WP Upgrader launches GDPR Consent Plugin for WordPress

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-nrzf6b’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

With the General Data Protection Regulation (GDPR) about to be enforced, many website owners are also challenged: How do you make sure your website is compliant with these new rules? We have already discussed how you can make your website GDPR-proof with diverse WordPress plugins. Still, we kept missing one crucial plugin.

In order to meet the new, ‘privacy by default’ rule, WordPress plugins are only allowed to gather user data after your visitors have given you permission to do so. In other words, your website has to be accessible without personal data being gathered by default. The easiest solution for this — a cookie wall for your entire site — will no longer be allowed. So, how do you activate these WordPress plugins after your visitors have given their explicit consent?

GDPR Consent Plugin (€ 39/year)

For WordPress websites in Europe, WP Upgrader introduces the GDPR Consent Plugin: a plugin for WordPress that allows you to ask your customers’ permission before other WordPress plugins (and scripts) start gathering personal data. This way, you stop your site from gathering personal information before visitors actually allow you to do this.

How does the GDPR Consent Plugin work?

Step 1:
After having purchased the GDPR Consent Plugin, you have to determine which sections of your WordPress website gather personal data. Think in terms of plugins, but perhaps it may also apply to several scripts in your footer and/or header. You can sort this out by making use of the free GDPR-checklist for your WordPress website.
Personal data that is gathered, can be categorize in separate permission groups, such as ‘Statistics’, ‘Adverts’, and ‘Functional’. Inform yourself of the types of permission groups below this article.

Step 2:
Place the [gdpr_consent_settings] shortcode on the page where your visitors are allowed to edit their privacy settings. Then, activate the ‘Consent Bar’.

Step 3:
From this point onward, visitors will be shown a slim bar at the bottom of their screen upon their first visit informing them of their rights. On the privacy settings page they can now indicate whether or not they want to allow additional data to be gathered. For instance, to receive customized advertisements. Only when they give permission, will these plugins be activated for this particular visitor.



View the demo here: demo.wpupgrader.com

Does this make my WordPress website GDPR-proof?

The GDPR Consent Plugin is a tool to assist you in making your WordPress website GDPR-proof. This doesn’t mean that, by simply installing the plugin, your website will be automatically compliant.

Inform yourself on the impact of the GDPR on your WordPress website to get an impression of the additional aspects you have to take into account. Consider a solid privacy-statement on your website, ‘I agree’-tick boxes for contact forms, and a handling agreement with your hosting and administrative party. Also, take note that the GDPR will impact your entire organisation (for instance due to the right to have data erased from all records in your organization). Logically, such things are not solved by merely building a plugin into your website.

What kind of permission groups are there?

Common permission groups (‘Consents’) are groups such as ‘Functional’, ‘Statistics’, ‘Social media’, ‘Adverts’ and ‘Remarketing’. Certain organizations may set up specific labels for themselves. NPO.nl, for instance, makes a separate request for allowing ‘NPO Recommendations’.

You can define your own permission groups (‘Consents’) within the GDPR Consent Plugin. Some WordPress websites will use a Facebook pixel, remarketing plugins, etc., and then list them all under the ‘Adverts’ group. Others may prefer to split these into separate groups, like ‘Adverts’ and ‘Remarketing’.

Whatever your approach, it is important that you define your permission groups in such a way that visitors are not forced to activate plugins they do not necessarily need. Should a visitor agree to becoming part of statistics, for example, then this does not give you free range to automatically place cookies for social media sharing.

Celebrate consent!

Few visitors will explicitly give their consent to flooding them with ‘Adverts’ and ‘Remarketing’. This is why you will have to thoroughly explain what the added benefits are for doing just that. Terms like ‘Functional’, ‘Statistics’, ‘Social media’, ‘Adverts’, and ‘Remarketing’ are very technical in nature.

However, instead of having visitors mark the ‘Adverts’ and/or ‘Remarketing’ tick boxes, you can approach things from an entirely different perspective. Once you explain to them that you can optimally facilitate special offers, you may find the ones that do give permission, to be a smaller, but more committed target audience for your organization.

Top 5 mistakes in your navigation menu: This is how to prevent them!

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q5dose’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

The menu structure of your WordPress website is very important for both visitors and search engines. With this article, you can improve the main navigation of your website in a few simple steps. We’re talking about the most important menu at the top of your WordPress website. Are you ready for the do’s and don’ts?

Five mistakes in the navigation of your WordPress website

Mistake #1: Generic names for menu items

When I talk to customers about a new menu navigation, I usually show their homepage and cover everything but their navigation menu with my hands. I read the menu out loud and ask them: what is this website offering and to whom? There’s usually a silence. After your logo, the navigation menu is the first thing a visitor reads on your website. An excellent opportunity to show important information here. That is why instead of ‘Our services’ or ‘What we do’ we use the terms ‘WordPress Development’ and ‘Hosting & Maintenance’. When choosing the right terms, think of what the customer is looking for, instead of what your organization wants to say. Also check out our tips at the bottom of this blog.

Mistake #2: Too many items in your navigation

Limit the number of items in your navigation. A maximum of 7 is a good guideline, but less is even better. Personally, we only have four. Other options:

  • Make a short menu of, for example, three items. The last item being a menu button called ‘More’, that contains a drop-down menu with all the other, less important options
  • Use a secondary menu next to the main menu
  • Or both, see screenshot:

Mistake #3: Menu with an odd style

A menu with an unusual style is very common. Think of these mistakes:

  • Bad contrast between the menu items and the background, for example menu items that are shown on a colorful picture that makes it unreadable.
  • Hamburger menu on a desktop. We usually advise against this, because it adds an additional click, before your visitor gets to the relevant information. Except for a landing page where you want to show as little distraction as possible, and you choose to focus on just one action.
  • Bad responsive menu, that doesn’t come out well on smaller screens like tablets and mobile phones. (Tip: look at your website on all devices with Browserstack)
  • Odd location, for example when your main menu is not situated horizontally at the top or vertically at the left-hand side of your page (but in another creative place, without this making any sense or being a deliberate choice).

Mistake #4: Wrong order

Items at the top or bottom of a list are the most effective. Navigation is no exception to this. In psychology there’s the term ‘serial position effect’, which describes the tendency of a person to most remember the first and last items on a list. So, place your most important menu items at the top and your least important ones in the middle.

Mistake #5: Complicated drop-down menus

You’ve probably seen this: drop-down menus containing more drop-down menus, that make it impossible for you to click on the item you want. Just don’t do it! Live on the edge and try not using a drop-down menu at all. Why? Because you’re causing a choice overload, by confronting your visitor with more choices after they’ve just made a choice in the main menu. And yes, we’ve got some learning to do ourselves in this area ????

Five tips to improve your menu navigation

These where the things we often see go wrong in navigation menus of WordPress websites. But then what? How can you do it right? We give you five tips to improve the navigation of your WordPress website:

Tip #1: Take a visitor’s perspective

When naming your menu items, look at it from the visitor’s perspective and not your own (or that of your organization). When selling products, consider using the most important products or product categories as navigation. When providing services, try to name them. It can be helpful to use your target groups as navigation items. What will help your visitor to a better navigation?

Tip #2: Remember the search engines

When creating your main navigation, you also give an incredible amount of information to search engines about the structure of your website. This is why it can be a good idea to include your most important services and/or products in the navigation. Because with this, you’re saying: “Look, Google, this is what I have to offer”.

Tip #3: Remove the ‘Home’ button

The ‘Home’ button is not necessary in the main navigation. By far, the most internet users get that they can click on the company’s icon to go to the homepage. But keep your target group in mind: for an older target group we do recommend you leave the home buttons, because they are very used to them, and are very attached to the buttons they’re familiar with.

Tip #4: Put the call-to-action in your menu

In the end, your website is there to convince your visitors to do something. For example, to subscribe to something, order a product, request a quotation, to donate or to contact you. Put this action in your menu, because that is the way you want to lead your visitors. You’ll find good example, here below:

Tip #5: Make your menu visually attractive

When you sell various products on your website and you have a target group that is visually oriented, it can be very effective to include images of these products in your menu. Do you offer a service? Then icons are often very suitable. An example of Sony:

Bonus tip: Use WordPress to simply change your main navigation

Did you know you can easily change your main menu in WordPress? Check out our special WordPress Menu Manual!


There is usually lots of room for improvement in a main navigation. Do you have any good tips or ideas for this? We’d love to hear from you! Let us know in a comment below.

10 WordPress plugins to increase your conversion rate

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

In this article, we’ll talk about WordPress plugins that can substantially improve the conversion rate of your website. Please note: it’s no use installing ALL plugins. Consider which WordPress plugins actually lead to the kind of conversion you want. In case you need help with this, then read our tips on how to determine your online strategy.

We’ve divided the WordPress plugins into four common calls to action (some plugins appear in more than one category):

WordPress plugins for newsletter subscriptions

Do you want visitors of your WordPress website to sign up for your newsletter? Then we’ve listed the best WordPress plugins for newsletter subscriptions for you.

1. Ninja Popups ($ 25)

Ninja Popups is still one of our favorite plugins when it comes to collecting e-mail addresses on your website. The plugin is flexible, you can choose from many different pop-ups and you can choose the exact moment to show the pop-up (for example when the visitor is on your website for more than 30 seconds, when he’s scrolling, or rather right when opening the page). Also, you can send the new e-mail subscriptions directly to your favorite e-mail marketing software (like MailChimp or CreateSend). Make sure the pop-up is not full screen, because Google doesn’t like pushy pop-ups.

2. Elegant Bloom Email Optin ($ 89 per year)

Elegant Themes gives you one year access to a lot of plugins and themes for $ 89 per year, among which there’s Bloom Email Optin. You can choose from many beautifully designed pop-ups, opt-in bars and banners to let visitors subscribe to the newsletter. The nice thing about Bloom Email Optin is that you can also place the call to action as a widget in the sidebar or footer. This is something Ninja Popups does not offer. Bloom Email Optin is in comparison a rather pricy alternative, but worthwhile, if you also want to make use of the beautiful themes and the Divi content builder that Elegant Themes offers.

3. ConvertPlug ($ 21)

With ConvertPlug, you can choose from many different pop-ups for very little money. Subscriptions to your newsletter can be linked directly to your favorite e-mail marketing software, and there are flexible options to set up the pop-ups. The design of some of these pop-ups is in detail not always that great, but if you have some knowledge of CSS, then ConvertPlug is a good and cheap solution.

4. Thrive Leads (one time $67)

Thrive Leads is our most favorite plugin, because it is the most extensive one, and offers all the features of the above-mentioned plugins. You can make all kinds of pop-ups, but also do A/B testing, create Content locks (content is made available after you’ve given your e-mail address), Multiple Choice forms, etc. A big advantage of this plugin is that you get free updates for life after one single purchase. When you are a WpUpgraders customer, you can try out this plugin for free for a year.

