WordPress speed optimization: 6 trics for a speedy website

/in , , /by

WordPress speed optimization is a must for any website owner or marketer. If your WordPress website does not load fast enough, visitors will leave as quickly as they came in. Concretely speaking, this means that your website should load within 2 seconds. We can already hear you thinking, “really, that fast?”. Yes, the attention span of the modern internet user is short. Very short. 

Also for search engines like Google a fast website is an important parameter for a seamless user experience. If your website does not meet the speed requirements then it is more likely to rank lower in the search engines. A lower ranking means less traffic. And less traffic means, you guessed it, less sales. 

Fortunately, there are several techniques you can employ to optimize your WordPress website speed. This article lists and describes these tricks so you can get started right after! We also tell you our three favorite WordPress plugins for speed optimization. 

How fast is your WordPress website? 

Before we present the best practices of WordPress speed optimization, it might be nice to know how fast your WordPress is. This is easy to test by using some speed/user experience tools. 

There are several free tools you can use to get an indication of your website speed. The ones we often use ourselves are: Google pagespeed Insights, GTmetrix and Pindom. 

All these tools do essentially the same thing: they give you the status quo of your website speed and tips on how to improve it. It is wise to run these tests on multiple devices because the scores are influenced by your physical location and speed of your internet connection, among other things. 

Other factors that influence the tests are:

  • The size of a specific page;
  • How many requests the page generates at a given time;
  • Whether the page is cached or not;
  • And finally, what kind of content (static or dynamic) the page contains.

Often the homepage of a website is used to benchmark speed, as this is usually the largest and heaviest page. In the example below, where the tool Google Pagespeed Insights is used, this is also the case. 

wordpress speed optimization

This custom made WordPress website passed with flying colors. But how does this score come to be so positive? We will answer that question in the next section. 

What factors can optimize the speed of your WordPress website? 

Now it’s time to tell you how to boost your WordPress website speed: 

WordPress speed optimization trick 1: pick a fast and solid WordPress hoster

WordPress Hosting has a big impact on how fast your website is. If your website is running on a server that is slow to respond, then there is little point in starting to optimize your website. That’s why hosting is also seen as the foundation for WordPress speed optimization 

If you choose a fast WordPress hosting, your website will have more hosting capacity and you will notice that almost immediately in the loading time. Two hosters we have very positive experiences with are Kinsta and SiteGround. Both are very good and score excellent on speed, support and security.

WordPress speed optimization trick 2: use a lightweight WordPress theme

WordPress themes with lots of dynamic elements like sliders, widgets, moving icons are attractive to the eye. But remember this: too much of a good thing will drastically lower your website speed. Therefore, it is wise to use a lightweight theme.

The only problem is that there are thousands of WordPress themes to choose from. So When picking a theme, you can look out for the following to seperate the wheat from the chaff: 

  • The number of downloads
  • Positive reviews (extra tip: read reviews through to the end)
  • No superfluous functionalities and a compact code
  • Relevance (is the theme still updated?) and support (do they have a ticket system and/or a helpdesk)

We recommend the themes Astra and OceanWP. Both are outstanding lightwieght WordPress themes and very user friendly. 

If you don’t want to change from theme, use a plugin like WProcket that optimizes your website codes.

WordPress speed optimization trick 3: resize images

Most websites are full of images. This often also means that images are the cause of a significant portion of the loading time. Therefore, we recommend testing the loading time of your website thoroughly and to reduce the size of unnecessarily large images to the actual size. 

WordPress already helps by saving each image you upload in different formats. You can further reduce and scale images in the WordPress media library, but also – if you are handy – on your own computer before uploading. You can use any image editor that exists; from Photoshop to Paint.

When you have set the format of your images correctly, there is a second optimization possible for the loading time of your images: compression. This means that the images are “packed” as best as possible into small packages, without losing too much quality. In this way you can quickly save several megabytes on dozens of images.

Fortunately, it is possible to use plugins that compress images for you. Two plugins that we definitely would recommend: WPsmush and Imagify.

WordPress speed optimization trick 4: loading static content externally with a CDN

Normally, images and scripts are loaded from your own server. A Content Delivery Network (CDN) is an external hosting party that copies and offers all your static content (images, PDFs, videos, but also scripts that rarely change). 

When a visitor visits your website, the dynamic content (the code of your website that changes per request) is still delivered by your own server, but all static content can be retrieved from somewhere else.

Because the requests of a visitor are spread over two servers, the load per server is lightened and a request can be handled faster. This improves your website speed. Cloudflare is an excellent CDN and is among one of the most popular in the world.

WordPress speed optimization trick 5: use caching

A cache makes your website faster by preventing the web server from having to load the same page over and over again. The website will load faster on your next visit because the browser has already saved it, so to speak. It is very easy to set up caching. If you have a WordPress website, you can do this using the plugins WP Rocket and W3 Total Cache.

WordPress speed optimization trick 6: website maintenance

The final point for website speed optimization is maintaining your WordPress environment. Many website owners neglect this task which makes their website slower and sometimes even let it crash. Therefore, always make sure that your theme, plugins, WordPress and PHP version are up to date. Also try to remove all plugins you no longer use, they take up unnecessary space and slow down your website speed.

Our top 3 plugins for WordPress speed optimization

To conclude this article, we finally present three more plugins that can help you make your website faster. These plugins have already been briefly mentioned above, but we’d like to pay a little extra attention to them.

WProcket 

WProcket is an all-in-one tool for optimizing the speed of your WordPress website. With this plugin you can not only combine and compress scripts, but also empty your cache. It can also help you remove and/or move render blocking resources. You do have to pay for this plugin, but it is certainly worth the investment if you are looking for a quick way to boost your website speed.

Cloudflare

Cloudflare is a CDN that makes your website faster and more secure. CloudFlare does this by capturing all your website traffic on their own faster servers. Indirectly, they get all the necessary information from your website. This way, your own server is protected from overloading. 

Some hosters like Kinsta already have a standard integration with Cloudflare, so always check this before downloading the plugin. 

WP Smush 

WP Smush is a best-of-class plugin for optimizing images. With this plugin you can compress and optimize images without losing quality. Hence, very useful if you want your website to be fast but at the same time look attractive. WP Smush also allows you to ‘lazy load’ images that are out of focus when opening the page. You can also optimize 50 images with just one click of a button. 

WP Smush has a free and a paid version. The free version will get you a long way but if you are looking for something more serious like image backups, image optimization above 5MB and optimization of more than 50 images then it is a good idea to upgrade to the premium version. 

WP Upgrader launches GDPR Consent Plugin for WordPress

/in , , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-nrzf6b’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

With the General Data Protection Regulation (GDPR) about to be enforced, many website owners are also challenged: How do you make sure your website is compliant with these new rules? We have already discussed how you can make your website GDPR-proof with diverse WordPress plugins. Still, we kept missing one crucial plugin.

In order to meet the new, ‘privacy by default’ rule, WordPress plugins are only allowed to gather user data after your visitors have given you permission to do so. In other words, your website has to be accessible without personal data being gathered by default. The easiest solution for this — a cookie wall for your entire site — will no longer be allowed. So, how do you activate these WordPress plugins after your visitors have given their explicit consent?

GDPR Consent Plugin (€ 39/year)

For WordPress websites in Europe, WP Upgrader introduces the GDPR Consent Plugin: a plugin for WordPress that allows you to ask your customers’ permission before other WordPress plugins (and scripts) start gathering personal data. This way, you stop your site from gathering personal information before visitors actually allow you to do this.

How does the GDPR Consent Plugin work?

Step 1:
After having purchased the GDPR Consent Plugin, you have to determine which sections of your WordPress website gather personal data. Think in terms of plugins, but perhaps it may also apply to several scripts in your footer and/or header. You can sort this out by making use of the free GDPR-checklist for your WordPress website.
Personal data that is gathered, can be categorize in separate permission groups, such as ‘Statistics’, ‘Adverts’, and ‘Functional’. Inform yourself of the types of permission groups below this article.

Step 2:
Place the [gdpr_consent_settings] shortcode on the page where your visitors are allowed to edit their privacy settings. Then, activate the ‘Consent Bar’.

Step 3:
From this point onward, visitors will be shown a slim bar at the bottom of their screen upon their first visit informing them of their rights. On the privacy settings page they can now indicate whether or not they want to allow additional data to be gathered. For instance, to receive customized advertisements. Only when they give permission, will these plugins be activated for this particular visitor.


[/av_textblock]

Tip

View the demo here: demo.wpupgrader.com

Does this make my WordPress website GDPR-proof?

The GDPR Consent Plugin is a tool to assist you in making your WordPress website GDPR-proof. This doesn’t mean that, by simply installing the plugin, your website will be automatically compliant.

Inform yourself on the impact of the GDPR on your WordPress website to get an impression of the additional aspects you have to take into account. Consider a solid privacy-statement on your website, ‘I agree’-tick boxes for contact forms, and a handling agreement with your hosting and administrative party. Also, take note that the GDPR will impact your entire organisation (for instance due to the right to have data erased from all records in your organization). Logically, such things are not solved by merely building a plugin into your website.

What kind of permission groups are there?

Common permission groups (‘Consents’) are groups such as ‘Functional’, ‘Statistics’, ‘Social media’, ‘Adverts’ and ‘Remarketing’. Certain organizations may set up specific labels for themselves. NPO.nl, for instance, makes a separate request for allowing ‘NPO Recommendations’.

You can define your own permission groups (‘Consents’) within the GDPR Consent Plugin. Some WordPress websites will use a Facebook pixel, remarketing plugins, etc., and then list them all under the ‘Adverts’ group. Others may prefer to split these into separate groups, like ‘Adverts’ and ‘Remarketing’.

