri’s free malware scanner is simple to use as it only requires your website URL. However, unless you subscribe to a premium plan, you need to remember to manually run the scan to ensure you spot any malware or virus infections.
The server-side scanner could be confusing for non-technical website owners to set up, as it requires FTP/SFTP credentials. Sucuri offers a range of guides and documentation, and its premium customers are offered email support.
Pricing of Sucuri:
Sucuri SiteCheck and their WordPress plugin are free of charge. Premium subscriptions start at $199 a year and include a range of features, including server-side automatic malware scanning, a web application firewall, and unlimited malware removal.
MalCare is a malware scanning and removal service specifically for WordPress websites. The plugin offers automatic malware scanning alongside other security features, including a web application firewall to prevent attackers from accessing your site.
MalCare’s malware scanner will automatically scan your entire site, including admin files, plugins, and themes. The plugin temporarily and securely copies your files to its servers to conduct each malware scan, meaning that scans won’t slow down your site.
MalCare also monitors your website’s files and databases and will let you know if it spots a change that it thinks could be the result of malware. If it thinks you have a malware or virus infection, it will alert you by email, and the plugin’s premium version offers automatic malware removal.
Key features of MalCare:
A malware scanner with automatic daily scanning
Vulnerability detection
Monitoring for suspicious file changes
A web application firewall
Automated malware cleaning (premium)
Pros of MalCare:
MalCare offers automatic daily malware scans, which can check your entire site.
The plugin uses MalCare’s servers to carry out its malware scanning, meaning it won’t slow down your site.
MalCare will send you an alert by email if it finds any signs of a malware infection, so you can take action to secure your site.
Cons of MalCare:
While the free version of the plugin will tell you if your site is infected with malware, it won’t let you know where it is. Instead, you must upgrade to a premium plan to locate and remove the infection.
MalCare is a solution specifically designed for WordPress website owners to check their site for malware, so if your site does not use WordPress, you’ll need to explore one of the other options on our list.
Ease of use:
MalCare is easy to install and set up, and its automatic scans mean you don’t need to remember to scan your site. The automated malware removal in its premium version makes it simple to recover your site from most infections. MalCare offers email support for all users and live chat support for premium users.
Pricing of MalCare:
There’s a free version available from the WordPress plugin directory. Premium plans include malware removal and start at $99 a year.
Jetpack Scan is one of the best ways for WordPress website owners to check their sites for malware and viruses. Jetpack Scan acts as a security guard who constantly watches over your site, taking all the stress out of protecting your site from the latest security threats.
Jetpack Scan is a premium feature of the Jetpack plugin, which is maintained by Automattic — the same people who are behind WordPress.com, WPScan, and WooCommerce. This means you’ll benefit from the expertise of dedicated WordPress security specialists, who ensure that the vulnerability database used by Jetpack Scan is kept up to date with the latest malware, viruses, and exploits.
As soon as it’s installed, Jetpack Scan gets to work, scouring your site for malware and vulnerabilities.
If an issue is detected, it’ll notify you immediately and provide clear guidance about any identified threats. And, in most cases, Jetpack Scan will offer simple, one-click fixes, so you can get back to running your site.
Even if your site has been taken offline by a malware attack, you can still see the results of the latest malware scan and implement most one-click fixes from the cloud, meaning you’ll be able to quickly get your site back up and running.
Jetpack Scan uses clever decentralized scanning technology to scan your entire website, including admin pages, themes, and plugins. It does so with Automattic’s servers, allowing you to benefit from the same protection enjoyed by millions of WordPress websites without slowing down your site. You’ll also get access to other security features, including a web application firewall. You can benefit from even more features, including automated backups and spam protection, by purchasing the Jetpack Security bundle.
Key features of Jetpack Scan:
Automated daily scanning
Instant email notifications if any issues are found
One-click fixes to resolve the majority of security threats
The ability to access your scan results and one-click fixes even if your site is down
A vulnerability database updated by WordPress security experts
A web application firewall to help keep hackers out of your site
Priority support from Jetpack’s WordPress Happiness Engineers
Pros of Jetpack Scan:
As Jetpack Scan keeps watch over your site through its automated daily scans, you can ‘set it and forget it’ and rest easy knowing that you’ll be notified immediately if anything’s ever found.
Jetpack Scan offers one-click fixes for most malware infections and security vulnerabilities.
Jetpack Scan integrates seamlessly with WordPress and WooCommerce and works alongside other Jetpack features, including VaultPress Backup.
Cons of Jetpack Scan:
Jetpack Scan was designed specifically for WordPress websites, so if your site doesn’t use WordPress, you’ll need to explore another option on this list.
Ease of use:
Jetpack Scan is simple to set up and use. Its automated scans mean you don’t have to worry about remembering to scan your site, and one-click fixes make solving the majority of security issues simple. Plus, detailed documentation and priority support from Jetpack’s team of Happiness Engineers is available for all Jetpack Scan users.
Pricing of Jetpack Scan:
Jetpack Scan is available through the Jetpack plugin or as an upgrade to the Jetpack Protect plugin for just $10 a month. You can also benefit from Jetpack Scan by purchasing Jetpack’s Security or Complete bundles.
IsItWP provides a range of tools for site owners, including a website malware scanner, which can check any website for malware and other security vulnerabilities. IsItWP’s scanner is powered by Sucuri, allowing you to scan your site’s front end pages for malware by entering its URL.
In addition to checking your site for malware and viruses, IsItWP’s scanner also checks if your site is listed in Google’s Safe Browsing and other malware blocklists.
Key features of IsItWP Security Scanner:
The ability to check any website’s public-facing pages for malware and viruses
Reports that outline if malware is found or if the website is on Google’s Safe Browsing or other malware blocklists
Pros of IsItWP Security Scanner:
It allows you to check any website for malware by simply entering its URL.
Cons of IsItWP Security Scanner:
There’s no automated scanning option, meaning you must remember to visit IsItWP to check your site for malware.