WordPress plugins for forms

Sometimes catching someone’s e-mail address is not enough; for example, when the purpose of your website is to collect warm leads that want to be called back. In that case, you want at least a name and phone number, and a contact form with a flexible configuration is what you’re looking for. We’ve listed the best forms plugins for WordPress for you.

1. Gravity Forms ($ 39 per year)

Gravity Forms is still our favorite forms plugin for WordPress. The plugin has been around for years, it has a good reputation and is very well maintained. This is important, because collecting customer data requires a well-secured plugin. Granted; when it comes to design, there are other forms plugins for WordPress that look much more modern, but if your theme includes support for Gravity Forms – or if you’re pretty good with CSS – then this is still the plugin you want. Gravity Forms saves the subscriptions for you in WordPress, but you can also have them forwarded to e-mail addresses, external CRMs or marketing software.

2. Formidable Pro ($ 49 per year)

Formidable Pro is somewhat more complicated than Gravity Forms, but it also allows you to make simple applications. You can make forms entries publicly searchable, which allows you to, for example, create a review system on your website. In case you will be needing this kind of system on your website in the future, then Formidable Pro is a nice two-birds-with-one-stone plugin that’s worth buying.

3. Contact Form 7 (free)

The most well-known and widely used WordPress plugin for contact forms is still Contact Form 7. This plugin is completely free and has all the basic requirements; you can create forms, and visitors can fill them out. However, the entries are not saved on the website (so, if you don’t receive them by e-mail then they’re lost) and there’s no link to third parties included in the standard package. On the other hand, there are hundreds of add-ons for Contact Form 7 that offer such extensions. But if you think you’ll be needing those, we’d rather recommend one of the above-mentioned plugins; they have proven to be very reliable – with OR without add-ons.

WordPress plugins for direct contact

When we say direct contact, we mean the possibility to contact you with just one click. Contact forms (or newsletter subscriptions) are not included in this category, because the visitor has to do more than just clicking once. Depending on the branch you’re in, offering direct contact on your WordPress website can be very attracting (or even necessary). Think of websites for car dealers, but also web stores, real estate agents, etc. There are several plugins that create the possibility to make direct contact on your website.

1. LiveChat (free trial, then from $ 16 per month)

With LiveChat visitors can start a chat session on your website with just one click. With the LiveChat app on your phone, you can also respond while travelling. Are you not available? Then the chat will not be visible on your website. The WordPress plugin LiveChat is integrated into your WordPress website with just a few clicks. Plus, you can try out the service for free the first 30 days.

2. YITH Live Chat (free)

The YITH Live Chat plugin requires a little more configuration than the previous one, but a limited version is available for free. You do have to integrate the plugin using Firebase, a Google service for mobile applications. This service has a limited free version, but you have to pay once you start using it more frequently. If you like playing with settings options, you should definitely try YITH Live Chat.

3. Really Simple Click To Call Bar (free)

Did you know you can link buttons on your WordPress website to a phone number? When you click it, your device will directly call the phone number. For laptops and desktops this is, of course, of very little use, but for mobile visitors it can be very useful to be able to call you with just one click. The plugin Really Simple Click To Call Bar does exactly what its name implies; for mobile users, it adds a bar at the bottom of the website with a clear button: ‘Call us’. When you tap it, you immediately make the call.

WordPress plugins for social media conversion

Social media can be used in different ways to increase the conversion rate of your WordPress website. This works on two levels; first of all, you can convince the visitors of your WordPress website to follow you on social media (e.g. ‘Follow us on Facebook’. Secondly, you can use your WordPress website to feed your social media channels with new content, so you keep attracting your visitors to your website. Note: always keep step 1 in mind: does the integration of social media serve your strategy and objective?

1. Ninja Popups ($ 25)

Ninja Popups is not only good for e-mail marketing, but you can also use it to gather followers on social media. For example, you can show pop-ups on specific pages where you invite visitors to follow you on Facebook. It helps when you briefly explain to them the advantages of following you. For example, being informed on interesting offers or relevant messages.

2. ConvertPlug ($ 21)

ConvertPlug also offers social media integration beside e-mail marketing. The nice thing about ConvertPlug, is that you can also use pop-ups to tell your visitor about certain messages you’ve shared on social media. So, the plugin can be used to get more followers, but also to increase your range among your followers!

3. Jetpack Publicize (free)

Jetpack Publicize makes it easy to automatically share recently placed messages on your WordPress website with your social media channels. This is very practical when you want to efficiently increase your range of your WordPress website. There are very many WordPress plugins like Publicize, but we still find Publicize the easiest to work with. Publicize is part of Jetpack; a free plugin package that allows you to activate or deactivate different functionalities (so, you can install the package, but only use Publicize).

6 Plugins to Make Your WordPress Website GDPR-Proof

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

As the new privacy law — the General Data Protection Regulation (GDPR) — is about to come into effect, all sorts of plugins are marketed to help you get GDPR compliant. In this article we cover six practical WordPress plugins that enable you to make your WordPress website GDPR-proof!

GDPR Consent Plugin (€ 39 per year)

For WordPress websites in Europe, Sowmedia launches the GDPR Consent Plugin: a plugin for WordPress with which you first ask permission from your visitors, before your other WordPress plugins (and scripts) start collecting personal data. This way you prevent your website from already collecting personal data before your visitor has given permission for this. The GDPR Consent Plugin lets you define exactly which consents you want to request of your visitors, allowing you to present a clear overview of unique required and optional consents for your visitors to interact with. This GDPR Consent Plugin is the most complete WordPress cookie & consent plugin of all.

Delete Me (free)

The GDPR issues the ‘right to be forgotten’. This basically means that you have to be able to erase someone’s  personal data within a reasonable timespan upon their request. You could, of course, do this manually, but the WordPress plugin Delete Me offers your visitors to it themselves — that is, when it comes to data gathered by your website. Users can remove all their own posts and links, including their reactions to articles.

This plugin particularly comes in handy when you have a subscriber website or an active user group that regularly responds to your articles. Be aware, though, that this plugin will not remove data stored separately by additional plugins you may have added to your WordPress website.

Wider Gravity Forms Stop Entries (free)

The Gravity Forms plugin is our number one favorite plugin to build advanced forms for WordPress websites. Its form entries are stored in your WordPress site, but can also be mailed or forwarded to third parties, such as email marketing software. In case your entries are directly forwarded to another system, you may not need to additionally store these entries in your WordPress site.

The GDPR requires you to refrain from needlessly storing user data. This is why the Wider Gravity Forms Stop Entries is so convenient. This plugin removes entries immediately in your WordPress database, so form entries will only be stored in your external systems (or your mailbox). The only drawback is that you don’t have a backup of these entries any more in case you discover the link to your external system to be unresponsive, for instance. Alternatives to tackle this are the plugins below.

Gravity Forms Encrypted Fields ($ 27)

Do you store Gravity Forms entries within your website? Then you can protect these by encrypting them. The WordPress plugin Gravity Forms Encrypted Fields ($ 27) does this for you. User data is encrypted by this plugin within the database. Next, you can configure which persons are allowed to view specifically allotted entries. This may be required, particularly when you are gathering high risk personal data (like Social Security Numbers or medical information) that is not meant to be seen by all WordPress editors and administrators.

WP GDPR Compliance (free)

The GDPR demands ‘explicit consent’ of your visitors to allow you to process their data. Whether you want your visitors to subscribe to a newsletter, fill in a contact form, or react to a message, permission is required. Such explicit consent can be realized by virtue of providing a tick box for example. However, should a tick box be marked by default, then you are overriding the ‘privacy by default’ principle.

Forcing explicit consent in your WordPress website is largely done manually. Again, make sure that tick boxes aimed at having users agree with your terms, are not ticked by default. Fortunately, WP GDPR Compliance imbeds such tick boxes for you and supports plugins like Contact Form 7, WooCommerce and WordPress Comments. The author of this plugin has announced future support for other plugins as well.

Policy Genius (free)

An important part of GDPR compliance is making your privacy policy transparent. It is common practice to facilitate a link to a privacy policy in the footer of a website. Drawing up such protocols can be quite an endeavor. However, once you have constructed one that is explaining your policy in a clear and complete manner, you can then refer to it from any part of your website (for instance, places where you ask your visitors’ explicit consent).

The free WordPress plugin ‘Policy Genius’ helps you draw up a privacy policy in a few easy steps. This is no guarantee, however, that your policy then meets all requirements. It would be best to consult a lawyer to be safe.

The Impact of the New Privacy Law (GDPR) on Your WordPress Website

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

As from the 25th of May, 2018, the new privacy law (GDPR) comes into force. From then onward, all of Europe will have to abide by the same privacy regulations. The Dutch Wbp will be suspended and replaced by new regulations for processing and editing personal data. These new rules apply to your WordPress website too should you have a contact form, make use of Google Analytics, or have a webshop. In this article we explain how the new privacy law operates and what applies to your WordPress website and, therefore, deserves your attention.

This is no juridical article and no rights can be derived from its content.

Moving from a user agreement to a handling agreement

The former privacy law already required a secure processing of personal data, which was to be defined in a user agreement. The new law requires every European organization to be able to account for a secure handling of all personal data, which is to be recorded in a handling agreement. This means that you, first of all, need to know exactly what kind of personal data your organization gathers.

Secondly, you need to be able to guarantee that personal data you share with third parties, is also protected; such as personal data you share with your accountant, with your CRM or within your email marketing software. This applies to software of non-European origin as well (e.g. software supplied by American companies). You are obligated to make agreements with all your suppliers. Practically, this means the GDPR has an impact on privacy policies of organizations worldwide.

You also need to make agreements with third parties that have access to your WordPress website; like your hosting party, editors, administrators and parties that can access personal data via a plugin.

What is personal data?

What is considered to be personal data? And, when is this data deemed privacy-sensitive? Basically, all data that can identify a person as an individual. For instance, when someone fills in a contact form on your WordPress website. Data like,

  • name
  • postal address
  • email address
  • location data (e.g. GPS coordinates)
  • IP-addresses

Keep in mind that company information (e.g. the name of an organization, email address, postal address, etc.) is not considered personal data.

When is personal data regarded as extremely privacy-sensitive?

On top of ‘standard’ personal data, there is an additional category: ‘privacy-sensitive’ personal data. Should you handle data within your organization that is categorized as such, then there are additional requirements. These requirements also apply to your WordPress website, when you gather data that involves,

  • Social Security Number
  • Race
  • Medical information
  • Sexual orientation
  • Religious / political preference

What rights do consumers have?

As mentioned before, the goal of the new privacy law (GDPR) is to protect the rights of the end user (consumer). This includes visitors of your WordPress website. But what exactly are their rights, and what can they demand from you as an organization?

Inform, permit and refuse

People have the right to be informed before their data is being gathered, edited and processed by your WordPress website. Users must give their explicit consent to this, too. This means providing a cookie announcement in the footer of your website, giving the option to sign up for a new letter via a tick box (that is not checked by default!). Ultimately, users must be given the option to withdraw their permission at any time, for instance by unregistering or reviewing the cookie settings again.

