The Jetpack plugin is an all-in-one solution for WordPress sites with free and premium features that boost performance, security, marketing, design, and publishing. It’s developed and maintained by Automattic — the people behind WordPress.com.

It integrates seamlessly with WordPress, saving you the hassle that comes with dozens of standalone plugins. But, at the same time, it allows you to enable only the features you need, keeping your site management process simple. 

Let’s take a more in-depth look at some of the functionality included with Jetpack.

WordPress security features

Jetpack provides powerful, easy-to-use WordPress security that protects your site from hackers and malware. Jetpack Security features include:

• Automated real-time and daily backups
• Malware scans
• Spam prevention tools
• A site activity log
• Downtime monitoring
• Brute force attack protection
• Two-factor authentication
• Plugin auto-updates

Here’s a bit more about Jetpack Security’s most popular features:

Jetpack Backup 

Manual backups require time, expertise, and energy. But automated WordPress backups from Jetpack Backup are different — they run in the background while you do the things you want to do. It’s like having a security blanket you can always rely on. 

Avoid costly interruptions and get back online if your site crashes by restoring a backup with just one click. And, since things don’t only go wrong when you’re at your desk, you can even get your site up and running again on the go with the Jetpack mobile app.

There are two backup options:

1. Real-time backups, which save your site as you make changes. This is the perfect choice for eCommerce stores, news organizations, membership sites, online forums, and any site that is regularly updated. It provides the ultimate peace of mind that comes from knowing that your important data is completely safe, all the time.
2. Daily Backups, which save your site once per day. Daily backups are great for brochure sites, restaurants, blogs, resume sites, or any website that isn’t updated regularly throughout the day. 

Jetpack Scan

Let’s face it: you don’t have time for downtime. But in today’s online world, up-to-the-minute scanning and protection against malware and viruses is, unfortunately, a necessity.

That’s why Jetpack Scan checks your files for malware automatically and, at the first sign of trouble, instantly alerts you. Better yet, it provides one-click fixes for the majority of known threats. Here are a few other features:

• An up-to-date vulnerability database. Because Jetpack monitors millions of sites for vulnerabilities, they learn about the newest security threats as quickly as they appear.
• An easy-to-use interface. This means that you won’t spend your time wading through jargon and you don’t need to be an expert to stay safe. Instead, confidently and quickly deal with any issue that arises. 
• Decentralized scanning. Jetpack scanning is done on their own servers, so it doesn’t slow your site down. 

Jetpack Anti-spam

Spam is any type of unsolicited or unwanted communication. On a website, it typically appears in comments and form submissions. You’ll know it when you see it — a spam comment is often completely unrelated to your post, contains questionable links, or just sounds “off.”

You may want to allow legitimate comments on your site to boost engagement and build community, but problematic spam can cheapen your brand and even impact your search rankings. The issue then becomes finding hours of extra time to manually filter through every comment to determine which ones are real and which ones are fake.  

The solution? Jetpack Anti-spam, one of the most recognized spam solutions for WordPress. Powered by Akismet, it learns spammers’ latest tricks and automatically screens comments so you don’t have to. Plus, it provides spam prevention on forms without the need for a CAPTCHA. 

WordPress speed tools 

The speed at which your site loads can have a major impact on both your web presence and your bottom line. After all, a site visitor isn’t just going to sit around and wait for your page to load. If they get too frustrated, they’ll just go somewhere else. 

And the same is true for search engines — Google considers load time when deciding which sites to show first in the results. But improving site speed doesn’t have to be hard, thanks to Jetpack. 

Jetpack’s performance tools for WordPress sites are: 

• Smart search functionality
• Unlimited video hosting
• A CDN (content delivery network)
• Image lazy loading
• Advanced performance features with one-click activation
• Jetpack Boost, a separate plugin that optimizes CSS structure and defers non-essential Javascript, among other things.  

Let’s review some of the most popular performance solutions from Jetpack:

A WordPress CDN

Images take up a lot of space on your server and require a ton of data to display to visitors. This makes them one of the biggest factors that slow down your site. 