Whatever your approach, it is important that you define your permission groups in such a way that visitors are not forced to activate plugins they do not necessarily need. Should a visitor agree to becoming part of statistics, for example, then this does not give you free range to automatically place cookies for social media sharing.

Celebrate consent!

Few visitors will explicitly give their consent to flooding them with ‘Adverts’ and ‘Remarketing’. This is why you will have to thoroughly explain what the added benefits are for doing just that. Terms like ‘Functional’, ‘Statistics’, ‘Social media’, ‘Adverts’, and ‘Remarketing’ are very technical in nature.

However, instead of having visitors mark the ‘Adverts’ and/or ‘Remarketing’ tick boxes, you can approach things from an entirely different perspective. Once you explain to them that you can optimally facilitate special offers, you may find the ones that do give permission, to be a smaller, but more committed target audience for your organization.

The Impact of the New Privacy Law (GDPR) on Your WordPress Website

/in , , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

As from the 25th of May, 2018, the new privacy law (GDPR) comes into force. From then onward, all of Europe will have to abide by the same privacy regulations. The Dutch Wbp will be suspended and replaced by new regulations for processing and editing personal data. These new rules apply to your WordPress website too should you have a contact form, make use of Google Analytics, or have a webshop. In this article we explain how the new privacy law operates and what applies to your WordPress website and, therefore, deserves your attention.

This is no juridical article and no rights can be derived from its content.

Moving from a user agreement to a handling agreement

The former privacy law already required a secure processing of personal data, which was to be defined in a user agreement. The new law requires every European organization to be able to account for a secure handling of all personal data, which is to be recorded in a handling agreement. This means that you, first of all, need to know exactly what kind of personal data your organization gathers.

Secondly, you need to be able to guarantee that personal data you share with third parties, is also protected; such as personal data you share with your accountant, with your CRM or within your email marketing software. This applies to software of non-European origin as well (e.g. software supplied by American companies). You are obligated to make agreements with all your suppliers. Practically, this means the GDPR has an impact on privacy policies of organizations worldwide.

You also need to make agreements with third parties that have access to your WordPress website; like your hosting party, editors, administrators and parties that can access personal data via a plugin.

What is personal data?

What is considered to be personal data? And, when is this data deemed privacy-sensitive? Basically, all data that can identify a person as an individual. For instance, when someone fills in a contact form on your WordPress website. Data like,

  • name
  • postal address
  • email address
  • location data (e.g. GPS coordinates)
  • IP-addresses

Keep in mind that company information (e.g. the name of an organization, email address, postal address, etc.) is not considered personal data.

When is personal data regarded as extremely privacy-sensitive?

On top of ‘standard’ personal data, there is an additional category: ‘privacy-sensitive’ personal data. Should you handle data within your organization that is categorized as such, then there are additional requirements. These requirements also apply to your WordPress website, when you gather data that involves,

  • Social Security Number
  • Race
  • Medical information
  • Sexual orientation
  • Religious / political preference

What rights do consumers have?

As mentioned before, the goal of the new privacy law (GDPR) is to protect the rights of the end user (consumer). This includes visitors of your WordPress website. But what exactly are their rights, and what can they demand from you as an organization?

Inform, permit and refuse

People have the right to be informed before their data is being gathered, edited and processed by your WordPress website. Users must give their explicit consent to this, too. This means providing a cookie announcement in the footer of your website, giving the option to sign up for a new letter via a tick box (that is not checked by default!). Ultimately, users must be given the option to withdraw their permission at any time, for instance by unregistering or reviewing the cookie settings again.

Easy access

Individuals you have gathered personal data from on your WordPress website, are allowed to request this data from you. Organizations have to deliver this data within a month and are, in principle, not entitled to charge any costs. In addition, there is the data portability right: personal data must be able to be inspected in a reasonable manner. Excel sheets or CSV files are relatively easy to open, but a direct database dump is not.

Edit, limit and remove

Consumers are entitled to ask you to rectify faulty information, as well as request to refrain from further editing of personal data (apart from storing it). Also, every person has ‘the right to be forgotten’. Put differently, upon request you will have to be able to remove people’s data completely.

The GDPR and marketing automation

Quite possibly, you make use of marketing automation in your WordPress website. This may consist of email marketing software reminding you to respond to a comment, or to send a follow up mail once the first email has been viewed. Or perhaps adverts that are shown based on customer behavior.

People have the right to demand from you that your software cannot make automated decisions based on their data and/or behavior, unless you have explicitly have asked their permission. Therefore, in case you use marketing automation, make sure you explicitly ask your visitors permission, as well as inform them that automated decisions are made based on their personal data.

How serious is all this GDPR stuff?

The penalties that can be imposed by this law are considerable. That is, fines can run up to € 20 million or up to 4% of the annual revenue. The provided ‘grace period’ that lasts until May 2018, foretells that the GDPR will be seriously upheld. Moreover, the GDPR is applies to every organization within Europe; not only the bigger ones or the multinationals.

Make sure your WordPress website is GDPR compliant

There are many aspects to take into account in order to make sure your WordPress website complies with the new GDPR regulations. Make sure you do a Checklist: Is Your WordPress website GDPR Compliant?

Checklist: Is Your WordPress Website GDPR Compliant?

/in , , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

By May 25, 2018, every European organization has to comply with a new privacy law to be allowed to process and handle personal data. This applies to the personal data you gather via your WordPress website as well. We already posted an article on the impact the General Data Protection Regulation (GDPR) has on your WordPress website. In this article, we provide you with a clear-cut checklist to help you determine whether your WordPress website meets the GDPR requirements.

This is no juridical article and no rights can be derived from its content.

1. Inventory and document

To start off, describe the target group(s) that visit your website. Then make up a spreadsheet in which you document the kind of personal data your WordPress website collects for each group (inform yourself here on what the GDPR marks as personal data). As you specify per target group, you’ll reduce the risk of missing something. Complete this inventory by checking the following list:

a. Hosting & Administration

External service providers have access to your website as well. Check how they handle your data and if you have made the right agreements with them.

  • Hosting Party
    • Theoretically, your hosting party has access to all data on your website. For this reason, you will have to make a processing agreement with your WordPress hosting party.
  • Managed hosting, external developers and administrators
    • Which administrators have access to your WordPress website? Should you contract certain bureaus (or freelancers) to work on your WordPress website, then you will have to set up processing agreements with them as well.
  • Backup Locations
    • Where and how does your hosting party make backups?

b. Plugins

Log in as administrator on your WordPress website and answer the following questions to complete the list above. In WordPress, go to ‘Plugins’, then locate what data is being collected by each plugin and determine whether this data is being stored or not:

  • Contact forms (e.g. Gravity Forms)
    • What information do you require from your users? And where is it being stored?
  • Usernet plugins (e.g. Ultimate Member, BuddyPress, etc.)
    • What profile information is stored for each user? And, what else can possibly be deduced about your users through membership? Think in terms of political activity, religious preference, financial status, or sexual orientation.
  • E-commerce (bijv. WooCommerce)
    • E-commerce will contain basic personal data, such as names, addresses , and banking details. However, it also reveals the kind of products people order. Do you, for instance, sell magazines with a political affiliation?
  • Email marketing widgets (e.g. sign up via MailChimp or CreateSend)
    • Which information do you require? What will you do once you obtain it from your users, and to which service do you forward it?
  • Links with external services, like accounting packages
    • g. a link between WooCommerce and Exact Online
  • WordPress reaction plugins
    • g. Akismet, which filters spam based on data gathered from your users’ reactions, email addresses and IP-addresses. Or, Disqus, which stores such information as well.
  • Safety
    • Safety plugins, like Wordfence, process IP-addresses and user locations for instance.
  • Backup plugins
    • Complete copies of your site are privacy sensitive should they end up in the wrong hands. Where are backups stored and how are they secured?
  • Statistics
    • Like Google Analytics or Google Tag Manager: are you aware of which parts of your users’ data is being stored.
  • Logging
    • For instance, activity monitors that register user activity.

c. Services outside the EU

Check whether you make use of services outside the EU. For instance, American service providers, for instance, that may process data from your website. Verify if they are GDPR compliant.

d. Duration

Check how long personal data is stored and ascertain yourself that this is done no longer than necessary. The following step will help you consider whether this time span is justifiable.

e. Other

Which users have access to your website, and are their pass words up to par? Are you using marketing automation or A/B-testing? If so, have the subjects been informed?

2. Justify

You have to be able to justify reasons for all personal data you are storing on your WordPress website. Make sure your data gathering stays within the boundaries of the law. If you intend to store data on your WordPress website, then this is only allowed when meeting one of the following criteria:

  • Because it is by consent, backed up by an agreement
    Like paid subscriptions on your WordPess website for which you need users’ banking details.
  • Because you are obliged to record this by law
    Like customer data in your WooCommerce shop that you also need for your administration according as the Tax Administration demands.
  • Because you have been given explicit consent to do so
  • By virtue of a cookie announcement on your WordPress website or a registration form by which one subscribes to your newsletter. Make sure that,\
    • consent is freely given (users are not to be misled or forced)
    • consent is explicit (that means no tick box checked by default!)
    • consent needs to be given per component (e.g. someone registers for an event, and also subscribes for a newsletter)
    • users have to be able to withdraw their permission.
  • Because the gathering of this data is justifiable
    Like tracing the location of a logged in user as an additional safety check to determine if the user is logging in from a likely location on the planet. Of course, determining what is justifiable data gathering is somewhat of a grey area. All the more reason to explain in detail why you consider it justifiable. And, when in doubt, you may want to consult a lawyer.

