WordPress

WordPress is arguably the most popular website-building solution. It is free and is suitable for almost any kind of website - from a blog and gallery to an e-commerce store. It uses PHP and MySQL as server-side technologies, and its installation/maintenance is quite easy. In this tutorial we will show you how to install WordPress using the WordPress Manager in the hosting Control Panel. For instructions on installing WordPress manually, check our Installing WordPress Manually article. Requirements To install WordPress on your hosting account, you need: At least 80 MB of free disk space. One MySQL database. The database will be created by the automatic installation script. Installation To install WordPress, navigate to the WordPress Manager > Install tab of your hosting Control Panel. You will need to fill in or select the following options: Site Title: You need to enter the name of your WordPress site. You choose this name. For example, it can be related to the content of the website, the name of your company, your domain name, etc. Language:  Select the language for your site and its administrative area - the WordPress Dashboard. Note that the sample content the site comes with is always in English. Domain: Select a domain for the website from the domains associated with the account. Note that WordPress is a domain-dependent application, so the domain you choose here will be used for all links to pages, posts, etc. Subdomain: Choose the subdomain where you want WordPress installed. To have WordPress as the main website for the domain, choose the www subdomain. If you want to install WordPress in a new subdomain, click on the Create a subdomain link, which will take you to the Subdomains section of the Control Panel. Path: If you wish to install WordPress in the main folder of the subdomain you have chosen, you can leave this field empty. If you wish to install in a subfolder, please click the (Folder) icon and choose an installation folder. We advise that you install WordPress in a folder that does not contain other files and folders as they can be overwritten by the installation script. Use WWW in the WordPress URL: Choose whether to prefix the address with www (e.g. http://www.example.com). Use HTTPS in the WordPress URL: Choose whether to set the site to use HTTPS instead of HTTP. This is only possible if there is a valid SSL certificate installed for the host. Force HTTPS for the subdomain: Select whether to force SSL/HTTPS connections for the subdomain you selected above. You can enable/disable this option at any time via the SSL/HTTPS > Force HTTPS section. Enable server-side caching: Choose whether to enable server-side caching for improved site loading times. It can also be enabled after the installation. For more details, check our Enabling server-side caching for WordPress article. MySQL version: Select the MySQL version that you would like to use for WordPress - MySQL 5 or MySQL 8. Username: Enter the username that you want to use for administering your site. You will be able to create additional WordPress users later through the WordPress Dashboard. Password: Enter a password for the above username. Make sure you set a complex and unique password. Password Again: Enter the password again. Е-Mail: Enter the email address of the main user for administration. You will need this email for example to retrieve the password of your WordPress main administrative user (in case it is lost). Accept license agreement: You need to check the license of WordPress and accept it. After you configure all options, click on the Install button. If the folder you are installing in contains files/folders, you will see a warning. If you want to choose another subdomain or subfolder for the installation, you need to click on the Cancel button. Otherwise, you can click on the Continue button. Note that the results of some operations are cached, so you may not see your changes immediately. If that happens, please allow a few minutes for the cache to expire.If the WordPress installation completes successfully, you will see a screen with the installation details: We strongly advise that you keep your WordPress installation up to date, along with the plugins you add. You can perform the updates through the administrative section of WordPress or the hosting Control Panel > WordPress Manager, where you will see notices that new versions of the WordPress core and/or plugins are available. Most operations made in the WordPress Manager of the Control Panel are performed using the WP-CLI tool. These operations are logged in the ~/.wp-cli/history.log file in your hosting account.

After successfully logging into the hosting Control Panel, your account will be scanned for WordPress installations (running WordPress version 3.9+) that are not imported to the WordPress Manager. If such WordPress installations are found, a notification like the following will be displayed with convenient button to scan and import them: In the WordPress Manager of the hosting Control Panel, you can use the Scan for WordPress installations button to manually scan your hosting account and list the WordPress installations it finds. To import a WordPress installation from the list, you need to check its checkbox and click on the Import button. Some issues with your WordPress installation can be automatically fixed by the Control Panel's WordPress Manager. If an issue like that is detected, you will see an option to attempt a fix on the management page of your WordPress installation. If your WordPress installation does not work and cannot be repaired automatically by the Control Panel, you can contact our support team for assistance. The Log in button next to each administrative username allows you to log in to the WordPress dashboard of your website with that particular username. This way, you can log in without entering a password. Note that the results of some operations are cached, so you may not see your changes immediately. If that happens, please allow a few minutes for the cache to expire. Most operations made in the WordPress Manager of the Control Panel are performed using the WP-CLI tool. These operations are logged in the ~/.wp-cli/history.log file in your hosting account.

You can use the WordPress Manager section of the hosting Control Panel to change the Site URL of a WordPress installation by following the steps below: 1. Open the Manage tab. 2. Find the WordPress installation in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. 3. Select the Site URL using the controls under the Site URL section. A preview of the URL is shown below the controls. The controls are as follows: Use HTTPS: Set the site to use HTTPS instead of HTTP. This is only possible if there is a valid SSL certificate installed for the host. Use WWW: This option gives you the ability to prefix www. to the website address of your WordPress installation. This option is available only for the www subdomain. Choose subdomain: You can choose from a list of the subdomains created through the hosting Control Panel > Subdomains section. Choose domain: Choose the domain from the list of domains associated with the account. Choose directory: Choose a directory in the selected subdomain. If you wish to have the WordPress installation within the root of the domain/subdomain, you should leave it blank. If you choose a directory that is different from the current one, you are effectively moving WordPress to that directory. Details about that can be found in our Moving WordPress between directories or subdomains on the hosting account article. 4. Click on the Change button. When you change the address of WordPress, the tool performs the following actions: Creates a temporary backup of the WordPress installation. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Searches and replaces the current address with the new address in the database. Note: If there are any hard-coded links of the website's URL in the WordPress files, you will need to update them manually.

You can enable the recommended output compression, enable browser caching, and prevent 404 (Not found) errors for WordPress very easily by following these steps: Go to the WordPress Manager in the hosting Control Panel. Click on the Manage button next to your WordPress installation. Click on the Enable button next to WordPress optimizations under the Tools section. This will add the following code block to the .htaccess file of your WordPress installation: ### BEGIN Optimization enabled via Control Panel > WordPress ###<IfModule mod_deflate.c>    # Insert filters according to https://codex.wordpress.org/Output_Compression    AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css application/xml application/xhtml+xml application/rss+xml application/javascript application/x-httpd-php application/x-httpd-fastphp image/svg+xml    # Drop problematic browsers    BrowserMatch ^Mozilla/4 gzip-only-text/html    BrowserMatch ^Mozilla/4\.0[678] no-gzip    BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html    # Make sure proxies don't deliver the wrong content    Header append Vary User-Agent env=!dont-vary</IfModule>## LEVERAGE BROWSER CACHING ##<IfModule mod_expires.c>    ExpiresActive On    ExpiresByType image/jpg "access 1 year"    ExpiresByType image/jpeg "access 1 year"    ExpiresByType image/gif "access 1 year"    ExpiresByType image/png "access 1 year"    ExpiresByType text/css "access 1 month"    ExpiresByType application/pdf "access 1 month"    ExpiresByType application/x-javascript "access 1 month"    ExpiresByType application/javascript "access 1 month"    ExpiresByType application/x-shockwave-flash "access 1 month"    ExpiresByType image/x-icon "access 1 year"    ExpiresDefault "access 2 days"</IfModule>## LEVERAGE BROWSER CACHING ##### Skip 404 error handling by WordPress for static files ###<IfModule mod_rewrite.c>    RewriteEngine On    RewriteCond %{REQUEST_FILENAME} !-f    RewriteCond %{REQUEST_FILENAME} !-d    RewriteCond %{REQUEST_URI} !(robots\.txt|sitemap\.xml(\.gz)?)    RewriteCond %{REQUEST_FILENAME} \.(css|js|html|htm|rtf|rtx|svg|svgz|txt|xsd|xsl|xml|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|swf|tar|tif|tiff|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)$ [NC]    RewriteRule .* - [L]</IfModule>#### END Optimization enabled via Control Panel > WordPress #### You can also add the code block listed above to the .htaccess file of your WordPress installation manually using the File Manager in the hosting Control Panel. The Leverage Browser Caching code block is essential for preparing your WordPress installation for server-side caching. You can learn more about getting WordPress working properly with our server-side caching service in the Enabling server-side caching for WordPress article. All WordPress applications pre-installed on the hosting account or installed through the hosting Control Panel > WordPress Manager are optimized by default.

The loading speed of your website is very important and may be the difference between a visitor staying on it or leaving it. In this article, we will take a quick look at some of the factors that can affect and improve the performance of your website. Website Performance Measuring Tools There are many types of tools you can use to measure the performance of your website. Some tools can come preinstalled on the server. For example, WordPress Doctor is installed by default on our servers and can be easily accessed via the hosting Control Panel > WordPress Manager > WordPress health section. There are also plugins which can be installed on your website (like Code Profiler and Query Monitor) to view the performance of your website and see some recommendations. Last, but not least, there are plenty of third-party online scanners. Just to mention a few - GTmetrix, Google PageSpeed Insights, and WebPagetest. These websites can provide detailed information about different aspects that affect the performance of the website, as well as instructions on how to improve problematic ones. Server-side Settings and Changes The hosting server where your website is hosted, and the technologies it supports, can seriously help you speed up your website. If a hardware component of a web server is not picked carefully and in accordance with the other components, this may cause the entire server to run slowly, which will also slow down your website. That is the reason all of our hosting servers use top-tier components that are carefully picked for the best possible website performance. Having the best hardware available does not necessarily mean that it will make your website perform at its best. The software layer on top of the hardware has to be configured and optimized for specific tasks. Our servers are specifically tailored to make WordPress websites quick. The technologies supported by a hosting server are very important as they can drastically improve your website load speed. Here are some of the technologies supported on our servers that can help you in this regard: PHP Version and Handler WordPress runs on PHP, so the PHP version and execution mechanism play a huge role for the performance of the website. CGI and FPM are the PHP handlers supported on our servers. CGI offers immense compatibility with older and more specific software applications and scripts, while the FPM handler comes with blazing fast execution of PHP scripts. It is paired with OPcache for even faster performance. The FPM handler with OPcache support is the go-to option for WordPress websites on our servers. Newer PHP versions often come with better security features and faster performance, so using the latest PHP version that is compatible with your WordPress installation is advisable. Content Compression Enabling content compression can reduce the size of pages of up to 70% for pages with mostly text. This can cause your website to load quickly and feel a lot snappier. This reduction of the data transferred between the server and the visitor will also reduce the traffic usage for your hosting account and the visitor, which is very beneficial for mobile devices. On our servers, the following content compression methods are supported - mod_deflate and mod_brotli. Caching WordPress websites use PHP scripts and MySQL databases to display content to visitors. The content is generated dynamically by requesting and loading elements one after the other, which in some cases can take a significant amount of time. That is why the best and easiest way to improve the load time of a WordPress website is to reduce the number of requests that the server should handle by utilizing cache. There are generally four types of cache that you can use - browser caching, server-side caching, object caching, and content delivery network (CDN) caching. Browser Caching To start using browser caching, you just have to configure your website to instruct the browsers of your WordPress visitors to cache content locally. This way static content like images and other media can be loaded locally from the visitor's device if requested repeatedly instead of obtaining the content from the web server. Enabling the browser caching for WordPress is super easy and takes literally few clicks. You can find more information on how to take advantage of browser caching for your WordPress website in our Optimizing WordPress article. Server-side Caching Server-side caching means that a server generates a static version of dynamic pages or content for faster delivery to the end user. We use an NGINX reverse proxy on our servers as a server-side caching mechanism, which can be easily enabled via the WordPress Manager of the hosting Control Panel. The process is explained in our Enabling server-side caching for WordPress article. Object Caching Object caching for WordPress helps improve the loading time of websites by caching queries sent from the web server to the database server. In recent versions of WordPress, there is a recommendation for enabling object caching for improved performance: On our servers object caching is supported with Redis and Memcached. You can find details on how to enable this type of caching in our Using Memcached with a web app and Running a Redis Instance articles. Content Delivery Networks The last type of service which can be considered on the server's side, and that can improve the performance of a website, is a Content Delivery Network (CDN). Content Delivery Networks cache website content and store it on servers at different locations. When a visitor opens your website, the CDN will deliver the cached version of your website to the visitors from the server that has the best response time. Usually, this will be the server with the nearest location to the visitor. You can find instructions on how configure your domain to use the CDN service of Cloudflare in our How to Enable DDoS Protection and CDN with Cloudflare on your Website article. Client-side Settings and Changes You can make WordPress run faster by cleaning up and optimizing your WordPress installation. We will list below some of the changes you can make to your website to make WordPress work and feel faster. In general, they have the biggest impact on the performance of WordPress. Updating WordPress and Its Components Running older versions of WordPress, themes, and plugins is not only a security risk, but it can also be penalizing your website's performance. Newer versions often present security, compatibility, but also performance fixes. Just like using a more recent PHP version and other server technologies is recommended, the same is important for the WordPress core and its components. You can easily update your WordPress core and plugins via the hosting Control Panel > WordPress Manager. Managing and Choosing the Right Theme and Plugins Every time your website is opened by a visitor, your themes and plugins will have an impact on the website's loading time. The more themes and plugins you have installed on your website, the slower the website will load. Some themes and plugins continue to work and consume resources in the background, even if they are disabled. That is why it is extremely important to remove all themes and plugins that you do not use or need. After removing plugins and themes, you should also look for (and remove) leftover files, settings, or changes to your WordPress installation from the removed components as they could be slowing down your website. Choosing the right plugin for the job is also very important. Here is an example - you need to add a specific feature to your WordPress installation that is not available with your theme or WordPress itself. You search for plugins that can add this feature for you, and you find only two plugins matching the criteria. The first one is a popular plugin that has the feature you need along with of other features, and the second one is a small plugin that adds only the feature you need. If you choose the popular option with many extra (and unnecessary for you) features, each of the extra features will add up to the settings of your WordPress installation and, essentially, slow it down. The same goes for your website's theme. If you go for a feature-rich theme, it may affect the website's performance, while if you go for a light theme, your website should run and feel faster. Optimizing Content and Your Database The size and number of the elements loaded on your website will affect the loading time of your website's pages. Larger files will take more time to be delivered to your visitors, and the larger the number of files that have to be loaded on your website, the more requests the visitor's device will have to send to the server. For this reason, you should consider optimizing the content on your website. Reducing the size of the images on your website can reduce its overall size multiple times, so you should consider using the best image and size for the occasion. The same is true for JavaScript and CSS files. Loading unnecessary content should be avoided whenever possible, so removing unnecessary content from JavaScript and CSS files can help speed up your website. If multiple JavaScript or CSS files are loaded on your website, you can try to combine them with a plugin or manually. WordPress stores a lot of its data and settings in the database tables. Tables with the MyISAM storage engine should be optimized regularly as they tend to store temporary records indefinitely. Since WordPress uses MyISAM by default for most tables, you should schedule the optimization of your database to keep WordPress operating normally. You can perform this task with a plugin or manually via the phpMyAdmin MySQL database management interface.