One great solution is a content delivery network (CDN). A CDN stores your site files in geographically-distributed data centers, displaying them to site visitors based on their location. This takes the pressure off of your server and ensures that everyone has the best experience possible. 

Jetpack’s WordPress CDN offers all of these features, specifically designed for WordPress. You can enjoy: 

• One-click setup and installation
• Automatic access to Jetpack’s worldwide network of servers 
• Auto-resizing of images for mobile devices (further improving speed)
• Unlimited data
• Compatibility with Jetpack’s ad-free WordPress video hosting service

Best of all — and unlike most CDN services — it’s completely free for everyone using Jetpack.

Video hosting

Video is becoming increasingly popular, but video files are large and can slow down a site dramatically. 

Jetpack’s video hosting for WordPress features are served through a high-speed CDN, so viewers enjoy smooth streaming and site owners avoid expensive hosting upgrades. Storage is unlimited and you’ll also receive access to rich viewership stats. 

As a bonus, using Jetpack’s video hosting means you can avoid third-party services that distract viewers and limit your control. Instead, provide an ad-free, unbranded experience directly on your site. 

Image lazy loading

As mentioned earlier, images are one of the top offenders when it comes to site speed. But lazy loading helps reduce their bloat by displaying pictures as a site visitor scrolls down the page. Instead of loading all images at the same time, it shows just the ones required for the visitor’s current place on the page. 

You can turn on this feature with a single click, without needing to make any changes to existing pages, files, or galleries. It also works on mobile devices and is completely free for Jetpack users.

Super fast search 

WordPress search plugins are super valuable for sites, but they’re not all created equal. Jetpack Search provides the right results with less frustration — instantly. This means that site visitors can find exactly what they’re looking for right away, without having to filter through tons of menu items or even reload the page they’re on.

It provides intuitive results in real time so visitors can find what they want before they finish typing. And it’s smart enough to look past typos and understand the intentions behind common phrases — a must-have for any site that has a lot of content or products. 

WordPress growth tools 

The right tools can help you maximize every opportunity and grow your business sooner rather than later. That’s why Jetpack’s growth suite provides solutions that automate your workflow, enhance customer and client relationships, help you monetize your content, and more. 

Jetpack’s growth tools include:

• A customizable CRM
• Social media tools
• Payment solutions
• An advertising program
• Easy Google Analytics integration
• Website stats at a glance
• SEO tools

We’ll explore three of these solutions a little further:

A WordPress CRM

A customer relationship management tool (CRM) is an excellent solution for any growing business. It tracks customer and client history and allows you to provide better service, marketing, and order fulfillment. The problem with many WordPress CRM tools is that they have an overwhelming number of features that most entrepreneurs will never need. 

But Jetpack CRM is modular, so you can add exactly the features you need and leave everything else behind, speeding up your site and saving you money. Plus, it’s built specifically for WordPress, so it’s easy to integrate with your existing workflow. 

Jetpack CRM is available as a separate plugin.

WordPress Site Stats

Jetpack Site Stats simplifies important information so that you can easily analyze your site’s health and make key marketing decisions. Keep an eye on:

• Site traffic
• Most popular posts
• Common site searches
• Comment volume 

These metrics help you understand what’s working (and what’s not!) so you can put your efforts in the right place and provide the best possible experience for visitors. Plus, they’re available in your WordPress dashboard at a glance — no complicated screens or separate accounts.

WordPress social media publishing tools

Social media is an invaluable marketing strategy. It helps you reach new visitors and engage with existing ones through advertising or content creation. And it’s one of the best ways to gain customer feedback and connect directly with supporters.

That’s why Jetpack includes social media publishing tools in their suite of growth solutions. You can:

• Automatically publish new content to social media accounts (free)
• Schedule posts for future dates and times (paid)
• Re-share evergreen content to maximize opportunities (paid)

This type of automation saves you a tremendous amount of time while still making the most of social media.

WordPress website design tools 

Don’t worry — it’s possible to create a site that’s just as beautiful as you envisioned. The Jetpack team has developed options and tools to make design intuitive for any site owner, no matter their experience level. Here are a few of Jetpack’s design tools: 

• Hundreds of WordPress themes
• Related post solutions
• Gallery and slideshow tools
• Subscriptions payment collection
• Contact forms
• Extra WordPress blocks

Highlights include: 

Related posts

Related posts automatically suggests similar content to site visitors based on the current post they’re viewing. This keeps people on your site longer and increases the chances that they become customers, followers, or supporters. Plus, it’s a great way to keep advertisers happy!