Go through the inventory list (step 1) and check each item for its justification.

3. Confine

Remove personal data that you cannot legitimately gather and store in your WordPress website.

Deactivate plugins that can’t do so either, or search for alternative plugins that do comply.

4. Draw up Procedures

Record different protocols for situations that may occur in the future. Make sure it is crystal clear which information is to be found where, so you won’t have to figure that out later on. In any case, record the following procedures:

  • Personal requests
    Individuals may demand access to their personal data stored by your WordPress website, but may also want to edit or delete their data.
  • Safety
    Record how you will guarantee data to remain confidential, now and in the future. Think about a consistent update policy for your WordPress website, plugins and theme, but also a safe back up storage and a complex password policy for every new user that is added.
  • Data breaches
    In case of data breaches, you are required by law to inform the Personal Data Protection Authority within 72 hours. Therefore, make sure you have a phased plan ready, as speed is crucial in such cases.

5. Inform and ask for permission

Inform visitors of your WordPress website in a clear and transparent manner. This can be realized by clearly referring to a privacy statement, for instance in the footer of your website and in the cookie statement. Also, ask visitors of your WordPress website explicitly for permission of data handling activities as documented in your privacy statement. Make sure that you get their permission as described in step 2c.

Common WordPress problems and solutions

/in , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

WordPress is popular. Many users love the possibilities the system offers and see no problems. At WpUpgraders we focus on professional maintenance. We see WordPress problems on a daily basis. Time for an overview of the problems we come across and the solutions that are available.

Before you tackle these kinds of problems we advise you to make sure the back ups of your website are in order. 

Content

Slow website

A common problem is a slow website. We’ve written various blogs about this issue. The most important cause is slow hosting. Start with a good Managed WordPress hosting. Is your hosting fast? You can work to improve the speed of your website yourself.

Unexplainable visual changes

With unexplainable visual changes your WordPress website looks different even though you haven’t updated it. The website isn’t offline. The cause could be anything. In this case it’s important to start by emptying the cache.

Rule out caching problems

  • Empty the browser cache

    Start by refreshing the browser cache via Ctrl + R (Windows) of Command + R (Mac). The page will then be reloaded without using the cache from the browser. A more thorough way is to remove the entire cache from your browser.

  • Empty the plugin cache

    Do you use a caching plugin like WP Super Cache, W3 Total Cache or WP Rocket? In that case you can log into the WordPress back end and empty the cache there via the plugin settings.

  • Empty the hosting cache

    Lastly, sometimes caching happens at server level. In most cases you can log in to your hosting provider’s admin pannel and empty the cache there.

White Screen of Death – WSOD

After working on your website you encounter a white screen. The cause is usually a PHP conflict in a WordPress plugin or your theme. It may also have to do with the maximum memory available for your WordPress website. In these cases you should get an error notification from the server, this is just hidden from outside users.

  • Rule out hosting as the cause

    When you see a white screen the problem is probably your website and not the hosting provider. Still, it can’t hurt to make sure the server is accessible. Ping your WordPress website and you will find out if the problem is at a server level. There are also other interesting tests you can run from the Ping website.

  • Switch on the debug function for more information

    The white screen indicates there are error notifications, but they are not being shown. Sometimes you can see an error notification by turning on the WordPress debug function in the wp-config.php file of your WordPress website. PHP errors will then be shown in your WordPress website. You can change the wp-config.php file with a FTP program. The file is in the main folder of your WordPress website and can be edited. Make sure the debug function is on: WP_DEBUG is normally set to ‘false’, set it to ‘true’ to show notifications.

    define( 'WP_DEBUG', true );

  • Repair WordPress

    Have you just updated WordPress? Or did you accidentally make a wrong change to WordPress files? In that case WordPress could be the cause. Go to your website files via FTP and overwrite all WordPress files with the latest version. Find the latest version of WordPress here.

  • Switch off conflicting plugin(s)

    What is the last plugin that you changed or installed? That is probably the problem. Try to deactivate the plugin via the WordPress back end. Doesn’t work? Deactivate all the plugins. If the website is working again your can re-activate the plugins one by one.

    Can’t access the WordPress back-end? Use FTP to deactivate the plugin(s). You can do this by renaming the plugin directory in the directory /wp-content/plugins. Put a number in front of the name, for example. The name change will mean the plugin will be seen as a new plugin and will not be activated.

  • Increase the maximum allocated PHP memory

    Another possible cause for a white screen is that there is not enough memory available on the server for your WordPress website. For example, because there are a lot of visitors to the site or because of a plugin or script that takes up (too much) memory. This problem often occurs with cheap, shared hosting in combination with WordPress websites with heavier plugins like WooCommerce, WPML or other plugins.

    Tip: you can find out how much memory is available via the WordPress phpinfo() plugin.

  • Check homepage and other pages

    Is your homepage working, but all the other pages are white? In that case the permalinks might not be working properly. You can solve this problem with a quick fix by going to Settings -> Permalinks in WordPress and changing the settings to standard.

    The actual cause and solution, however, are at the hosting level. To be able to re-write the standard permalinks to ‘good permalinks’ the mod_rewrites module (for Apache) or a similar module (for Windows servers) needs to be on. As soon as the settings are right on hosting level you can choose the permalink structure you want via the WordPress back-end.

  • Repair your theme

    WordPress itself and the plugins not the problem? Check to see if the theme is the source of the problem. In general, themes aren’t usually the source of the problem. It is possible however. If this is the case, deactivate the theme via the back-end or via FTP, just like with the plugins. Take into consideration that switching off or changing your theme will have consequences for your widgets, theme settings and menus.

    • Activate a standard WordPress theme (for example Twenty Sixteen) to see if this solves the problem.;
    • Overwrite your theme with the newest version available.

    Finally, it’s possible that the white screen is due to the fact that there is no theme activated at all. The theme could have been removed via FTP. In that case you get your website back by activating you (child) theme.

Notification: Internal Server Error / “HTTP 500 Internal Server Error”

When you see these notifications you have usually (but not always) done something wrong. This notification is usually given when there are PHP problems with plugins or thema’s. Exceeding the memory or a modified .htaccess file could also be the problem.

  • Empty the cache

    Rule out problems with caching. Follow the instructions for Unexplainable visual changes.

  • Switch on the debug function for more information

    See the instructions for White Screen of Death – WSOD.

  • Repair corrupt .htaccess file

    You just – consciously or unconsciously – made a change to the .htaccess file. If you access the website via FTP you can see the .htaccess file in the root. Rename the file. For example, by calling the file .htaccess_old. If the website works again after changing the name you know that the .htaccess file is the problem.

    After renaming the file it’s important to make a new .htaccess. You do this by clicking Save changes in Settings, Permalinks. If there is no .htaccess file WordPress will create a new one.

  • Repair permissions

    Specific files or authorizations do not have the right permissions, which causes an Internal Server Error. The easiest wat to fix this is to repair the folder permissions and set up the files again via FTP. Standard settings in WordPress are 755 for directories and 644 for files.

  • Repair WordPress, plugins or theme

    An important cause of a 500 notification are plugins and themes. In this case, follow the same steps as for White Screen of Death – WSOD.

  • Contact your hosting provider

    Contact your hosting provider if above mentioned solutions do not solve the problem. It’s possible that the Internal Server Error is because of an error in the server configurations. And otherwise they will be able to find the cause of the error notification in the server logs.

Notification: Error Establishing Database Connection

This notification means that no connection is being made with the database. This notification usually appears during WordPress installation. The notification may also appear randomly.

  • Check database data in wp-config.php

    WordPress gets the information needed to make connection with the database from the wp-config.php file in the root. Check to see if the information is correct, for example, if you have recently moved your WordPress website. We advise this step particularly around the time of installation when there has not been any connection with the database.

  • Contact your hosting provider

    If your website has been working properly, but suddenly gives this error notification this points to a problem with the database server. This is not something you can fix yourself. Contact your hosting provider.

Notification: Connection Timed Out

The server generates this notification when your website needs more time to generate a webpage than is available.

  • Deactivate the plugin causing the problem

    What is the last plugin that you modified or installed? This is probably the source of the problem. Try deactivating the plugin via the WordPress back end first. Follow the same steps as for White Screen of Death – WSOD.

  • Deactivate your theme

    Deactivate your theme to find out if the theme is causing memory problems. Follow the same steps as for White Screen of Death – WSOD.

  • Increase your memory

    Contact your hosting provider to talk about options for increasing the memory for your website.

Notification: Parse error, syntax error

The syntax error is a PHP notification that a piece of code has not been written following PHP guidelines and so cannot be executed. The notification will specify where the problem is. You can look up the file and line of code via FTP to change it.

Notification Warning: Cannot modify header information

After updating WordPress you see this notification in your browser: “Warning: Cannot modify header information” – headers already sent”. Often this is caused by other error notifications on your webpage. If you see any other error notifications take care of them first.
If you continue to see the notification afterwards, it is probably due to unneccesary spaces (for example enters, spaces) at the beginning or end of WordPress files, before the code begins and after it ends. In the example below, for example, there is unneccesary whitespace at the top of the wp-config.php file:

To solve this problem your can reach the file via FTP. Edit the file using a text editor and remove all whitespace at the beginning and the end of the code.

Notification: Briefly unavailable for scheduled maintenance. Please check back in a minute.

When updating WordPress and plugins the maintenance mode is activated and the website is not available. Updating doesn’t take long (usually no more than a few minutes), so the down-time is limited. Sometimes WordPress gets stuck in maintenance mode after an update.