Easy access

Individuals you have gathered personal data from on your WordPress website, are allowed to request this data from you. Organizations have to deliver this data within a month and are, in principle, not entitled to charge any costs. In addition, there is the data portability right: personal data must be able to be inspected in a reasonable manner. Excel sheets or CSV files are relatively easy to open, but a direct database dump is not.

Edit, limit and remove

Consumers are entitled to ask you to rectify faulty information, as well as request to refrain from further editing of personal data (apart from storing it). Also, every person has ‘the right to be forgotten’. Put differently, upon request you will have to be able to remove people’s data completely.

The GDPR and marketing automation

Quite possibly, you make use of marketing automation in your WordPress website. This may consist of email marketing software reminding you to respond to a comment, or to send a follow up mail once the first email has been viewed. Or perhaps adverts that are shown based on customer behavior.

People have the right to demand from you that your software cannot make automated decisions based on their data and/or behavior, unless you have explicitly have asked their permission. Therefore, in case you use marketing automation, make sure you explicitly ask your visitors permission, as well as inform them that automated decisions are made based on their personal data.

How serious is all this GDPR stuff?

The penalties that can be imposed by this law are considerable. That is, fines can run up to € 20 million or up to 4% of the annual revenue. The provided ‘grace period’ that lasts until May 2018, foretells that the GDPR will be seriously upheld. Moreover, the GDPR is applies to every organization within Europe; not only the bigger ones or the multinationals.

Make sure your WordPress website is GDPR compliant

There are many aspects to take into account in order to make sure your WordPress website complies with the new GDPR regulations. Make sure you do a Checklist: Is Your WordPress website GDPR Compliant?

Checklist: Is Your WordPress Website GDPR Compliant?

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

By May 25, 2018, every European organization has to comply with a new privacy law to be allowed to process and handle personal data. This applies to the personal data you gather via your WordPress website as well. We already posted an article on the impact the General Data Protection Regulation (GDPR) has on your WordPress website. In this article, we provide you with a clear-cut checklist to help you determine whether your WordPress website meets the GDPR requirements.

This is no juridical article and no rights can be derived from its content.

1. Inventory and document

To start off, describe the target group(s) that visit your website. Then make up a spreadsheet in which you document the kind of personal data your WordPress website collects for each group (inform yourself here on what the GDPR marks as personal data). As you specify per target group, you’ll reduce the risk of missing something. Complete this inventory by checking the following list:

a. Hosting & Administration

External service providers have access to your website as well. Check how they handle your data and if you have made the right agreements with them.

  • Hosting Party
    • Theoretically, your hosting party has access to all data on your website. For this reason, you will have to make a processing agreement with your WordPress hosting party.
  • Managed hosting, external developers and administrators
    • Which administrators have access to your WordPress website? Should you contract certain bureaus (or freelancers) to work on your WordPress website, then you will have to set up processing agreements with them as well.
  • Backup Locations
    • Where and how does your hosting party make backups?

b. Plugins

Log in as administrator on your WordPress website and answer the following questions to complete the list above. In WordPress, go to ‘Plugins’, then locate what data is being collected by each plugin and determine whether this data is being stored or not:

  • Contact forms (e.g. Gravity Forms)
    • What information do you require from your users? And where is it being stored?
  • Usernet plugins (e.g. Ultimate Member, BuddyPress, etc.)
    • What profile information is stored for each user? And, what else can possibly be deduced about your users through membership? Think in terms of political activity, religious preference, financial status, or sexual orientation.
  • E-commerce (bijv. WooCommerce)
    • E-commerce will contain basic personal data, such as names, addresses , and banking details. However, it also reveals the kind of products people order. Do you, for instance, sell magazines with a political affiliation?
  • Email marketing widgets (e.g. sign up via MailChimp or CreateSend)
    • Which information do you require? What will you do once you obtain it from your users, and to which service do you forward it?
  • Links with external services, like accounting packages
    • g. a link between WooCommerce and Exact Online
  • WordPress reaction plugins
    • g. Akismet, which filters spam based on data gathered from your users’ reactions, email addresses and IP-addresses. Or, Disqus, which stores such information as well.
  • Safety
    • Safety plugins, like Wordfence, process IP-addresses and user locations for instance.
  • Backup plugins
    • Complete copies of your site are privacy sensitive should they end up in the wrong hands. Where are backups stored and how are they secured?
  • Statistics
    • Like Google Analytics or Google Tag Manager: are you aware of which parts of your users’ data is being stored.
  • Logging
    • For instance, activity monitors that register user activity.

c. Services outside the EU

Check whether you make use of services outside the EU. For instance, American service providers, for instance, that may process data from your website. Verify if they are GDPR compliant.

d. Duration

Check how long personal data is stored and ascertain yourself that this is done no longer than necessary. The following step will help you consider whether this time span is justifiable.

e. Other

Which users have access to your website, and are their pass words up to par? Are you using marketing automation or A/B-testing? If so, have the subjects been informed?

2. Justify

You have to be able to justify reasons for all personal data you are storing on your WordPress website. Make sure your data gathering stays within the boundaries of the law. If you intend to store data on your WordPress website, then this is only allowed when meeting one of the following criteria:

  • Because it is by consent, backed up by an agreement
    Like paid subscriptions on your WordPess website for which you need users’ banking details.
  • Because you are obliged to record this by law
    Like customer data in your WooCommerce shop that you also need for your administration according as the Tax Administration demands.
  • Because you have been given explicit consent to do so
  • By virtue of a cookie announcement on your WordPress website or a registration form by which one subscribes to your newsletter. Make sure that,\
    • consent is freely given (users are not to be misled or forced)
    • consent is explicit (that means no tick box checked by default!)
    • consent needs to be given per component (e.g. someone registers for an event, and also subscribes for a newsletter)
    • users have to be able to withdraw their permission.
  • Because the gathering of this data is justifiable
    Like tracing the location of a logged in user as an additional safety check to determine if the user is logging in from a likely location on the planet. Of course, determining what is justifiable data gathering is somewhat of a grey area. All the more reason to explain in detail why you consider it justifiable. And, when in doubt, you may want to consult a lawyer.

Go through the inventory list (step 1) and check each item for its justification.

3. Confine

Remove personal data that you cannot legitimately gather and store in your WordPress website.

Deactivate plugins that can’t do so either, or search for alternative plugins that do comply.

4. Draw up Procedures

Record different protocols for situations that may occur in the future. Make sure it is crystal clear which information is to be found where, so you won’t have to figure that out later on. In any case, record the following procedures:

  • Personal requests
    Individuals may demand access to their personal data stored by your WordPress website, but may also want to edit or delete their data.
  • Safety
    Record how you will guarantee data to remain confidential, now and in the future. Think about a consistent update policy for your WordPress website, plugins and theme, but also a safe back up storage and a complex password policy for every new user that is added.
  • Data breaches
    In case of data breaches, you are required by law to inform the Personal Data Protection Authority within 72 hours. Therefore, make sure you have a phased plan ready, as speed is crucial in such cases.

5. Inform and ask for permission

Inform visitors of your WordPress website in a clear and transparent manner. This can be realized by clearly referring to a privacy statement, for instance in the footer of your website and in the cookie statement. Also, ask visitors of your WordPress website explicitly for permission of data handling activities as documented in your privacy statement. Make sure that you get their permission as described in step 2c.

Manual: Setting up Yoast SEO for WordPress

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-mnbi3f’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

With the free WordPress plugin Yoast SEO ((search engine optimization) you optimize your WordPress website for search engines. But how do you set up this plugin of Dutch origin? In this article, we’ll explain step by step how you can set up your WordPress website for the ideal search engine optimization.

In this manual

1. Install Yoast SEO plugin
2. Yoast SEO Configuration Service
3. Fine-Tune WordPress for SEO
4. Fine-Tune Yoast SEO
5. Link Search Console
6. Resolve Notification Issues
7. Write Content
8. Content Strategy

1. Install Yoast SEO Plugin

You’ll find the Yoast SEO plugin in the WordPress repository. In WordPress, go to Plugins -> New plugin and search for “Yoast SEO”. Click “Install now”, then click “Activate”.

2. Yoast SEO Configuration Service

Now that the WordPress SEO plugin has been installed, you’ll see a “SEO” button in your WordPress menu on the left-hand side. Click it to open the plugin’s Dashboard. You’ll probably already see some notifications and warnings, but we’ll ignore these for now. First click the “General” tab at the top, then click “Open the configuration service“, and then “Configure YOAST SEO”.

You’ll now run a wizard that will help you set up a large part of your website for SEO (search engine optimization). Many of these steps are self-explanatory, but we’d like to comment on some of them:

2a. Company or person? (step 4)

At step 4 you’re required to fill out whether you’re a company or a person. In both cases, you can still fill out the name of your company/person. We recommend you include your most important search term in your company name. For example, if you are a carpentry business with the name “Johnson LLC“, then fill out “Johnson LLC Carpentry”. And if your name is Vanetta Smith and you write a personal website on recipes, then call yourself “Food blogger Vanetta Smith”. Copy this text right away, because you’ll have to fill it out a couple of times.

2b. Social profiles (step 5)

When entering your social profiles, do not think: the more, the better. Limit yourself to using two or three social media channels, that you use well, instead of using eight which you totally neglect. Consider the social media channels that are most suitable for your target group.

2c. Visibility of the post type (step 6)

In every WordPress website there are three default post types: Pages, Posts and Media. Some themes and plugins add extra post types. A properties plugin for real estate agents, for example, can add the post type “Houses” to the website.

At this step, you can set up exactly which post types should be indexed by Google and which should not. All post types that you don’t use for the conversion goals of your website, can here be set to “Hide”. This does not mean that they won’t be used on your website. But only that the search engines won’t be instructed to index such posts.

In case you don’t have a blog/news archive, but only a few static pages, you can hide the post type “Posts”. The same often goes for media; the media library on your website is probably not setup with the purpose of attracting traffic that increases conversion; usually these media are used to, for example, placing images in your pages and posts, in which case you can simply hide “Media”.

In fact, some plugins put their settings in a post type. In that case, you might see something like “Extended framework” as a post type. If you have no use for this, then hide this too; the more unnecessary post types you hide, the better the other types will be valued by the search engines. Obviously, you’ll want to make sure you don’t accidentally hide a post type that you do need. Because then you’ll be throwing away a lot of valuable information for the search engines.

2d. Title settings (step 9)

At this step, you can fill out the website name. Here, you paste the text that you copied at step 4, or fill out your activities, and maybe even your location. For example, “Rotterdam Lawyers Friesinger & son”. Or “Architect Anna van der Molen”. You’ll need this text again later in this manual, so be sure to copy it again.

3. Fine-Tune WordPress for SEO

Now that you have run the configuration service, you’ll arrive back at the Yoast SEO plugin Dashboard. You’ll probably get some more notifications at this time. You can keep ignoring these, because first we’re going to run through some WordPress settings, that will probably resolve a large portion of these notifications.