Most modern browsers will display some sort of a warninig if a website is not accessed over a secure connection. This article will guide you on how to switch your WordPress URL to use HTTPS. Using a secure connection (HTTPS) improves security by encrypting all data between the server and the browser of a vistior. This also builds trust in visitors and allows browsers to display the green padlock next to your site's address in the address bar of the browser.   Prerequisites It is only possible to force HTTPS for a WordPress installation if there is a valid SSL certificate installed for its domain/subdomain. If an SSL certificate is installed for the subdomain your WordPress installation is on, this will be displayed in the Security section of the WordPress Manager in the Control Panel of the account: If a certificate is not available, you can click on the Manage button next to the SSL Certificate (HTTPS) security option. You can enable a free Let's Encrypt certificate with a single click using the SSL/HTTPS -> Let's Encrypt certificates section of the Control Panel as described in our Let's Encrypt certificates article.   Switching WordPress to HTTPS You can use the WordPress Manager in the hosting Control Panel to force HTTPS for a WordPress installation by following the steps below: Access the hosting Control Panel. Navigate to the WordPress Manager. Find the WordPress installation in the list, and click on the Manage button next to it. This will take you to the management page for the WordPress installation. Find the Site URL section and select the Yes checkbox under Use HTTPS. Click on the Change button.   When you force HTTPS for WordPress, the tool performs the following actions: Creates a temporary backup of the WordPress installation for quick and easy restoration in case of problems. For more information, you can check our Creating, downloading, and restoring from WordPress backups article. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Replaces the current address with the new address in the database. Note: If there are any hard-coded links of the website's URL in the WordPress files, you will need to update them manually.

WordPress is the most popular website software application, and one of the reasons is the wide range of themes and plugins which extend its capabilities. This makes WordPress a pretty enticing target for hacker attacks, so taking measures to secure it is strongly recommended. You can perform four simple actions via the hosting Control Panel > WordPress Manager that are very effective and should help you prevent the majority of hacking attempts against your website: Update WordPress and its components regularly Access WordPress via HTTPS (use SSL) Apply an additional layer of protection to the WordPress Dashboard Prevent execution of PHP scripts in folders with website content Disable access to XML-RPC Update WordPress and its components regularly Software applications which are actively worked on receive regular updates to introduce new features to their customers, apply security fixes, or resolve compatibility issues. With WordPress, there are updates for literally everything (the WordPress core, all installed themes, and all installed plugins), and you have to apply them regularly to have the best defense possible against vulnerability exploits. One solution is to activate automatic updates for the WordPress core, themes, and plugins; however, this may result in unexpected downtime of your website if any of the automatic updates causes your website to malfunction or not work correctly. That is why we would recommend that you regularly and manually check the WordPress core, themes, and plugins for updates. You can find more details about the available update options for WordPress themes and plugins in the How to update a WordPress theme? section of our Managing WordPress themes article and the How to update a WordPress plugin? section of our Managing WordPress plugins article. You can update the WordPress core and all outdated plugins via the hosting Control Panel > WordPress Manager by simply opening the management page for your WordPress installation and pressing the respective Update buttons which will be displayed if updates are available. Access WordPress via HTTPS (use SSL) By installing an SSL certificate on the server and configuring WordPress to work via HTTPS, all data will be transmitted securely between the browser of your website visitors and the server hosting your website. This will help against man-in-the-middle attacks. You can find step-by-step instructions how to do this the right way via the hosting Control Panel > WordPress Manager in our Forcing HTTPS for WordPress article. If a certificate is already available for the subdomain WordPress is installed on, this will be displayed in the Security section of the WordPress Manager. If a certificate is not available, clicking on the Manage button will take you to the SSL/HTTPS section of the Control Panel where you can enable a free SSL certificate from Let's Encrypt.     Apply an additional layer of protection to the WordPress Dashboard Hackers often try to brute-force their way into the WordPress Dashboard, so having a strong password for all administrators of your WordPress website is a must. Details on how to easily change the passwords of WordPress administrators are available in our Managing WordPress administrators article. On our servers, a Web Application Firewall (WAF) helps significantly with the prevention of most attacks. It attempts to filter out abusive traffic and allow only legitimate traffic; however, some brute-force attack (especially slow and/or distributed) are indistinguishable from legitimate traffic, so the WAF may not block them correctly. More information about the WAF available on our servers can be found in the Error "412 Precondition Failed" (mod_security2) article from our online documentation. What you can do to prevent such brute-force attempts altogether is to password protect the wp-login.php file (used for accessing the WordPress Dashboard), which takes just a few steps: Open the management page for the WordPress installation by clicking on the Manage button for it in the hosting Control Panel > WordPress Manager. Scroll down to the Tools section, and click on the Manage button next to Dashboard login protection. You will be redirected to the hosting Control Panel > Protection > Web access protection > Password protection page for the wp-login.php file in your WordPress directory. Choose a username and a password in the form that will be displayed there. We strongly recommend that you use a username that is hard to guess and not associated with your name, hosting account, or website, and that you choose a password after checking our Password tips article with general information on how to choose a strong password and secure it. You can add multiple username/password combinations using that form. A list of all authenticated users will be listed below the form with an option to change their password or delete them. Press the Add button. Now, anyone that tries to open the login page of your WordPress Dashboard (the wp-login.php file of your WordPress installation) via a browser will have to supply a combination of a valid username and password (those from the configured password protection):After successfully authenticating with a valid username and password in the pop-up screen, the login page of the WordPress Dashboard will be displayed where the WordPress user credentials can be entered:As you can see, this will require any brute-force attacks to break two different username-password combinations to gain access to your WordPress Dashboard. This process should take a lot of time and processing power, so it should be a good enough reason for brute-force attack initiators to give up on your website.Important: This extra layer of protection will affect ALL users registered on your WordPress website, so you will need to provide the additional set of credentials to them as otherwise they will be unable to reach the login page and access the WordPress Dashboard. If your website relies on having a lot of visitors or users to be logged in, this type of protection may not be the best solution for you, and we would suggest that you look for a plugin that offers similar protection. Prevent execution of PHP scripts in folders with website content Some vulnerabilities allow hackers to upload files in the wp-admin/includes, wp-content/uploads, and wp-includes directories of a WordPress installation. Hackers try to use this to their advantage by uploading malicious PHP files and trying to execute these files directly. A simple way to stop such attempts in their tracks is to prevent the execution of PHP files in the said folders. The WordPress Manager allows you to do it easily with a click of a button - all you need to do is: Go to the hosting Control Panel > WordPress Manager and click on the Manage button for your WordPress installation. Now, you will be inside the management page for your WordPress installation. Navigate to the Tools section there, and click on the Apply button next to Secure content directories. This will add the following code block to the .htaccess files in the wp-admin/includes, wp-content/uploads, and wp-includes directories of your WordPress installation (the WordPress Manager will create the .htaccess files if they do not exist):# BEGIN rules managed by Control Panel > WordPress### BEGIN PHP Security rules enabled via Control Panel > WordPress ###Options -Indexes -ExecCGI# Execution prevention<Files ~ "\.ph(?:p[345]?|t|tml)$">        deny from all</Files>#### END PHP Security rules enabled via Control Panel > WordPress ##### END rules managed by Control Panel > WordPressImportant: Some plugins or themes may rely on the web execution of PHP files located in the folders mentioned here, which will cause these plugins/themes to stop working correctly. If that happens, you should remove the code block added by the Secure content directories tool manually or use another theme/plugin that offers the same functionality but executes files only from its respective directory within the wp-content/plugins directory of your WordPress installation. Disable access to XML-RPC XML-RPC is a WordPress feature that allows WordPress to communicate with other systems when necessary. Most of the time, this feature is not required, and is often exploited by hackers. By default, access to XML-RPC in WordPress is disabled on our servers. However, you can manage access to XML-RPC in WordPress through the Security section in the WordPress Manager. Access to XML-RPC is sometimes required by some plugins. If you have such a requirement, you need to click the Enable button next to the Access to XML-RPC security option to enable access to XML-RPC. If access to XML-RPC has been enabled, you can disable it again by clicking on the Disable button next to the security option.  