Jetpack automatically determines related content using their own servers. This means that you get accurate, up-to-date suggestions without slowing down your site. You can activate this feature with one click and even customize the results to meet your needs. See why it’s popular? 

WordPress themes

Jetpack offers 100+ free starter themes, along with all of the tools necessary to customize your site’s design until it’s perfect for you and your visitors.

You can: 

• Browse themes, change colors, tweak designs, add or remove features, and change fonts — all with no coding experience whatsoever. 
• Preview changes as you make them and return to your previous theme with a single click.
• Add widgets to customize sidebars and embed everything from images and videos to your favorite social media feed on a per-page basis.
• Incorporate full-screen slideshows, tiled galleries, and carousels to bring life to any page or post. 

Bonus: Jetpack on the go

Jetpack’s tools are so powerful, it’s important to be able to access them from anywhere. 

Jetpack’s mobile app gives you the ability to solve issues by restoring a backup right from your phone! Plus, get security alerts, review the activity log, and pull the latest stats anytime you want. 

Learn more: Jetpack mobile app.

Jetpack: the ultimate WordPress toolkit

Jetpack protects your site from cybercriminals, helps you attract new site visitors, and offers tools to grow your business — all while providing a faster, more enjoyable experience for your audience. Plus, everything is easy to use no matter your level of technical knowledge.

Many of Jetpack’s features are free and all of them are a great deal. With amazing support from the world’s top WordPress experts, Jetpack can truly boost any kind of site.

Ready to improve your site? Get started with Jetpack. 

When it comes to running a WooCommerce store, a secure checkout process is one of the most critical elements. While every step in the buyer’s journey is important, protecting your data and your customers’ personal details is absolutely essential. Keeping credit card numbers and other sensitive information shielded from hackers or other data breaches should be every store owner’s number one priority.

Here are ten ways to ensure a safe and secure WooCommerce checkout experience:

1. Choose a secure host

Using a secure hosting platform is a simple and straightforward measure you can take to contribute to your site’s safety. A secure host is a shield against malicious activity to keep your site and its visitors safe from cyber attacks using firewalls and anti-virus protection. Some hosts offer eCommerce plans that provide features specific to the needs of online merchants. Look for plans that mention PCI compliance and choose VPS, cloud, or dedicated hosting if possible.

2. Install an SSL certificate

“SSL” is short for Secure Socket Layer. It’s a layer of security protocol between your browser and web server that encrypts communication between the two. Installing an SSL certificate is important because it enables encryption of customer information such as credit card numbers. This makes it very difficult for hackers to intercept sensitive information as it’s being transferred. 

You can tell if a website has a valid SSL certificate as the URL will begin with “https” instead of “http” and the browser bar will show a lock icon in grey or green. These visual indicators tell visitors that the site is secure and the owner’s identity has been verified. Customers value privacy and security, so they’re far more likely to trust and make purchases from SSL-enabled sites. 

SSL certificates are also a major factor if you want to ensure higher search rankings and avoid ‘Not Secure’ warnings from browsers. Google actually favors WooCommerce stores using https  over those that don’t and added it as a ranking signal back in 2014. 

In an effort to further encourage websites to use secure data transfer protocols, Google Chrome started marking non-SSL enabled sites as “Not Secure” back in 2017. Firefox and Safari quickly followed suit and now, when you visit a website without a security certificate, you’ll be presented with a warning saying that your connection is not private. These can scare off potential customers. 

3. Be PCI-DSS compliant 

PCI-DSS compliance is required by any online merchant who directly handles credit card data. This applies whether you’re a startup or a big company. Also, your compliance must be updated annually as per the Payment Card Industry Data Security Standard. 

PCI-DSS compliance ensures the security of credit card transactions in the payment industry. Businesses are required to follow certain technical and operational standards like regular testing of security systems and processing, installing and maintaining firewall configurations, encrypting cardholder data, and restricting physical access to cardholder data.