3a. Site title and subtitle

Now, in WordPress go to Settings -> General. At the top, you’ll see the site title and subtitle. Many people use the name of their website or organization as a site title. This seems logical, but if you want your website to be easy to find in the search engines, it’s better to put your activity here, just like you did in the configuration service. So, again paste the title that you’ve used at step 2a and 2d here, e.g. “Furniture manufacturer New York – Donald McMillan”, or “Antique children’s toys – Web store ToyToy”.

Very often, the subtitle is still the default WordPress text: “Just another WordPress site”. Remove this line and enter a short description of your website. Try to use keywords that apply to your entire website and keywords that you want to lead visitors to your website. For example: “Web store for remanufactured chassis parts for Volkswagen Beetle.”

Now that you are on this page: be sure to scroll down and check if your website language is set correctly. Is your website in Spanish? Make sure your website language is also in Spanish. Because the language is also picked up by search engines. It says something about your target group.

Finally, click “Save changes”. Save or copy the title and subtitle, because you’ll need them again later.

3b. Update services

In WordPress, go to Settings -> Write. At the bottom of this page you’ll find a field to “Update services”. These are external webservices that need to be informed when you’ve made changes to your website, e.g. when you’ve written a new blog, or made changes to one. This makes sure that search engines are almost immediately informed of your new content, so they’ll include it faster in their search results. Make sure it says: “http://rpc.pingomatic.com/” under “Update services”. If it doesn’t, then paste this URL here. Pingomatic is an update service that informs all large search engines of your new content, so you don’t have to. Usually this is configured correctly, but it never hurts to check.

3c. Search engine visibility 

In WordPress, go to Settings -> Read. At the bottom of this page, you’ll find the “Search engine visibility” option. Make sure this box is unchecked, otherwise your website will actively inform search engines to NOT be included in the search results. Are you developing a website, or do you have a website that you, in fact, do NOT want showing up in search engines, then DO check this box. By the way, this is not a completely safe guarantee that your website will not show up in any search results; if you really don’t want to be found, it’s best to secure your website with a password. You can do this with a free plugin such as Password Protected.

3d. SEO for comments on your WordPress website

In WordPress, go to Settings -> Comments. Here, you can change the settings for comments on your website. It may seem strange to include this topic in a manual for SEO, but we’ve done this for a good reason. After all, comments on your website are content too! So, ask yourself whether comments on your website will help you be more findable to search engines, or that they would only add less relevant information to your webpage. If you’ve noticed that the comments on your articles lead to irrelevant conversations and discussions, then it might be better to turn off the option to leave comments on your website, or decrease the amount of comments under your blog. Or maybe you’ve seen that your blogs rarely get comments. In that case, you also better turn off the option to leave comments, because it makes your pages more compact. And with less irrelevant content, the rest of the content gets valued more by search engines and your visitors.

3e. Permalinks

With permalinks you configure the structure of your website’s URLs. This is very important for the SEO (search engine optimization) of your WordPress website, because the structure of a URL says a lot about the content of its page. As the term implies, permalinks are permanent; you configure them once, and then you never look at them again. Anyone who links to your website (search engines, social media, friends, etc.), will link to the URL as configured in your permalink.

In WordPress, go to Settings -> Permalinks. The default general permalink settings are year, month, day and name. This will result in URLs like www.furnituremanufacturer-newyork.com/2017/08/12/sanded-wood-with-discount/. But these data are probably not at all what you want in your URL. What you do want is to include the most important category of your blog in the URL (e.g. “Sale”). This way, you could get a URL like this: www.furnituremanufacturer-newyork.com/sale/sanded-wood-with-discount/. You can configure this, by choosing the “Customized structure” and then typing: /%category%/%postname%/.

Under the general settings, you’ll also find the “Optional” button. Below this, you’ll be able to change the category and tag archives structure. The permalink of the archive for the category “Dinner tables” by default would be: www.furnituremanufacturer-newyork.com/category/dinnertables/. But the word “category” is not relevant here (and thus a distraction for the search engines), so you could choose another word instead, for example: “furniture”. Please note that the category structure is the same for all categories; so, the “Sale” category archive will get the URL: www.furnituremanufacturer-newyork.com/category/sale/. In case you don’t know any good category structures, you can also turn it off altogether (see step 4e).

You’ll probably use several categories for most of your articles. The Yoast SEO plugin gives you the option to set one primary category, so that one will always be used in the permalink. To do this, click “Make Primary” next to the most relevant category, when creating/editing a post.

If you change the permalink structure afterwards, a lot of old links will probably become obsolete. This has great consequences for your findability; search engines don’t like it when pages in their search results are suddenly unreachable. It will cause you to drop fast in their search results. So, when you change your permalinks, check to see if existing links still work in the search engines. If not, then install a plugin like WordPress Ultimate Redirect Plugin ($ 29), that will automatically try to redirect as many “not found” pages (or 404 pages) to the right page. It’s like saying to the search engines: “The current page still exists, but has been moved to this new URL”. That way you transfer the accumulated value in search engines to the new pages on your website, and search engines will gradually adjust their index to your new permalink structure.

4. Fine-Tune Yoast SEO

Now that WordPress has been set up correctly for SEO (search engine optimization) and the basics for Yoast SEO have been configured, it’s time to do some fine-tuning in the Yoast SEO plugin.

4a. Activate advanced settings

To unlock additional functionalities in Yoast SEO, we first must change some settings. To do this, go to WordPress, SEO -> Dashboard and click the “Features” tab. Set the “Advanced settings pages” to “Enabled”. Then click the “Security” tab and also enable the “Advanced section of the Yoast SEO metabox”. Now click “Save”. In the menu on the left-hand side, under “SEO” you will now see additional options.

4b. Titles and metas

Titles and metas, are the title and description of a page/post, just as they are communicated to search engines. With this, you actually tell the search engine: “When you include this page in your search result, then show this title and description.” It’s obviously up to the search engine to do what they want, but if you use relevant texts, your request is usually honored.

Using good Titles and metas is very important, because you use them to give a first impression to your potential visitors, even before they visit your website. So, make sure you have attractive, relevant texts. The title is also shown in the tab/title at the top of your browser screen when visiting that specific screen.

Click “SEO” -> “Titles & metas” and open the “Homepage” tab. Here, you enter the title and subtitle that you’ve also filled out at step 3a. If you want, you can change the subtitle a little, by adding a call to action, to make it even more attractive to click on. For, example, if your subtitle is: “Web store for remanufactured chassis parts for Volkswagen Beetle”? Then your meta description could be: “Web store for remanufactured chassis parts for Volkswagen Beetle? Ordered today, delivered tomorrow!”.

Now click the “Post types” tab. Here you’ll see the visibility for the post types, as you’ve configured them at step 2c. Good to know, if you ever have to change this in the future. Here, you can leave the title and meta templates as they are, because we’ll configure these per article/page later in this manual.

Now, click the “Taxonomies” tab. Taxonomies is the umbrella term for both categories and tags. So, on this tab you’ll find all the categories/tags of your WordPress website. Every taxonomy has an archive page in WordPress. It is passed on to search engines by default. Just like with the visibility of the post types (step 2c) you must ask yourself here which categories/tags you actually use. So, for example, if you have added no tags at all to your posts, then set the “meta robots” for that taxonomy to “noindex”. This way, you tell the search engines, that the archive pages for that taxonomy don’t have to be included by the search engines; because they are not relevant pages.

For the taxonomies that you do use, you can check out the title templates. By default, they are set up as follows: %%term_title%% Archives %%page%% %%sep%% %%sitename%%. The title for a post category called “Sale” would then be sent to search engines like this: “Sales Archives – Furniture manufacturer Rotterdam – Pieter de Heuvel”. Which is fine, but there’s room for improvement. If you make sure all your categories for this taxonomy are consistent, then you can change the template to for example: %%term_title%% of %%sitename%% %%sep%% %%page%%. With categories like “Sale” and “Portfolio” you’ll get nice-looking titles: “Sale of Furniture manufacturer New York – Donald McMillan”, or “Portfolio of Furniture manufacturer New York – Donald McMillan”. The meta description template can best be left empty here, we’ll run through that later on in this manual.

Now, click the “Archives” tab. Here you will see some additional options for archive pages generated by WordPress next to the taxonomies. Such as author pages, date archives, etc.

Author archives show all articles per author. This is usually unnecessary, because for search engines it is rarely relevant who wrote the article. In fact, author archives are only useful when you work with several well-known authors and you want to build up findable archive pages for them. For example, the Youp van ’t Hek columns on the NRC (news) website. You can probably turn off your Authors archives, though.

The same goes for date archives; these show all articles published on your website during a certain period (e.g. January 2017). Unless you publish news messages that actually describe current events, you can turn off these archives; your archive pages for taxonomies probably offer much more relevant content than this kind of archive pages.

You’ve now configured quite a lot, so don’t forget to hit “Save”!

4c. Social SEO

Go to SEO -> Social. Here, you’ll find an overview of the social media accounts you added at step 2b. Run through the various tabs and fill out all the required information for the social media that are relevant for you. The rest of the precompleted settings in these tabs are all perfectly set, so you don’t have to look at those.

4d. Sitemaps

Now go to SEO -> XML Sitemaps. Sitemaps are XML files, automatically generated by Yoast SEO, that give search engines a structured overview of all content on your WordPress website. Make sure that the settings under the “Post types” and “Taxonomies” tabs include only in the sitemap what you’ve configured as visible at steps 2c and 4b.

4e. Advanced

Now go to SEO -> Advanced. You start off at the “Breadcrumbs” tab. A breadcrumb trail shows on which page you currently are in the tree view of the entire WordPress website. Many WordPress themes already have a built-in crumb trail, but in case yours doesn’t, it is best to archive it here. You do, however, have to make some adjustments to your WordPress theme, so a little PHP knowledge is required.

When activating the breadcrumb trail, delete the text after “Prefix for Archive breadcrumbs”. And at the bottom, at “Taxonomy to show in the breadcrumb trail of the post types” select for each post type the richest taxonomy for that post type. When I say “rich”, I don’t necessarily mean the taxonomy containing the most terms, but that the terms in that taxonomy are full of posts. Categories are usually richer than tags; an average tag maybe contains two or three posts, an average category probably ten to twenty. Finally, click “Save”.

Then, click the “Permalinks” tab. In this tab Yoast SEO can make a few more changes beside the changes you’ve made to the permalinks in WordPress at step 3e. This way, you can turn off the category structure if you couldn’t think of any good category structures at step 3e.

Enable “Redirect attachment URLs to parent post URL” to prevent visitors from directly going from a search engine to one of your website’s attachment pages (usually containing only an image and a title). This feature makes sure that visitors are sent to the corresponding page where the attachment is used. This is generally more relevant.