In this article, you can find the following information about WordPress themes: What is a WordPress theme? How to choose a WordPress theme? How to install a WordPress theme? Installing and activating a WordPress theme via the Dashboard Activating a WordPress theme via the Dashboard Installing and activating a WordPress theme with WP-CLI Activating a WordPress theme with WP-CLI Installing a WordPress theme by uploading it to your account and activating it How to update a WordPress theme? Utilizing automatic theme updates Updating a theme through the WordPress Dashboard Updating a theme with WP-CLI Updating a theme via the File Manager or FTP How to disable a WordPress theme? How to delete a WordPress theme? Deleting a theme through the WordPress Dashboard Deleting a theme using WP-CLI Deleting a theme via the File Manager or FTP How to use a child theme in WordPress? How to secure a WordPress theme? What is a WordPress theme? Themes in WordPress were originally only used for changing the design (layout) of a website. Nowadays, there are a lot of themes that are very complex and totally change the way a WordPress installation functions. For example, some themes come with their own website builders that allow you to edit the website content very easily, others overhaul the default WordPress back and front-end. How to choose a WordPress theme? There are thousands of free themes available for preview and activation directly in the WordPress Dashboard. These themes can also be downloaded from the WordPress theme repository. Of course, this includes the default WordPress themes (like TT1 Blocks, Twenty Twenty-Three, Twenty Twenty-Two, Twenty Twenty-One, Twenty Twenty, etc.). Commercial themes can be found in the WordPress repository or dedicated theme-selling websites. Some commercial themes are available for purchase and download only through the websites of their vendors. There are basically themes available for all tastes. Of course, if you need something that is not available yet, there is always the option to hire a theme developer to build you the exact theme that you want and need. When choosing a theme for your WordPress website, you should also consider checking if the theme receives regular updates, and if its developers, support team, or community offer any assistance. Regular updates are important as they will help prevent or fix potential compatibility issues with the theme and future versions of the WordPress core or plugins. If you run into any issues related to the theme, the chances of getting the issues resolved will increase significantly if the theme developers can help or there are active and knowledgeable members in the theme's community. You can also refer to the official WordPress community for assistance, but they may not be always able to help. How to install a WordPress theme? After you have found the theme that you wish to use, there are several ways to actually install it on your WordPress website - via the WordPress Dashboard, with the help of the WordPress command-line interface - WP-CLI, or by manually uploading it to the account. Installed themes can be activated via the WordPress Dashboard, as well as via WP-CLI. Some themes may require additional steps for their proper installation or activation (adding files, installing plugins, or purchasing a license for example), so please refer to the official instructions of the theme that you wish to use on your website. You can install and test new themes on existing WordPress websites risk-free by using a staging instance. More information on how to set up a staging instance of your existing WordPress website via the hosting Control Panel is available in our Creating and using WordPress staging sites article. Installing and activating a WordPress theme via the Dashboard Installing a new theme via the WordPress Dashboard is the easiest and most user-friendly method which requires just a few steps. You only need to log in to your WordPress Dashboard (you can access it by adding "/wp-admin" to your website's URL - for example, http://your_domain.com/wp-admin) or even easier, use the "Log in" feature available in the hosting Control Panel > WordPress Manager as explained in our Managing WordPress administrators article. Once logged in, navigate to the Appearance > Themes section.Click on the Add New button or the Add New Theme block.Now, there will be two installation options available depending on whether your new theme is listed in the public WordPress repository or not. If your new theme is available in the WordPress theme repository, you can search for the theme directly through the WordPress Dashboard and use the Install button when you hover over its block.And if your new theme is not listed in the WordPress repository, you will need to obtain it in a ZIP format from its vendor. In this example, we are using the ZIP file of the free Hello Elementor theme.After you have the ZIP file, you need to click on the Upload Theme button within the Add Themes page of the WordPress Dashboard.Use the Browse button to locate the ZIP file on your device, or simply drag the file from your device to the Upload Theme section. After that, click on the Install Now button. Your new WordPress theme should now be installed successfully, and all that is left is to activate it by simply clicking on the Activate button:or the Activate link if you uploaded your theme as a ZIP file:Your new theme should now be activated. Installing and activating a WordPress theme with WP-CLI WP-CLI is supported on our servers, and you can use it with all hosting accounts. It basically allows you to use a command-line interface to manage your WordPress websites. For more information about WP-CLI, you can check our WP-CLI Tutorial article. To install and activate a new theme via WP-CLI, you need to follow these steps: Enable SSH access for your account, and connect to it via SSH. Once you have connected to your account via SSH, navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you need to navigate to the ~/www/www directory of your account with the following command:cd ~/www/www If you are trying to install a new theme from the WordPress repository, you will need to find the slug of the theme. For example, the slug of the Hello Elementor theme is hello-elementor, so the WP-CLI command to install and activate this theme will be:wp theme install hello-elementor --activateThe output of the command should look like this:Installing Hello Elementor (2.6.1)Downloading installation package from https://downloads.wordpress.org/theme/hello-elementor.2.6.1.zip...Unpacking the package...Installing the theme...Theme installed successfully.Activating 'hello-elementor'...Success: Switched to 'Hello Elementor' theme.Success: Installed 1 of 1 themes.In case your new theme is not available in the WordPress repository, you should obtain it as a ZIP file from the vendor and upload it to your account. Instructions on how to upload files to your account are available in the Uploading files section of our online documentation. So if you wish to install and activate a theme from a ZIP file named new_theme.zip that is uploaded to the Private directory of the account, you should use the following WP-CLI command:wp theme install ~/private/new_theme.zip --activateYou should see a result like the following:Unpacking the package...Installing the theme...Theme installed successfully.Activating 'new-theme-slug'...Success: Switched to 'New Theme' theme.Success: Installed 1 of 1 themes.If your new theme is already installed and you just want to activate it, you should use the following command and make sure you replace new-theme-slug with the actual slug of the new theme:wp theme activate new-theme-slug That is it. Your new theme has been installed and activated successfully. Installing a WordPress theme by uploading it to your account and activating it This method is the least preferred as different actions have to be performed and that is why it is usually the slowest. To start, you need to: Retrieve the files of the theme from its vendor. Usually, the theme files will be bundled in an archive. Upload the archive containing the theme to the /wp-content/themes directory of your WordPress website in the account. If your website is installed on the main domain, you should upload the archive to the ~/www/www/wp-content/themes directory. You can use the hosting Control Panel > File Manager section or an FTP program. More details on how to upload files to your account can be found in the Uploading files section of our online documentation. Extract the theme files from the archive using the hosting Control Panel > File Manager section. Instructions on how to achieve this are available in our File Manager article. In general, the theme files will be located in a directory with the theme slug. Activate the theme via the WordPress Dashboard or via WP-CLI. How to update a WordPress theme? Updating your active WordPress theme may cause your website to malfunction or even fully crash. For this reason, it is very important that you check your website thoroughly after a theme update and always have a working recent backup of your WordPress installation. Although our automatic backups are generated twice per day and kept for seven days, we strongly recommend that you create a full backup of your WordPress installation right before updating your theme. This way you will have a restore point generated moments before the update, so you will be able to restore the website without any loss of data or information in the event of a problem. You can create backups of your WordPress websites with just a single click via the hosting Control Panel > WordPress Manager as explained in our Creating, downloading, and restoring from WordPress backups article. Some themes may support automatic updates or updates through the WordPress Dashboard which allows for quick and easy updates. Other themes may require manual actions like downloading the latest version of the theme from the vendor, changing custom settings, or uploading the theme manually to your account. In the latter case, you should refer to the official documentation of your theme for instructions on how to update it correctly. Utilizing automatic theme updates There are WordPress themes that support automatic updates. Automatic updates for themes are disabled by default. You can enable them in one of two ways - the WordPress Dashboard or via WP-CLI. Automatic updates are processed twice per day by default, and you will see how much time is left before the automatic update will be processed for a theme next to it in the WordPress Dashboard > Updates section. After a theme has been updated automatically, an email message will be sent to the website owners about the event. To enable automatic updates for a theme via the WordPress Dashboard, you need to: Log in to your WordPress Dashboard. Navigate to the Appearance > Themes section. Click on the block of the theme that you wish to update to view its details. Click on the "Enable auto-updates" link. The theme will be updated automatically from now on. You should follow these steps to enable automatic updates for a WordPress theme via WP-CLI: Enable SSH access for your account, and connect to it via SSH. After you connect to your account via SSH, go to the directory of your WordPress installation. For example, you will need to go to the ~/www/www directory of your account if WordPress is installed on your main domain by using this command:cd ~/www/www Execute the following WP-CLI command to enable automatic updates for your active theme:wp theme auto-updates enable $(wp theme list --status=active --field=name)If you wish to enable automatic updates for all themes installed on your WordPress website, you can use the following WP-CLI command:wp theme auto-updates enable --all --disabled-only You have successfully enabled automatic updates for your WordPress theme/s. Updating a theme through the WordPress Dashboard Themes can be updated through the WordPress Dashboard after logging in as an administrator and going to the Updates section: In the Themes section, select the theme/s that you wish to update, and click on the Update Themes button: Alternatively, you can update a theme from the Appearance > Themes section of the WordPress Dashboard by clicking on the Update now link from the New version available notice of the theme with an available update: Updating a theme with WP-CLI Updating a theme with WP-CLI is very quick. All you need to do is: Enable SSH access for your account, and establish connection to it via SSH. After connecting, go to the directory of your WordPress installation. Let's say WordPress is installed on your main domain, so you will need to go to the ~/www/www directory of your account by using this command:cd ~/www/www You can update your active theme with the following WP-CLI command:wp theme update $(wp theme list --status=active --field=name)To update all themes with pending updates, you can use this WP-CLI command:wp theme update --all Your WordPress theme/s should be updated now. Updating a theme via the File Manager or FTP The process of updating a theme via the File Manager or FTP requires that you replace the directory (and files) of the outdated version of the theme with the directory (and files) of the latest version of the theme. So, the process is almost the same as installing a new theme, which is covered in the Installing a WordPress theme by uploading it to your account and activating it section of this article. The only difference is that you will need to choose whether you wish to remove the contents of the outdated theme from the account, or upload the latest version of the theme and overwrite any existing files. How to disable a WordPress theme? To disable a WordPress theme, you simply have to set another theme as active for your website. More instructions on the process of installing and activating a theme are available in the How to install a WordPress theme? section of this article. Note: We recommend that you delete any themes which you do not plan to use as third parties may be able to exploit vulnerabilities of both enabled and disabled themes and plugins. How to delete a WordPress theme? If you need to delete a theme from your WordPress website, this can be achieved in one of three ways: through the WordPress Dashboard, using WP-CLI, or by deleting the theme's folder from your account. In general, you should not have more than two themes (three if you use a child theme) installed on the account at all times. Your main (and child) theme, and one default WordPress theme that will be used as a fallback option in case of issues with your main (and child) theme. Deleting a theme through the WordPress Dashboard To delete a theme with the WordPress Dashboard, you need to log in as an administrator to your WordPress website. After that, you should navigate to the Appearance > Themes section and click on the block of the theme that you wish to delete: Click on the Delete button that will be visible in the box showing details about the theme: A prompt will appear asking you to confirm your action. Click on the OK button, and the theme will be deleted. Note: The active theme of a WordPress website cannot be deleted via the Dashboard. Deleting a theme using WP-CLI The deletion of themes takes just four steps when using WP-CLI: Enable SSH access for your account, and connect to it via SSH. Go to the directory of your WordPress installation. If WordPress is installed on your main domain, you will need to navigate to the ~/www/www directory of your account. You can do this with the following command:cd ~/www/www To delete all inactive (and non-parent) themes from your WordPress website, you can use the following WP-CLI command:wp theme delete --allIf you wish to delete just a specific theme (e.g. a theme with slug unused_theme), execute this WP-CLI command:wp theme delete unused_themeYou can find the slugs of the themes installed on your WordPress website with the following WP-CLI command:wp theme list Note: WP-CLI can be used with the --force option to delete themes that cannot be deleted by default or for some other reason. Please use this option with care as you may potentially break your website with it. Deleting a theme via the File Manager or FTP Important: This method should be used only if you are very familiar with the WordPress directory/file structure. With this method, you can delete your active (or parent) theme which will result in downtime of your website. If you still wish to give this method a try, we recommend that you create a WordPress backup of your website beforehand via the hosting Control Panel > WordPress Manager as explained our Creating, downloading, and restoring from WordPress backups article. To delete a theme via the hosting Control Panel > File Manager section or FTP, you have to delete the theme's directory from the /wp-content/themes directory of your WordPress website in the account. If WordPress is installed on the main domain of your account, you will find your themes in the ~/www/www/wp-content/themes directory. Navigate to that directory using the File Manager section or your FTP program, and delete the directory. Details on how to connect to your account via FTP are available in the Uploading files section of our online documentation. How to use a child theme in WordPress? A child theme in WordPress is essentially your own version of another (parent) theme. You can define and use custom elements like stylesheets, functions, and scripts in your child theme, but at the same time, the child theme will inherit the parent theme's look, feel, and functionality. The best thing about using a child theme is that all of its custom elements will remain intact if the parent theme is updated. If you were to make changes to the files of the parent (original) theme, they would be lost upon update. Depending on the (parent) theme that you are using on your WordPress website, you should refer to its documentation for instructions on configuring a child theme. By default, you can create a new child theme by simply creating a new directory for it using the hosting Control Panel > File Manager section or an FTP client. The recommended naming pattern for child themes is to have the slug/directory name of the parent theme (e.g. twentytwentythree) appended with the "-child" string (e.g. twentytwentythree-child). You should create the directory in the /wp-content/themes directory of your WordPress website in the account, so for a WordPress installation on the main domain of your account, you should create the directory at ~/www/www/wp-content/themes. For the child theme to work correctly and be recognized by WordPress, you need to create a styles.css file in its directory (e.g. ~/www/www/wp-content/themes/twentytwentythree-child/styles.css) with the following content: /*Template: twentytwentyone*/The Template definition is required as it indicates the slug/directory name of the parent theme, but you may add other definitions as necessary. To get your theme to use the default stylesheet of the parent theme, you will need to use the enqueue technique. If you would like to learn more about it and child themes in general, we would recommend that you check the official WordPress Child Themes article. After you are ready with the changes to your child theme, you have to activate it via the WordPress Dashboard or via WP-CLI. How to secure a WordPress theme? Free and commercial WordPress themes are generally secure. In case any vulnerability is found for a theme and reported in the WordPress community, the developers of the theme are informed, and it is up to them to release a new version of the theme where the vulnerability has been fixed. Commercial themes are usually less likely to get affected by such issues or exploits as their source code is not publicly available; however, that is not always the case. When it comes to the security of a WordPress theme, be it free or commercial, there are two major factors: 1. Obtaining your WordPress theme from a legitimate source You should always obtain WordPress themes from official vendors or reputable sources. If you are interested in using a free theme on your WordPress website, you should obtain it from the WordPress theme repository. Commercial themes should be purchased and downloaded ONLY from their vendor or official resellers. There are many leaked or pirated versions of both free and commercial themes; however, they often come at a high cost - malware or malicious code injected in the core files of the theme. Of course, this allows the bad actors to access all your website data (including all files of your hosting account) and use your account to perform malicious activities (like attacking third-party websites or networks and sending spam messages). 2. Updating and maintaining your WordPress themes regularly The best way to keep your WordPress installation and themes protected is to perform updates regularly. Newer versions usually offer security, stability, and performance improvements as well as new features. You can find how to update your themes in the How to update a WordPress theme? section of this article. In general, you should have just one or two themes installed on the website. If you are using a default WordPress theme, you should keep only this theme installed on your website and remove all other themes. In case you use a non-default WordPress theme, you should keep the non-default and one default WordPress theme installed on your website. Having a default WordPress theme installed is recommended as it will be used as a fallback option if a major problem occurs with your active theme.