  • Remove .maintenance file via FTP

    During the maintenance mode a .maintenance file is created in the root. You can remove this. Note: this is a hidden file, so you must set up your FTP program to make hidden files visible. After removing the file the website is taken out of maintenance mode and will be live again.

  • Don’t do anything

    The maintenance mode switches itself off after 10 minutes, so if you don’t do anything the problem will solve itself.

Images cannot be uploaded

A common problem is that images cannot be uploaded to the media library.

  • Check the permissions for the upload folder

    A condition for uploading images in WordPress is the permissions for the uploads folder. Uploads is a subfolder of the wp-content folder. Make sure the setting for the uploads folder and any subfolders is 744.

  • Upload a different image

    The cause of the problem could be the image itself or the extension. Try uploading another image. If it works then you know the file was the problem.

  • Check any image optimization services

    At WpUpgraders we use Kraken to optimize images. This means that images are optimized by Kraken at the time we upload them. A malfunction at Kraken could have effect on our websites. That’s why this is important to check.

  • Check the maximum upload size

    There may be a maximum upload size given by your hosting provider and via the php.ini file. When uploading to the media library this will be indicated under the upload button.

  • Check your storage space

    Check to make sure the hard drive space given by your hosting provider isn’t full. You can usually see this via the hosting admin panel. Sometimes you share storage for your website space with your e-mail accounts. This can cause your storage to fill up quickly. In this case ,you will need to delete files from your media library or ask your hosting provider for an upgrade.

  • Contact your hosting provider

    In many cases a permissions setting on the server is the reason you are unable to upload images. Contact your hosting provider if you can’t find a solution to the problem.

Problems logging in

You are sure you have the right user name and password, but you still can’t log in.

  • Reset your password

    Are you sure you have the right login details? Try resetting your password via the forgot password function. Doesn’t help? Try the solutions listed below.

  • Check security configurations

    ManyWordPress websites are secured by a security plugin like WordFence or iThemes Security. These plugins block an IP-address or IP-address ranges when too many attempts have been made to log in. This may be hackers trying to log in. But it could also be a colleague who has forgotten his or her password and tries to login multiple times in vain. An IP restriction is usually for a specific time, so you could just wait an hour and then try again. Another option is to (temporarily) turn off the security plugin via FTP.

  • Contact your hosting provider

    Many hosting providers look after the security of your WordPress website on a server level. It could be that you are locked out after failed attempts to log in. It is also possible that they changed your password for security reasons.

E-mails from the website do not arrive

Both admin and website visitors are not receiving e-mails via the website. Not when users register their information, not the forgot password function, notification of forms, order confirmations etc. The cause is probably that your e-mail is not getting through the spam filters.

  • Send via a transactional e-mail service

    Instead of sending the e-mails from the website (transactional e-mail) via your website server send the e-mail via an transactional e-mail service. A well known option is Mandrill from MailChimp. Charges apply. Freemium alternatives are Mailgun, Mailjet and SendGrid.

Website has been hacked

All above mentioned problems may occur if your website has been hacked. We’ve written a blog about removing malware from a hacked website.

Tips for keeping your WordPress website up-to-date

/in , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

Nearly every WordPress website that is not updated will be hacked sooner or later. Hackers make scripts that search the internet for vulnerability in WordPress plugins and themes. As soon as plugin vulnerabilities are known hackers can automatically scan WordPress websites to see if the relevant plugin is being used. For this reason, we sincerely recommend you update your website regularly. You can outsource this WordPress onderhoud (Dutch link) to WpUpgraders, but you can also do it yourself. In this article we’ll give tips both unexperienced administrators and professionals can use to keep your WordPress website up to date.

A number of links in this article are embedded with affiliate code.

Content

Tips unexperienced website administrators

Conquer your fear

Many WordPress website administrators are afraid to update their websites. They are afraid of potential consequences, like a plugin that stops working or layout changes in a theme. But all we can do is advise you to get over your fear and update anyway. The consequences of a potential hack are much greater than the consequences of the update.

Keep your website simple

An important tip is to keep your website simple. A simple website is simple to update. Complex websites are more difficult to update.

  • Limit the number of plugins; each extra plugin you install brings extra risk. We don’t limit the number of plugin that we use when developing a website, but we know where the risks lie and we are the ones responsible for the updates. If you are not experienced it’s better to use a limited number of plugins.
  • Avoid complex plugins like multilingual plugins (like WPML), e-commerce (like WooCommerce) and layout editors (like Visual Composer).
  • Avoid multi-purpose themes. We often use Enfold. This multi-purpose theme is technically solid. Even so, we have to pay close attention when updating. We are not as pleased with other multipurpose themes. Like Jupiter. Good looking theme, but it’s a hassle to update.
  • When purchasing plugins and themes check to see if they can be updated automatically, so that you avoid having to do updates at FTP level.
  • Want to make changes in the code of your theme? Use a child theme, this way you can update the main theme yourself. Read here to learn how to make a child theme.

Remove unused plugins and themes

During the development of a website various plugin and themes are often tested. Some of them don’t end up being used, but can make your website venerable to being hacked. Remove these plugins and themes so that they don’t have to be updated.

Update periodically

It’s best if you can update as soon as an update is released, but this might not be do-able. Small websites can be updated periodically. Once or twice a month, for example. Set a reminder in your agenda to update every first Monday of the month.

Backup before you update

Always make an update before you update. If the update happens to cause problems you can always go back to the situation before the update. Many hosting providers make automatic back-ups. Or you have an admin panel (cPanel, DirectAdmin) you can use to make a backup yourself. You can also make a backup with the WordPress admin using a plugin. We like to use UpdraftPlus, a premium plugin with a good basic version. Alternatives are BackWPup, BackupBuddy or VaultPress.

Update WordPress first and then plugins/theme

First update the core of WordPress and then your plugins and theme.

Updates in your e-mailbox

When you are logged in to the back end of WordPress you will see notifications in the lefthand menu when there are updates available. Many people forget to update because they don’t update their website when it gets busy. You can remind yourself. For example with the plugin WP Updates Notifier, it sends you an e-mail when new versions of WordPress, plugins or themes are available.

WordPress.com?

Is updating just not your thing? Outsource your web maintenance. Or choose a website via WordPress.com instead of a WordPress installation on your own server. WordPress.com is a Software-as-a-Service (SaaS). Your website wil be hosted on the Automattic servers (the company behindWordPress). They will make sure your website is up-to-date. WordPress.com gives you less freedom compared to your own WordPress version of WordPress.org. However, you don’t have to worry about safety and speed. And it is relatively cheap.

Tips for professionals

Make an inventory of risky plugins

There are plugins that cause little harm when updating. Take, for example, a plugin that adds a small functionality to the media library. Which plugins generally don’t give any update problems?

  • Statistic /Google Analytics plugins;
  • SEO plugins;
  • Backup plugins;
  • Database optimization plugins (Note, we are taking about updating the plugin, not the optimization);
  • Media library plugins;
  • Security plugins;
  • Admin plugins, that add extra functions to the WordPress back end;
  • RSS-feed plugins;
  • Development plugins.

Other types of plugins bring more risks.

  • E-commerce plugins like WooCommerce and add-ons;
  • Multilingual plugins like WPML;
  • Layout editor/Page builder plugins like Visual Composer;
  • Shortcode plugins;
  • Slider plugins;
  • Image presentation plugins;
  • Contact form plugins;
  • Event calendar plugins;
  • Pop-up and lead generation plugins.

Change log

Check the plugin change log to inventory any risks that may be expected.

Update premium plugins and themes

Most WordPress plugins can be automatically updated from the WordPress plugin repository. For plugins and themes you have purchased it doesn’t work like this unfortunately. You don’t always get a notification when an update is available. And you can only update the plugin or theme by overwriting the files on FTP level. Updating premium plugins is more complicated. Unfortunately we don’t have any standard solutions to this problem.

Use admin tools

Do you manage multiple websites? Use an admin tool like ManageWP, MainWP, WP Remote or InfiniteWP. We use this last tool. An admin tool gives you overview of which websites need updating. You can also perform updates directly from the tool.

Test

Don’t forget to test after you have updated the website. The most important thing to test is the functionality of the front end. You will find any potential problems in the back-end when managing the website. What is the best way to test?

  • Check the homepage and a few other pages;
  • Fill in a form and/or other call to actions;
  • Check to see that the multilingual function is working;
  • Check extra moving elements like sliders, pop-ups, cookie bar;
  • Test the search function;
  • Test any API links. For example MailChimp or CreateSend.

Use a staging

Want to really update safely? Use a staging environment. You perform the update in the stage and, after testing, overwrite the live environment with the staging. It takes more time, but prevents users from coming across any problems the update may have caused. How do you use a staging environment?

  • Hosting providers. We usually use a staging environment provided via the hosting provider. WP Engine, one of our hosting partners, has great facilities.
  • Plugins. Work with a staging via free plugin WP Staging or the paid plugins WP Stagecoach and RAMP.
  • Software. Develop and push changes via DesktopServer, a program on your own computer.

 

Useful plugins

There are plugins available that will help you update your WordPress website.

  • WP Update Settings; use this plugin to change settings via the back-end of WordPress that pertain to the update proces.
  • Automatic Plugin Updates; plugin for automatic updates.
  • Plugin Vulernabilities: plugin lets you know when vulnerabilities have been found in the plugins that are used on the website.
  • Plugin Security Scanner: plugin e-mails the website administrator if any vulnerabilities are found in the plugins that are present.
  • WP-UserOnline: plugin shows how many users are active on your website. Wait to update until there are almost no visitors at the website.