4. Choose a secure payment gateway

A payment gateway is a merchant service used by store owners to securely accept credit or debit card purchases from customers. Not all gateways are the same, so you’ll want to choose the right one for your needs.

Things to consider when selecting a payment gateway:

• Which currencies you want to accept
• How much of a transaction fee you’re willing to charge (or absorb the cost of)
• How fast you need the money from the transaction to hit your bank account
• Which payment methods you’d like to offer
• Which payment methods are accepted in the countries you sell to
• How it encrypts sensitive information in order to avoid payment processing fraud

Finally, you’ll want to choose between a hosted or integrated payment gateway. A hosted gateway is managed by a third party, so the customer will leave your site to make their purchase. The nice thing about hosted gateways is that you aren’t responsible for PCI compliance and integration is fairly straightforward.

The downside, however, is that customers don’t always trust them, so they have the potential to lower your conversion rates. Nevertheless, they can still be a sound option as some visitors are more comfortable using a hosted gateway they’re familiar with (like PayPal). 

An integrated payment gateway like WooCommerce Payments, on the other hand, doesn’t redirect to a third party at checkout. It provides a seamless user experience, is very safe, gives you greater control over the transaction process, and inspires customer trust. 

The biggest drawback is that you’ll store tokenized credit card data and other sensitive customer information on your server, so you’ll be responsible for PCI compliance. Integration can also be slightly more hands-on.

The type of payment gateway you choose is ultimately up to you and what your business’s needs are. Do some research, and make sure whatever you opt for has a reputation for being secure. 

5. Prevent brute force attacks

Brute force attacks are the most common form of hacking. They happen when hackers use botnets to try different combinations of usernames and passwords until they get into your site. These attacks not only slow down your store, they can permit unauthorized access so that hackers can modify code, add spammy links or comments, and put your content and customer data at risk.

To prevent this, use strong passwords that are hard to guess. Try a mix of numbers, letters, and characters. Also, don’t use your name or birthday. Automatic password generators and password management software can help with this. 

Finally, opt for a brute force attack protection plugin to block unwanted login attempts from botnets. Jetpack brute force attack protection uses state-of-the-art technology to block malicious login attempts from thousands of known bots. Best of all, it’s free for all Jetpack users.  

6. Identify and remove malware

Malware is any type of hostile or intrusive software designed to infiltrate your site. It costs eCommerce businesses millions in lost revenue every year. Each type of malware has a different agenda — website defacement, malicious redirects, and theft of customer data. 

Malware is bad news for any site owner, but it can be a downright nightmare for an eCommerce merchant. Using security tools like Jetpack brute force attack prevention will help keep hackers from gaining access to your site to inject malware in the first place. Additional tools like Jetpack Scan alert you to malware present on your site, identify affected files, and fix the majority of issues with a single click. 

7. Know everything that happens on your site

Having a list of what’s going on behind the scenes on your eCommerce site minimizes the guesswork involved in site management, debugging, and repair. 

Jetpack’s Activity log for WordPress lets you see right away if someone has made changes to a page on your site. And, in the event of a security breach, it helps you determine when someone gained access to your site and what damage they did. This way, you can stop any further harm before it happens.  

The free version of the activity log gives users access to the 20 most recent site events, while paid Jetpack Security plans provide up to a one-year archive of events. 

8. Install an anti-spam plugin 

No one likes a spammer, and spam can destroy your site’s reputation if you’re not careful. Too much of it can even result in Google removing you from its search results entirely. It can also bog down your database, slowing down your site. 

Using a plugin like Jetpack Anti-spam lets you beat spam by automatically blocking it from comments and contact forms. It’s powered by Akismet, the world’s leading spam prevention service, so you know it’s trustworthy and effective. 

9. Prevent fraudulent orders

Fraudulent orders are an unfortunate, sometimes unavoidable, part of running an online store. But, there are quite a few ways to stop them. 