In this article, you can find the following information about WordPress plugins: What is a WordPress plugin? How to find WordPress plugins? How to install and activate a WordPress plugin? Installing and activating a WordPress plugin via the Dashboard Activating a WordPress plugin via the Dashboard Installing and activating a WordPress plugin with WP-CLI Activating a WordPress plugin with WP-CLI Installing a WordPress plugin by uploading it to your account and activating it Where to find all plugins already installed on WordPress? How to update a WordPress plugin? Utilizing automatic plugin updates Updating plugins via the hosting Control Panel > WordPress Manager Updating a plugin through the WordPress Dashboard Updating a plugin with WP-CLI Updating a plugin via the File Manager or FTP How to downgrade a WordPress plugin? Downgrading a plugin through the WordPress Dashboard Downgrading a plugin with WP-CLI Downgrading a plugin via the File Manager or FTP How to deactivate a WordPress plugin? Deactivating a plugin through the WordPress Dashboard Deactivating a plugin using WP-CLI Deactivating all plugins via the hosting Control Panel > WordPress Manager How to delete a WordPress plugin? Deleting a plugin through the WordPress Dashboard Deleting a plugin using WP-CLI Deleting a plugin via the File Manager or FTP How to perform bulk actions with plugins? What are must-use plugins? How to handle issues with a WordPress plugin? How to secure a WordPress plugin? What is a WordPress plugin? WordPress plugins are essentially script bundles that add or remove functionality to a WordPress installation. Some plugins allow you to disable or modify existing functions and features of a WordPress installation, while others allow you to add new features or functions. You can convert your WordPress installation to a forum, install a WYSIWYG website builder to build a complex website very easily, or add custom forms. There are plugins available for almost everything you can imagine. The best thing about plugins is that you can have multiple plugins active at once, so you can add complexity to your website and add or remove features whenever you want. Of course, when you add more plugins, you should ensure that the plugins you use are compatible with each other, your theme, and the version of WordPress used on your website. If you encounter compatibility issues, you can always report them to the developers of the plugin/s and theme, so they can release an updated version where the issues are resolved. How to find a WordPress plugin? There are tens of thousands of freely available plugins for activation directly via the WordPress Dashboard. You can also download these plugins from the WordPress plugin repository. There are also commercial plugins which can be obtained through the websites of their vendors or through plugin-selling websites. If you need a feature that is not already available or supported by a plugin, you can always hire a plugin developer to create it for you. When considering a plugin for your WordPress website, you should also check if the plugin is updated regularly, and if assistance is offered by its developers, support team, or community. Plugins without regular updates are very likely to stop working due to compatibility issues with newer versions of your WordPress core, theme, or other plugins. This is also why the developers and community of the plugin are important as they may offer solutions to all kinds of problems that you may encounter while using the plugin. You can also seek help from the official WordPress community; however, communities of the specific plugin should be more knowledgeable and capable of helping you with issues related to that plugin. How to install and activate a WordPress plugin? You can install plugins on your website in one of three ways - through the WordPress Dashboard, using the WordPress command-line interface - WP-CLI, or by manually uploading them to the account. After a plugin is installed, it can be activated only via the WordPress Dashboard or WP-CLI. Please note that additional steps may be required for the proper installation or activation of some plugins, like adding files, installing extra plugins, or purchasing a license. You should refer to the official instructions of the plugin that you wish to use on your website for more information. A staging instance can be used to install and test new plugins on an existing WordPress website. You can find more details on how to set up a staging instance of your existing WordPress website via the hosting Control Panel in our Creating and using WordPress staging sites article. Installing and activating a WordPress plugin via the Dashboard The easiest way to install a new plugin is via the WordPress Dashboard. All you need to do is log in to your WordPress Dashboard (you can access it by adding "/wp-admin" to your website's URL - for example, http://your_domain.com/wp-admin) or use the "Log in" feature available in the hosting Control Panel > WordPress Manager as explained in our Managing WordPress administrators article. Once you have logged in, go to the Plugins > Add New section.There will be two installation options available depending on whether your new plugin is listed in the public WordPress repository or not. If the plugin is available in the WordPress plugin repository, you can use the search field in the WordPress Dashboard:After you find the plugin that you wish to install, hover over its block, and use the Install Now button.You can use the More Details button to view more details about the plugin, which will basically open the plugin's page from the WordPress repository in a pop-up window within the WordPress Dashboard. There you will also find an Install Now button that you can use to install the plugin.In case the plugin that you wish to install is not present in the WordPress repository, you will need to obtain it in a ZIP format from its vendor. In the below example, we are using the ZIP file of the free Elementor Website Builder plugin.Once you have the ZIP file of the plugin that you wish to install, click on the Upload Plugin button within the Add Plugins page of the WordPress Dashboard, and an upload form will be displayed.Click on the Browse button, and locate the ZIP file on your device, or just drag the file from your device to the Upload Plugin form. Once the file is selected/detected, all you have to do is click on the Install Now button. Your new WordPress plugin should now be installed successfully, and all that is left is to activate it by simply clicking on the Activate button:If you installed the plugin via a ZIP file, you can use the Activate Plugin button from the screen that indicates the installation of the plugin was successful:You can also activate installed plugins from the WordPress Dashboard > Plugins > Installed Plugins section:After the plugin is activated, you should see a message that the activation was successful: Installing and activating a WordPress plugin with WP-CLI The Command Line Interface for WordPress (WP-CLI) is supported on our servers by default for all hosting accounts. It provides the ability to use a command-line interface for the management of WordPress websites. You can find some information about WP-CLI in our WP-CLI Tutorial. Installing and activating a plugin using WP-CLI is actually very easy. All you need to do is follow these steps: Enable SSH access for your account, and connect to it via SSH. Once connected to your account via SSH, navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you need to navigate to the ~/www/www directory of your account with the following command:cd ~/www/www If you want to install a plugin that is available in the WordPress repository, you should find the slug of the plugin. For example, the slug of the Elementor Website Builder plugin is elementor, so to install and activate this plugin via WP-CLI, you should use this command:wp plugin install elementor --activateThe output of the command should look like this:Installing Elementor Website Builder (3.8.1)Downloading installation package from https://downloads.wordpress.org/plugin/elementor.3.8.1.zip...Unpacking the package...Installing the plugin...Plugin installed successfully.Activating 'elementor'...Plugin 'elementor' activated.Success: Installed 1 of 1 plugins.If you wish to install and activate a plugin that is not available in the WordPress repository, you will have to obtain it as a ZIP file from its vendor and upload that ZIP file to your account. You can find instructions on how to upload files to your account in the Uploading files section of our online documentation. For example, if you have a plugin as a ZIP file named new_plugin.zip that is uploaded to the Private directory of the account, you should use the following WP-CLI command to install and activate that plugin:wp plugin install ~/private/new_plugin.zip --activateYou should see a result like the following:Unpacking the package...Installing the plugin...Plugin installed successfully.Activating 'new_plugin-slug'...Plugin 'new_plugin-slug' activated.Success: Installed 1 of 1 plugins.If you have already installed the plugin and only wish to activate it, execute the following command, and ensure that you replace new-plugin-slug with the actual slug of the new plugin:wp plugin activate new-plugin-slug You have successfully installed and activated the plugin. Installing a WordPress plugin by uploading it to your account and activating it The methods listed so far were very easy to follow and use as they allow you to install plugins with the WordPress built-in plugin wizard or a single command via WP-CLI. The next method is more cumbersome as it requires manually downloading the plugin to your device, manually uploading it to your hosting account, and activating it via the WordPress built-in plugin wizard or WP-CLI. To use this manual approach, you should: Obtain the files of the plugin from its vendor, which should be compressed into one .ZIP archive file. Get the archive containing the plugin files in the /wp-content/plugins directory of your WordPress website in the account. For example, you will need to upload the archive to the ~/www/www/wp-content/plugins directory if your website is on the main domain of your account. You can do this with the hosting Control Panel > File Manager section or an FTP program. Step-by-step instructions on the process of uploading files to your account are available in the Uploading files section of our online documentation. After the plugin archive is uploaded, decompress the archive using the hosting Control Panel > File Manager section by following the instructions from our File Manager article. By default, the plugin files will be located in a directory with the plugin slug, and it is recommended to keep that structure for maintenance reasons. For example, if your plugin's slug is new-plugin-slug, the plugin's files should be in the ~/www/www/wp-content/plugins/new-plugin-slug directory of the account. Finally, you will have to activate the plugin. You can do this via the WordPress Dashboard or via WP-CLI. Where to find all plugins already installed on WordPress? You can find a list of all installed plugins on your WordPress website in the WordPress Dashboard, using WP-CLI, or by checking the wp-content/plugins folder. The list of installed plugins in the WordPress Dashboard can be found within the Plugins > Installed Plugins section.Using WP-CLI, you can retrieve a list of all plugins installed on your WordPress website by following these steps: Enable SSH access for your account, and connect to it through SSH. Go to the directory where your WordPress installation resides. If you have WordPress installed on your main domain, you need to go to the ~/www/www directory of your account, and the command that you should use is:cd ~/www/www Use the following WP-CLI command to have a list of all installed plugins displayed in the command line interface:wp plugin list The last way to find a list of all plugins installed in your account is to check the contents of the wp-content/plugins/ directory of WordPress (e.g. the exact directory will be ~/www/www/wp-content/plugins if WordPress is installed on your main domain). You can use the hosting Control Panel > File Manager section or your favorite FTP/SSH client to do this. More details on how to use the File Manager or how to connect via FTP are available in the Uploading files section of our online documentation. Note: Plugins that are essential for the operation of your WordPress website (e.g. plugins that came bundled with your theme or another plugin) are known as "Must-use" plugins. It is recommended that you do not delete/deactivate these plugins as your website may stop working correctly. You can learn more about this type of plugins in the What are must-use plugins? section of this article. How to update a WordPress plugin? It is important to keep all software applications installed on your account up to date as new versions usually include performance, security, or other improvements. However, you should always keep in mind that with every update the source code of the plugin is changing, so your website may start displaying warnings, errors, or even stop working altogether due to the changes. That is why we strongly recommend that you have a backup of your working WordPress installation before applying updates, and that you check your website for issues after updating any plugins. We generate full account backups automatically twice per day and keep them for seven days, which should have you covered in most cases. To be extra safe and make sure there is minimal data loss should an update cause any problems, we would advise that you create a personal backup right before you process the update. In our Creating, downloading, and restoring from WordPress backups article, you can find instructions on how to create and restore from WordPress backups very quickly through the hosting Control Panel. With commercial or custom-built plugins, you may be required to perform manual actions to perform updates (like installing additional plugins, downloading the latest version of the plugin from the vendor's website and installing it, or making changes to your WordPress core files, theme, or other plugins). There are many commercial plugins which also support updates via the Updates section or the plugin's page within the WordPress Dashboard. For such plugins, you should refer to the vendor's manual on how to apply updates correctly. Utilizing automatic plugin updates Automatic updates are supported by a lot of WordPress plugins, which is very convenient, but it can also result in unexpected website downtime, and that is why this feature is disabled by default. Automatic updates can be enabled via the WordPress Dashboard and WP-CLI. WordPress will check for new versions of automatic updates two times per day by default. If an update is available for a plugin with enabled automatic updates, you will be able to see the time left before the plug gets updated automatically within the WordPress Dashboard > Plugins section in the Automatic Updates column. Upon completion of the automatic update, the WordPress installation will generate an email message and send it to all website owners.One way to enable the automatic updates for a plugin is through the WordPress Dashboard by following these steps: Access your WordPress Dashboard. Go to the Plugins > Installed Plugins section. Click on the "Enable auto-updates" link next to the plugin that you wish to update automatically. WordPress will try to automatically update the plugin. You can also enable automatic updates for a WordPress plugin using WP-CLI. Here is how to do it: Enable SSH access for your account, and connect to it via SSH. Once connected, go to the directory of your WordPress installation. You should go to the ~/www/www directory of your account if you have installed WordPress on your main domain. To do this, use the following command:cd ~/www/www In the directory of your WordPress directory, run the following WP-CLI command to enable automatic updates for all activated plugins:wp plugin auto-updates enable $(wp plugin list --status=active --field=name)If you wish to enable automatic updates for all plugins installed on your WordPress website, you can use the following WP-CLI command:wp plugin auto-updates enable --all --disabled-only You have successfully enabled automatic updates for your WordPress plugin/s. Updating plugins via the hosting Control Panel > WordPress Manager By opening the management page for a particular WordPress website via the hosting Control Panel > WordPress Manager, you can see if the WordPress core and plugins are running the latest available versions. If updates are available for some plugins, a link showing the exact number of outdated plugins will be listed. By clicking on the link with the number of plugins that can be updated, a table will appear showing the names of the outdated plugins and their current and latest versions. To update these plugins, just click on the Update button on the right. In case all plugins are up to date, an  (OK) icon will be displayed alongside a message that all of your plugins are running the latest available version. Note: The WordPress Manager relies on WP-CLI to determine if a newer version is available for a plugin, so the update feature may not work correctly for some commercial plugins. Updating a plugin through the WordPress Dashboard The preferred way to update plugins is through the WordPress Dashboard > Updates section: There you can find all elements of your WordPress website with pending updates. Under the Plugins section, you can select the outdated plugins that you would like to update. After that, click on the Update Plugins button:Alternatively, you can update plugins one by one from the Plugins > Installed Plugins section of the WordPress Dashboard by using the update now link within the plugin's information box: After the updates are ready, you should see a success message like the following if you used the Dashboard > Updates section:or the following message if you updated a plugin through the Plugins > Installed Plugins section: Updating a plugin with WP-CLI If you wish to update a WordPress plugin using WP-CLI, there are just a few simple steps that you need to take: Enable SSH access for your account, and establish connection to it via SSH. Once logged into your account via SSH, you need to navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you will need to navigate to the ~/www/www directory of your account by using this command:cd ~/www/www To update all plugins with pending updates, you can use this WP-CLI command:wp plugin update --allIf you wish to update only your active plugins, you can do it with the following WP-CLI command:wp plugin update $(wp plugin list --status=active --field=name)To update just a specific plugin, you will need to find its slug, which is possible by listing all outdated plugins installed on your WordPress website with this command:wp plugin list --update=available --field=nameFor example, the output from the command should look like this if there is only one outdated plugin named Elementor (with slug elementor):elementorUsing the slug of the plugin (e.g. elementor for the Elementor plugin), you can update it with the following command:wp plugin update elementorNote: Make sure to replace the elementor string from the example above with the slug of the plugin that you wish to update.If the newer version of a plugin is not available in the WordPress repository (e.g. a commercial plugin), but it was provided to you as a ZIP file from the plugin developer or vendor, you will need to upload that file to your account. Instructions on how to upload files to your account are available in the Uploading files section of our online documentation. If the newer version of the plugin is in a new_plugin.zip archive file that you have uploaded to the Private directory of the account, you can update the plugin with the following WP-CLI command:wp plugin install ~/private/new_plugin.zip --force A message should be displayed indicating the result of the update process. Updating a plugin via the File Manager or FTP To have a plugin updated through the File Manager or FTP, you should replace the directory (and files) of the outdated version of the plugin with the directory (and files) of the latest version of the plugin. This means that updating a plugin is basically identical to installing a new plugin, which is covered in the Installing a WordPress plugin by uploading it to your account and activating it section of this article. The only differences are that you will not need to activate the plugin after the update (for WP-CLI, you will have to remove the --activate string from the command), and that you will need to remove the contents of the outdated plugin from the account prior to the update or just upload the latest version of the plugin and overwrite the existing files of the outdated plugin with the files of the newer version of the plugin. How to downgrade a WordPress plugin? Using outdated software is not advisable due to performance, compatibility, and security concerns, so you should downgrade a plugin to an older version ONLY if: Your WordPress website or some of its vital functions or features stopped working after a plugin update. You have reported the problem to the vendor or developer of the software application, so they can release a new version of the plugin where the problem is addressed. You have checked all possible sources that may be able to offer a permanent or temporary solution to the problem without downgrading the plugin - the vendor/developers/community of the plugin, the WordPress forums, or other communities that could potentially have information, like WordPress Stack Exchange. If the latest version of a plugin causes only minor issues like PHP warnings in the WordPress Dashboard, you can ignore them if they do not cause any inconvenience to your website audience. If any PHP warnings, for example, are displayed on your website, you can disable the reporting of errors for PHP scripts via the hosting Control Panel > PHP Settings section. Downgrading a plugin via the WordPress Dashboard The process of downgrading a plugin via the WordPress Dashboard is almost identical to the process of Manually installing a plugin via the WordPress Dashboard described earlier in this article. The only difference is that an extra screen will be displayed with information about the current version and the uploaded older version of the plugin. To downgrade the plugin from the currently installed version to the uploaded older version, you just need to click on the Replace current with uploaded button. After the old version of the plugin is installed, you have to activate it by clicking on the Activate Plugin button. Downgrading a plugin via WP-CLI Downgrading a WordPress plugin using WP-CLI is very easy and uses the wp plugin install command. Just follow these steps: Enable SSH access for your account, and connect to it via SSH. After you log into your account via SSH, navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you will need to navigate to the ~/www/www directory of your account by using this command:cd ~/www/www Use the following WP-CLI command to downgrade a plugin (e.g. with slug elementor) to a specific version (e.g. version 3.8.1):wp plugin install elementor --version=3.8.1 --forceNote: You will need to replace the elementor string and the version number from the example above with the slug and version number of the plugin that you wish to downgrade. The --force option is mandatory as the command will return a message that the plugin is already installed without it and the downgrade will not take place. If the old version of the plugin is not available in the WordPress repository (if you have to downgrade a commercial plugin, for example), but you have obtained it as a ZIP file from the plugin developer or vendor, you will need to upload that file to your account. You can find instructions on how to upload files to your account in the Uploading files section of our online documentation. If the old version of the plugin is in an archive named old_plugin_version.zip that you have uploaded to the Private directory of the account, you can downgrade the plugin with the following WP-CLI command:wp plugin install ~/private/old_plugin_version.zip --force After the command is executed, a message indicating the result of the downgrade process will be displayed. Downgrading a plugin via the File Manager or FTP You can downgrade a plugin via the hosting Control Panel > File Manager or FTP by replacing the files of the installed plugin with the files of the older version of the plugin. To achieve this, you basically have to install the older version of the plugin, which is covered in the Installing a WordPress plugin by uploading it to your account and activating it section of this article. The only difference between downgrading a plugin and installing a new one will be that, as part of the downgrading process, you should delete or overwrite the files of the currently installed version. Since the plugin should already be activated, it will not be necessary to activate it after the downgrade. How to deactivate a WordPress plugin? We strongly recommend that you delete all deactivated plugins from your WordPress website. This is important as bad actors can use vulnerabilities of both activated and deacticated themes and plugins to abuse your website and account. You can find instructions on how to delete a plugin in the How to delete a WordPress plugin? section of this article. Important: Since some plugins modify core files or functions of WordPress, they can continue to affect your WordPress installation even after they are deactivated. For this reason, you should always try to disable all features of the plugins that you plan to deactivate within their management page inside the WordPress Dashboard before deactivating the plugins. You should also consider removing any data generated by the plugins (depending on the plugin, this could be forms, pages, contacts, etc.) within their management page within the WordPress Dashboard to have these entries removed from your database, as otherwise these entries will remain in your database forever as obsolete records. Deactivating a plugin through the WordPress Dashboard To deactivate a WordPress plugin, you can go to the Plugins > Installed Plugins section of the WordPress Dashboard and click on the Deactivate link.After that you should see a notification indicating that the plugin has been deactivated successfully. Deactivating a plugin using WP-CLI Another way to deactivate a plugin is via WP-CLI by following these steps: Enable SSH access for your account, and connect to it through SSH. Go to the directory where your WordPress installation resides. If you have WordPress installed on your main domain, you need to go to the ~/www/www directory of your account, and the command that you should use is:cd ~/www/www In case you want to deactivate just a single plugin (e.g. a plugin with slug unused_plugin_slug), you should use the WP-CLI command listed below:wp plugin deactivate old-plugin-slugIf you do not know the exact slug of a plugin, you can use the following command to retrieve a list of all plugins installed on your WordPress website:wp plugin list Deactivating all plugins via the hosting Control Panel > WordPress Manager Should you need to deactivate all plugins for your WordPress website, the fastest way to do this is via the hosting Control Panel > WordPress Manager. Detailed instructions on the process are available in our Disabling all WordPress plugins article. How to delete a WordPress plugin? If you need to delete a plugin from your WordPress website, this can be achieved in one of three ways: through the WordPress Dashboard, using WP-CLI, or by deleting the plugin's folder from your account. We strongly recommend that you delete all plugins that you do not use or do not intend to use. Important: Some plugins modify existing or add new files to your WordPress installation that are outside the plugin's folder. Some of the most commonly changed files are the .htaccess, wp-config.php, php.ini, or .user.ini files in the root WordPress folder (e.g. the ~/www/www folder of your account if WordPress is installed on your main domain). If new files are created by the plugins, they are also usually stored in the root folder of WordPress. After you delete or disable such plugins, it is possible that they will not perform a full cleanup, and the changed or created files may remain, and may cause your website to stop working at that moment or at a later stage without there being any obvious reason. It is also possible for plugins to leave obsolete records in your database after being deleted or deactivated. You should be able to find information about such issues and how to fix them in the official documentation or community forums of the specific plugin. Alternatively, you can simply disable all settings and features of the plugin as explained earlier in the How to deactivate a WordPress plugin? section of this article. Deleting a plugin through the WordPress Dashboard To delete a plugin using the WordPress Dashboard, you need to log in as an administrator to your WordPress website. After that, you should navigate to the Plugins > Installed Plugins section and click on the Delete link below the name of the plugin you wish to delete. Note: The Delete link is displayed only for deactivated plugins, so if you do not see the Delete link, you should first deactivate the plugin. A prompt will appear asking you to confirm your action. Click on the OK button, and the plugin will be deleted. Deleting a plugin using WP-CLI You can delete plugins using WP-CLI by following these simple steps: Enable SSH access for your account, and connect to it via SSH. Navigate your WordPress installation's directory. This will be the ~/www/www directory of your account if WordPress is installed on your main domain. You can navigate to this folder using this command:cd ~/www/www If you wish to delete all disabled/deactivated plugins from your WordPress website, you can use the following WP-CLI command:wp plugin delete $(wp plugin list --status=inactive --field=name)In case you want to delete just a single plugin (e.g. a plugin with slug unused_plugin_slug), you should use the WP-CLI command listed below:wp plugin delete unused_plugin_slugYou can find the slugs of the plugins installed on your WordPress website with the following WP-CLI command:wp plugin list Note: WP-CLI can be used with the --force option to delete plugins that cannot be deleted by default or for some other reason. Please use this option with care as you may potentially break your website with it. Deleting a plugin via the File Manager or FTP Important: You should use this method only if you are very familiar with the WordPress directory/file structure as deleting plugins this way is very likely to result in errors on your website or even downtime. We recommend that you create a WordPress backup of your website via the hosting Control Panel > WordPress Manager as explained our Creating, downloading, and restoring from WordPress backups article if you plan to use this method. You can delete a plugin via the hosting Control Panel > File Manager section, or via FTP by deleting its directory from the /wp-content/plugins directory of your WordPress website in the account. If WordPress is installed on the main domain of your account, you will find the plugins in the ~/www/www/wp-content/plugins directory. Go to that directory with the File Manager section or your FTP program of choice, and delete the directory. Details on how to connect to your account via FTP are available in the Uploading files section of our online documentation. After deleting a plugin this way, the first time you open the WordPress Dashboard > Plugins > Installed Plugins section a notice will be displayed indicating that the plugin files cannot be found: How to perform bulk actions with plugins? You can use the Plugins > Installed Plugins section of the WordPress Dashboard to manage all or select plugins quite easily. Just mark the checkboxes next to the plugins that you wish to manage, choose the action that you wish to perform from the Bulk actions drop-down menu, and click on the Apply button next to it. You can mark the topmost checkbox to select all plugins. The Bulk actions drop-down menu allows you to perform the following actions for the selected plugins: Activate Deactivate Update Delete Enable Auto-updates Disable Auto-updates WP-CLI can also be used to perform actions for multiple or all plugins at once. To perform actions for all installed plugins, simply add the --all option to the WP-CLI command. For example, to deactivate all installed plugins, you can execute this command:wp plugin deactivate --allTo perform an action for multiple plugins at once, you have to list the slugs of the plugins one after the other. If you wish to deactivate the Elementor plugin (with slug elementor) and the Akismet plugin (with slug akismet), you have to execute the following WP-CLI command:wp plugin deactivate elementor akismet What are must-use plugins? If one or multiple plugins are essential for the operation of a WordPress website, theme, or another plugin, it is best they be configured as must-use WordPress plugins. "Must-use" plugins are always enabled and cannot be managed via the WordPress Dashboard > Plugins > Installed Plugins section. The must-use plugins reside in a special directory (by default, the directory is wp-content/mu-plugins within the root directory of your WordPress website), and they will be displayed with Status mu-plugin in the plugin list that can be obtained with WP-CLI. The best way to update such plugins is by updating the theme or plugin they were installed with and that relies on them. Alternatively, you can manually update them via the hosting Control Panel > File Manager section or FTP, but this may cause your website to return errors or stop working correctly. Please check the official article on Must Use Plugins at WordPress.org to learn more about their benefits and specifics. Note: We recommended that you do not delete/deactivate "Must Use" plugins for your WordPress website as it may stop working correctly. How to handle issues with a WordPress plugin? A plugin that you have been using on your WordPress website can stop working partially or fully for many reasons, and it may even break your website. Most often this happens due to compatibility issues after an update of the WordPress core, the active theme, or the plugin in question. It is also possible for a plugin to stop working correctly due to compatibility issues after a new plugin is installed or another one gets updated. This is especially true after WordPress 5.6 where the automatic core updates policy has changed from performing only minor version updates to both minor and major version updates. Important: The best defense against plugin issues is to always keep the WordPress core, the active theme, and all installed plugins updated to the latest version as this is one of the main reasons newer versions are usually released. If you can determine which plugin is causing problems, you can try to deactivate it and activate it again, or you can try to re-install it to see if this will resolve the problem. More details on how to perform these actions are available in the How to deactivate a WordPress plugin?, How to delete a WordPress plugin?, and How to install and activate a WordPress plugin? sections from this article. If the issues appeared after a recent plugin update, you can downgrade the plugin to a previous version by following the steps listed in the How to downgrade a WordPress plugin? section from this article. It is not always possible to find which plugin or combination of plugins is causing problems, so you can temporarily disable all plugins using the hosting Control Panel > WordPress Manager and start enabling them one by one to find the faulty plugin/s. This solution can also be used if you are having problems accessing the WordPress Dashboard after a recent plugin update. If the problem remains after trying the aforementioned methods, you can try to restore your website from a WordPress backup or restore your website files and database from a system backup. We would strongly recommend that you create a manual WordPress backup via the hosting Control Panel > WordPress Manager just in case something else goes wrong. More information about using the backups created through the WordPress Manager are available in our Creating, downloading, and restoring from WordPress backups article. You can reach out to the community, support team, or developers of the plugin for advice on how to solve the particular problem you encounter. They should have sufficient knowledge about the plugin. You can also search for help in the WordPress community, but assistance may be limited there especially for plugin-specific issues. How to secure a WordPress plugin? Both free and commercial WordPress plugins are generally secure as their developers are informed if a vulnerability is found and reported in the WordPress community. However, it is up to the developers to release new versions of their plugins in such events. In general, it is less likely for commercial plugins to get affected as their source code is not publicly available. To ensure that your plugins are not potential security hazards for your WordPress installation and account, you should always: 1. Get your WordPress plugins from a legitimate source Free plugins are publicly available in the WordPress plugin repository, and can be downloaded and installed very easily. Commercial plugins should be purchased and downloaded ONLY from their official vendors or resellers. This way you will get the latest and non-modified versions of the plugins as intended by their authors. Many leaked or pirated versions of both free and commercial plugins can be found online, and almost always they contain malware or malicious code that allows unauthorized access to the files and databases of your website and hosting account. With such access, the bad actors can retrieve private information from your website and account for blackmailing purposes or use your website and account for other malicious intents like hosting of phishing websites, sending spam messages, or attacking/scanning remote websites and networks. 2. Regularly update and maintain your WordPress plugins The second most important measure you can take is to regularly update all plugins installed on your WordPress website. Plugin authors usually try to release new versions to introduce new features, but the most common reasons for releasing a new version are security, stability, and/or performance improvements. It is a common practice for WordPress administrators to only update the enabled plugins on their website; however, disabled plugins should also be updated regularly as the files of all installed plugins (no matter enabled or disabled) exist on the server, and they can be used as an attack vector by third parties. Detailed instructions on the process of updating your plugins are available in the How to update a WordPress plugin? section of this article.