 

What to do when it goes wrong?

  • During the update WordPress switches to maintenance mode. The website is not accessible while updates are being made. Usually for no more than a minute. Does the website get stuck in maintenance mode while updating? No problem. Wait ten minutes, the maintenance mode overrides itself. Or go to the server via FTP and remove the .maintenance file from the root.
  • Activate your backup and update themes and plug one by one so that you know which update causes the problem.
  • Google the problem and see if you the solution is known.
  • Get in touch with the theme or plugin builder and ask if there is a solution to the problem.

 

How to remove malware from a hacked WordPress website

/in , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

In this article we will explain why and how WordPress websites are hacked. We will also give you a step-by-step plan for removing malware and cleaning up your WordPress website.

Why are WordPress websites hacked?

The most important motivation for most hackers is money. The hacked websites are used to promote commercial websites; particularly things like gambling, sex and pharmaceuticals. By hacking a website, for example, thousands of spam e-mails can be sent. Or links are placed on your website to mislead Google so that the commercial websites are placed higher in the search results. Every now and then hacks may be ideologically or politically motived.

How do you discover that your WordPress website has been hacked?

  • Various links appear on the website that don’t belong there. Often these are links to websites that have to do with pornography, gambling, drugs, illegal pharmaceuticals, et cetera. Sometimes the links are hidden in the color of the background of the website so that they are not visible to visitors, but can be found by search engines.
  • When you search for your own website via Google (for example ‘wpupgrader.com’ as search term), you find information about the website that isn’t yours.
  • Visitors to your websites are redirected to another website. Sometimes only mobile visitors.
  • Your website is being used to send spam. If this is the case you will usually get a message from your host company saying that an unusual amount of e-mail is being sent from your website.
  • Organic search traffic decreases because Google no longer shows your website in the search results.

How is it possible for your WordPress website to be hacked?

To gain control of your WordPress website hackers must find some way to upload or edit a file on your server. In general there are four possible ways for hackers to gain access to your website:

  1. Insecure passwords; most of the WordPress hacks that we come across could have been prevented by using more secure passwords.
  2. Update-policy; when you seldom or never update your WordPress, your plugins and your theme you greatly increase the chance that you will be hacked.
  3. Insecure themes/plugins; sometimes your website can be up-to-date, and still contain an insecure theme/plugin. Always purchase plugins/themes from a trustworthy website.
  4. Bad hosting; you may have protected your website well yourself, but if, for example, it’s possible for your hosting company to move files between different websites then your website is not properly secured.

How to make sure your WordPress website is hack free?

When a hacker has had access to your website, it is possible that files have been added/altered, passwords have been changed and possibly even new users added. If any one of these things are not detected and cleaned up then others steps will have no effect, because the hacker will still be able to gain access and cause damage once again. For this reason, clean up must be thorough.

We will try to explain all the steps as simply as possible, but some technical knowledge is required. Make sure that you have an administrators account in WordPress, that you have FTP access (and that your know how FTP works), and that you can access the database using a program like phpMyAdmin or Adminer. The steps we are going to take are:

Tip

If you know when the hack took place you can skip the clean up by replacing with a back-up from before the hack. It is possible you may lose a number of responses and web forms. Continue with step 5.

Backup your hacked WordPress website

You are going to clean up your WordPress website thoroughly. This means you may end up cleaning up too much and it might be better to start again. In that case it is always good to have a backup on hand. Make sure that you add both the files and all databases to your backup.

Close the doors

Make sure your WordPress website is temporarily inaccessible from the outside. Theoretically hackers could infect your website while you’re still going through these steps. This also prevents you from infecting your visitors with any malware that might be installed on your website.
You can usually block your website from your host company’s control pannel by way of a password or by using an IP filter. If you have access to your .htaccess file you can add the following code to allow one specific IP address (find our what your IP address is at WhatIsMyIPAddress.com):

order deny,allow
deny from all
allow from 123.456.789.123

Find the source of your WordPress website hack

It is important to find the source of the hack and the extent of the impact as soon as possible.  

  • Look for your plugins, themes and WordPress version in the WPScan Vulnerability Database and see if there are known vulnerabilities for the versions you installed on your website.
  • Do you use Google Webmasters? Go to your dashboard and see if there are any reports of malware.
  • Check your website in Google: http://www.google.com/safebrowsing/diagnostic?site=www.example.com
  • Many hosting parties make access logs available. This is a list of all requests for files, saved at server level. Files placed by hackers are usually requested using a ‘POST-request’. By looking for ‘POST’ in your access log you can filter a list of of php files to further examine. Later in this article we will explain what to look for when examining php files. These files may not necessarily be infected however; a POST-request is also used when you fill in a contact form or if you log in to wp-login.php.
  • We sometimes come accres situations where an old WordPress website is on the same server, for example in the file ‘old’. Often this installation will have been forgotten and no longer up-to-date, which makes the whole website vulnerable to all sorts of old security flaws.

Clean up the files on your hacked WordPress website

During a successful hack a hacker can potentially place or alter a file in every folder on your web server; not just the folder containing the infected plugin. This means that you should examine all your folders and files, and this is painstaking work. Thankfully you can limit this work to various steps. We explain how below.

  • Clean up WordPress core (wp-admin and wp-includes)

    Log in with FTP and go to the folder of your WordPress website. In the root of your WordPress website there are at least three folders: ‘wp-admin’, ‘wp-content’ and ‘wp-includes’. In the ‘wp-content’ folder all the specific changes to your website are saved, but ‘wp-admin’ and ‘wp-includes’ only contain files from the WordPress core; files that only change when a new version WordPress is released.

    To make sure in one go, that there are no files in your WordPress core that have been added or infected you can remove the ‘wp-admin’ en ‘wp-includes’ files and replace them with a clean version by downloading WordPress again.

    • Not sure which WordPress version you are running? Check in ‘wp-includes/version.php’ and you will find the version number on line 7.
    • Download a zip-file of this version from the WordPress release-archive and unzip it on your computer.
    • Remove the ‘wp-admin’ and ‘wp-includes’ using FTP from the root of your WordPress website.
    • Upload the ‘wp-admin’ and ‘wp-includes’ from the file you just unzipped.

    Along with folders there are also files in the root of your website. Replace these files – except wp-config.php (!) – with the files from the unzipped zip file.

    Are there other files and folders in the root of your website? Examine them critically and decide whether or not they are familiar to you; is there any other software running on your site? If not then they may have been placed by the hacker. When in doubt confer with your web host. Sometimes your web host will preinstall a folder like ‘stats’, ‘webstats’, ‘logs’ and ‘cgi-bin’ . Always take a look at these folders and look for files that end in ‘.php’. Because, normally speaking, they shouldn’t be there.

  • Cleaning up plugins (wp-content/plugins)

    Just like the WordPress core, you can find original clean versions of your plugins in the WordPress plugin repository. It is, however, possible that not all your plugins come from here; you may have purchased premium plugins, for example, elsewhere. Premium plugins cannot always be updated automatically. Either way, to be sure that your plugin folder is clean, you will have to locate all the originals.

    • This is a good time to remove inactive plugins and plugins that are used infrequently. Do this first.
    • The plugins from the WordPress plugin repository can only be removed via FTP. After removing them download clean versions from the repository and upload them via FTP. A plugin like Wordfence may be able to do this step for you.
    • It is also important get clean versions of plugins that do not come from the WordPress repository. Make sure you find these files and repeat the above step for these plugins. Can’t find the original plugin files? Then you will have to remove the entire plugin, because it is very possible that the plugin is (partially) responsible for the hack. More importantly, you will not be able to update the plugin in the future and that could be disastrous to the safety of your website in the future. Often you will be able find an alternative plugin for the functionality you are looking for.

    In this step you will update all your plugins to the newest version. That is safe, but may lead to conflicts if your WordPress core or theme, for example, is not compatible with the newest version of the plugin. In that case, replace it with an older version of the plugin or – better yet – update your theme (see the following step) to see if that will resolve the problem.

  • Update theme (wp-content/themes)

    WordPress themes sometimes contain customization done by you or your website builder. These modifications will be lost if you update the theme, unless the modifications are saved in a separate folder by using a child theme.

    Your WordPress website doesn’t use a child theme? Then you have the option to update your theme, as explained in the previous step, but any modification will be lost. Want to keep your modifications? Then you can use this opportunity to first save your modifications in a child theme. The child theme manual by WordPress will explain how (caution: it’s not simple).

    Does your WordPress website have a child theme? In that case you can update your WordPress theme as explained in the previous step. Afterwards you will need to make sure that your child theme folder is clean. If you have a local copy of your child theme you can replace it (sometimes an old backup will work just fine, as long as you know that the website wasn’t hacked at the time the backup was made). If you don’t have a copy then you will have to go through the folder containing the child theme by hand. Read the next step for more information.

    Finally, do not forget to remove any unused themes; this way you will decrease the chance you’ll run into problems in the future.

  • Checking remaining files (wp-content)

    You have now cleaned up as much as you can without have to look in detail, but there are always a number of files and folders that you will have to check by hand.