The scanner can only find malware that is present on the front end pages of your website.
If malware or viruses are detected, IsItWP doesn’t provide any guidance or tools to help you remove the malware and restore your site.
The online scanner is slower than many others on this list.
Ease of use:
IsItWP Security Scanner is easy to use as it only requires you to enter your website’s URL to check it for malware.
SiteLock offers a range of malware detection and removal services, including a free online malware scanner.
SiteLock’s free scanner allows you to check the public-facing pages of any website for malware. The web-based scanner returns results in under 60 seconds and also checks for any known viruses or other vulnerabilities.
SiteLock also offers a number of premium plans which offer automated scans, notifications, and automatic malware removal. Premium customers can also scan their entire website, including admin pages, plugins, and files, using SiteLock’s cloud servers so that website performance is not impacted.
Premium scans also check for additional security concerns, including SQL injections and cross-site scripting, as well as your website’s status on malware blacklists.
Key features of SiteLock:
A free, web-based malware scanner
Automated daily scans (premium)
Automatic malware removal (premium)
Additional security features including a web application firewall and DDoS protection (premium)
Pros of SiteLock:
SiteLock’s free online malware scanner is quicker than many others and provides results in an easy-to-understand format.
SiteLock’s premium plans feature automated malware removal, so malware is removed from your site as soon as it’s identified.
Cons of SiteLock:
Automated scanning is only available on premium plans.
While SiteLock supports WordPress and other content management systems, its plugin is not widely used.
Ease of use:
The web-based scanner is easy to use and returns results quickly. For SiteLock’s premium features to work, you must provide FTP/SFTP details, which could be confusing for some users. Email support, with a guaranteed 30-hour response time, is provided to all premium customers.
Pricing of SiteLock:
SiteLock’s online scanner is free. Premium plans, which include automated scans of all areas of your site and malware removal, start at $15 a month.
Detectify is a cybersecurity company that offers a range of options to check websites and web apps for malware and viruses. Detectify is designed specifically for complex DevOps environments. It can be configured to run either on-demand or scheduled security scans that look at your entire website, including back-end resources.
In addition to malware, Detectify will scan your server for a wide range of other security risks and vulnerabilities, including SQL injections, authentication vulnerabilities, and SSL issues. Scans also check your site against a unique list of exploits gathered from the hacker community to help keep your site secure from the latest threats.
Detectify will integrate into your existing workflow to inform you of the results of its scans through tools such as Slack or Jira so that you can take action to address any issues it has identified.
Key features of Detectify:
Enterprise-grade malware and vulnerability scanning
Scans for a wide range of potential security issues
Scans of your entire website
Multiple scan profiles
Pros of Detectify:
Detectify offers a high level of security for complex web apps and websites that checks for a range of vulnerabilities, including malware and viruses.
Cons of Detectify:
Detectify is an enterprise-grade service, and therefore it offers many features that most website owners may not need.
Due to its advanced features, Detectify is significantly more expensive than any other option on this list.
Ease of use:
Due to its range of options and scan profiles, Detectify is more complex to set up than many other options on this list. It may require the support of a DevOps specialist to integrate with your website.
Pricing of Detectify:
Detectify plans are customizable, but start at around $80 per month.
Quttera is an established name in website security, and they offer a number of different solutions to check your website for malware, including a free online malware scanner. All of Quttera’s solutions use a patented malware-detection algorithm that it claims can detect previously unknown malware rather than checking your site’s files against a list of malware definitions.
Quttera’s online malware scanner can only check the front end of your website. But, if your website is built using WordPress, then Quttera’s free plugin will scan your entire site for malware, including admin pages and plugins. A detailed report is provided after each scan, which identifies any malicious or suspicious files, and lets you know your site’s status on several common malware blocklists.
Quttera’s premium ThreatSign! product offers automated malware scanning, including server-side scanning for all websites, and automated malware removal is provided with some plans.
Key features of Quttera:
A web-based malware scanner
A WordPress plugin that checks all website files
Malware blocklist checking
Automated scanning (premium only)
Malware removal (premium only)
Additional security features, including a web application firewall and DDoS protection (premium only)
Pros of Quttera:
The free report provided by Quttera is more detailed than the reports provided by other free tools on this list.
Quttera’s server-side scanning, available via their WordPress plugin and premium plans, uses their cloud servers to conduct the scan, meaning it won’t slow down your site.
Quttera’s malware detection algorithm can detect previously unknown malware.
Cons of Quttera:
It scans using the free web-based tool can only check the front end of your site.
Automatic scanning is only available on premium plans.
Ease of use:
Quttera’s web-based scanner and WordPress plugin are both easy to use, but the lack of automation means that you need to remember to check your site regularly for malware. Support is only available to premium subscribers.
Pricing of Quttera:
Quttera’s web-based scanner and WordPress plugin are free. Premium plans offer automatic scanning and other security features for $10 a month, with plans that offer malware removal starting at $179 a year.
Google’s Transparency Report provides information on Google’s services, and has a section dedicated to its Safe Browsing technology. Site owners can enter their URL and check its Safe Browsing status to see if it has been flagged as unsafe by Google.
Safe Browsing is Google’s technology that checks websites for malware and phishing attacks and flags them as unsafe for visitors if they’re potentially malicious.Â
Key features of Google’s Transparency Report:
Includes a tool that checks if a site has been identified as unsafe
Reports that offer a basic reason for the site being listed as unsafe
Pros of Google’s Transparency Report:
The Safe Browsing status check allows website owners to see if Google has identified signs of malware on their site.
The service is free of charge and can be used by anyone to check the status of a site.
Cons of Google’s Transparency Report:
The Safe Browsing status check is not automatic, meaning you must remember to check your site’s status.
Google Transparency Report’s Safe Browsing status check section is not a substitute for a comprehensive malware scanning solution because it’s not proactive and only reports issues after visitors are likely to have been affected.