System backups are created automatically every day for all hosting accounts and kept for at least seven days on our servers; however, we would recommend that you always create manual backups before making any major changes to your WordPress websites. The management page of a WordPress installation in the hosting Control Panel's WordPress Manager allows you to easily create, download, delete, and restore from WordPress backups via the Backup section. More details about the information and features of the section are available in our WordPress Manager article. Note: WordPress Manager will create temporary backups automatically when you perform actions through it that may cause your website to stop working correctly or at all. The automatic backups will remain on the server for seven days, and you can see when exactly they expire by clicking on the  (Warning) icon next to the backup's creation date in the management page of the WordPress installation.All backups generated from the WordPress Manager section can be found in the wp_backups directory of your account's Private directory, so they are only accessible via FTP/SSH or the hosting Control Panel > File Manager section. Creating a WordPress backup To manually create a WordPress backup, all you need to do is: Go to the hosting Control Panel's WordPress Manager section. Find the desired WordPress installation in the list, and click on the Manage button next to it. This will take you to the management page for the WordPress installation. In the Backup section, click on the Backup now button at the bottom to create a new backup. Downloading, deleting, or restoring from a WordPress backup To download, delete, or restore from a WordPress backup on your account, follow these steps: Navigate to the WordPress Manager section of the hosting Control Panel. Click on the Manage button next to the WordPress installation associated with the backup. In the Backup section, use the Download, Delete, or Restore buttons next to a specific backup to download, delete, or restore your WordPress installation from that backup. If you wish to delete all backups for the particular WordPress installation, use the Delete аll button. You can also manually download backups created through the hosting Control Panel's WordPress Manager section directly from the ~/private/wp-backups/ directory of your account. Restoring from an off-site WordPress backup If you have created a backup of a WordPress installation through WordPress Manager and have downloaded it to an off-site location, you can use that backup to restore your website. You can also copy or move WordPress installations between hosting accounts on our servers by simply downloading the backup from one account and importing it to another account. Here are the exact steps that you need to take: Go to the hosting Control Panel > WordPress Manager. Click on the Manage button for the specific WordPress installation that you would like to restore. From the WordPress management page, click on the Delete button. This step is necessary as the WordPress Manager will not allow you to import the WordPress installation from your backup to the existing WordPress installation. An automatic backup of the WordPress installation will be created before its deletion, so you will be able to restore the installation to its previous state if you encounter any issues. Open the Import tab of the WordPress Manager. Click on the input field, and select the backup file on your local computer. If the backup file size is more than 200 MB, you should upload it to the server through the hosting Control Panel > File Manager or via FTP and use the or select an uploaded file link to select the uploaded backup. Select the Site URL for your WordPress installation using the controls in the Select WordPress import destination section. A preview of the URL is shown below the options, which are as follows:Use HTTPS: Configure the site to use HTTPS instead of HTTP. This is only possible if there is a valid certificate issued for the host.Use WWW: Add the www. prefix to the WordPress address.Choose subdomain: Choose the subdomain from the list of subdomains created on the account. Select www to use your domain.Choose domain: Choose the domain from the list of parked and main domains on the account.Choose directory: Choose a directory in the selected subdomain. Leave empty for the root of the domain/subdomain. In the Select MySQL version section, choose the MySQL version that you would like to use. Click on the Import button. If the import process takes too long, it will continue to run in the background. When you use the Import tool of the WordPress Manager, it performs the following actions: Imports the files to the directory from the backup. Creates a database and database user. Imports the database structure and data. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Performs a search and replace operation in the database, replacing the address from the backup with the new address.

You can use the WordPress Manager in the hosting Control Panel to create staging sites of your WordPress installations, make and preview your changes on them, and finally, publish those changes to the main site. Creating a staging site Navigate to the hosting Control Panel's WordPress Manager. Find the WordPress site in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. Select the Site URL of the staging site using the controls under the Site URL section. A preview of the URL is shown below the controls. The controls are as follows: • Use HTTPS: Choose whether to set the site to use HTTPS instead of HTTP. This is only possible if there is a valid SSL certificate installed for the host. • Use WWW: Choose whether to add the www. prefix to the address. • Choose subdomain: Choose the subdomain from the list of the subdomains created on the account. • Choose domain: Choose the domain from the list of domains available on the account. • Choose directory: Choose a directory in the selected subdomain. Leave empty for the root of the domain/subdomain. Please note that you need to choose a location that is different from the current one. Nested WordPress installations are not supported, so you cannot have a WordPress installation in a subdirectory of another WordPress installation. Thus, you will not be able to create a staging instance in a subdirectory of the current WordPress installation. Our recommendation is to use a different subdomain. Here, we are using a subdomain named "staging" as an example. Click on the Create staging button. This will create a separate staging site at the chosen location by copying the files and folders there. It will also use a separate MySQL database and user, so you can edit the new installation without affecting the original site. The staging site will be automatically added to WordPress Manager. Publishing the staging site to the live one Open the WordPress Manager section in the hosting Control Panel. Find either the live WordPress site or the staging one and click on the corresponding Manage button. This will take you to the management page for the WordPress installation in question. Find and click on the Set as live button. If you are on the management page for the live site, you will find the button in the Staging section of the page. If you are on the management page for the staging site, you will find the button in the Staging site info section. On the next step you will be asked to choose what to do with the posts, pages, and comments on the live site, as well as the files and folders there. By default, the system will merge the staging site with the live one. You have four possible ways for setting the staging site as live depending on the options on this page: If you don't select any of the two checkboxes for deleting content from the live site.All current posts, pages, and comments on the live site will remain. All files attached to posts on the live site will remain on the file system and will be available in the WordPress Media Library. Files uploaded via the WordPress Media Library that are not attached to posts will not be available in the WordPress Media Library, but will remain on the file system. If you select only the option to Delete posts, pages, comments on live site.All current posts, pages, and comments on the live site will be deleted. All files on the live site, no matter whether they are attached to posts or not, will remain on the file system, but will not be available in the WordPress Media Library. If you select only the option to Delete all files and folders in live site's folder.All current posts, pages, and comments on the live site will remain. All files attached to posts will remain as well, but all other files will be deleted from the WordPress Media Library and from the file system. If you select both options - Delete posts, pages, comments on live site and Delete all files and folders in live site's folder.All current posts, pages, and comments on the live site will be deleted. All files will be deleted from your WordPress Media Library and from the file system.