Finally, under “Clean-Up Permalinks” choose “Remove” under “Stop words in the slug”. This way, words like “the”, “a” and “an” are automatically removed from your permalink when writing new articles. The rest of the advanced settings are good, so now click “Save changes”.

5. Link Search Console

You can link the Yoast SEO plugin to your Google Account. This way, you can load relevant SEO information and resolve warning notifications on the website. Go to SEO -> Search Console and click “Get Google Authorization Code”. Follow the steps, paste the code and click “Authenticate”. You then get an overview of the pages of your website that cannot be found by Google, but that are linked to on other pages (or used to). You can run through this list and check to see if you can restore them (by changing the permalink of a page, or by making redirects to the correct page).

6. Resolve Notification Issues

Go back to the Yoast SEO plugin Dashboard. Maybe you’re still getting a few notifications. These notifications point to your WordPress settings that need to be resolved to further optimize your website for search engines. Do not click the close icon on the right, but click the link on the notification. You’ll then be directed to the right page for the WordPress settings.

In the above-mentioned example, you’re redirected to the WordPress Customizer, where you can enter your site title and subtitle under “Site Identity”. By the way, if you’ve been following the steps of this manual, you’ll probably not get this notification, because we’ve already fixed this problem.
Resolving notifications is something you can do on a regular basis. The Yoast SEO plugin gives you a clear overview, so if you schedule this once a month, it’ll cost you very little time.

7. Write Content

Your website is pretty much set up for Yoast SEO. But you can still fine-tune Yoast SEO per page, post, category and even per tag. We’ll start with fine-tuning posts and pages.

7a. Titles and permalinks of your WordPress articles and pages

After typing the title of your post, WordPress automatically generates a permalink for you. This is not always the permalink you want, and sometimes you change the title afterwards, but the permalink stays the same. The main rule is: you can easily change your permalink as long as you haven’t published your post yet. Then, you best leave the permalink as it is.

What is a good permalink for your post or page? You only need to include the most important keywords. Say, as a furnituremaker, you’re writing an article in the category “import” called “Strong quality improvement of imported wood from Italy”, the permalink automatically ends with: “/import/strong-quality-improvement-imported-wood-from-italy/”. This can be made shorter and more relevant; the words “import/imported” are duplicates and some of these words are not relevant for the slug. How about: /import/quality-improvement-wood-italy/? Much better.

7b. Configure the Yoast SEO metabox

When you’ve finished writing your article, there’s a new block “Yoast SEO” under your text editor. Here, you’ll see an example of how Google will probably show your page in the search results, based on your title, permalink and text. An example of such a snippet below.

The content of this snippet is based on the settings we’ve configured in the previous steps. However, it is possible to make a few more adjustments for this particular article. In the above example, we see that the title is too long for the box, and the description underneath is too. Click “Edit Snippet” to change the title and description. By making the title and the meta description a bit shorter and more attractive, we’ve created a snippet that looks nice in Google:
You can edit the snippet for each and every post or page that is important for you in the search results. Also, you can edit your categories and tags to see per category what a similar archive page will look like in search engines. To do this, go to Posts -> Categories (or Tags) and select a category. At the bottom, you’ll find the Snippet. You can, for example, give the category “Import” a nicer description:

7c. Focus keyword

Under every snippet you’ll also find a “Focus keyword” field. Here, you can enter the most important keyword of the page. Under the focus keyword, the SEO plugin gives you an analysis of the page, containing suggestions to make improvements. Mind you, it is a technical tool; always ask yourself if the suggestions make sense. The analysis of an article with the focus keyword “jerseys” can turn out wrong, because the words “jersey” and “sweater” won’t be recognized. So, use the analysis as a guideline, not as hard facts. Furthermore, it is good to know that the focus keyword is only a personal analysis; the focus keyword won’t be sent to search engines as a search term, nor is it embedded in the code of your page.

7d. Cornerstone articles

When you’re editing pages or posts, there’s another option under the focus keyword: mark the article as “cornerstone content”. Cornerstone articles are the most important articles on your website. The ones you really want everyone to read. Say you write a lot of articles on the different aspects of DIY woodworking. But there is one article about the complete process of woodworking. In that case, this article is a cornerstone article; in a way, all the other articles are related to this main article. By marking the main article as a cornerstone article, Yoast SEO will make new suggestions; are there enough links to this article? And do these links contain the most relevant keywords for this article?

An average website can contain about five cornerstone articles. Choose them carefully and ask yourself; can I link to these cornerstone articles from all the other (non-cornerstone) articles? And make sure you do this; after the introduction of a non-cornerstone article, make a quick reference to the cornerstone article.

8. And from Now on: Content Strategy

If you’ve made it all the way to the end, your WordPress website has a great configuration for SEO! But you’re just getting started; make sure your website stays attractive, relevant and up to date. You do this, by regularly writing articles on topics related to your website. Make a content strategy and schedule, for example, one day a month to write and publish a good article.

Use social media for your organization

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

Many organizations have all kinds of social media links on their WordPress website. But is this wise? When you use social media the wrong way, they can backfire on you. In this article, we’ll explain what you can do as an organization to prevent this from happening. And we’ll talk about a social medium that is often forgotten.

Invite in or send away?

Imagine you’ve just finished a new blog post and you share it on your Facebook page. An interested follower clicks on the link and visits your WordPress website. While he’s reading your article, he sees the sidebar with Facebook and Twitter feed. He stops reading and starts scrolling through your Twitter feed. He clicks on one of the conversations and goes to the Twitter website.

What is happening here? You first successfully get the attention of a visitor on Facebook, but as soon as he arrives on your WordPress website, you make it really easy for him to leave again. That sucks!

Social media on your website 

We see many organizations embed all kinds of social media feeds on their website. For example, you’ll see their most recent messages from Facebook, Twitter, LinkedIn, etc. in the sidebar next to an article. Embedding a feed like that is so simple, that you almost forget to ask yourself why you would do this. Very often, such a feed does not serve your goals.

I often hear people say they place these feeds to keep their website ‘alive’, or because they want to show their organization is an interactive and modern one. But these arguments don’t fit in a solid online marketing plan. You’re treating your visitors like ping-pong balls: on social media you invite them to visit your website, but once they’re there, you put your social media back on display.

Don’t make it too difficult for your visitors; limit their choices. Ask yourself where does most of the conversion of online activities take place for your organization. Are most of the sales and quotation requests processed on your website or on your social media channels?

Marketing funnel

Your online activities are like a funnel: by being visible on various platforms, you attract as many people as possible to one place. Often this place is your website, but in some cases, this can be a social medium (a vlogger’s purpose is to “funnel” as many followers as possible to his YouTube channel).

Say your marketing funnel points to your website. Does this mean you should not integrate any social media on your website? Maybe, but then you might be taking it a bit too far. Because even if the conversion for your website might not be happening on social media, they may still serve another purpose: engagement.

Engagement: a long-term relationship through social media 

Even if the conversion for your organization does not take place on social media, they can still be functional to build a “soft relationship” with your visitors. Because every visitor is unique; one takes immediate action on your WordPress website, another may want to get to know you better first. Social media are perfect for this.

Again, a well thought-out online strategy is very important; because you need to focus your social media on a specific target group: potential clients that want to get to know you better. This means you have to think about the image you want for your organization on social media; are you an informal bunch, or a serious group of professionals?

These choices determine the type of content you put on social media; do you build confidence by showing you’re having a good time or by sharing professional knowledge? To answer this question, you can ask some of your new clients what made them decide to become your customer. You can let these decisions determine your content on social media.

When you’ve decided on a strategy, then you can go back to thinking about the role of social media on your website. A role which is now well-defined: For example, you now only bring social media to the attention of your visitors to give them an alternative, next to the direct action to make a purchase. Or you use social media mostly to ask (and answer) direct questions. Whatever the purpose, with a clear definition you’ll know how and where to use social media on your website. For example, a social media follow button with caption, or rather a prominent place on the contact page.

Which social media and which target group?

Every social medium has a different user group. And these groups change continuously. We see Facebook being used mostly by adult consumers, Instagram and Snapchat are more popular with teenagers, and Twitter is averagely used more by men than by women.

Plus, there is a clear difference between business and personal use. Few users have a Facebook account for their business. On the other hand, there aren’t many people on LinkedIn who show pictures of their afternoon walk.

The difference in age, fields of interest and motivation of users are important for the way you use social media. When you have a business service, think about the usefulness of approaching your customers through social media. A manufacturer of packaging material would not use a marketing campaign on Instagram.

Don’t forget this one 

The landscape of social media is changing continuously. Every time, different social media are popular. That’s why you’d almost forget this one social medium that has been incredibly effective when it comes to building engagement: e-mail.

The great power of e-mail is in this small detail: messages on social media pass by very fast; if you’re not on Facebook even for a day, you miss a great number of messages. Messages that you don’t just get back on your timeline. An e-mail, however, only disappears after you’ve read it (or marked it as read). So, e-mail has a much more pressing character than messages on social media.

Because e-mail is more pressing, it demands caution; for a good reason, many e-mails end up in the trash or spam folder without being read. By law you are required to get someone’s permission before sending them a newsletter. And if you have this permission, consider carefully the e-mail’s title, length, content, the time you send it and the frequency with which you send e-mails.

Common WordPress problems and solutions

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

WordPress is popular. Many users love the possibilities the system offers and see no problems. At WpUpgraders we focus on professional maintenance. We see WordPress problems on a daily basis. Time for an overview of the problems we come across and the solutions that are available.

Before you tackle these kinds of problems we advise you to make sure the back ups of your website are in order. 


Slow website

A common problem is a slow website. We’ve written various blogs about this issue. The most important cause is slow hosting. Start with a good Managed WordPress hosting. Is your hosting fast? You can work to improve the speed of your website yourself.

Unexplainable visual changes

With unexplainable visual changes your WordPress website looks different even though you haven’t updated it. The website isn’t offline. The cause could be anything. In this case it’s important to start by emptying the cache.

Rule out caching problems

  • Empty the browser cache

    Start by refreshing the browser cache via Ctrl + R (Windows) of Command + R (Mac). The page will then be reloaded without using the cache from the browser. A more thorough way is to remove the entire cache from your browser.

  • Empty the plugin cache

    Do you use a caching plugin like WP Super Cache, W3 Total Cache or WP Rocket? In that case you can log into the WordPress back end and empty the cache there via the plugin settings.

  • Empty the hosting cache

    Lastly, sometimes caching happens at server level. In most cases you can log in to your hosting provider’s admin pannel and empty the cache there.

White Screen of Death – WSOD

After working on your website you encounter a white screen. The cause is usually a PHP conflict in a WordPress plugin or your theme. It may also have to do with the maximum memory available for your WordPress website. In these cases you should get an error notification from the server, this is just hidden from outside users.

  • Rule out hosting as the cause

    When you see a white screen the problem is probably your website and not the hosting provider. Still, it can’t hurt to make sure the server is accessible. Ping your WordPress website and you will find out if the problem is at a server level. There are also other interesting tests you can run from the Ping website.