Google’s Safe Browsing technology does not scan every website, and the frequency of scans is not publicly available.
The Safe Browsing status check does not provide any guidance on how to remove malware if it’s identified on your site.
Ease of use:
The Google Transparency Report Safe Browsing status check is easy to use and quickly returns the Safe Browsing status for the URL you enter.
Pricing of Google’s Transparency Report:
Google’s Transparency Report is free to use.
A comparison of the best website malware scanners
Jetpack Protect
Wordfence
Sucuri
MalCare
Over 44,000
IsItWP Security Scanner
SiteLock
Detectify
Quttera
Google Transparency Report
Made especially for WordPress websites
Yes
Yes
No
Yes
Yes
No
No
No
No
No
Number of malware definitions your site is checked against.
Over 37,000
Yes (with a paid plan)
Not stated
Not stated
Over 37,000
Not stated
Not stated
Not stated
Uses proprietary algorithm
Not stated
Automated scans
Yes
Yes
Premium only
Yes
Yes
No
Premium Only
Yes
Premium only
No
Scans your full site, including admin files
Yes
Yes
Premium only
Yes
Yes
No – checks front end files only.
Premium Only
Yes
Premium only
No – checks front end files only
Can scans impact website performance?
No
Yes
No- external scanner
Yes
No
No
No
Yes
No
No
Frequency of malware definition updates
Daily
Every 30 days (free version) Daily (pro version)
Daily
Daily
Unknown
Daily
Daily
Daily
N/A
Daily
Malware removal if malware is found
Yes (with a paid plan)
Limited removal in the premium version. Full removal in Care version.
Premium only
Premium only
Yes (with paid plan)
No
Premium Only
No
Premium only
No
Price
Free with paid upgrades.
Limited free version. Premium plans start at $99/year.
Limited free online scanner. Premium plans start at $199/year.
Limited free version.Premium plans start at $69/year.
$10 / month
Free
Free online front end scanner. Premium plans start at $15 a month.
From $80/ month.
Limited free online scanner and plugin. Premium plans start at $10 a month. Plans including malware removal start at $179 a year.
Free
Frequently asked questions about malware scanners
What is the best website scanner to check for viruses and malware?
The best website scanner to check for viruses and malware will depend on the platform or CMS your site is built on.
For example, WordPress site owners should opt for a malware scanner that’s built specifically for WordPress, and it’s clear from our review that Jetpack Protect is the best option. It offers automated scans for vulnerabilities with premium access to a malware database that’s constantly updated by a team of WordPress security experts, so you can be sure your site is being checked for the latest issues.
Both Jetpack Scan and the paid upgrade for Jetpack Protect offer clear guidance and one-click fixes if a security threat is identified, along with a web application firewall to keep malicious actors off of your site.
Should I use an external or server-side malware scanner?
Many of the free website scanners only search the external pages of your website for malware, and this means that they won’t spot issues that are hidden on the back end of your site.
In contrast, server-side malware scanners offer full protection, since they scan the entirety of your site. But, if the malware scanning happens on your server, it could temporarily slow down your website performance. This means the best option to scan your site for malware is to use a tool that uses decentralized scanning technology.
For example, Jetpack Protect uses Automattic’s cloud servers to securely scan the front and back ends of your site, meaning you don’t have to worry about the impact on performance while its comprehensive automated scans are being carried out.
How do I scan a WordPress website for malware?
To scan your WordPress site for malware, you’ll need to use a malware scanner such as Jetpack Protect that can scan your entire website, including your plugins and themes.
You can install Jetpack Protect for free by going to Plugins → Add New inside of your WordPress dashboard. Then, search for “Jetpack Protect†and click Install Now → Activate.
Then, choose either Jetpack Protect or upgrade to benefit from additional features, including one-click malware fixes and a web application firewall.
Jetpack Protect will then get to work scanning your entire site for malware.
Once its scan is complete, you’ll be shown the results and told if any security threats have been identified on your site. If Jetpack Protect has identified any issues, it’ll give you a clear description of the issue and let you know where it’s located.
Jetpack Protect will automatically scan your site for vulnerabilities every day. You can see the results of your scans by going to your WordPress admin dashboard menu and selecting Jetpack → Protect.
You can also run a manual scan at any time by clicking Scan Now.
How can I prevent my website from being affected or hacked in the future?
While regular automated scanning will help you detect a malware infection, keeping it secure is the best way to protect your site. Here are some ways you can do this:
Use strong passwords. The easier your password is to guess, the more likely it is that a malicious hacker will be able to guess it to get access to your website and install malware. Learn more about securing your WordPress login page.
Enable secure authentication.Secure authentication requires users to provide a code from their mobile device alongside their username and password, meaning that if someone does happen to crack your password, they still can’t log in and cause damage to your site.
Limit admin user accounts. By limiting the number of users who can have full access to your site, you reduce the number of accounts that could become compromised and used to infect your site with malware.
Keep your site up to date. By keeping the software up to date, including any plugins and themes, you’ll benefit from the latest security improvements and vulnerability patches.
Get protection against brute force attacks.Brute force protection stops bots who try to guess hundreds of username/password combinations each second until they find one that lets them into your site.
Use a web application firewall. Firewalls help prevent attackers from gaining access to your site and are essential for all website owners. For example, Jetpack Scan includes a firewall specifically designed for WordPress sites that uses a vast database to help it identify potentially malicious visitors.
WordPress site owners can help keep their site secure and prevent malware infections by using a complete WordPress security solution such as Jetpack Security, which includes advanced features including backups, Jetpack Scan, and protection from spam.
If you’re thinking of starting a website, you’ll probably want to use WordPress to build it. This popular CMS and site builder enables you to create any type of site. However, you may be wondering: is WordPress safe?
The answer is a resounding yes. The proof is in the unprecedented popularity of the tool. Still, there are some simple steps you can take to make your WordPress site more secure, like opting for a reliable web host and using the right plugins.