Here are some of the most effective methods to avoid fraudulent orders:

• Add a CAPTCHA. CAPTCHA is an acronym for Completely Automated Public Testing, and it’s used to determine whether visitors are humans or sneaky bots. Setting up a CAPTCHA is easy to do with reCaptcha for WooCommerce. 
• Use WooCommerce Anti-Fraud. This plugin is designed to help you identify fraudulent transactions and catch them while they’re happening. The tool uses advanced rules to scan and provide a score for each transaction. You can use these to automatically identify and block fraudulent orders and get notifications based on an order’s risk assessment.  
• Limit purchase quantities. One common form of fraud is purchasing large volumes of products from websites that don’t have quantity limits. Criminals do this to quickly extract as much value as possible from a stolen card before it’s discovered. The WooCommerce Min/Max Quantities extension lets you set limits for individual products as well as entire orders.
• Require an account for customers to place their orders (if necessary). Requiring an account helps prevent fraudulent orders, but the extra steps can also dissuade legitimate customers from making a purchase.
• Verify customers and customer details before you ship the item. If you suspect fraud, follow up with the customer first to ensure they’re a real and legitimate buyer. This is always a good idea if something looks fishy, even if you’ve taken all of the other necessary precautions. 

10. Keep WordPress, themes, and plugins updated

Security experts around the world are always studying WordPress code and reporting bugs and fixes 24/7. When a security vulnerability is reported, WordPress, theme, and plugin developers release an update to fix it. So, make sure you keep everything up-to-date.

Keeping your WooCommerce checkout experience safe and secure does require a fair bit of due diligence and work on the backend, but the peace of mind it saves can’t be bought. Plus, you have easy-to-use, affordable WordPress security tools at your fingertips to make the whole process smoother! 

You don’t have an SEO strategy unless you have a website performance strategy to go along with it. With each passing Google update, the skill and attention required to consistently rank highly are refined. 

Google is now beginning to roll out ‘page experience’ as one of their ranking factors. Note that page experience is related to, but distinct from, user experience. Google has released a good amount of documentation explaining the specific website performance metrics they’ll be looking for. 

While this update won’t be a drastic change, it will require your website to deliver a page experience that involves more than just speed. Page speed is important, but it’s also too broad of a metric to be very helpful. 

Google’s three new site performance metrics (called Core Web Vitals) measure the tangible visitor experience on each page. 

Don’t have time to learn about Core Web Vitals? Trust us and install our free plugin Jetpack Boost.

What are Core Web Vitals and why are they better than old metrics?

As Google explains, web vitals give site owners a way to quantify the user experience and provide specific steps they can take to improve. Core web vitals will address the fact that many measurement tools are tech focused — not people focused. 

Google’s previous website performance metrics measured things that automated scripts, bots, and computers cared about. But Core Web Vitals relate to the real experiences of real visitors. So yes, these metrics still relate to website speed, but speed that users care about in the real world. 

Users feel it when Core Web Vitals underperform.

At present, Google has established three Core Web Vitals related to:

1. Loading performance, measured by largest contentful paint (LCP)
2. Interactivity, measured by first input delay (FID)
3. Visual stability, measured by cumulative layout shift (CLS)

These terms may seem a bit overwhelming, but they’ll make it much easier for you to improve your page experience along with your search engine rankings. 

Let’s take a closer look at each one. 

LCP: largest contentful paint 

Terms like ‘website speed’ aren’t helpful because they’re too broad and don’t really reflect what the user cares about. When you open up a webpage, you don’t need the entire page to load before you can begin interacting with it. What you do need to see are the central features of the page. 

The LCP metric measures the render time of the largest image or block of text that appears within the first visible screen. This could be a photo, a video, or a text block. The idea here is, even if all the various elements in the sidebar or in smaller sections of the page haven’t fully loaded, as long as the primary content is visible, you can begin engaging with the page. 

When measuring your website’s performance on the LCP metric (on both mobile and desktop devices), Google looks for a score of under 2.5 seconds on at least 75% of experiences. That earns a ‘good’ rating. A ‘poor’ rating is anything more than 4.0 seconds. 

How to improve my LCP score

According to Google, LCP is mostly affected by slow server response, client-side rendering, resource load times, and render-blocking JavaScript and CSS. This gets a bit more technical, but if you have the know-how or can hire a developer, they can start working on some of these tasks.