    • Look for .php, .asp, .exe, and .sh files in the wp-content/uploads files. These do not belong here and may have been placed by hackers. It takes time, but don’t forget to check all the subfolders. Many FTP programs allow you to search automatically within a folder.
    • Some plugins add their own folders to the de wp-contents folder. This is not necessarily bad, but go ahead and go through these folders for above mentioned files.
    • Are there php-files that you no longer have the original to, that you will have check by hand? Think about php files in the wp-contents folder (like object-cache.php), your child thema, or wp-config.php in the root. Follow these steps:
      • Open them in text editor and scroll in all directions; sometimes hackers put code in a file ‘out of sight’ by placing it very far to the right or really far down.
      • Keep looking for any worrying code. Look for terms like ‘eval’, ‘exec’, ‘base64’, ‘hash’, ‘decode’ and see if you find any code that doesn’t belong.
      • Not sure about something? Copy a section of the code and look it up in Google. Sometimes you’ll come across all kinds of malware forums and you’ll know that something’s not right.

  • Check wp-config.php

    Up until now you have left the wp-config.php file untouched, but you do have to check it. This file contains all kinds of basic configurations for your WordPress website. Do you have a backup available? Then we advise you use the wp-config.php file from the backup for your website. Edit the list under ‘Authentication Unique Keys and Salts’ by adding a few characters to each line of random code. This way you make sure that any users that are logged in (potentially hackers) will no longer be logged in.

    Don’t have a back up? Open your wp-config.php and fill in the values you see in the wp-config.php generator by following all these steps. Chose ‘Auto Generate’ in Authentication Keys & Salts . Click update after the last step and copy and paste the code to your wp-config.php. Then you know for certain that you have generated a clean wp-config.php.

  • Looking for .htaccess

    A .htaccess file makes it possible to configure a lot of server settings. If a hacker modifies these kinds of files it can lead to very destructive behavior. There is definitely a .htaccess file in the root of your WordPress website, but in theory there could be one in every folder in your website. Use an FTP program to look for ‘htaccess’ on your website.

    The .htaccess file in the root of your website will contain the following lines:

    # BEGIN WordPress

RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress

    Is there more code in your .htaccess file? This could have been added by a plugin, but it could be a hack. If in doubt, remove all extra code from your .htaccess file; the plugin may no longer work optimally, but most plugins are able to add the necessary code to the .htaccess file automatically if need be.

    Find more .htaccess files?

    Go to the place where you found them. Are they in a plugin or theme folder? Then in theory they are safe, since you cleaned up all these folders in the previous steps. However, if you find any in your uploads folder, child theme etc. then it’s a good idea to take a closer look. Sometimes a .htaccess file is placed in wp-content/uploads to prevent visitors from going through your upload folders without permission. In this case you may come across the following line in your .htaccess file:

    Options -Indexes

    This is not a harmful line, so your can safely leave it as is.

Cleaning up users

Now that all the files have been cleaned up, hackers still may have access to your website. They could have made an extra admin account, for example, or have changed the password of one of the other users. Furthermore, it’s possible that the hackers got in because they were able to guess a weak password.
Go to ‘users’ in WordPress and remove any user who doesn’t belong. Set new (complex!) passwords for all other users. This way you know for certain that hackers cannot login using an existing account. Explain to existing users why it is necessary to use a complex password.

Check the database

The more advanced users among us can now take a look at the database. Using a program like PhpMyAdmin or Adminer it’s relatively easy to browse through your database.
First, you can have a look in the ‘wp_users’ table; do you still see any users that don’t belong here? Remove them by hand. Sometimes hackers are able to add an invisible user.
Then take a look at the structure of the table and compare it to the standard WordPress Database description; have any tables been added that you don’t recognize? Take a closer look. Some plugins add tables to your database. Only remove the tables that belong to plugins that have been removed.

Change all passwords

In the fifth step you changed the passwords of all your users, but hackers may have been able to discover other passwords as well. For this reason, at least change the password of your database, and your FTP account, host control panel, etc. as well. This way you don’t have to wonder if your website really is secure again. Fill in the new database password in ‘DB_PASWORD’ in the wp-config.php file.

Go live and test

Now you are ready to take your WordPress website live again. Remove the block from step one and check to see if your website can be accessed when you are not logged in, for example, by visiting your website from a different network or using your telephone without wifi.
You may still get a notification stating that your website contains malware. In this case your website has been placed on a blacklist, which means it also no longer comes up in Google searches. Use the options Google offers to put your website back in the search results.

  1. Google Diagnostic Center (replace www.example.com) in the url for your own domain). You can use this tool to see if your website is on the Google blacklist.
  2. Google Webmasters indicates if and when Google indexed a problem with your WordPress website.
  3. Submit a request via Google Reconsideration Tool to have Google reindex your WordPress website.

Update

Behind the scenes at WordPress there is a large community of developers constantly working on improving the code. The advantage of this is that any known leaks in WordPress, plugins and themes are often resolved quickly when a new version is released. That’s why you should always make sure your website is up-to-date. This way you greatly decrease the chance you will be hacked again and you can perform new updates very quickly because it’s usually just a small modification.

Links

Plugins

Below some plugins you can use to secure your website.

How do you get Google Maps working again on you WordPress website?

/in , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q4q0yw’ custom_class=” admin_preview_bg=” heading=’Post title’][/sowmedia_posttemplates_heading]

Google Maps stopped working

If Google Maps is no longer visible on your WordPress website, this is probably caused by the Google policy changes. This change may have caused Google Maps to stop working on your WordPress website. If you’re using a Google service (such as Google Maps) on your website, Google decided they want you to link these to your Google account by using a so-called Google Maps API key. In this article, we explain how you can get and install this API key for Google Maps, so you can get Google Maps working again on your WordPress website.

How does the Google Maps API work?

When you’re showing a map from Google Maps on a page of your website, a connection is made with the Google Maps API at every visit. It is a free service from Google that builds up this map for you, so it loads quickly. Excessive use of this tool costs Google a lot of money, because their servers have to make calculations every single time.

That is why Google is now limiting the use of the API. A connection can be made with the Google Maps API up to 25.000 times a day. When you exceed this limit, you have to pay. Most of the websites will never exceed this limit, so for most people, this service will remain free. You do, however, have to enter an API key on your website, so Google can keep score of the times your website is making a connection with the Google Maps API.

Getting a Google Maps API key

Step 1

  • Go to the Google Maps Developers page.
  • Click the blue button ‘Get a key’.
  • Login with your Google account (if you are not yet logged in). It’s best to login with the same account as the one you’re using for example for Google Analytics.

Step 2

  • Select ‘Create a project’.
  • Click ‘Continue’.
  • Wait until you are led to the next screen. This can take several minutes, so don’t close the window and don’t click away while waiting. The next page will open automatically.

Step 3

  • Enter a clear description, under ‘Name’, e.g.: Google Maps for yourdomainname.nl.
  • Enter the domain name for which you want to use the API key, under ‘Accept requests from these HTTP referrers’. Enter it like this: *.yourdomainname.nl.
  • Enter any other domain names in the same way, if applicable.
  • Click ‘Create’.
  • You now see a screen with your API key. Copy the key and save this in a safe place.

Installing the Google Maps API key on your WordPress website (easy)

Make sure WordPress, your plugins and the theme on your website are up to date. Check which WordPress plugins and themes show the maps from Google Maps. Check their settings to make sure you can now paste your Google Maps API key. If not, you can contact your plugin or theme developer, because they should fix this immediately for all their users.

Paste the API key in the option field and save the changes. In the example on the right, you see how you can install the Google Maps API key for the newest version of the WordPress theme Enfold.

Installing the Google Maps API key on your WordPress website (advanced)

Does your website run a customized version of Google Maps, or does your plugin or theme no longer get support? Then find an alternative plugin, because using unmaintained code leads to serious safety risks for your website. In the meantime, you can take these steps temporarily – provided you know how to use an FTP program and a code editor:

  1. With your FTP program, go to the folder of the plugin or theme that’s using Google Maps.
  2. Download the folder to your computer and search through all the files in the folder for “maps.googleapis.com”.
  3. Open the files (one or more) that show up in your code editor with this search term.
  4. Scroll to the place/places with “maps.googleapis.com”. You will probably see a longer address, like “https://maps.googleapis.com/maps/api/js?callback=initMap”.
    • Check whether you see a question mark in the URL. In that case, paste the following, directly after the URL: &key=YOUR_API_KEY
    • When there is no question mark in the URL, paste the following directly after the URL: ?key=YOUR_API_KEY
    • Replace YOUR_API_KEY with the API key you got from Google.
  5. Save the files and upload them with FTP back to your website.

 

Tips and tools for professional WordPress website development

/in , , , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

We see more and more often that internet businesses choose to use WordPress as standard CMS to build websites. We also come across many freelancers, just starting out, who place their focus entirely on WordPress. In this article we will make an summary of the best tools, techniques and plugins for developing WordPress websites that we have picked up over the years – and that we wish someone had shown us ten years ago when we first started working with WordPress.

Content

  1. WordPress development tools
  2. Standard plugins
  3. Developer plugins
  4. Cheatsheets
  5. Team work
  6. Stay up-to-date
  7. Finally

WordPress development tools

Over the years we’ve tested, used and thrown away lot of development tools. Which tools do we still use for developing WordPress websites?