In this article, we’ll show you what makes WordPress a reliable platform. Then, we’ll look at how to build a secure WordPress site in six steps. Finally, we’ll discuss some factors that can impact the security of your WordPress site and go over some frequently asked questions.
How reliable is WordPress?
WordPress is one of the most secure CMSs available. Let’s look at five factors that demonstrate its safety and reliability.
WordPress is the most popular website-building tool
If you’re searching for evidence that WordPress is reliable, the statistics say it all. Over 43 percent of websites are powered by WordPress, which makes it the most popular website-building tool available.
It’s safe to say that users wouldn’t be flocking to WordPress if it wasn’t dependable. Such a vast market share serves as the ultimate customer testimonial.
WordPress has a large community
WordPress has a large and thriving group of users and developers who continually contribute to expand, improve, and secure the technology for the good of the entire community. Since the software is free and open-source, users can download it at no cost.
Additionally, WordPress is offered under the General Public License. This means you can use it for any purpose, redistribute the software, and modify it.
With this flexibility, you can use the CMS however you wish. Moreover, you can modify, build upon, and improve it as you see fit.
In fact, the contributors of WordPress encourage others to participate in any way they can.
Since Matt Mullenweg, a founding developer of WordPress, organized the first WordCamp event in 2006, there have been over 1,100 WordCamp events in 65 countries. And that’s not the only way that the WordPress community comes together.
Spanning 115 countries, there are more than 750 WordPress-focused groups on Meetup.com. These communities help support talented WordPress developers and designers who are continually working to improve the software.
WordPress is trusted by top enterprises
WordPress isn’t limited to a specific type of user. While it started out as a blogging platform, today it’s used by a wide range of people and businesses.
There are many reasons that big businesses choose WordPress over other platforms. For instance, it’s highly customizable, giving users complete control over almost every aspect of the site.
Plus, you can easily expand upon its functionality with WordPress plugins. For example, the WooCommerce plugin enables you to transform any WordPress site into a fully functional online store. It even offers extra powerful plans for high-volume online stores.
When it comes to ecommerce platforms, WooCommerce makes up nearly 39 percent of the market and 23 percent of the world’s top one million online stores.
Experienced WordPress developers
The first version of WordPress was released in 2003. Since then, thousands of the most highly talented and experienced developers have devoted themselves as both users and volunteer contributors.
In addition to working on the core software, some WordPress developers may specialize in plugins, themes, or even security.
And the WordPress plugin and theme directories help verify the quality of plugins that extend WordPress by displaying accurate information about the plugin’s latest update, developer background and history, verified reviews, and number of users.
This way, you’ll be able to tell right away if the tool you’re interested in has been built by experienced developers. Alternatively, if you have the budget to work with a WordPress developer directly, you can easily find top-notch talent in a variety of WordPress niches.
Solutions like Jetpack offer powerful security tools
One of the best things about WordPress is that it enables you to use affordable yet robust security solutions like Jetpack.
Jetpack offers both security and performance tools. It also offers a security plan that includes a backup tool, a malware scanner, and an anti-spam solution. With this powerful trio, you can create real-time backups of your site, run automatic scans for threats, stop spam in its tracks, and more.
How to build a secure WordPress site (in 6 easy steps)
By default, WordPress is a powerful and reliable tool. Still, cyber threats remain a universal reality, and strong WordPress security is crucial for every website.Â
So, let’s outline how to build a secure WordPress site in just six steps.
1. Choose a secure host for your website
WordPress is free and open source, but there are still some costs associated with it. Primarily, when you’re using WordPress.org, you’ll need to pay for a domain name and web hosting.
Simply put, a domain name is your site’s web address. A web host provides the server space needed for your site and makes it available to view online.
If you don’t choose your hosting provider carefully, your website may be set up in a way that makes it vulnerable to security threats and performance issues. So, the first step in building a secure WordPress site is choosing a reputable web host.
This choice will depend on your site’s unique needs, but any trustworthy web host should offer most of the following security features:
You’ll also need to choose the right hosting plan. If you’re running a small professional site, a basic or mid-tier plan might be sufficient for your needs. On the contrary, ecommerce stores will likely need higher-tier plans that can accommodate increased web traffic and use of resources.
If you’re totally new to the CMS, it might be a good idea to go with a managed WordPress hosting plan. This can simplify the daily management that’s required for your site.
Finding the right WordPress web host can be a little difficult. If you’re not sure where to look, you might try popular choices like Bluehost or DreamHost.
2. Install WordPress using best practices (or use WordPress.com)
Unless you’re an experienced developer, installing WordPress manually might be challenging. That’s because it requires you to create your own database and modify your site’s files.
Fortunately, most high-quality web hosts will offer one-click installations. This means they’ll download and set up the software for you.
If you do decide to install it manually, here are some best practices to keep in mind:
Make sure you’re downloading the latest version of WordPress
Use secure database usernames and passwords
Make sure your hosting provider uses the latest versions of PHP and MySQL
Create secure FTP usernames and passwords
If you prefer a more streamlined approach, you might consider using WordPress.com.
This is the hosted version of WordPress. Unlike WordPress.org, WordPress.com isn’t free, but it includes web hosting and a domain name. What’s more, WordPress.com has a wide variety of plans, ranging from personal to enterprise options.
3. Make sure all user accounts have a unique username and strong password
Once your WordPress installation is complete, you’ll get access to the back end of your website. If you’re the site owner, you’ll need to create an ‘administrator’ account. This role will give you complete control over all the front and back-end elements of your site.
It’s crucial that you create a unique username and a strong password. Otherwise, your website could become vulnerable to brute force attacks. You may even want to use a password manager like KeePass or 1Password.
This way, you can regularly reset your WordPress password as an added layer of security and never have to worry about forgetting it.