You can use the WordPress Manager in the Control Panel to move or copy WordPress installations between directories or subdomains on the same hosting account by following the steps below: Access the hosting Control Panel. Navigate to the WordPress Manager section. Click on the Manage button next to the WordPress installation that you would like to move or copy. This will take you to the management page for the WordPress installation. Select the target subdomain and/or directory on the account. At the same time, you can optionally choose a different domain, start using HTTPS, or prefix the address with www. The Choose domain drop-down menu lists the domains associated with the account. To move the installation to the new location, click the Move button. To copy the installation to the new location, click the Copy button. Depending on the size of the WordPress installation, the process might run in the background. If the source and target directories are overlapping, you won't have the option to copy WordPress, and only the Move option will be available. When you move or copy a WordPress installation to another location, the tool performs the following actions: Copies/moves the files to the new directory. If copying, the tool creates a new database and database user. Copies/moves the data from the current database to the new one. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Performs a search and replace operation in the database, replacing the current address with the new address. The usernames and passwords for the WordPress installation will remain the same.

You can use the WordPress Manager in the hosting Control Panel to move or copy WordPress installations between different hosting accounts on our servers. The process requires that you create a backup of the original WordPress installation and import it to the account where you wish to copy or move that WordPress installation. You can refer to the respective sections about these actions in our Creating, downloading, and restoring from WordPress backups article or follow the steps below: Access the hosting Control Panel for the account with the original WordPress installation. Navigate to the WordPress Manager. Find the WordPress installation in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. Click on the Backup now button. This will generate a backup of your entire WordPress installation - the database and the files. Download the backup to your local computer by clicking on the Download button. Open the Import tab of the WordPress Manager in the Control Panel for the account where you wish to move/copy the WordPress installation. Click on the gray area to select the backup file on your local computer. If the file size is bigger than 200 MB, you need to upload it to the server via the hosting Control Panel's File Manager or with FTP first, and then select the uploaded backup using the or select an uploaded file link. Select the Site URL of the new WordPress installation using the controls in the Select WordPress import destination section. A preview of the URL is shown below the controls. The controls are as follows:Use HTTPS: Set the site to use HTTPS instead of HTTP. This is only possible if there is a valid certificate issued for the host.Use WWW: Add the www. prefix to the WordPress address.Choose subdomain: Choose the subdomain from the list of subdomains created on the account.Choose domain: Choose the domain from the list of parked and main domains on the account.Choose directory: Choose a directory in the selected subdomain. Leave empty for the root of the domain/subdomain. Select the MySQL version for the new WordPress installation from the MySQL version drop-down menu. Click on the Import button. Depending on the size of the WordPress installation, the process might run in the background. When you import WordPress from a backup, the tool performs the following actions: Imports the files to the directory. Creates a database and database user. Imports the database structure and data to the database. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Performs a search and replace operation in the database, replacing the address in the backup with the new address. The usernames and passwords for the WordPress installation will remain the same.

Server-side caching may help reduce page load times by a significant margin if configured properly. You can learn more about the server-side caching service in the General information about server-side caching article. Automatic server-side caching configuration for WordPress You can configure server-side caching for a WordPress website with just a few clicks using the hosting Control Panel: Open the WordPress Manager section of the hosting Control Panel. Navigate to the management screen of your WordPress installation by clicking on the Manage button next to the WordPress installation. Click on the Enable button next to Server-side Caching under the Tools subsection. A pop-up message will appear with information about the changes that will be made to the account and the WordPress installation to enable server-side caching - WordPress optimizations must be enabled for the WordPress installation, server-side caching must be enabled for the domain/subdomain, and the Server-Side Cache Autopurge plugin must be installed and activated for the WordPress installation.Click on the OK button to proceed. Manual server-side caching configuration for WordPress To manually configure server-side caching on a WordPress website, you need to: Configure WordPress to cache content. Choose how to clear the cache. Enable server-side caching. 1. Configure WordPress to cache content You should configure your WordPress installation to send the correct caching headers. If you have installed your WordPress instance using the WordPress Manager section of the hosting Control Panel, content caching should be already enabled for your WordPress installation. Otherwise, you can enable it by following the instructions from our Optimizing WordPress article. By optimizing your WordPress installation through the hosting Control Panel, the following line of code will be added to your .htaccess file, which will guarantee that a separate cache entry gets created for every different User Agent (browser): Header append Vary User-Agent env=!dont-vary If you don't want to have a separate cache entry for every User Agent, you should comment or remove that line from the main .htaccess file of your WordPress installation. Alternatively, you can install a plugin that allows you to set caching headers. The Cache-Control plugin has proven to work correctly on our servers. Note: We advise that you do not combine multiple tools/methods that set HTTP Cache-Control headers as this may lead to unexpected results. 2. Choose how to clear the cache You can configure WordPress to clear the server-side cache automatically whenever content is changed. All you need to do is download and activate the Server-Side Cache Autopurge plugin for your WordPress installation. The plugin works correctly out of the box, so no additional configuration is required. This plugin also allows you to purge the cache on demand via the "Purge Server-Side Cache" button at the top left side of the WordPress Dashboard, as well as via WP-CLI with the following command: wp surecache purge If you do not wish to install or use the Server-Side Cache Autopurge plugin, or you do not update content regularly, you can purge the server-side cache manually by using any of the methods listed in our Purging the server-side cache article. 3. Enable server-side caching Once you have prepared WordPress for server-side caching, you can enable the server-side caching service by navigating to the hosting Control Panel's Server-side Caching section and clicking on the Enable button next to the domain/subdomain where your WordPress is installed.

Public access to the XML-RPC file (xmlrpc.php) on our servers is blocked by default, because the file is a common target for hackers. More details are available in our Error "412 Precondition Failed" (mod_security2) article. You can now easily enable access to it by following these steps: 1. Open the WordPress Manager in the hosting Control Panel. 2. Find the WordPress installation in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. 3. Scroll down to the Security section, and locate the option called Enable access to XML-RPC. 4. Click on the Enable button next to it.This is it - you can now successfully install and use any plugin that requires access to XML-RPC.

This article will help you troubleshoot and restore your website if suddenly 404 error pages start to appear instead of your website pages. What are 404 error codes? Generally, 404 errors indicate that a requested page or resource was not found on the server. A resource can be any file, directory, image, or URL. You can read more about the different error codes in our article on Apache error codes (401, 403, 404, 412, 500). However, WordPress can sometimes display 404 errors, even if the requested page is available. This is usually caused by a configuration issue within WordPress itself.   How to fix 404 error codes in WordPress? Check your Permalinks settings If your WordPress website starts displaying a 404 error page, even if the requested page, post, or resource is available on the server, there might be a problem with your Permalinks configuration. The first thing you need to try is to log in to your WordPress Dashboard, and go to Settings > Permalinks. There, make sure the settings are set to reflect your website's desired URL structure, and hit the "Save Changes" button. Even if you don't make any changes on this page, you still need to hit the "Save Changes" button. This will re-generate your permalinks settings, and allow WordPress to access existing pages and resources again: Re-saving your Permalinks settings generally helps with most problems that might cause 404 errors. Check your plugins Sometimes, the 404 errors might be caused by a plugin conflict, or by a malfunctioning plugin. In this case, disabling all plugins on your website should help. You can disable all plugins by clicking on the Disable button next to the "Disable all plugins" option in the Tools section of your hosting Control Panel > WordPress Manager: More information on how to disable all plugins with a single click is available in our article on disabling WordPress plugins. You can then access your Dashboard and start to enable the plugins you are using one by one to identify the plugin causing the issue. Each time you enable a plugin, please refresh your website in a separate browser window to check if the 404 errors return. If the errors return, you should disable the last plugin you enabled, and contact the plugin developer to report the problem. Restore from a backup If your website was working properly and started to display 404 error codes after you made a change, you can try to restore your files and database from the system backups on the server. You need to restore from a backup created before the change that caused the problem was made. This should restore your website to its previous state. Please note that when restoring, all changes that have been made after the backup you are restoring from was created, will be lost. Instructions on how to restore can be found in our article on restoring data from the backup. Check your files and directories If you continue to experience 404 error codes when requesting a specific page or resource, you can check whether the file, directory, or resource actually exist on the server. If you are looking for a page or a post, you can check whether the item actually exists through your WordPress Dashboard. Respectively, if you are looking for a file or a directory, you can use the File Manager in the Control Panel of your account to browse your files and directories and verify the file or directory you are looking for is there.

It is possible for a WordPress website to stop working correctly after a new plugin is installed, or an existing plugin is updated. If the WordPress Dashboard remains active, you can temporarily disable or remove the problematic plugin; however, some plugins also cause the WordPress Dashboard to stop working. In such cases, you can easily disable all plugins on your WordPress website via the hosting Control Panel's WordPress Manager by following these steps: Find the WordPress installation in the list inside the WordPress Manager, and click on the Manage button for it. Under the Tools subsection, click on the Apply button next to Deactivate all plugins. This should allow you to log in your WordPress Dashboard, and resolve the problem with the misbehaving plugin. You can find step-by-step instructions on how to re-activate your plugins through the WordPress Dashboard in our Managing WordPress plugins article.

This tutorial covers the following topics: Obtaining a list of the available WP-CLI commands Updating the WordPress core Updating WordPress plugins Installing and activating/deactivating plugins Managing WordPress themes Managing WordPress users Changing the WordPress URL   WP-CLI is the command-line interface for WordPress, allowing you to manage all aspects of the application from the command prompt, without having to use a web browser. It's a very powerful tool that could help you complete complex tasks that would otherwise require additional plugins or would take much more time to accomplish. This tutorial focuses on using WP-CLI to complete typical WordPress administration tasks, such as updating themes and plugins, managing the dashboard users, and changing the site's URL settings. Note that WP-CLI is available on all servers, but it requires SSH access. Thus, you will first need to make sure that you have enabled SSH access for your account. You can do that through the "SSH Access" section of the hosting Control Panel. More information on SSH is available in the following articles from our online documentation: Enabling SSH Connecting to your account over SSH Once logged into your account over SSH, you will need to navigate to the location of your WordPress site. If you are looking to manage the site for your main domain name and you have not changed the default web root folder, you will need to run the following command: cd ~/www/www/ If your WordPress site is located in another directory, you will need to navigate to that directory instead. Now that you are in the WordPress directory, you can start executing WP-CLI commands. Obtaining a list of the available WP-CLI commands You can obtain a list of all the available WP-CLI commands by running the following wp help Updating the WordPress core You should first check the current version of your WordPress installation by running the following command: wp core version You can start the update with the following command: wp core update If there are no updates available, you will receive the following message: Success: WordPress is up to date. Updating WordPress plugins Again, you should first check the status of the installed plugins, and that's done by running: wp plugin list +---------------------+--------+-----------+---------+| name | status | update | version |+---------------------+--------+-----------+---------+| all-in-one-seo-pack | active | none | 2.9.1 || contact-form-7 | active | none | 5.0.5 || fusion-builder | active | available | 1.1.6 || fusion-core | active | available | 3.1.6 || jetpack | active | none | 6.7 || LayerSlider | active | available | 6.3.0 || revslider | active | none | 5.4.2 || the-events-calendar | active | available | 4.6.25 || wp-mail-returnpath | active | none | 1.0.3 |+---------------------+--------+-----------+---------+ We have a total of nine plugins installed in our sample WordPress project. You can see under the Status column that all of them are currently active and there are updates available for four of them. Here is how we can update one of the plugins: wp plugin update fusion-builder Enabling Maintenance mode...Downloading update from https://updates.theme-fusion.com/?avada_action=get_download&item_name=Fusion%20Builder&nonce=27c6b23b34&t=1542808142&ver=5.7.1...Unpacking the update...Installing the latest version...Removing the old version of the plugin...Plugin updated successfully.Disabling Maintenance mode...+----------------+-------------+-------------+---------+| name | old_version | new_version | status |+----------------+-------------+-------------+---------+| fusion-builder | 1.1.6 | 1.7.1 | Updated |+----------------+-------------+-------------+---------+ Installing and activating/deactivating plugins  Here are the commands for installing, activating, and deactivating plugins: wp plugin install plugin_name wp plugin activate plugin_name wp plugin deactivate plugin_name You should replace the plugin_name string with the actual name of the plugin. Deactivating plugins via the command line can be quite helpful if you have a plugin that has caused an issue with your website and yet you cannot log in at the dashboard with a browser, in order to deactivate it. In such cases, you would still be able to log into your account via SSH and deactivate the problematic plugin from the command line using WP-CLI.  Managing WordPress themes Here are the most common commands for managing the WordPress themes: wp theme list wp theme activate theme_name wp theme delete theme_name wp theme install theme_name wp theme update theme_name The first command shows you a list of the themes currently installed, and here is the output when executed in our sample installation: wp theme list +-----------------+----------+-----------+---------+| name | status | update | version |+-----------------+----------+-----------+---------+| twentyfifteen | inactive | available | 1.8 || twentyseventeen | inactive | available | 1.3 || twentysixteen | inactive | available | 1.3 |+-----------------+----------+-----------+---------+ This table shows there are three themes installed with updates available for all of them. Here is how a theme can be updated via the command line: wp theme update twentyseventeenDownloading update from https://downloads.wordpress.org/theme/twentyseventeen.1.7.zip...Unpacking the update...Installing the latest version...Removing the old version of the theme...Theme updated successfully.+-----------------+-------------+-------------+---------+| name | old_version | new_version | status |+-----------------+-------------+-------------+---------+| twentyseventeen | 1.3 | 1.7 | Updated |+-----------------+-------------+-------------+---------+Success: Updated 1 of 1 themes. Managing WordPress users You can obtain a list of the existing users with the following command: wp user list The following command can be used to change the password of a given user: wp user update USERNAME --user_pass="PASSWORD" This command is helpful if you have forgotten the password for a given user and do not have access to the email account associated with it. Here is how you can create a new dashboard user directly from the command line: wp user create USERNAME EMAIL --role=administrator You should replace the USERNAME string with the desired username and the EMAIL with his/her actual email address. The "role" field sets the role of the user to create; the possible values are: ‘administrator’, ‘editor’, ‘author’, ‘contributor’, ‘subscriber’. Here is an example: wp user create example [email protected] --role=administrator Changing the WordPress URL CMS applications like WordPress are configured to work and accept requests over a specific URL. This URL is set during the installation process. However, it's often required to change it for a number of different reasons. For example, you might have to move your WordPress installation from one subdomain or subfolder to another, or may wish to change your domain name. Another fairly common situation is whenever you wish to force HTTPS connections to your website after installing an SSL certificate. This is a fairly complex task as it requires an update of all the database entries containing the old URL to the new one. The process is much easier with the use of WP-CLI, as you just need to run the following command: wp search-replace 'http://your-old-URL.com' 'http://your-new-URL.com' --skip-columns=guid Your site should now be configured to work over the new URL. Don't hesitate to open a support ticket in case you detect any issues. Note: There may be hard-coded links to resources in your files that contain the old URL. If you notice missing images, CSS files, or any other discrepancies, you may want to check the browser's error console for specific errors. You can open the error console by clicking F12. It will help you locate files that may contain links to missing resources. You may also open a support ticket for help.