Render-blocking resources can cause the largest contentful paint to take longer to load than it should. By deferring non-critical CSS and JavaScript, you can speed up the loading time of your main content. 

When resources like videos and images take too long to load, this also affects your LCP. By optimizing and compressing your images, you can speed things up.

If this sounds complicated, skip to the bottom for a tool that handles much of this for you. 

Learn more about LCP and how to improve your score

FID: first input delay

A poor user experience happens when the visitor takes a specific action, and then nothing occurs on your site. 

For example, when you click a link or button, or tap an image, how long does it take for your action to process? If you have to sit there waiting, that’s a bad page experience, and it will hurt your website’s performance. 

Google’s new ranking factors will reward sites for having a low FID score. This score measures from the first time a user interacts with something on a webpage to the time when the browser responds to that action. 

That shouldn’t take long, and Google ranks a site as ‘good’ for an FID score under 100 milliseconds on at least 75% of user interactions. Poor is anything over 300 milliseconds.

How to improve my FID score

Begin by running a Lighthouse performance audit, which will reveal opportunities for improving your FID score. 

The most common cause of a poor FID score is too much JavaScript trying to execute various tasks. If the main thread is busy dealing with all the JavaScript tasks, it won’t respond to user interactions. 

You can improve your FID score by breaking up long tasks, optimizing your page so it’s ready for user interaction, using a web worker, and reducing JavaScript execution time.

If this sounds complicated, skip to the bottom for a tool that handles much of this for you. 

Learn more about FID here

CLS: cumulative layout shift 

Your visitors care about this one a lot, and we’ll show you several ways to improve it later, including a free tool that does much of the work for you. 

A ‘layout shift’ happens when you’re on a webpage, and suddenly everything shifts up or down a little. Ever had that happen? You’re trying to read a page and the text keeps jumping around. It’s very frustrating. And if you’re trying to click on something, it can be even more aggravating. 

This shifting happens because other elements on the page are getting added or removed, somewhere outside of the part of the page you can see. This might be an image resizing, a video opening, a font changing size, a third-party ad, or a widget. 

The CLS metric measures how often this happens and uses a formula to score your site for all unexpected layout shifts that occur during the lifespan of the page load. The key here is ‘unexpected’. If the user clicks on something, they’re expecting something to happen, so those kinds of shifts don’t negatively impact this score. 

A good CLS score is anything under 0.1. A poor score is over 0.25.

If you know how to work with the code on your website, or have some basic development experience, you may be able to improve your CLS score by fixing features that are degrading the user experience.

How to improve my CLS score

• Include sizing attributes for all images and videos. Or, reserve the space with something akin to CSS aspect ratio boxes. By doing this, the browsers will set aside the right amount of space even if the image or video hasn’t loaded yet.
• Never build a page that inserts new content above where the user is unless it directly relates to actions taken by the visitor to your site. 
• Handle animations carefully, if you use them on your site.

Learn more about how to improve your CLS score

How can I check my current Core Web Vitals performance metric scores?

The simplest way to find out how well your website is performing according to these new metrics is to use Google PageSpeed Insights. This free tool scores your site and gives practical steps you can use to improve.

PageSpeed Insights will give scores for a variety of metrics and combine them into an overall score from 0 to 100. Below 50 is considered poor, 50 to 89 means you need improvement, and 90 to 100 is good. 

Here’s a screenshot showing how the main score report looks:

Below your score report, it will give you opportunities for how to improve your score. The recommendations are very specific in some cases. For example, it will recommend specific plugins you can install and use on your site to address a particular problem. And it will estimate the time savings you can expect from making each improvement.

Here’s a screenshot of the Opportunities section. 

When you click on the dropdown arrow to the right of each item, you’ll see all the suggestions for how to improve that particular metric.

Visit PageSpeed Insights to score your site

Once you reach the Insights page, enter your URL in the bar at the top, wait for it to analyze your site, and see your results. 

Another tool you can use is the Core Web Vitals report, which you can access from within Search Console. Here’s how to get and understand that report.