Depending on your website, you may also need to add users. For instance, if you have an online store, you’ll have to allow for customer accounts. If you have a marketing manager, they may need access to make periodic updates to landing pages or other parts of the site. Or, if you’re starting a blog, you may need to give authors and editors access.
You’ll want to make sure that all of these users have strong usernames and passwords as well. To achieve this, you can use a tool like the Password Policy Manager plugin.
This tool enables you to enforce strong passwords for your site. It also gives you lots of other features that enhance password security. Plus, it’s compatible with WooCommerce, which makes it an excellent option for ecommerce sites.
Also, familiarize yourself with the user roles included with WordPress. Make sure that each person only has the minimal capabilities required to do their job. And if someone stops working with your organization, it’s best to change their login information.
4. Keep your WordPress core version up to date
With every release, WordPress is evolving and getting better. Each new version of the CMS can contain design updates, but also bug fixes and security improvements.
Therefore, it’s crucial that you keep your WordPress core version up to date after your site is set up. If you don’t, you may leave your site vulnerable to attacks.
You can easily check if your WordPress site is up-to-date by navigating to Dashboard → Updates.
If you’re not using the most recent version of WordPress, you’ll be able to update it from this page. Additionally, you can configure automatic updates here.
5. Install a powerful security plugin like Jetpack Security
WordPress is powerful enough for some of the world’s biggest companies. Still, even one security incident or data leak can destroy a brand’s reputation. That’s why organizations both large and small should find a WordPress security plugin to safeguard their work.
One of the most trusted, and professionally supported, options is Jetpack Security.
This plugin is the best on the market because it includes tools to protect you from every angle — like Jetpack VaultPress Backup, Jetpack Scan, and Akismet Anti-Spam. So while many other WordPress security plugins only provide protection for a singular type of threat, Jetpack Security gives you everything you need to safeguard your site.
After you’ve purchased Jetpack Security, and it’s installed on your site, navigate to your WordPress dashboard and go to Jetpack → VaultPress Backup.
From here, you can configure regular backups of your WordPress site. This way, you’ll always be able to restore a recent copy of your entire site in case of emergency.
Keep in mind that backups may take a moment to complete. Once this process is done, and you’ve finished configuring the tool, you can return to this page to view or restore backups at any time.
You can manage your anti-spam settings by going to Jetpack → Anti-Spam. Here, you’ll also be able to see how much spam the tool has helped you block.
Finally, you can go to Jetpack → Protect → Scan toset up the malware scanning feature. If you discover any instances in the Malware Threats Found section, you can easily eliminate malware by clicking on Remove Threat.
6. Only install reliable plugins created by reputable developers
The ability to extend WordPress with plugins is part of what makes the platform so powerful and flexible. Plus, these tools are easy to use, and you can install them directly from your WordPress dashboard.
Still, it’s not a good idea to add just any plugin to your site. You should only install tools created by reputable developers. Otherwise, you might be putting your site at risk.
You’ll want to make sure that the plugin is compatible with your current version of WordPress and has been updated recently. An out-of-date plugin can make your site vulnerable to threats.
Additionally, the number of active installations is usually a good measure of a tool’s reliability. You can also check out its star rating to see what users are saying about it.
Lastly, make sure to pay close attention to the By section beneath the plugin name:
This will tell you who is behind the development of the tool, which can be another strong indicator of its dependability.
For example, Jetpack’s suite of plugins is developed and maintained by Automattic, the company behind WordPress.com. So, if you see that the plugin was created by a reputable company, you can probably assume that it’s safe to use.
What factors can affect the reliability and security of a WordPress site?
Now that you know how to build a secure WordPress site, let’s dive a little deeper into the factors that can negatively affect the reliability and security of WordPress.
A low-quality hosting provider
Low-quality web hosts don’t provide enough performance and security features to keep your site running smoothly. If you opt for a subpar web host, your site may suffer from slow loading times or even excessive downtime.
Moreover, a poor web hosting provider might not provide enough storage space or customer support. With this in mind, you’d be wise to avoid low-quality web hosts.
If you run a large site that gets high amounts of traffic, it’s best to avoid shared hosting plans. This type of hosting is often cheaper, but requires your site to share resources with other websites, which can lead to poor performance. And, if another site on the shared server is compromised, it’s possible that yours could be as well.
It’s important to note that reliability is crucial when it comes to Search Engine Optimization (SEO). If your site is often down or glitchy, Google will notice this, and it can lower your rankings in search results.
A good web hosting service will usually give you unlimited bandwidth, access to a private or cloud-hosted server, a Content Delivery Network (CDN), an SSL certificate, added security features, a server-level firewall, and more.
An obsolete or outdated plugin or theme
Any software that runs on your site can affect its reliability and security. This includes plugins and themes.
Therefore, anytime you install either of these on your site, you’ll want to vet the developers and check out the version details and user reviews. This can help ensure that you only download and install high-quality themes and plugins.
When it comes to themes, always check to see if the design is compatible with your current tools and WordPress version. Most obsolete themes or plugins will just mess with your site’s layouts, but some may be intentionally infiltrated by hackers.
It’s also important that you keep your existing themes and plugins up to date. As long as you’re regularly monitoring your site for issues, you can set up automatic updates to immediately take advantage of the latest security patches.
An outdated version of WordPress
As we discussed earlier, keeping your WordPress core version up to date is essential. You can do this by navigating to Dashboard → Updates.
If you don’t update your WordPress version, you could miss out on key bug fixes and maintenance improvements, leaving your site vulnerable. Plus, running an outdated version of the CMS could lead to compatibility issues with your active plugins and theme.
WordPress accounts with weak login credentials
Even if you use strong passwords for your own account, a single user with weak credentials can present a safety risk. This situation is especially possible for large ecommerce sites with lots of customers, blogs with multiple authors, and marketing agencies with large teams.
Therefore, it’s best to use a trusted password policy plugin to help you manage your user accounts. These kinds of plugins enable you to enforce strong passwords, show a password strength score, and more.