  • Switch on the debug function for more information

    The white screen indicates there are error notifications, but they are not being shown. Sometimes you can see an error notification by turning on the WordPress debug function in the wp-config.php file of your WordPress website. PHP errors will then be shown in your WordPress website. You can change the wp-config.php file with a FTP program. The file is in the main folder of your WordPress website and can be edited. Make sure the debug function is on: WP_DEBUG is normally set to ‘false’, set it to ‘true’ to show notifications.

    define( 'WP_DEBUG', true );
  • Repair WordPress

    Have you just updated WordPress? Or did you accidentally make a wrong change to WordPress files? In that case WordPress could be the cause. Go to your website files via FTP and overwrite all WordPress files with the latest version. Find the latest version of WordPress here.

  • Switch off conflicting plugin(s)

    What is the last plugin that you changed or installed? That is probably the problem. Try to deactivate the plugin via the WordPress back end. Doesn’t work? Deactivate all the plugins. If the website is working again your can re-activate the plugins one by one.

    Can’t access the WordPress back-end? Use FTP to deactivate the plugin(s). You can do this by renaming the plugin directory in the directory /wp-content/plugins. Put a number in front of the name, for example. The name change will mean the plugin will be seen as a new plugin and will not be activated.

  • Increase the maximum allocated PHP memory

    Another possible cause for a white screen is that there is not enough memory available on the server for your WordPress website. For example, because there are a lot of visitors to the site or because of a plugin or script that takes up (too much) memory. This problem often occurs with cheap, shared hosting in combination with WordPress websites with heavier plugins like WooCommerce, WPML or other plugins.

    Tip: you can find out how much memory is available via the WordPress phpinfo() plugin.

  • Check homepage and other pages

    Is your homepage working, but all the other pages are white? In that case the permalinks might not be working properly. You can solve this problem with a quick fix by going to Settings -> Permalinks in WordPress and changing the settings to standard.

    The actual cause and solution, however, are at the hosting level. To be able to re-write the standard permalinks to ‘good permalinks’ the mod_rewrites module (for Apache) or a similar module (for Windows servers) needs to be on. As soon as the settings are right on hosting level you can choose the permalink structure you want via the WordPress back-end.

  • Repair your theme

    WordPress itself and the plugins not the problem? Check to see if the theme is the source of the problem. In general, themes aren’t usually the source of the problem. It is possible however. If this is the case, deactivate the theme via the back-end or via FTP, just like with the plugins. Take into consideration that switching off or changing your theme will have consequences for your widgets, theme settings and menus.

    • Activate a standard WordPress theme (for example Twenty Sixteen) to see if this solves the problem.;
    • Overwrite your theme with the newest version available.

    Finally, it’s possible that the white screen is due to the fact that there is no theme activated at all. The theme could have been removed via FTP. In that case you get your website back by activating you (child) theme.

Notification: Internal Server Error / “HTTP 500 Internal Server Error”

When you see these notifications you have usually (but not always) done something wrong. This notification is usually given when there are PHP problems with plugins or thema’s. Exceeding the memory or a modified .htaccess file could also be the problem.

  • Empty the cache

    Rule out problems with caching. Follow the instructions for Unexplainable visual changes.

  • Switch on the debug function for more information

    See the instructions for White Screen of Death – WSOD.

  • Repair corrupt .htaccess file

    You just – consciously or unconsciously – made a change to the .htaccess file. If you access the website via FTP you can see the .htaccess file in the root. Rename the file. For example, by calling the file .htaccess_old. If the website works again after changing the name you know that the .htaccess file is the problem.

    After renaming the file it’s important to make a new .htaccess. You do this by clicking Save changes in Settings, Permalinks. If there is no .htaccess file WordPress will create a new one.

  • Repair permissions

    Specific files or authorizations do not have the right permissions, which causes an Internal Server Error. The easiest wat to fix this is to repair the folder permissions and set up the files again via FTP. Standard settings in WordPress are 755 for directories and 644 for files.

  • Repair WordPress, plugins or theme

    An important cause of a 500 notification are plugins and themes. In this case, follow the same steps as for White Screen of Death – WSOD.

  • Contact your hosting provider

    Contact your hosting provider if above mentioned solutions do not solve the problem. It’s possible that the Internal Server Error is because of an error in the server configurations. And otherwise they will be able to find the cause of the error notification in the server logs.

Notification: Error Establishing Database Connection

This notification means that no connection is being made with the database. This notification usually appears during WordPress installation. The notification may also appear randomly.

  • Check database data in wp-config.php

    WordPress gets the information needed to make connection with the database from the wp-config.php file in the root. Check to see if the information is correct, for example, if you have recently moved your WordPress website. We advise this step particularly around the time of installation when there has not been any connection with the database.

  • Contact your hosting provider

    If your website has been working properly, but suddenly gives this error notification this points to a problem with the database server. This is not something you can fix yourself. Contact your hosting provider.

Notification: Connection Timed Out

The server generates this notification when your website needs more time to generate a webpage than is available.

  • Deactivate the plugin causing the problem

    What is the last plugin that you modified or installed? This is probably the source of the problem. Try deactivating the plugin via the WordPress back end first. Follow the same steps as for White Screen of Death – WSOD.

  • Deactivate your theme

    Deactivate your theme to find out if the theme is causing memory problems. Follow the same steps as for White Screen of Death – WSOD.

  • Increase your memory

    Contact your hosting provider to talk about options for increasing the memory for your website.

Notification: Parse error, syntax error

The syntax error is a PHP notification that a piece of code has not been written following PHP guidelines and so cannot be executed. The notification will specify where the problem is. You can look up the file and line of code via FTP to change it.

Notification Warning: Cannot modify header information

After updating WordPress you see this notification in your browser: “Warning: Cannot modify header information” – headers already sent”. Often this is caused by other error notifications on your webpage. If you see any other error notifications take care of them first.
If you continue to see the notification afterwards, it is probably due to unneccesary spaces (for example enters, spaces) at the beginning or end of WordPress files, before the code begins and after it ends. In the example below, for example, there is unneccesary whitespace at the top of the wp-config.php file:

To solve this problem your can reach the file via FTP. Edit the file using a text editor and remove all whitespace at the beginning and the end of the code.

Notification: Briefly unavailable for scheduled maintenance. Please check back in a minute.

When updating WordPress and plugins the maintenance mode is activated and the website is not available. Updating doesn’t take long (usually no more than a few minutes), so the down-time is limited. Sometimes WordPress gets stuck in maintenance mode after an update.

  • Remove .maintenance file via FTP

    During the maintenance mode a .maintenance file is created in the root. You can remove this. Note: this is a hidden file, so you must set up your FTP program to make hidden files visible. After removing the file the website is taken out of maintenance mode and will be live again.

  • Don’t do anything

    The maintenance mode switches itself off after 10 minutes, so if you don’t do anything the problem will solve itself.

Images cannot be uploaded

A common problem is that images cannot be uploaded to the media library.

  • Check the permissions for the upload folder

    A condition for uploading images in WordPress is the permissions for the uploads folder. Uploads is a subfolder of the wp-content folder. Make sure the setting for the uploads folder and any subfolders is 744.

  • Upload a different image

    The cause of the problem could be the image itself or the extension. Try uploading another image. If it works then you know the file was the problem.

  • Check any image optimization services

    At WpUpgraders we use Kraken to optimize images. This means that images are optimized by Kraken at the time we upload them. A malfunction at Kraken could have effect on our websites. That’s why this is important to check.

  • Check the maximum upload size

    There may be a maximum upload size given by your hosting provider and via the php.ini file. When uploading to the media library this will be indicated under the upload button.

  • Check your storage space

    Check to make sure the hard drive space given by your hosting provider isn’t full. You can usually see this via the hosting admin panel. Sometimes you share storage for your website space with your e-mail accounts. This can cause your storage to fill up quickly. In this case ,you will need to delete files from your media library or ask your hosting provider for an upgrade.

  • Contact your hosting provider

    In many cases a permissions setting on the server is the reason you are unable to upload images. Contact your hosting provider if you can’t find a solution to the problem.

Problems logging in

You are sure you have the right user name and password, but you still can’t log in.

  • Reset your password

    Are you sure you have the right login details? Try resetting your password via the forgot password function. Doesn’t help? Try the solutions listed below.

  • Check security configurations

    ManyWordPress websites are secured by a security plugin like WordFence or iThemes Security. These plugins block an IP-address or IP-address ranges when too many attempts have been made to log in. This may be hackers trying to log in. But it could also be a colleague who has forgotten his or her password and tries to login multiple times in vain. An IP restriction is usually for a specific time, so you could just wait an hour and then try again. Another option is to (temporarily) turn off the security plugin via FTP.

  • Contact your hosting provider

    Many hosting providers look after the security of your WordPress website on a server level. It could be that you are locked out after failed attempts to log in. It is also possible that they changed your password for security reasons.

E-mails from the website do not arrive

Both admin and website visitors are not receiving e-mails via the website. Not when users register their information, not the forgot password function, notification of forms, order confirmations etc. The cause is probably that your e-mail is not getting through the spam filters.

  • Send via a transactional e-mail service

    Instead of sending the e-mails from the website (transactional e-mail) via your website server send the e-mail via an transactional e-mail service. A well known option is Mandrill from MailChimp. Charges apply. Freemium alternatives are Mailgun, Mailjet and SendGrid.

Website has been hacked

All above mentioned problems may occur if your website has been hacked. We’ve written a blog about removing malware from a hacked website.

Tips for keeping your WordPress website up-to-date

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

Nearly every WordPress website that is not updated will be hacked sooner or later. Hackers make scripts that search the internet for vulnerability in WordPress plugins and themes. As soon as plugin vulnerabilities are known hackers can automatically scan WordPress websites to see if the relevant plugin is being used. For this reason, we sincerely recommend you update your website regularly. You can outsource this WordPress onderhoud (Dutch link) to WpUpgraders, but you can also do it yourself. In this article we’ll give tips both unexperienced administrators and professionals can use to keep your WordPress website up to date.

A number of links in this article are embedded with affiliate code.


Tips unexperienced website administrators

Conquer your fear

Many WordPress website administrators are afraid to update their websites. They are afraid of potential consequences, like a plugin that stops working or layout changes in a theme. But all we can do is advise you to get over your fear and update anyway. The consequences of a potential hack are much greater than the consequences of the update.

Keep your website simple

An important tip is to keep your website simple. A simple website is simple to update. Complex websites are more difficult to update.