  • Google Chrome
    Google Chrome has a powerful set of development tools that come standard. You can make CSS changes from the element-inspector, which means that you see the effect immediately before you make any changes in the css files. You can view existing JavaScript variables from the console or run new scripts. You can also view saved cookies, check the headers to see if your page is being cached and more. Mozilla Firefoxis a good alternative as well and offers many similar functions.
  • Sublime/ Coda
    Everyone has their own favorite text editor, but there are two that really stand out for us: Sublime and Coda. An important advantage of Sublime (Windows / Mac) is that it is that it is easy to expand, while Coda (Mac) is already very complete. In both editors it’s possible to change files directly on the server. This makes doing small, quick changes very easy.
  • FileZilla
    Maybe obvious, but maybe not at all. We use Filezilla daily for quick and secure FTP connections with our customer’s servers. Easy to use and ideal for quick changes. We do advise setting up a good version managed GIT workflow for bigger projects.
  • Browserstack
    You can use Browserstack to virtually test a website on any imaginable device. Like all desktop browsers on multiple Windows and OSX versions, but also all known Android devices, iOS devices and tablets. This is ideal for responsive tests, because simulations for mobile devices in desktop browsers tend to lack details. Browserstack also offers a Chrome extension, that you can use to simulate any website you visit on a different platform.
  • Ghost Inspector
    This fantastic Chrome extension makes it possible to record a numbers of steps on your website (for example: “visit homepage, click on ‘contact’, scroll down, fill in form”). The operations in these records are then regularly run by Ghost Inspector. If there are any abnormal results (for example a page is missing or the layout is different) you will receive a notification.
  • Photoshop
    Although you can do a lot in WordPress itself, Adobe Photoshop remains indispensable to our work. This is the favorite software package of everyone of our team members who works on design.

Standard plugins

Although every website is different, there are a few plugins that we use for every project. That is why we always install them for a new project. If we end up not using them we can always remove them:

  • Avia Framework
    This visual block builder is not available as separate plugin, but built into the Enfold theme (Dutch link). Very user friendly and makes it possible to build up content quickly.
  • Gravity Forms
    The most comprehensive form building plugin we know, with conditional logic, import/export function, various notifications etc. Many themes take this plugin into account in their styling.
  • io
    Make sure you have this plugin running before you upload your first image. That way you keep everything optimized.
  • Akismet
    Reduce spam on your website. Really a must-have.
  • Yoast SEO
    Helps you fine tune your SEO settings globally, and to easily make changes per page, to things like title and meta-description.

Developer plugins

There are many plugins for WordPress that simplify the development of your website. The most common plugins are listed here.

  • Password protected
    Protect your website with a password to prevent search engines and unwanted visitors from taking a look at your website before it’s ready.
  • Debug Bar
    Want to dig a little deeper into the code? The debug bar adds a button to your admin bar you can use to read various server variables, warnings,errors, queries and requests. The Actions and Filters Addon makes it possible to see which hooks were triggered on your page.
  • Query monitor
    This plugin offers many of the same functionalities that the Debug Bar does, but also makes it possible to do targeted searches of the queries that were carried out, for example per plugin or kind of query, as well as sluggish performance.
  • Custom Post Types UI
    With this plugin you can easily make extra custom posts types. WordPress offers a number of posts and pages, but you may need an extra post type at times, for example ‘books’ for a kind of library. When you have set up the post type this plugin will have to remain active. To keep the number of plugins at a minimum and thus your website performance optimum we prefer adding post types via GenerateWP(see the ‘Cheatsheets’ below).
  • Advanced Custom Fields
    By default, you have a limited number of fields at your disposal in a message, page or custom post.Advanced Custom Fields (ACF) adds all sorts of extra fields; date planners, color pickers, taxonomy links, fields for extra images, you name it. ACF also works very visually and intuitively, so that you can prepare even complicated custom post constructions without using a single line of code. To then be able to use all the custom fields and show them on a page you can use short codes, or change the templates.
  • FacetWP
    This plugin allows you to create different filters to expand the search option for messages, pages and custom posts. This way your visitors are not only able to fill in key words in the search bar, but can also click on taxonomies (categories or tags) in a drop down or a selection box, to further specify the search results. Very interesting for large databases, with, for example, thousands of articles. You can put FacetWP to work, just like ACF, by using short codes and templates.
  • SearchWP
    Would you rather improve the standard search function in WordPress? Then SearchWP is our favourite This plugin indexes all of WordPress so that the results can be shown quicker. You can set the index to your own preferences. Choose, for example, which types of posts will be searched, which fields in a post are important or in fact irrelevant, whether or not to search for partial matches and much more.
  • P3 Profiler
    Is your website getting slower and slower? Use the P3 profiler to measure which plugins have the most impact on your load time. Sometimes it can help to get rid of a few plugins, to improve your website speed. Another solution is to choose super fastPremium WordPress hosting (Dutch link).
  • Broken link checker
    Before going live check to see if all the links on your website still work. Not missing anything, all external pages still available? You’ll get an e-mail if a link doesn’t work. You can even choose to have the check done regularly.
  • Redirection
    When you place your website online will you be replacing an old website?The older website has built up value in the search engines. To maintain as much of this value as possible you can redirect all the URL’s from the old website to the corresponding pages on the new website. This is a lot of work, but it is worth it. You can use the Redirection plugin, but in some cases a .htaccess file as well. Sometimes you can use one redirection rule to reroute multiple pages by using regular expressions (see the ‘Cheatsheets’ below) Dutch link.

Cheatsheets

There are many resources online dealing with developing websites, CSS procedures,  WordPress tweaks, typography etc. Below you will find a handy overview of cheatsheets we’ve saved in our favorites. Always good to have on hand.

  • Golden Ratio Typography Calculator
    Can’t figure out why your text is not very readable? Check your line spacing and font size with this tool. It will calculate the best line spacing, font size etc. based on things like the width of your content area.
  • Can I Use
    Just found a nice new CSS-feature? Want to use HTML5? Usecom to check and see which browser can/can’t use this code. Sometimes caniuse.com even gives fallback tips for older browsers. Look up ‘border-radius’ and then check the tab resources for an example.
  • com/ RegExr
    Website finished and you want to quickly add a few redirect rules to your htaccess file? Or are you programming and need to filter by pattern? If you are not familiar with regular expressions they can be headache inducing. txt2re.com helps by entering a string you want to match (for example an e-mail address, URL, telephone number or just a sentence). The tool generates suggestions of what a regular expression should look like. RegExr turns it around: input your regular expression and a piece of text and the tool shows you which parts of your example text match.
  • com
    A fantastically simple website that gives you the HTML code to embed things like YouTube URLs responsively. Also works for Vimeo, DailyMotion, Google Maps, Instagram, Vine, Getty Images and a normal iFrames.
  • w3.org
    Is the syntax of your website built according to the standards? The validator from W3 helps answer this question. Don’t let all the warnings scare you, a website that is 100% perfect is still just an illusion, especially when you work with themes and plugins. And yet, making fewer mistakes in your code makes your website more findable by search engines. A first tip: tick the box in WordPress ‘Automatically correct invalidly nested XHTML’ under General > Writing.
  • GenerateWP
    Need an extra custom post type for your website? Or want to add additional taxonomies to your page? GenerateWP walks you through a wizard and then gives you the code to place in the functiphp of your theme, super simple!
  • WordPress Code Reference
    The first place to go to look for hooks, functions and classes within It’s thephp.net for WordPress.
  • WordPress API’s
    A helpful overview of all API’s available for the WordPress core. Your code will be much more durable if you use these kinds of APIs. For example, by writing and and reading files via WordPress’s File system API your code will be better compatible with various server platforms.
  • io
    This website makes an attempt to inventory all the hooks for WordPress. You will also find all the actions and filters from a growing number of plugins and theme’s. This website has become a great resource for the better known plugins.
  • Wcom/ WP Sniffer
    These two tools help you browse other peoples WordPress sites. You can see which theme is activated and what kind of plugins are running on the website. The picture it paints is not always complete, but it can help you find a underlying theme you like.
  • Google Fonts/ Adobe Typekit
    A few years ago it wasn’t possible for all web browsers, but these days, in theory, it is possible to use almost every font on your WordPress website (which doesn’t mean that all fonts are ideal, load quickly or are readable on your website). Google fonts offers a growing selection of free fonts that you can use. If you are looking for a very specific font then Adobe Typekit may be a better option. You will pay an annual price, depending on the font. Lastly, you can turn your own fonts into web fonts. With the Webfont generator by Font Squirrel, for example.

Teamwerk

To keep the ball rolling for larger projects there is almost no escaping teamwork. The following tools really help us develop our WP websites in team.

  • Google Apps
    The complete suite of Google services is also provided for companies under the name ‘Google Apps’. E-mail, agenda’s, hangouts, analytics and contacts all run on user-friendly Google software, but under your own domain. Various extensions for Gmail (like Labelizer) make it possible to share e-mails within your team by using labels. We use this tool as task system at the moment.
  • LastPass (Enterprise)
    Indispensable when it comes to the safe keeping of your login details and those of your clients. Thanks to LastPass Enterprise we can also easily share logins within the team or change them safely. Very affordable and used by large companies like MailChimp and
  • GitLab
    To keep self-written code orderly and simple, we use GitLab as a version management system. GitLab is really a kind of open source GitHub alternative you can host yourself. By using GitLab multiple team members can work on the same project without getting in each other’s way.
  • Toggl
    A good timesheet isn’t just something your customers will appreciate; it helps you get better at estimating where the most time goes in a project. That’s why we use Toggl to track the hours we spend on a project. That way we can see, per project, if we are on schedule with our hours or if we need to make changes. Above all, customers gain insight in the time that was spent and how. Time tracking isn’t fun to do, but it is important.
  • Teamwork Projects
    For project management we used to use Basecamp Classic, a relatively old system (in internet terms). At a certain pointBasecamp Classic stopped meeting our needs because it wasn’t further developed. Teamwork Projects made it possible to transfer our entire archive from Basecamp Classic, so that we could keep all the history of our projects. Colleagues and customers can get access per project. There are to-do lists, where each task can be assigned to a colleague or customer.  You can confer with all involved parties per task. You can share files, messages and important milestones.