Lack of security protection
In addition to strong login credentials, you’ll want to make sure that your site has some extra security measures in place. These should protect it against the most common risks, like brute force attacks.
This is when a hacker uses trial and error to guess someone’s login credentials. Strong passwords and usernames are the first defense against this type of attack, but there’s more you can do. As an added layer of security, you can install a plugin like Jetpack and enable the brute force protection feature.
Incorrect user permissions or unnecessary accounts
WordPress lets you assign a different user role to each account. Each role has a unique set of permissions, which you can then customize.
If you’re not familiar with the default permissions for each role, you can end up giving certain users too much control over your website. As a result, inexperienced WordPress users could end up breaking your site.
Let’s go over the major WordPress roles in descending order:
Administrator
Editor
Author
Contributor
Subscriber
Some of these roles were originally developed for collaborative blogging purposes, so they can come in handy if you run a blog. If you manage an ecommerce store or WordPress Multisite, you’ll likely have additional roles like customer, shop manager, or super admin.
As a general rule, there should only be one administrator per site. This user has access to all the administration features on a site.
The other roles are pretty self-explanatory, but it’s probably best to review the details of WordPress user roles and capabilities before you start assigning them. It’s also a good idea to audit your site’s users from time to time. Dormant accounts can be hacked and utilized for nefarious purposes, so you’ll want to delete them before it’s too late.
An insecure login form
Users will need to use a login form to access your site. Unless you use a third-party tool, WordPress generates this page form for you.
By default, it only has fields for ‘username’ and ‘password.’ A simple form makes it easy for users to log in, but it’s not the most secure login process.
Therefore, you may want to enable Two-Factor Authentication (2FA) to make the login page more secure. This requires users to produce a unique, one-time code that’s sent to them via text message.
Lack of spam filters
Unfortunately, if you have a website, you’re likely going to have to deal with spam. With WordPress, this will most likely come in the form of comment spam.
To prevent this, WordPress gives you the option to turn off comments completely. This might not be ideal if you want to use the comments section to engage with your followers.
Therefore, you may want to use a spam filter. With over five million active installations, Akismet Anti-Spam is one of the most widely used spam solutions for WordPress. You can download a free version of the tool from the WordPress plugin directory, or you can get Jetpack Security, which includes a premium version of the Akismet plugin.
Frequently asked questions about WordPress security and reliability
At this point, you hopefully have a good understanding of how to secure your WordPress website. Still, just in case you have any lingering doubts, let’s go over some of the most frequently asked questions on the matter.
Is WordPress suitable for large and enterprise-level websites?
Yes, WordPress is an excellent platform for large and enterprise-level websites. That’s because you can customize every element of your site to support any amount of content and traffic. And if you run an ecommerce store, WooCommerce is highly scalable and grows with you.
Can WordPress reliably handle high-traffic sites?
Yes, WordPress can easily handle high-traffic sites without issue, but this is largely dependent on your site’s hosting provider.
If you know your website is going to receive a lot of traffic, it’s best to avoid shared hosting and opt for a private or cloud-hosted server instead. You’ll also want to look for unlimited bandwidth and performance optimization tools that will help keep your website running smoothly at all times.
Is WordPress core secure?
Yes, WordPress core is highly secure. In fact, it’s getting better all the time. Since it was created in 2003, it has undergone continual “hardening†to reduce the number of threats.
Are WordPress plugins secure?
Most WordPress plugins are secure. But outdated tools can put your site at risk.
Fortunately, it’s easy to check if a plugin is reputable and safe. All you have to do is find its listing in the WordPress plugin directory and view its version details and ratings.
Unfortunately, premium plugins without free versions are not listed here. That means you’ll need to dig a little deeper.
In this scenario, your best bet is to look into the developers who created the plugin. For starters, you could look for an official website to learn more about them. If you discover that the same developers have made other tools, you can also cross-reference those. Make sure to read real reviews and testimonials from users as well, which will provide the most accurate assessment of the plugin.
Are WordPress themes secure?
Most WordPress themes are secure, but you should always vet them the same way you would plugins.
What are some common security threats faced by WordPress websites?
Some of the most common security threats for WordPress sites are brute force attacks, Direct Denial of Service (DDoS) attacks, malware, and comment spam.
Here are some additional resources on these topics:
You can greatly reduce the threat of these attacks by following the best practices we discussed in this article, and by using the right security plugins.
What measures can I take to improve the security of a WordPress site?
Here are a few things you can do to improve the security of your WordPress website:
Keep your WordPress core, plugins, and themes up to date.
Even if you do all of the above, it might not be enough to provide the level of security your website needs. Therefore, the best thing you can do to protect your site is to use a robust WordPress plugin like Jetpack Security.
What is Jetpack Security, and where can I learn more about it?
Jetpack Security is a plugin that provides you with everything you need to safeguard your WordPress site. It includes the following tools:
With these powerful security tools, you can create and manage backups, scan for malware, and block spam comments. You can learn more about Jetpack Security here.
Build and manage a secure website with WordPress
Choosing the right platform for your website is crucial, especially if you run a business. When your site is built on a solid foundation, you’ll be able to safeguard sensitive data and user information more easily.
The good news is that WordPress is a highly-secure CMS. As long as you select a reliable hosting provider and follow some best practices, you should have nothing to worry about. You can start by installing WordPress safely and vetting any themes and plugins that you add to your site. It’s also important that you manage your user roles and permissions carefully.
Are you ready to take your WordPress security to the next level? With Jetpack Security, you’ll get a comprehensive web security tool that includes automatic backups, real-time malware scanning, spam protection, and much more!
One of the hallmarks of a user-friendly website is that it doesn’t keep visitors waiting too long while loading. Caching static assets is a critical step to improving site performance, but it doesn’t help much to simply set this up and move on. Without an efficient WordPress caching policy, you might struggle to provide fast loading times.