  • Limit the number of plugins; each extra plugin you install brings extra risk. We don’t limit the number of plugin that we use when developing a website, but we know where the risks lie and we are the ones responsible for the updates. If you are not experienced it’s better to use a limited number of plugins.
  • Avoid complex plugins like multilingual plugins (like WPML), e-commerce (like WooCommerce) and layout editors (like Visual Composer).
  • Avoid multi-purpose themes. We often use Enfold. This multi-purpose theme is technically solid. Even so, we have to pay close attention when updating. We are not as pleased with other multipurpose themes. Like Jupiter. Good looking theme, but it’s a hassle to update.
  • When purchasing plugins and themes check to see if they can be updated automatically, so that you avoid having to do updates at FTP level.
  • Want to make changes in the code of your theme? Use a child theme, this way you can update the main theme yourself. Read here to learn how to make a child theme.

Remove unused plugins and themes

During the development of a website various plugin and themes are often tested. Some of them don’t end up being used, but can make your website venerable to being hacked. Remove these plugins and themes so that they don’t have to be updated.

Update periodically

It’s best if you can update as soon as an update is released, but this might not be do-able. Small websites can be updated periodically. Once or twice a month, for example. Set a reminder in your agenda to update every first Monday of the month.

Backup before you update

Always make an update before you update. If the update happens to cause problems you can always go back to the situation before the update. Many hosting providers make automatic back-ups. Or you have an admin panel (cPanel, DirectAdmin) you can use to make a backup yourself. You can also make a backup with the WordPress admin using a plugin. We like to use UpdraftPlus, a premium plugin with a good basic version. Alternatives are BackWPup, BackupBuddy or VaultPress.

Update WordPress first and then plugins/theme

First update the core of WordPress and then your plugins and theme.

Updates in your e-mailbox

When you are logged in to the back end of WordPress you will see notifications in the lefthand menu when there are updates available. Many people forget to update because they don’t update their website when it gets busy. You can remind yourself. For example with the plugin WP Updates Notifier, it sends you an e-mail when new versions of WordPress, plugins or themes are available.


Is updating just not your thing? Outsource your web maintenance. Or choose a website via WordPress.com instead of a WordPress installation on your own server. WordPress.com is a Software-as-a-Service (SaaS). Your website wil be hosted on the Automattic servers (the company behindWordPress). They will make sure your website is up-to-date. WordPress.com gives you less freedom compared to your own WordPress version of WordPress.org. However, you don’t have to worry about safety and speed. And it is relatively cheap.

Tips for professionals

Make an inventory of risky plugins

There are plugins that cause little harm when updating. Take, for example, a plugin that adds a small functionality to the media library. Which plugins generally don’t give any update problems?

  • Statistic /Google Analytics plugins;
  • SEO plugins;
  • Backup plugins;
  • Database optimization plugins (Note, we are taking about updating the plugin, not the optimization);
  • Media library plugins;
  • Security plugins;
  • Admin plugins, that add extra functions to the WordPress back end;
  • RSS-feed plugins;
  • Development plugins.

Other types of plugins bring more risks.

  • E-commerce plugins like WooCommerce and add-ons;
  • Multilingual plugins like WPML;
  • Layout editor/Page builder plugins like Visual Composer;
  • Shortcode plugins;
  • Slider plugins;
  • Image presentation plugins;
  • Contact form plugins;
  • Event calendar plugins;
  • Pop-up and lead generation plugins.

Change log

Check the plugin change log to inventory any risks that may be expected.

Update premium plugins and themes

Most WordPress plugins can be automatically updated from the WordPress plugin repository. For plugins and themes you have purchased it doesn’t work like this unfortunately. You don’t always get a notification when an update is available. And you can only update the plugin or theme by overwriting the files on FTP level. Updating premium plugins is more complicated. Unfortunately we don’t have any standard solutions to this problem.

Use admin tools

Do you manage multiple websites? Use an admin tool like ManageWP, MainWP, WP Remote or InfiniteWP. We use this last tool. An admin tool gives you overview of which websites need updating. You can also perform updates directly from the tool.


Don’t forget to test after you have updated the website. The most important thing to test is the functionality of the front end. You will find any potential problems in the back-end when managing the website. What is the best way to test?

  • Check the homepage and a few other pages;
  • Fill in a form and/or other call to actions;
  • Check to see that the multilingual function is working;
  • Check extra moving elements like sliders, pop-ups, cookie bar;
  • Test the search function;
  • Test any API links. For example MailChimp or CreateSend.

Use a staging

Want to really update safely? Use a staging environment. You perform the update in the stage and, after testing, overwrite the live environment with the staging. It takes more time, but prevents users from coming across any problems the update may have caused. How do you use a staging environment?

  • Hosting providers. We usually use a staging environment provided via the hosting provider. WP Engine, one of our hosting partners, has great facilities.
  • Plugins. Work with a staging via free plugin WP Staging or the paid plugins WP Stagecoach and RAMP.
  • Software. Develop and push changes via DesktopServer, a program on your own computer.


Useful plugins

There are plugins available that will help you update your WordPress website.

  • WP Update Settings; use this plugin to change settings via the back-end of WordPress that pertain to the update proces.
  • Automatic Plugin Updates; plugin for automatic updates.
  • Plugin Vulernabilities: plugin lets you know when vulnerabilities have been found in the plugins that are used on the website.
  • Plugin Security Scanner: plugin e-mails the website administrator if any vulnerabilities are found in the plugins that are present.
  • WP-UserOnline: plugin shows how many users are active on your website. Wait to update until there are almost no visitors at the website.


What to do when it goes wrong?

  • During the update WordPress switches to maintenance mode. The website is not accessible while updates are being made. Usually for no more than a minute. Does the website get stuck in maintenance mode while updating? No problem. Wait ten minutes, the maintenance mode overrides itself. Or go to the server via FTP and remove the .maintenance file from the root.
  • Activate your backup and update themes and plug one by one so that you know which update causes the problem.
  • Google the problem and see if you the solution is known.
  • Get in touch with the theme or plugin builder and ask if there is a solution to the problem.


The 100 best free WordPress themes of 2018

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

There’s and endless choice of WordPress themes in all shapes and sizes. Looking for a good free WordPress theme is like looking for a needle in a haystack. That is why we list the best free WordPress themes for you every year. In this article you’ll find our review for the best free WordPress themes of 2018.

Focus points for good free WordPress themes in 2018


Mobile user-friendliness

For 2018, the most important focus point is: mobile user-friendliness. Search engines, such as Google, attach more and more value to website performance on mobile devices. So, always test a free WordPress theme on a mobile phone. When you do this, pay special attention to the alignment of texts and images, but also check to see if a page opens directly and displays the most important text first.


In the past, there was the risk of finding malware in free WordPress themes. Luckily, the control mechanisms have now improved strongly on the most important market places for WordPress websites, and such practices are being dealt with as soon as they are uncovered. Still, the safety of your WordPress theme remains of great importance. So, only download/buy your WordPress themes at reputable WordPress theme providers.

Revenue model

Nothing comes for free. A free WordPress theme is free for a reason. For example, because the provider hopes you’ll buy one of his products in the future. Or he’ll offer an extended version of the free theme at additional cost. So, make sure the free WordPress theme contains all the features you need, otherwise you’ll end up paying for the theme later on.

Maintenance and support

With a free WordPress theme, you don’t have to expect any long continuing development or good support from the developer. Which makes sense, since the theme is free. So, are you looking for a WordPress theme you can build on for years to come? Then it might be wise to spend a few euro’s on a recommended payed WordPress theme.

The 100 best free WordPress themes for 2018




Minimalist Portfolio






Unicon Lite


Arcade Basic





Coral Parallax

Seos Photography

Portfolio Lite



Zoom Lite







Parallax Frame


Alpha Centauri

Coral Drive


WP Portfolio






Business World




SKT Design Agency

Business Elite

Portfolio Gallery


Better Health

Adventure Lite



Grid Magazine

Start Blogging


Bar Restaurant


CT Corporate

Compact One

Tech Literacy

Business Point





Play School


Vision Lite





InterServer Portfolio



Olsen Light

Brittany Light









Shop Isle

Zerif Lite


Riba Lite

Simple Business WP

Blogger Theme


Sold WooCommerce




Public Opinion



Socute shop


How to remove malware from a hacked WordPress website

[sowmedia_posttemplates_heading tag=’h1′ link_apply=” link=’manually,http://’ link_target=” style=” size=” subheading_active=” subheading_size=’15’ margin=” margin_sync=’true’ padding=’10’ color=” custom_font=” av-medium-font-size-title=” av-small-font-size-title=” av-mini-font-size-title=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” custom_markup=” av_uid=’av-k7q1bh6w’ custom_class=” admin_preview_bg=”][/sowmedia_posttemplates_heading]

In this article we will explain why and how WordPress websites are hacked. We will also give you a step-by-step plan for removing malware and cleaning up your WordPress website.

Why are WordPress websites hacked?

The most important motivation for most hackers is money. The hacked websites are used to promote commercial websites; particularly things like gambling, sex and pharmaceuticals. By hacking a website, for example, thousands of spam e-mails can be sent. Or links are placed on your website to mislead Google so that the commercial websites are placed higher in the search results. Every now and then hacks may be ideologically or politically motived.

How do you discover that your WordPress website has been hacked?

  • Various links appear on the website that don’t belong there. Often these are links to websites that have to do with pornography, gambling, drugs, illegal pharmaceuticals, et cetera. Sometimes the links are hidden in the color of the background of the website so that they are not visible to visitors, but can be found by search engines.
  • When you search for your own website via Google (for example ‘wpupgrader.com’ as search term), you find information about the website that isn’t yours.
  • Visitors to your websites are redirected to another website. Sometimes only mobile visitors.
  • Your website is being used to send spam. If this is the case you will usually get a message from your host company saying that an unusual amount of e-mail is being sent from your website.
  • Organic search traffic decreases because Google no longer shows your website in the search results.

How is it possible for your WordPress website to be hacked?

To gain control of your WordPress website hackers must find some way to upload or edit a file on your server. In general there are four possible ways for hackers to gain access to your website:

  1. Insecure passwords; most of the WordPress hacks that we come across could have been prevented by using more secure passwords.
  2. Update-policy; when you seldom or never update your WordPress, your plugins and your theme you greatly increase the chance that you will be hacked.
  3. Insecure themes/plugins; sometimes your website can be up-to-date, and still contain an insecure theme/plugin. Always purchase plugins/themes from a trustworthy website.
  4. Bad hosting; you may have protected your website well yourself, but if, for example, it’s possible for your hosting company to move files between different websites then your website is not properly secured.

How to make sure your WordPress website is hack free?

When a hacker has had access to your website, it is possible that files have been added/altered, passwords have been changed and possibly even new users added. If any one of these things are not detected and cleaned up then others steps will have no effect, because the hacker will still be able to gain access and cause damage once again. For this reason, clean up must be thorough.

We will try to explain all the steps as simply as possible, but some technical knowledge is required. Make sure that you have an administrators account in WordPress, that you have FTP access (and that your know how FTP works), and that you can access the database using a program like phpMyAdmin or Adminer. The steps we are going to take are:


If you know when the hack took place you can skip the clean up by replacing with a back-up from before the hack. It is possible you may lose a number of responses and web forms. Continue with step 5.