 

Stay informed

The WordPress landscape is constantly under development. To stay informed regarding new features, as well as upcoming changes, we recommend you put these websites in your bookmarks or subscribe to their mailinglists.

To close

Now that we have covered all kinds of tools, techniques, plugins and tips for WordPress, we would like to emphasize the most important tip we like to give WordPress professionals: keep it simple! Especially when you’re thinking of using a technically clever solution, always ask yourself: ‘is this not already lying around somewhere?’. Often the answer is yes, and your customers will be happy they don’t have to pay for re-inventing the wheel.  This will also enable you to spend more of your budget on making sure the content of the WordPress website is just right, and that is often more valuable to your client.

Do you use tools we haven’t named? Let us know in a response below!

18 Tools for WordPress Hosting, Maintenance and Management

/in , , /by

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

When hosting, maintaining and managing hundreds of WordPress websites for our customers on a daily basis, you’ll need to guarantee stability for all these websites. To have them operate smoothly and safely you can use of a variety of tools. In this article we will go over the most important techniques and explain how we keep everything in-sync.

Note: Some of the provided links have an affiliate code.

WordPress hosting and maintenance: the ultimate worry-free solution

Our goal is to completely unburden our customers when it comes to WordPress. Practically, this means we take care of all the technical hassle so our clients only have to focus on the content of their website. This way, they don’t have to worry about WordPress hosting, updates, security or speed, because we got it all covered. Now, what tools do we use to accomplish all this?

Hosting

Managed WordPress hosting

We buy our hosting from the best Premium WordPress hosting parties, and continually and carefully look at the safety, stability and speed of their servers, and the quality of their support. Should we be able to guarantee a better speed on a different server, we may transfer websites between hosting parties.

Currently, we buy Premium WordPress hosting from WpEngine (starting at $29 pm) and Kinsta (starting at $100 pm for 1 website), among other hosting parties. In any case, we make sure we get the best match, which will depend on the specific requirements and requests of our clients.
[/av_textblock]

Managing

Making Sites Maintenance ready

Many clients that want us to maintain their website, have modified their WordPress theme. This often results in an inability on our side to update their theme without loosing the modifications they have made. This is why the first important step to prepare websites for our maintenance program, is to split the modifications into a parent theme (the original theme) and a child theme (the modifications made to the theme). This makes it safer and easier to update the parent theme without losing the modifications set in the child theme.

Once new clients are added to our program, we thoroughly verify whether or not hackers have had access to the installation. We also double-check if all users make use of complex passwords. Thirdly, we check if the installed plugins are malware free, non-conflicting and up-to-date. At times we may advise our clients to give up a certain plugin in exchange for a more solid solution.

InfiniteWP

Our update policy is an important aspect of our service. By virtue of performing controlled, daily updates, we guarantee the safety of our WordPress websites. All safety updates of plugins, themes and WordPress itself, are directly executed by us. For this daily taks we make use of  InfiniteWP (free, with add-ons at extra cost), enabling us to access and manage all of our WordPress websites within one interface, regardless where a website is hosted at that time.

In this central control system we can see how many updates are ready to be installed per website, and can perform these updates directly from a central admin panel without having to log into each separate website. We also check the impact of each update, and whether changes have an effect on the performance of the corresponding website. This way we resolve any issue that a new update may cause. All this is part of our service.

Other than that, InfiniteWP gives us the ability to clone a website, make backups, login directly, perform malware scans, install and activate multiple plugins at once, and much more. To cut a long story short: InfiniteWP is the linchpin in our centralized WordPress management system.

Plugins

Kraken.io

Images on a website are prone to take up a lot of loading time. By making use of image optimisation, we aim to limit file sizes to a minimum. For this we use Kraken.io (starting at $ 5 pm), a service that optimizes GIF, JPG, PNG and SVG files without any visible loss of quality. We use the Kraken Image Optimizer (free) plugin on every website, which automatically compresses every uploaded image, causing images of our clients to load over 50% faster.

Gravity Forms

Contact, sign up or request forms are indispensable for virtually every website we manage. There are but few WordPress form plugins that offer as many options as Gravity Forms (starting at $ 99 per year for multiple sites). Our clients use this plugin for many purposes. This is why we have a Developer License for Gravity Forms, enabling all of our clients to make use of this versatile plugin.

Akismet

Akismet (starting at $ 50 pm for multiple sites) is a spamfilter for WordPress websites that checks responses and form submissions. For this plugin we also have an Enterprise license, automatically filtering all comments, responses, requests and form submissions of all our clients.

Yoast SEO

We also install the Yoast SEO plugin (free) plugin for all websites of our clients. Another vital plugin to improve the findability of your website. With this plugin you can indicate each page’s title and a summery, and then immediately view how this would show up in Googles search results.

Monitoring

Uptime Robot

Uptime Robot (starting at $ 5,50 p/m) is an online service set up to verify whether a website is still up. Every website we host is being monitored via Uptime Robot. As soon as a website shows downtime, we are notified and can immediately investigate what is causing the site to be down.

Uptime Robot enables us to swiftly take action in case a site causes trouble. This way, the actual time a website is unavailable is significantly minimised. Uptime Robot also builds its own history, enabling us to compare the amount of downtime of multiple WordPress hosting providers over an extended period of time. Added to this, we are given insight into which websites are downtime prone. This, then, helps us to zoom in on specific problems so we can solve them.

Broken Link Checker

Once a website is transferred or going life, we double-check the links used on the site by virtue of Broken Link Checker (free). In some cases, we keep this plugin activated to be able to perform routine checks. Whenever links on a website are troublesome or no longer active, this WordPress plugin will notify us instantly via email.

Visual Monitor

Sometimes a website may be available and operative, but certain elements cease to operate as they should, like a slider that doesn’t function or a widget that suddenly disappeared. Logically, Uptime Robot won’t pick up on such inconsistencies. For this reason we have an additional monitoring system set up, that makes multiple screenshot per day of each website we host. This system then compares each screenshot with the previous one, and notifies us promptly when it detects any visual discrepancies. As a result, we can investigate what is going on as soon as part of a site changes or disappears.

Maintenance Mode Monitor

‘Maintenance-mode’ is selected by default when WordPress is updated. During such an update, visitors are shown a white background with a notice that the website is currently under maintenance. This notification only last seconds, for as soon as the update is completed, maintenance mode is deactivated. However, once in a while, it may occur that an update cannot be completed, which then results in WordPress staying in ‘maintenance-mode’.

To counter this we have developed a ‘maintenance-mode-detection’ in our visual detection system, which alerts us as soon as unusual quantities of ‘white’ are found in a screenshot. This detection also traces other issues (like a website that refuses to load completely), making it a valuable addition to the visual monitor mentioned before.

Robots.txt monitor

Search engines look for a file called ‘robots.txt’ on every website. For example https://www.wpupgrader.com/robots.txt. The ‘robots.txt’ file dictates which pages of your site may or may not be indexed by search engines. WordPress automatically generates this file for you. This, however, also causes you to have little of no influence on changes made within this file. Should this file store the wrong kind of information, then search engines may by default ignore you when indexing the internet. This is, of course, fatal when you want people to find you easily and swiftly. Our ‘robots.txt monitor’ checks whether each websites is configured correctly and alerts us as soon as it detects changes in this file.

PageSpeed monitor

For search engine optimalization (SEO) Google measures speed and optimisation by virtue of a so-called PageSpeed score. For this reason a fourth monitor is installed for all websites: the Google PageSpeed monitor.

Several times a day we verify the Google PageSpeed score of a website. As soon as major shifts are detected, we are alerted so we can investigate the reason behind an irregular score. Particularly when the PageSpeed score drops drastically all of a sudden, it is crucial that we find out why as soon as possible. The PageSpeed monitor helps us to inform our clients promptly when the alterations they make to their site negatively affect their score.

Dashing.io

Dashing (free). With Dashing multiple widgets can be projected onto a dashboard. Such a dashboard gives us a clean-cut overview of up and downtime monitors, pending updates, and much more. Instant alerts are given when one of our sites is down, or when there is an outage.

Dashing is open-source, but definitely a must for programmers. Dashboard is written in Ruby, Coffeescript, HTML and CSS. Additionally, you will find quite an extensive list of widgets for Dashing on GitHub, many of which can be installed as is.

Optimisation

CDN

A Content Delivery Network (CDN) is a server network that stores and delivers static content. By saving static content (images, scripts) in a CDN, visitors are able to load your website much faster because different segments of your site are delivered simultaneously from multiple servers. We make use of several CDNs, in accordance with the demands of our customer. Widely used CDNs are MaxCDN (starting at $9 p/m) and CloudFlare (free with paid add-ons). MaxCDN can be easily installed with an optimalisation plugin (read below), while CloudFlare is a bit more complicated in set up.

Optimisation Plugins

To improve the speed of a WordPress website a proper optimisation plugin is indispensable. Such a plugin first of all offers proper caching; a technique that memorizes frequently visited pages in order to prevent them from having to be rebuilt by the server every single time, thereby cutting loading time short. There are Premium Hosting companies that will handle caching themselves.
An optimisation plugin can equally help to combine and compress HTML, JavaScript en CSS, causing a webpage to load faster as it then consists of fewer files.

Lastly, linking a CDN is another option. In doing so, the plugin automatically loads images and other static content (like scripts) via the CDN.

Generally, we use two different optimisation plugins: WP Rocket (starting at $99 p/y for multiple websites) or W3 Total Cache. WP Rocket is conveniently simple to manage, works out-of-the-box, and automates many things. For more complexer websites we use W3 Total Cache, as it has more configuration options, like for instance specific script handling.