Fortunately, learning how to leverage browser caching on WordPress is easier than you might think. You can configure browser caching manually, and the Content Management System (CMS) also enables you to use tools that do it for you.
In this article, we’ll explain how browser caching works and discuss its benefits. We’ll also show you how to check if caching is enabled on your site and look at different ways to turn it on.
What is browser caching?
Browser caching is a process that saves copies of a website’s elements on your computer. When you visit a website, your browser downloads different pieces of content, like images and text. Instead of downloading this content every time you visit the site, your browser “caches†or stores some of it in case you need it later.
The next time you visit the site, your browser will check what elements are stored locally. It will then load these elements from the cache instead of requesting them from the site’s server. This can make the page load significantly faster, depending on the number of assets that are stored in the cache.
If you had to check your browser’s cache right now, you’ll likely find a few hundred megabytes of files inside it. Most modern browsers enable you to see an overview of cached files if you go into the privacy settings.
The thing about caching is that a browser can’t decide to do it on its own. To leverage browser caching in WordPress, you’ll need to configure your website or server to do so. This means that your site controls which assets the browser caches and for how long.
What are the benefits of caching static assets?
The primary benefit of browser caching is that it can help visitors load pages faster upon returning to your site. We talk about “static assets†because it’s not possible to cache every element on a website.
Dynamic assets are elements that change every time you load a page. For example, if you log into an app that shows you a post feed in real time, like Twitter or Instagram, those assets are dynamic.
Since dynamic assets can change frequently, caching them might not serve any purpose. After all, the next time you log into Twitter or Instagram, you’ll see entirely new posts.
Caching provides the best possible results when it’s limited to static assets. Learning how to serve static assets with an efficient cache policy in WordPress can have several benefits:
Reducing bandwidth usage. Since cached assets are loaded from local storage, there’s less data being transferred between the server and the visitor’s device. This helps visitors with limited internet plans save on data usage.
Decreasing the load on your server. When browsers use cached assets, the server receives fewer requests for those files. This reduces the server’s workload and can help prevent server overloads during periods of high traffic.
Enabling partial offline browsing. In some cases, caching static assets can enable visitors to access certain parts of a website even when they’re offline. If the browser has previously cached the necessary files, it can display the content without needing an active internet connection.
Caching static assets enables you to make better use of server resources and improve the experience for visitors. All of this works by instructing your server on what assets it should tell browsers to cache.
How to check if browser caching is enabled on your site
The easiest way to check if a website leverages caching is to use browser developer tools, like the ones you find in Firefox and Google Chrome. This approach requires you to look at some code, but you don’t need to be a developer to understand it.
To do this in Google Chrome, visit the website you want to check, right-click anywhere on the page, and select the Inspect option. This will open the developer tools tab within the browser, which should look like this:
Click on the Network tab. If you see an empty list, you’ll need to reload the page with the developer tools tab open. The Network tab will display all the requests and assets the browser loads while accessing the page.
The element we’re interested in should be the first on the list. In our case, it’s Jetpack.com, and it contains the page’s headers. Select that file, and it will open a new tab to the right, jumping straight into the Headers section.
Some headers will tell us whether the site uses caching and how it’s implemented. These are:
Cache-Control. This header specifies caching directives, like max-age (the maximum time a resource is considered fresh) or no-cache (forces caches to submit the request to the origin server for validation before releasing a cached copy).
Expires. This header provides an expiration date and time for the resource. After this, the resource is considered stale, and the browser will revalidate it.
ETag. This header is an identifier for a specific version of a resource. When the resource changes, the ETag changes as well, allowing browsers to determine if a cached resource is still valid.
Last-Modified. This header indicates the last modification date of the resource. Browsers can use this information to validate if their cached version is still up-to-date.
If you can find these headers in the file, then the website uses caching. Keep in mind that specific caching configurations can vary from site to site. Some sites might tell browsers to store static files for a day, whereas others will tell them to store files for months or longer periods.
How to leverage browser caching with a plugin
The easiest way to leverage browser caching on a WordPress site is by using a plugin. There are a lot of caching plugins you can use. One great option is WP Super Cache.
Once you’ve installed and activated WP Super Cache on your site, you can implement caching using several approaches. The simplest way is to go to Settings → WP Super Cache and select the Caching On option next to Caching.
The plugin’s default settings enable caching for logged-out visitors and set a lifetime of 30 minutes for stored assets. If you want to change these settings, you’ll need to go into the Advanced tab.
Here, you can decide which visitors to enable caching for, whether to enable dynamic caching, if the plugin should clear the cache when you update pages, and more. The plugin helps you out by recommending the most effective options.
If you don’t have a firm grasp of caching, you might want to stick with the default settings. Configuring caching settings without fully understanding how they work can lead to problems with your website.
How to leverage browser caching without a plugin
If you don’t want to use a plugin, you can enable browser caching on your website manually. This process might involve dealing with code at the server or at the site level, depending on the implementation method that you choose.
1. Add “Cache-Control†and “Expires†Headers in NGINX
To add “Cache-Control†and “Expires†headers in NGINX, you’ll need to modify the server configuration file. This file is usually called nginx.conf, and it’s located in the main nginx directory.
The easiest way to connect to your site’s server is to use a File Transfer Protocol (FTP) client. Then, you’ll need to locate the nginx.conf file, which should be in either
/etc/nginx/nginx.conf or /etc/nginx/sites-available/default.
Open the file using a text editor and look for the server block of code within nginx.conf. Here, we’re going to add the following new block of code, which specifies what files the server should tell browsers to cache and how long that cache should last before it expires:
This code includes both the “Cache-Control†and “Expires†headers. You can modify both the expiration time range and the file types that browsers should cache.
If you can’t decide what types of files to cache, take a look at what’s in your WordPress media folder. Any static files that visitors access regularly should be cached. As for the expiration header, 30 days is generally a good timeframe for most websites.