Backup your hacked WordPress website

You are going to clean up your WordPress website thoroughly. This means you may end up cleaning up too much and it might be better to start again. In that case it is always good to have a backup on hand. Make sure that you add both the files and all databases to your backup.

Close the doors

Make sure your WordPress website is temporarily inaccessible from the outside. Theoretically hackers could infect your website while you’re still going through these steps. This also prevents you from infecting your visitors with any malware that might be installed on your website.
You can usually block your website from your host company’s control pannel by way of a password or by using an IP filter. If you have access to your .htaccess file you can add the following code to allow one specific IP address (find our what your IP address is at WhatIsMyIPAddress.com):

order deny,allow
deny from all
allow from 123.456.789.123

Find the source of your WordPress website hack

It is important to find the source of the hack and the extent of the impact as soon as possible.  

  • Look for your plugins, themes and WordPress version in the WPScan Vulnerability Database and see if there are known vulnerabilities for the versions you installed on your website.
  • Do you use Google Webmasters? Go to your dashboard and see if there are any reports of malware.
  • Check your website in Google: http://www.google.com/safebrowsing/diagnostic?site=www.example.com
  • Many hosting parties make access logs available. This is a list of all requests for files, saved at server level. Files placed by hackers are usually requested using a ‘POST-request’. By looking for ‘POST’ in your access log you can filter a list of of php files to further examine. Later in this article we will explain what to look for when examining php files. These files may not necessarily be infected however; a POST-request is also used when you fill in a contact form or if you log in to wp-login.php.
  • We sometimes come accres situations where an old WordPress website is on the same server, for example in the file ‘old’. Often this installation will have been forgotten and no longer up-to-date, which makes the whole website vulnerable to all sorts of old security flaws.

Clean up the files on your hacked WordPress website

During a successful hack a hacker can potentially place or alter a file in every folder on your web server; not just the folder containing the infected plugin. This means that you should examine all your folders and files, and this is painstaking work. Thankfully you can limit this work to various steps. We explain how below.

  • Clean up WordPress core (wp-admin and wp-includes)

    Log in with FTP and go to the folder of your WordPress website. In the root of your WordPress website there are at least three folders: ‘wp-admin’, ‘wp-content’ and ‘wp-includes’. In the ‘wp-content’ folder all the specific changes to your website are saved, but ‘wp-admin’ and ‘wp-includes’ only contain files from the WordPress core; files that only change when a new version WordPress is released.

    To make sure in one go, that there are no files in your WordPress core that have been added or infected you can remove the ‘wp-admin’ en ‘wp-includes’ files and replace them with a clean version by downloading WordPress again.

    • Not sure which WordPress version you are running? Check in ‘wp-includes/version.php’ and you will find the version number on line 7.
    • Download a zip-file of this version from the WordPress release-archive and unzip it on your computer.
    • Remove the ‘wp-admin’ and ‘wp-includes’ using FTP from the root of your WordPress website.
    • Upload the ‘wp-admin’ and ‘wp-includes’ from the file you just unzipped.

    Along with folders there are also files in the root of your website. Replace these files – except wp-config.php (!) – with the files from the unzipped zip file.

    Are there other files and folders in the root of your website? Examine them critically and decide whether or not they are familiar to you; is there any other software running on your site? If not then they may have been placed by the hacker. When in doubt confer with your web host. Sometimes your web host will preinstall a folder like ‘stats’, ‘webstats’, ‘logs’ and ‘cgi-bin’ . Always take a look at these folders and look for files that end in ‘.php’. Because, normally speaking, they shouldn’t be there.

  • Cleaning up plugins (wp-content/plugins)

    Just like the WordPress core, you can find original clean versions of your plugins in the WordPress plugin repository. It is, however, possible that not all your plugins come from here; you may have purchased premium plugins, for example, elsewhere. Premium plugins cannot always be updated automatically. Either way, to be sure that your plugin folder is clean, you will have to locate all the originals.

    • This is a good time to remove inactive plugins and plugins that are used infrequently. Do this first.
    • The plugins from the WordPress plugin repository can only be removed via FTP. After removing them download clean versions from the repository and upload them via FTP. A plugin like Wordfence may be able to do this step for you.
    • It is also important get clean versions of plugins that do not come from the WordPress repository. Make sure you find these files and repeat the above step for these plugins. Can’t find the original plugin files? Then you will have to remove the entire plugin, because it is very possible that the plugin is (partially) responsible for the hack. More importantly, you will not be able to update the plugin in the future and that could be disastrous to the safety of your website in the future. Often you will be able find an alternative plugin for the functionality you are looking for.

    In this step you will update all your plugins to the newest version. That is safe, but may lead to conflicts if your WordPress core or theme, for example, is not compatible with the newest version of the plugin. In that case, replace it with an older version of the plugin or – better yet – update your theme (see the following step) to see if that will resolve the problem.

  • Update theme (wp-content/themes)

    WordPress themes sometimes contain customization done by you or your website builder. These modifications will be lost if you update the theme, unless the modifications are saved in a separate folder by using a child theme.

    Your WordPress website doesn’t use a child theme? Then you have the option to update your theme, as explained in the previous step, but any modification will be lost. Want to keep your modifications? Then you can use this opportunity to first save your modifications in a child theme. The child theme manual by WordPress will explain how (caution: it’s not simple).

    Does your WordPress website have a child theme? In that case you can update your WordPress theme as explained in the previous step. Afterwards you will need to make sure that your child theme folder is clean. If you have a local copy of your child theme you can replace it (sometimes an old backup will work just fine, as long as you know that the website wasn’t hacked at the time the backup was made). If you don’t have a copy then you will have to go through the folder containing the child theme by hand. Read the next step for more information.

    Finally, do not forget to remove any unused themes; this way you will decrease the chance you’ll run into problems in the future.

  • Checking remaining files (wp-content)

    You have now cleaned up as much as you can without have to look in detail, but there are always a number of files and folders that you will have to check by hand.

    • Look for .php, .asp, .exe, and .sh files in the wp-content/uploads files. These do not belong here and may have been placed by hackers. It takes time, but don’t forget to check all the subfolders. Many FTP programs allow you to search automatically within a folder.
    • Some plugins add their own folders to the de wp-contents folder. This is not necessarily bad, but go ahead and go through these folders for above mentioned files.
    • Are there php-files that you no longer have the original to, that you will have check by hand? Think about php files in the wp-contents folder (like object-cache.php), your child thema, or wp-config.php in the root. Follow these steps:
      • Open them in text editor and scroll in all directions; sometimes hackers put code in a file ‘out of sight’ by placing it very far to the right or really far down.
      • Keep looking for any worrying code. Look for terms like ‘eval’, ‘exec’, ‘base64’, ‘hash’, ‘decode’ and see if you find any code that doesn’t belong.
      • Not sure about something? Copy a section of the code and look it up in Google. Sometimes you’ll come across all kinds of malware forums and you’ll know that something’s not right.
  • Check wp-config.php

    Up until now you have left the wp-config.php file untouched, but you do have to check it. This file contains all kinds of basic configurations for your WordPress website. Do you have a backup available? Then we advise you use the wp-config.php file from the backup for your website. Edit the list under ‘Authentication Unique Keys and Salts’ by adding a few characters to each line of random code. This way you make sure that any users that are logged in (potentially hackers) will no longer be logged in.

    Don’t have a back up? Open your wp-config.php and fill in the values you see in the wp-config.php generator by following all these steps. Chose ‘Auto Generate’ in Authentication Keys & Salts . Click update after the last step and copy and paste the code to your wp-config.php. Then you know for certain that you have generated a clean wp-config.php.

  • Looking for .htaccess

    A .htaccess file makes it possible to configure a lot of server settings. If a hacker modifies these kinds of files it can lead to very destructive behavior. There is definitely a .htaccess file in the root of your WordPress website, but in theory there could be one in every folder in your website. Use an FTP program to look for ‘htaccess’ on your website.

    The .htaccess file in the root of your website will contain the following lines:

    # BEGIN WordPress
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
    # END WordPress

    Is there more code in your .htaccess file? This could have been added by a plugin, but it could be a hack. If in doubt, remove all extra code from your .htaccess file; the plugin may no longer work optimally, but most plugins are able to add the necessary code to the .htaccess file automatically if need be.

    Find more .htaccess files?

    Go to the place where you found them. Are they in a plugin or theme folder? Then in theory they are safe, since you cleaned up all these folders in the previous steps. However, if you find any in your uploads folder, child theme etc. then it’s a good idea to take a closer look. Sometimes a .htaccess file is placed in wp-content/uploads to prevent visitors from going through your upload folders without permission. In this case you may come across the following line in your .htaccess file:

    Options -Indexes

    This is not a harmful line, so your can safely leave it as is.

Cleaning up users

Now that all the files have been cleaned up, hackers still may have access to your website. They could have made an extra admin account, for example, or have changed the password of one of the other users. Furthermore, it’s possible that the hackers got in because they were able to guess a weak password.
Go to ‘users’ in WordPress and remove any user who doesn’t belong. Set new (complex!) passwords for all other users. This way you know for certain that hackers cannot login using an existing account. Explain to existing users why it is necessary to use a complex password.

Check the database

The more advanced users among us can now take a look at the database. Using a program like PhpMyAdmin or Adminer it’s relatively easy to browse through your database.
First, you can have a look in the ‘wp_users’ table; do you still see any users that don’t belong here? Remove them by hand. Sometimes hackers are able to add an invisible user.
Then take a look at the structure of the table and compare it to the standard WordPress Database description; have any tables been added that you don’t recognize? Take a closer look. Some plugins add tables to your database. Only remove the tables that belong to plugins that have been removed.

Change all passwords

In the fifth step you changed the passwords of all your users, but hackers may have been able to discover other passwords as well. For this reason, at least change the password of your database, and your FTP account, host control panel, etc. as well. This way you don’t have to wonder if your website really is secure again. Fill in the new database password in ‘DB_PASWORD’ in the wp-config.php file.

Go live and test

Now you are ready to take your WordPress website live again. Remove the block from step one and check to see if your website can be accessed when you are not logged in, for example, by visiting your website from a different network or using your telephone without wifi.
You may still get a notification stating that your website contains malware. In this case your website has been placed on a blacklist, which means it also no longer comes up in Google searches. Use the options Google offers to put your website back in the search results.

  1. Google Diagnostic Center (replace www.example.com) in the url for your own domain). You can use this tool to see if your website is on the Google blacklist.
  2. Google Webmasters indicates if and when Google indexed a problem with your WordPress website.
  3. Submit a request via Google Reconsideration Tool to have Google reindex your WordPress website.


Behind the scenes at WordPress there is a large community of developers constantly working on improving the code. The advantage of this is that any known leaks in WordPress, plugins and themes are often resolved quickly when a new version is released. That’s why you should always make sure your website is up-to-date. This way you greatly decrease the chance you will be hacked again and you can perform new updates very quickly because it’s usually just a small modification.