How to validate changes to core web vitals

Once you’ve improved the user experience and speed on your site, you want Google to account for those improvements as soon as possible. To validate changes:

1. Log into your Google Search Console account and select your website property.
2. Select Core Web Vitals in the left hand menu.
3. Click Open Report next to the chart for either mobile or desktop.
4. Select the Issue Type that you’ve fixed. For example, this might be “LCP issue.”
5. Click the Validate Fix button. 

This will start a 28-day monitoring session across your site. If Google doesn’t see any evidence of the issue, they’ll mark it as “fixed.” You can also return to this same page to check on validation progress and see the final result. 

What if I don’t optimize my site for core web vitals?

The introduction of core web vitals represents an overall shift in Google’s focus towards the user experience. Search engines will continue to put more and more weight on whether or not site visitors can easily use your site, find what they’re looking for, and leave happy. And if you don’t keep up with the new standards, you could see your website falling in the rankings.

Of course, a drop in rankings also means a drop in site traffic and, consequently, a drop in sales, ad revenue, or followers. But since core web vitals also directly impact the user experience, it’s also about so much more.

Whether you’re a blogger, store owner, or service provider, the experience of your site visitors is critical to your success. If your site loads quickly and provides a great user experience, they’ll be much more likely to read your posts, purchase your products, sign up for your email list, or get in touch with your sales team. If it doesn’t, then they’ll probably leave and find what they’re looking for elsewhere.

In the end, it’s very worthwhile for you to optimize your site for core web vitals.

What if I don’t want to hassle with suggested improvements?

Even though Google’s new approach has made it a lot easier for you to improve your website performance metrics, it will still take some work. 

Isn’t there an easier way? What if you don’t have the time or technical experience?

The good news is – yes! – there’s an easier way. 

It’s called Jetpack Boost. 

If you don’t want to look at website performance stats every day and manage the nonstop tasks of optimization, but you also don’t want to hire a web development specialist, then Jetpack Boost is exactly what you want.

Best of all, it’s free. 

Most other tools saddle you with numerous options that often require technical knowledge you don’t have. All the boxes you can check or uncheck can be confusing, and it’s often unclear how enabling features will impact your site. It’s rarely made clear why you might or might not want to change each setting. Press the wrong button or adjust the wrong setting, and you can break your site, or open it up to other risks and threats. 

Jetpack Boost was created for site owners who don’t have the time or expertise to stay on top of all this, but who still want to improve their website performance metrics and deliver a positive page experience.

With Jetpack Boost, you turn it on, and let it handle everything for you. Run a test to see how well your site is performing and turn on improvements with a single toggle. 

Learn more about Jetpack Boost

Again, your search engine rankings are directly linked to your website’s ability to deliver a positive experience. Google is using these three Core Web Vitals – largest contentful paint, first input delay, and cumulative layout shift – as one of their site ranking factors. 

With Jetpack Boost, you can receive high marks from Google and deliver a better experience for your visitors at the same time.

If you have questions and want to see more details about Jetpack Boost, start here. 

Versions before 4.5.1 of the Software License Manager plugin for WordPress have an exploitable Cross-Site Request Forgery (CSRF) vulnerability. Any user logged in to a site with the vulnerable extension can, by clicking a link, be tricked to delete an entry in the plugin’s registered domain database table. The link can be distributed in an email, or on a website the victim user is likely to visit.

The good news is, there’s not much else that can be done by exploiting this weakness. And the attacker needs to know the id of the domain they wish to delete from the database beforehand. 

Still, we recommend anybody running version 4.5.0 or earlier of the plugin to upgrade as soon as possible.

Details

• Plugin Name: Software License Manager
• Slug: software-license-manager
• Plugin URI: https://wordpress.org/plugins/software-license-manager/
• Vendor: Tips and Tricks HQ
• Vulnerable versions: <= 4.5.0
• Fixed in version: 4.5.1
• References: CVE-2021-24711, CWE-352, CVSS: 7.6, CWSS: 40.7

The vulnerability is caused by the handler for the ajax action del_reistered_domain (sic) neither performing nonce checks nor authorization of the user performing the action. 

add_action( 'wp_ajax_del_reistered_domain', 'slm_del_reg_dom' );
function slm_del_reg_dom() {
	global $wpdb;
	$reg_table = SLM_TBL_LIC_DOMAIN;
	$id        = sanitize_text_field( $_GET['id'] );
	$ret       = $wpdb->query( "DELETE FROM $reg_table WHERE id='$id'" );
	echo ( $ret ) ? 'success' : 'failed';
	exit( 0 );
}

We always recommend performing nonce checks on any action, and to authorize the user by checking it’s capabilities for all non-public action handlers.