Once you add the code, save the changes to the file and exit the editor. You’ll need to restart NGINX to apply the changes.
2. Add “Cache-Control†and “Expires†Headers in Apache
Using “Cache-Control†and “Expires†headers in Apache requires you to enable their corresponding modules. You can enable these modules by opening the terminal and running the following commands:
The final command will restart Apache with both modules active. Next, you’ll need to modify the Apache configuration file, which is usually called either httpd.conf or apache2.conf.
You can find this file in either /etc/httpd/conf/httpd.conf, /etc/apache2/apache2.conf, or
/etc/apache2/sites-available/000-default.conf, depending on the server configuration.
Then, look for the <Directory> block within the Apache configuration file and add the following code inside it:
<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 1 month"
ExpiresByType image/jpg "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 month"
ExpiresByType image/gif "access plus 1 month"
ExpiresByType image/png "access plus 1 month"
</IfModule>
<IfModule mod_headers.c>
<FilesMatch "\.(jpg|jpeg|png|gif)$">
Header set Cache-Control "public, no-transform"
</FilesMatch>
</IfModule>
The first part of that code governs the expiration settings for cached files. The second part indicates what file types browsers should cache. As with NGINX, you can modify these settings depending on the files you want browsers to store.
When you’re done, save the changes to the Apache configuration file and close it. You’ll need to restart Apache for the changes to take effect.
3. Use a Content Delivery Network (CDN)
A Content Delivery Network (CDN) is a network of servers that you can use to store cached copies of your website in key regions. CDNs tend to be paid services, and they help by serving cached copies of your site from the server that’s geographically closest to the visitor.
This approach lessens the load on your own servers. Moreover, CDNs tend to be optimized for top-of-the-line performance and are typically distributed across the globe, so they can serve websites from the best possible location for each visitor.
Jetpack CDN is an option that integrates seamlessly with WordPress, is easy to use, and highly effective.
Best of all, it’s a free CDN that stores images and other types of static assets from your website. Once you install and activate it, you can enable the CDN by going into Jetpack → Settings in the WordPress dashboard.
Then, locate the Performance & Speed settings and toggle the Enable site accelerator option.
4. Host third-party scripts and assets locally (whenever possible)
Third-party scripts are elements like code from external sites, tracking pixels, fonts, and other assets that require loading to work. The more scripts and assets you load from third-party sources, the longer the process will take, which can slow down your site.
Ideally, you should look to eliminate any third-party scripts and assets you don’t use. Alternatively, you can host code and assets on your local server to reduce loading times.
You can identify third-party scripts, as well as unused JavaScript, using PageSpeed Insights. This tool highlights opportunities for improving site performance, including lists of unused code and third-party scripts that can be removed from your pages.
You can safely delete any unused third-party scripts on your website. For important scripts, you may want to consider the option of hosting them locally.
Final step: Install a free plugin to improve Core Web Vitals
Learning how to leverage browser caching in WordPress is a key step to improving site performance. Fortunately, it’s not the only thing you can do to make the user experience better.
Google measures the quality of a site’s user experience with a set of metrics called Core Web Vitals. Key performance metrics include:
Largest Contentful Paint (LCP). This metric measures how long it takes to load the largest asset on a page. Typically, it’s a good indicator of a page’s overall loading time.
First Input Delay (FID). There is a delay between loading a page and it becoming interactive. You might think a page is done loading, but if it doesn’t enable you to interact with elements like forms or links, it might have a high FID.
Cumulative Layout Shift (CLS). While a page is loading, its layout can shift, moving elements around on the browser. The more elements there are moving around, the higher the CLS score is. Ideally, this should be zero.
There are a lot of ways to improve Core Web Vitals in WordPress. The easiest approach is to use a plugin that optimizes all the variables behind these metrics.
Typically, you would need to use multiple plugins to implement these configurations or do so manually. After you install and activate Jetpack Boost, you can simply enable every setting by navigating to Jetpack → Boost and toggling the corresponding options.
Frequently asked questions about WordPress browser caching
While we’ve covered the essentials of browser caching in WordPress, you may still have some questions about the process. Let’s look at some of the most common ones.
Is browser caching secure?
Browser caching is very secure. Most of the websites you visit probably use some type of caching policy to improve performance for visitors. As a visitor, you won’t even notice it unless you go digging into the website’s headers, or you need to clear the cache.
The only way in which browser caching might not be secure is through bad implementation. If it’s not configured properly, browsers won’t be able to store assets the right way, or a page might fail to load (although this is very rare).
Browser caching vs. server caching: How do they differ?
Browser and server caching work very similarly. The only difference is that one method stores files locally, whereas the other does it on the server side.
The best example of server caching in action is a CDN. With CDNs, you can store cached copies of your site on a third-party server (or a cluster of them). When visitors try to access the website, the CDN intercepts that connection and serves the stored copy of the site.
In that scenario, visitors can still cache static content through their browsers. The experience for end users shouldn’t change in any way, except that CDNs often deliver much better loading times than traditional servers.
What else can I do to improve my site’s performance?
There are a lot of things you can do to improve your site’s performance (beyond leveraging browser caching). Some other changes you can make include eliminating render-blocking resources, minifying CSS, using a CDN, making fewer HTTP requests, and reducing TTFB and server response times.
When it comes to site performance, some changes are more effective than others. Improvements in loading times can have a significant impact on the user experience, which can lead to a higher conversion rate for your business.
Start serving static assets on your WordPress site
Leveraging browser caching in WordPress is one of the most effective ways to improve loading times. An efficient strategy will focus on static files and configure them to reload periodically. This way, visitors aren’t stuck with outdated elements.
The easiest way to implement browser caching in WordPress is by using a plugin like WP Super Cache. This plugin enables you to leverage browser caching using a set of default configurations or control every setting manually. Plus, it’s free to use.
Additionally, when you install Jetpack Boost, you can further improve your site’s performance. Check out the plugin to learn more!