If the appearance or behavior of your site has changed, this may mean that it has been compromised. In this article, we will cover how our Incident Response Team handles such cases. We have selected a WordPress installation for this example, and while the details will be different, the logical framework of the investigation is nearly identical for all common web applications. The Incident Any WordPress installation will contain a number of standard core files in its main directory, and the same goes for all major CMS applications, so you should look for unexpected and unusual files and subdirectories in your web root directory. In this case, the user has the following two files in their WordPress installation directory:   133ja3lore.php  a1cw42ipim.php We will be using some of the standard Unix command line tools in order to gain more information about these files, and about how they originally appeared on the account. We provide SSH access out of the box, as well as full Apache access logs, so you could reproduce these steps on your own. Obtaining Timestamps The stat utility gives us a lot of information about files, and this is how its output looks like: [17:09:32] server~$ stat ~/www/www/133ja3lore.php   File: ~/www/www/133ja3lore.php   Size: 4909          Blocks: 16         IO Block: 4096   regular file Device: fc00h/64512d    Inode: 202768472   Links: 1 Access: (0664/-rw-rw-r--)  Uid: ( 4731/user)   Gid: ( 4674/user) Access: 2018-02-02 15:16:02.000000000 +0800 Modify: 2018-02-02 15:16:02.000000000 +0800 Change: 2018-08-07 20:49:47.771134758 +0800  Birth: [17:09:43] server~$ stat ~/www/www/a1cw42ipim.php   File: ~/www/www/a1cw42ipim.php   Size: 4909          Blocks: 16         IO Block: 4096   regular file Device: fc00h/64512d    Inode: 202768462   Links: 1 Access: (0664/-rw-rw-r--)  Uid: ( 4731/user)   Gid: ( 4674/user) Access: 2018-02-02 15:16:02.000000000 +0800 Modify: 2018-02-02 15:16:02.000000000 +0800 Change: 2018-08-07 19:41:46.676971426 +0800  Birth: The "~" symbol stands for "/home/$USER" where $USER is your hosting username. The main difference between the mtime (modification time) and ctime (change time) is that mtime shows the last change of the contents of the file, while ctime shows the last change of the contents of the file or of one of its attributes (such as permissions or owner). Depending on the situation, we may search our logs for the ctime attribute, the mtime attribute, or even both. In this case, we will take the ctime timestamp for further analysis, because for both files, it is the more recent attribute. We will also start by searching for the ctime timestamp we obtained from a1cw42ipim.php, because it was changed about an hour earlier than the same attribute of the other file. We will assume that it was uploaded first and should take us closer to the original Point of Entry. Log Analysis Current, real-time access logs are available from the Logs section of the Control Panel – this is helpful if the attack was very recent. In this case, the original event occurred a long time ago, so we will be using archived copies of the logs. These archives are stored in the Logs directory of the account, and can be viewed from the File Manager, via FTP, or through SSH. The archives are in the gzip format, so you can use the zgrep command to search in them. Furthermore, log archives are split into individual files, with names based on subdomain and day, so this is how a search for the timestamp obtained previously would look like: zgrep "19:41:" ~/logs/2018-08/www-07.log.gz When checking the access logs, we pay special attention to any POST requests that we discover. Unlike GET requests, where all data is encoded in the URL, POST requests include data in the body of the request. Most file uploads and setting updates use this method, and this is how malware is usually uploaded, too. The search yields the following lines of interest to our investigation: www.domain.com 192.0.2.1 - - [07/Aug/2018:19:41:44 +0800] "POST /um-api/route/um!core!Files/ajax_image_upload/a2c75736fe HTTP... www.domain.com 192.0.2.2 - - [07/Aug/2018:19:41:45 +0800] "POST /wp-content/uploads/ultimatemember/temp/Ao3uKpx8B9klgpJ6Ra7A8... You should not expect to discover the Point of Entry on the first try. The malware that we investigate may have been uploaded by another malicious file, and more often than not, the same process will have to be repeated several times before the Point of Entry can be identified. It is also entirely possible that the account was compromised on another server and was then migrated. Additionally, this process is tuned and specific for our environment. However, any respectable hosting provider should be able to provide you with the access and tools required to perform these steps. Once we have identified the original Point of Entry, we can begin working on cleaning up the account and hardening it against similar issues in the future. Unless a safe backup exists, this task can appear daunting, but it is actually pretty straightforward with a modern CMS. Finding all executable files on your account and manually reviewing them for malware (since automated scanners do not work well enough for obfuscated PHP code) can range from difficult to outright impossible. Luckily, with a modern web application such as WordPress, you can simply re-install it while preserving your uploaded files. This is the fastest and the most effective method to bringing your site back up in a clean and secure state. We use it every day on all but the most specific and niche cases. Save the wp-config.php file, your images, and your personal files The wp-config.php file contains the basic configuration for your site, including the information necessary to connect to the database server. When saving it, open it and inspect its contents for anything suspicious, like a very long first line containing unusual characters. As a rule of thumb, if your text editor has an unusually long horizontal scroll bar, the file that you are editing is likely to be compromised. If that’s the case with the wp-config.php file, copy the database connection strings to a clean wp-config.php file from a fresh WordPress archive. Your images and personal files should be stored in the wp-content/uploads directory. Ideally, there should be no PHP files at this location. Unfortunately, some plugins and themes may store some of their files in subdirectories there, making the task of correctly identifying and removing malware even harder. An easy way to list all PHP files in a given directory is to run the following command via SSH: find ~/www/www/wp-content/uploads/ -iname "*.php" If you receive no output, you can safely copy the uploads directory. Otherwise, you should review the identified PHP files manually in order to see if they were placed there by a harmless plugin, or by an attacker. Before you delete anything, you should first get a list of your active plugins. You can either do this from the WordPress Dashboard, or by typing the following command in the SSH terminal inside your WordPress directory (e.g. ~/www/www): wp plugin list --status=active This is how the command’s output may look like: +----------------------------------+----------+-----------+---------+ | name | status | update | version | +----------------------------------+----------+-----------+---------+ | classic-editor | active | none | 1.5 | | really-simple-ssl | active | none | 3.2.3 | +----------------------------------+----------+-----------+---------+ You can do the same for your active theme: wp theme list --status=active Delete the entire folder where WordPress is installed The wp-config.php file and the uploads directory are all the files that you need to preserve from your current WordPress installation, since most of your site resides in the database. In some cases, the database needs cleaning, too – but these are relatively rare, and not as trivial to secure. By now, you should also have a list of your active plugins and themes, so that you can download their latest versions from the official vendors. Upload a new clean full package of the latest WordPress version You can obtain WordPress from their official website and install it manually, or you could use our automated installer. In either case, you can now copy the previously saved wp-config.php file and the uploads directory. You can also install all plugins and themes that you had been using previously. If they are publicly available in the WordPress repository, you can do so from the terminal: wp plugin install really-simple-ssl classic-editor --activate At this point, you can test your site – ideally, it should work just like it did before the incident. In the odd chance that it does not, you should contact our Support Team. Additional precautions When a WordPress site has been compromised, we assume that the attackers know its administrative credentials. This is why you should review and update the passwords for all administrative users. You should also double-check for any unusual users created around or after the attack. We also encourage you to update your Control Panel password, as well as the passwords for all MySQL users. You should note that following a password change for your MySQL user, you should also update your wp-config.php file accordingly.

What is the WordPress cron? WordPress uses a system similar to the Unix cron that runs scheduled tasks like checking for updates, applying automatic updates, publishing scheduled posts, etc. The WordPress cron does not always run on the server like the Unix cron; it works by loading the wp-cron.php file when a visitor accesses a page of the WordPress website. What are some benefits and downsides of the WordPress cron? The default behavior of relying on visitors to access a page of a WordPress website comes with some benefits and downsides. The main benefit is that the WordPress cron will be checked regularly for jobs that should be executed if there are a lot of visitors on the website. This is crucial for high-traffic websites that rely on retrieving timely updates or data through plugins via the WordPress cron as the data presented to the website visitors will be up-to-date. This may also backfire as your WordPress cron may not run for extended periods if there are no visitors on your website for some time. The WordPress cron will run after a visitor arrives at your website; however, depending on the time it takes for the WordPress cron to finish, the visitor may see inaccurate data. It is also important to mention that multiple instances of the WordPress cron can run simultaneously when they take too long to finish, so this may additionally delay the execution of the scheduled tasks. Another big downside of the default WordPress cron execution mechanism is that it may result in an increased usage of system resources when there are a lot of visitors on the website (if your website is crawled by bots for example). Another downside is that the WordPress cron may actually increase the page loading time for your visitors and negatively impact their experience on your website. How to reduce the WordPress cron execution interval? To try and reduce the downsides of the default WordPress cron mechanism, you can add the following line to the WordPress configuration file: define( 'WP_CRON_LOCK_TIMEOUT', 3600 ); This line sets the minimum execution interval of the WordPress cron to one hour, which is usually sufficient for most websites and WordPress scheduled tasks, but still helps significantly in reducing the usage of system resources and the negative effects on your website's page load times. All WordPress applications pre-installed on the hosting account or installed through the hosting Control Panel > WordPress Manager will have this line added to the WordPress configuration file by default. How to replace the WordPress cron with a cron job? To replace the WordPress cron with a regular cron job on our servers, you need to: Disable the default WordPress cron execution for page visits. You can do this by adding the following line to your WordPress configuration (wp-config.php) file:define('DISABLE_WP_CRON', true);You can use the hosting Control Panel > File Manager section to do this. Create a wrapper script in the directory of your WordPress installation (e.g. /www/www/cron.sh if WordPress runs on your main domain) that will execute the WordPress cron. Again, you can use the hosting Control Panel > File Manager section. There are many ways you can execute the WordPress cron, so we will list only two examples - by sending a GET request to the wp-cron.php file and by using WP-CLI.To have the wrapper script run the WordPress cron by sending a GET request to the wp-cron.php file (effectively visiting it on your website), add the following code block to your wrapper script:#!/bin/bashGET "http://YOUR_DOMAIN.com/wp-cron.php" > /dev/nullMake sure you replace YOUR_DOMAIN.com with the exact domain/subdomain where your WordPress installation is running.To have the wrapper script execute the WordPress cron via WP-CLI, use this code block in your wrapper script:#!/bin/bashwp cron event run --due-now > /dev/nullIf you have the WP-CLI wrapper script outside your WordPress directory, you will need to explicitly specify the WordPress directory with the path option: #!/bin/bashwp cron event run --due-now --path /home/example/www/www > /dev/nullIn the above example, WP-CLI will run all pending cron events in the hosting account with username example for the WordPress installation of the main domain (in the ~/www/www/ directory). Navigate to the hosting Control Panel > Cron Jobs section and create a cron job that executes the wrapper script once per hour or, if necessary, more frequently based on your needs and the available cron execution intervals for your hosting plan:You may see a warning displayed for the cron job indicating that the wrapper script is missing execute permissions. To fix this, simply use the "Click here" link in the warning message: The WordPress cron will now run correctly at the specified interval to execute any pending scheduled tasks without relying on visitors to access your website and without increasing the page load time when visitors actually access and use your website.

This article will help you troubleshoot and restore your website, if suddenly blank pages start to appear, instead of your website pages.   What causes the white screen of death error? Most of the time, these errors are caused by plugin or theme conflicts. This usually happens when a plugin or a theme gets updated, or a new plugin or theme is being installed and activated. These errors are frustrating, because they contain no information on what the problem might be.   How to troubleshoot the white screen of death in WordPress? Here are the most common methods to troubleshoot a white screen of death in WordPress.   Enable debug mode To set up an error message with useful information to appear on the screen instead of a blank page, you need to enable debug mode in WordPress. To do this, open the WordPress Manager in the Control Panel of the account, and locate the Debugging section on your website's management page. There, check the box next to the WP_DEBUG option and click Save.   You can also manually enable debug mode by editing your website's wp-config.php file. To do this, open the File Manager in your Control Panel and locate your wp-config.php file. The file is located in your WordPress installation directory. Click on the file to open it for editing and find the line that reads: /* That's all, stop editing! Happy publishing. */ Place the following code above that line: define( 'WP_DEBUG', true); Hit the "Save" button to save the file.   Look for error messages You can now reload your website and look for an error message that will provide information on why the page is unable to load. You can check if the error message lists a directory of a plugin or a theme installed on your website. Plugins are located in the wp-content/plugins directory, while themes are located in the wp-content/themes directory in your WordPress installation directory. If a file in such a directory is listed in the error message, you should deactivate the plugin or theme in question, and contact its vendor to report the problem.    Deactivate all plugins Sometimes, the White screen of death error does not even allow you to load the WordPress login page and log in to your Dashboard. In this case, disabling all plugins on your website usually helps. You can deactivate all plugins by clicking on the Disable button next to the "Disable all plugins" option in the Tools section of the WordPress Manager in the hosting Control Panel: You can also manually disable all plugins by renaming the plugins directory. You can browse your account's files with the File Manager in the Control Panel of your account, and locate the wp-content/plugins directory. There, click on the  ("Rename") button next to the plugins directory name to rename it.  Renaming this directory will also deactivate all plugins:   Detailed instructions on how to deactivate all plugins with a single click are available in our Disabling all WordPress plugins article. Once you obtain access to your Dashboard, you can start to activate the plugins you are using one by one to identify the plugin that is causing the error. After each activated plugin, refresh your website in a separate browser window to check if the error returns. If the error returns, you should deactivate the last plugin you activated, and contact the plugin developer to report the problem.   Set the default theme The White Screen of Death error can also be caused by a malfunctioning theme. This can be mitigated by reverting your website to the default WordPress theme. You can revert to the default WordPress theme by renaming the directory of your current theme. This can be done through the File Manager in the Control Panel of your account. Navigate to the wp-content/themes directory of your WordPress website, and click on the  ("Rename") button next to the name of the directory that contains your current theme to rename the directory:  If a problem with your theme is causing the White Screen of Death, this should allow you to view your website again, and log in to your Dashboard. You should then contact the theme vendor and report the problem.   Check the PHP version of your website It is possible that the current version of PHP you are running is not compatible with your version of WordPress, a plugin, or a theme. This might lead to the White Screen of Death. To change the PHP version for your WordPress website, go to your website's management page in the WordPress Manager. There, scroll down to the Tools section, and look for the PHP Version option. To change it, click on the Manage button next to the version: You can manage the PHP version of your website on the next page. Detailed instructions are available in our PHP Settings article. If there is a conflict with your PHP version, your website should start loading again once the PHP version has been changed. Don't forget to refresh your website after every change to the PHP version you make.   Check the memory limit settings White Screen of Death errors can be caused by insufficient memory as well. The default memory limits on our servers are very generous, so it is unlikely that the default limit is being hit. To check for any additional memory limits imposed on WordPress, use the File Manager in the Control Panel of your account to locate your wp-config.php file. Click on the file to open it for editing, and search for any line that reads: define('WP_MEMORY_LIMIT', '256M'); Regardless of the memory limit defined on such lines, just delete or comment the entire line. This should make WordPress use the memory limit set by the PHP configuration on your account.  The next step is to check if a custom limit is applied for your account. To check the PHP configuration for your WordPress website, go to your website's management page in the WordPress Manager. There, scroll down to the Tools section and look for the PHP Version option. Click on the Manage button next to the version, and you will be taken to the PHP Settings page in the Control Panel. There, click on the Manage button next to the subdomain where your WordPress website is located: Once you are on the management page, click on the "Restore to default" button: This should restore the default settings, allowing WordPress to have sufficient memory to run. Detailed instructions on how to manage the PHP settings on your account are available in the PHP Settings article.   Restore from a backup If you made a change to your website and got the White Screen of Death, you can try to restore your files and database to bring the website back to its working state. You can restore from the system backups on the server. Instructions on how to restore can be found in our article on restoring data from the backup.

You can view a full list of the WordPress administrators on your websites, change their passwords, and also log in with their username via the WordPress Manager in the hosting Control Panel. To use these features and view this information, click on Manage button next to the WordPress installation in the list inside the WordPress Manager. Under the WordPress administrators subsection, you will see a list of all the administrators on your WordPress website showing their respective login usernames, display names, and email addresses. Next to each administrator, you will find two buttons - Log in and Password. The Log in button allows you to log into the WordPress Dashboard as that user, and the Password button allows you to change the password for that user. General advice on how to choose a strong password and secure it can be found in our Password tips article.

WordPress comes with multiple integrated debugging tools which can be used for troubleshooting issues, warnings, and errors on your WordPress website. Here are the exact tools available within WordPress that you can use for debugging various problems: WP_DEBUG, WP_DEBUG_DISPLAY, and WP_DEBUG_LOG - Enabling debug mode for WordPress (WP_DEBUG) will output PHP errors, warnings, notices, and deprecated functions and arguments. To control how the debug information will be presented, you need to use the additional WP_DEBUG_DISPLAY and WP_DEBUG_LOG options which will essentially display the debug information to the HTML part of your WordPress pages or store it to a log file. We advise that you do not enable debug mode with the WP_DEBUG_DISPLAY option on a live website as PHP notices, warnings, and errors may be displayed on the website to all visitors. This may allow bad actors to gather sensitive information or exploitable files in the WordPress installation. Using a staging instance is the recommended way to debug any issues with your WordPress installation. For more information on WordPress staging websites, please refer to our Creating and using WordPress staging sites article. SCRIPT_DEBUG - The SCRIPT_DEBUG option should be used if you are making changes to any built-in .js or .css files. It forces WordPress to use the development versions of core CSS and JavaScript files instead of the normally-loaded minified versions. SAVEQUERIES - This option allows you to store all database queries to an array which can be displayed for analysis. Additionally, you will be able to see the time it took for the query to fully execute and the function that called it. The query information will be stored as an array in the $wpdb->queries global object. To view how to get this information displayed on your website, please check the Viewing MySQL queries from the SAVEQUERIES debug tool section of this article. We would recommend that you enable this feature only during the debugging process, and turn it off once ready, because it will decrease the performance of your website. These debugging tools can be enabled by: utilizing the hosting Control Panel > WordPress Manager to enable/disable them via an intuitive-to-use interface using WP-CLI commands editing the WordPress configuration file (wp-config.php) via the hosting Control Panel > File Manager section There are also a lot of plugins available that can help you troubleshoot issues with your WordPress website. The most popular plugin for debugging a WordPress website is Query Monitor, which allows you to view various types of information about your WordPress installation like requests, scripts, and even queries. Some additional information about debugging WordPress and dealing with the most common WordPress errors is available in our Fixing 404 error codes in WordPress and Fixing a WordPress blank page error (White Screen of Death) articles. Enabling Debug mode for WordPress via the hosting Control Panel > WordPress Manager The easiest way to control the WordPress debug tools is by opening the management page for your WordPress installation via the hosting Control Panel > WordPress Manager and navigating to the Debugging section. Once there, select the checkboxes for the debug tools that you wish to use, and press the Save button. Note: When you enable the WP_DEBUG option via the hosting Control Panel > WordPress Manager, the WP_DEBUG_DISPLAY option will be automatically enabled as well, so you can easily view the debug information in the HTML content of your website. Enabling Debug mode for WordPress using WP-CLI You can also manage the debugging tools for your WordPress installation using the Command Line Interface for WordPress (WP-CLI). WP-CLI is supported by default for all hosting accounts on our servers. You can find additional information about WP-CLI in our WP-CLI Tutorial. Controlling the debug tools for a WordPress installation is very easy with WP-CLI. All you need to do is follow these steps: Enable SSH access for your account, and connect to it via SSH. Once you connect to your account via SSH, navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you should navigate to the ~/www/www directory of your account with the following command:cd ~/www/www The debug tools are managed via the wp config set command which allows you to modify the WordPress configuration file. Depending on the debug tool that you wish to enable, you will need to use different options for the WP-CLI command:To enable the WP_DEBUG tool, you should execute this WP-CLI command:wp config set --raw WP_DEBUG trueAfter you enable the WP_DEBUG tool, you need to decide how you wish to have the debug information provided to you. If you wish to view the information in the HTML part of your WordPress pages, use this command:wp config set --raw WP_DEBUG_DISPLAY trueIf you wish to have the debug information stored in a log file within your WordPress installation (debug.log in the wp-content directory), run this command:wp config set --raw WP_DEBUG_LOG trueYou can also store the debug information to a custom file on your account (e.g. ~/private/debug.log) using the following WP-CLI command:wp config set WP_DEBUG_LOG "/home/$USER/private/debug.log"To enable the SCRIPT_DEBUG and SAVEQUERIES tools for your WordPress installation, you can run these commands:wp config set SCRIPT_DEBUG --raw truewp config set SAVEQUERIES --raw trueIf you wish to deactivate a specific debug tool for your WordPress installation, you can use the WP-CLI command for enabling that feature, but the value should be replaced from true to false. Enabling Debug mode for WordPress by editing the WordPress configuration file (wp-config.php) The last method for managing the various debug options of WordPress is by manually editing the WordPress configuration file (wp-config.php). You can do this quickly via the hosting Control Panel > File Manager section by following these steps: Navigate to the directory of your WordPress installation. If your WordPress installation runs on the main domain for your account, you will need to navigate to the ~/www/www directory. Click on the name of the wp-config.php file or the  (Edit) button next to the file to edit it. The Edit file page for the wp-config.php file will open up. You will need to add a specific line of code for every debug tool that you wish to enable. It is important that you add the new lines before the following line within the wp-config.php or the debug tools will not be enabled correctly:/* That's all, stop editing! Happy publishing. */Note: If a specific debug feature is already defined in your WordPress configuration file, you should only modify its value (e.g. from false to true) instead of adding a new line for it.To enable debug mode for WordPress, you need to add this line of code to your wp-config.php file:define( 'WP_DEBUG', true );To have the debug details displayed on your WordPress pages within the HTML part, add this line of code to your WordPress configuration file:define( 'WP_DEBUG_DISPLAY', true );If you want to have the debug details stored in a log file (e.g. debug.log within your WordPress installation's wp-content directory), add this line:define( 'WP_DEBUG_LOG', true );In case you wish to use a custom log file (e.g. а debug.log file within the Private directory of your account), you should insert this line of code to your wp-config.php file:define( 'WP_DEBUG_LOG', '/home/USERNAME/private/debug.log' );Note: You will need to replace USERNAME with your hosting account username.To enable the SCRIPT_DEBUG tool, you have to add this line to your WordPress configuration file:define( 'SCRIPT_DEBUG', true );You will need to add this line if you want to enable the SAVEQUERIES WordPress debug tool:define( 'SAVEQUERIES', true );Should you want to disable a given debug tool that is already enabled for your WordPress installation, you just have to set its value to false without quotes. Viewing MySQL queries from the SAVEQUERIES debug tool Once you have enabled the SAVEQUERIES debug tool in WordPress, you will need to use the $wpdb->queries global object to actually see the queries. The simplest way to do this is by adding the following code block to the footer PHP file of your theme (e.g. ~/www/www/wp-content/themes/twentytwentythree/patterns/footer-default.php if you use the Twenty Twenty-Three WordPress theme):<?phpif ( current_user_can( 'administrator' ) ) {    global $wpdb;    echo "<pre>";    print_r( $wpdb->queries );    echo "</pre>";}?>The code block will get the SAVEQUERIES debug information printed to all users with administrator access. You can add the code block right before the closing paragraph tag (</p>) using the hosting Control Panel > File Manager section.

What is the WordPress maintenance mode? The WordPress maintenance mode allows you to temporarily show a maintenance page to your website visitors. This is helpful if you need to make changes, fix problems, or install/update new plugins or themes on your WordPress website. When you enable the maintenance mode for WordPress, your website visitors will see a message (or a custom page) informing them that the website is undergoing maintenance. What are the differences between the default WordPress maintenance mode and the maintenance mode of a plugin/theme? The default WordPress maintenance mode is enabled by adding a .maintenance file to the root folder of your WordPress installation. WordPress enables maintenance mode during core, plugin, and theme updates/installations. While the default maintenance mode is enabled for the website, all public access to it will be blocked - none of your posts/pages will be visible, and the WordPress Dashboard will not be accessible. Maintenance mode causes the website to return a 503 error, which informs search engines that the website is down only temporarily. The WordPress maintenance mode will be automatically deactivated 10 minutes after it has been enabled. This helps prevent unnecessary downtime of websites after a failed update, for example. There are many WordPress maintenance plugins and themes available that provide an easy way to enable maintenance mode and set a custom maintenance page. They may offer various features, like countdown timers, email notifications, and customizable pages, allowing you to personalize your website's maintenance page to your liking. Note: When updating the core, plugins, or themes, WordPress should automatically enable its maintenance mode. Once the update process completes, maintenance mode should be automatically disabled by WordPress. Even if you manually enable maintenance mode using this tool, when the core, plugins, or themes get updated, WordPress should automatically disable maintenance mode. If you use a maintenance plugin/feature, you may still be able to access the WordPress Dashboard. This will allow you to make changes to the website (like install new plugins/themes, apply updates, or perform any other tasks) without affecting the visitor's experience. Once you complete the maintenance tasks, you can disable maintenance mode, and the website will be accessible to visitors again. In general, the differences are that the default WordPress maintenance mode limits public access to the website, while with a maintenance plugin/feature, you get better control over what gets disabled and what information is provided to your website visitors. Enabling/disabling the WordPress maintenance mode via the hosting Control Panel > WordPress Manager The hosting Control Panel > WordPress Manager provides easy control over the WordPress maintenance mode. To enable/disable the WordPress maintenance mode for your website, you need to access the management page of your WordPress installation via the hosting Control Panel > WordPress Manager, and simply click on the Enable or Disable button next to the Maintenance mode tool. If you use this Maintenance mode tool instead of manually adding a .maintenance file to your WordPress directory, the WordPress maintenance mode will last until you disable the maintenance mode (manually or after a plugin or a theme is installed or updated), and access to the WordPress Dashboard will be available.

WordPress has a feature which informs search engines and crawling bots that the website should not be indexed or crawled. When it is enabled, the "noindex, nofollow" meta tags will be added to your website header, and the sitemap will be removed from the virtual robots.txt file of WordPress. Additional details about the changes applied with this feature are available at the official WordPress documentation. The discouraging of search engine indexing is mostly used for test, staging, and private WordPress installations. Note: It is up to the search engines or web crawlers to honor such requests, so this solution may prove to be ineffective in certain scenarios. If you wish to restrict public access to your WordPress website, you can enable password protection for the website, so only authorized parties will have access to it. For more details, please refer to the Password protection section from our online documentation. Enabling this feature after your WordPress website has been indexed will not get the indexing for your website removed. You will need to send a request to the search engine or crawler to remove the indexing. The feature that allows you to advise search engines and crawling bots to ignore your WordPress website can be managed from the WordPress Dashboard, through the hosting Control Panel > WordPress Manager, and via WP-CLI. Request search engines to not index the website via the WordPress Dashboard To request search engines to not index your website via the WordPress Dashboard, you need to log into your WordPress website as an administrator and navigate to the Settings > Readings section. Under the Search engine visibility option, select the checkbox next to Discourage search engines from indexing this site, and press the Save Changes button. Discouraging search engines from indexing or crawling WordPress via the hosting Control Panel > WordPress Manager You can enable the Discourage search engines from indexing this site option for your WordPress website very easily through the hosting Control Panel. All you need to do is open the management page for your WordPress installation through the hosting Control Panel > WordPress Manager and click on the Enable button next to Discourage search engine indexing from the Tools section. Enable the Discourage search engine indexing option for WordPress via WP-CLI To send information to search engines or crawlers that your WordPress website should not be indexed via WP-CLI (the command-line interface for the management of WordPress websites), you need to enable SSH access for your account. After that, connect to it through SSH, and navigate to the directory of your WordPress installation. For example, you will need to go to the ~/www/www directory of your account if WordPress is installed on your main domain. The exact command to do that is:cd ~/www/wwwTo enable the Discourage search engine indexing option for your WordPress blog, use this WP-CLI command: wp option set blog_public 0