The observant reader may also wonder if there is not a SQL Injection vulnerability here. The $_GET['id'] parameter is expected to be numeric, but this is never validated. However, as WordPress will escape any quotation marks in the request parameters, and the sanitize_text_field function will remove any URL encoded octets, the usage here should be safe from exploitation if not necessarily bug free.

Version 4.5.1 addresses both of these issues.

Recommendations

We encourage any site with versions earlier than 4.5.1 of the Software License Manager plugin for WordPress to update as soon as possible.

We strongly recommend that you have a security plan for your site that includes malicious file scanning and backups. Jetpack Security is one great WordPress security option to ensure your site and visitors are safe.

Timeline

2021-09-01: Vulnerability discovered by the Jetpack Scan Team
2021-09-07: Reported to WPScan, contacted vendor. 
2021-09-10: Received and verified fixed version from vendor.

We’re thrilled to announce that Jetpack has acquired Social Image Generator, a WordPress plugin founded by Daniel Post.

Social Image Generator automatically creates social share images for your content, saving hours of tedious work. It creates images for all major social networks including Facebook, Twitter, LinkedIn, Pinterest, VK, WhatsApp, iMessage, and Reddit. Simply share your content as you normally would, and the images will automatically appear.

The template editor feels right at home in WordPress. There are tons of different templates to choose from, and all of them are fully customizable. If you’re a developer, you’ll love Social Image Generator. With lots of filters and actions, you can customize every single aspect of your social images.

It’s the perfect complement to Jetpack’s social media tools which include automatic publishing of posts and products to sites like Facebook, Twitter, LinkedIn, and Tumblr.

“When I initially saw Social Image Generator, the functionality looked like a ideal fit with our existing social media tools,” said James Grierson, General Manager of Jetpack. “I look forward to the future functionality and user experience improvements that will come out of this acquisition. The goal of our social product is to help content creators expand their audience through increased distribution and engagement. Social Image Generator will be a key component of helping us deliver this to our customers.“

Daniel will also be joining Jetpack to continue developing Social Image Generator and integrating it with Jetpack’s social media features. To the current customers of Social Image Generator, we want to say thank you for being early adopters and providing valuable feedback. You’ll be able to continue using it as you do today without any changes in the near term. If you’d like to influence the future of the product, please reach out and schedule some time to chat.

“I’m incredibly excited to join Jetpack and Automattic so I can continue to grow Social Image Generator and help more people in the WordPress community improve their social media presence and get their message out to their fans,” said Daniel.

A new month has arrived along with a shiny new version of Jetpack that provides an enhanced experience for you and your site visitors.

In this release:

• New in Jetpack 10.1, you will be able to customize Jetpack Search using a Block Editor interface, providing an easier and faster customization experience. You can read more information about Jetpack Search here.

And More…

• We made improvements to the carousel. Comments and photo information for each image will now remain open once toggled on, creating a more consistent experience as you swipe through the carousel. We also improved carousel compatibility with other third party plugins and themes.
• We worked on further compatibility updates to block widgets, as well as fixed issues with block transformations regarding the Tiled Gallery block. You can check the changelog for more details and the complete list of updates.

Come join us!

We continue to grow and have some exciting open positions available at our parent company Automattic, including in Engineering, Product, Marketing, Business Development, HR, Customer Support, and more.

Work for us, from anywhere: https://automattic.com/work-with-us/

A big thank you to everyone who contributed to this release:

Adrian Moldovan, André Kallehauge, Andrés Blanco, Andrew Serong, Anna McPhee, Aurorum, Bartłomiej Jakub Kwiatek, Biser Perchinkov, Bogdan Ungureanu, Brad Jorsch, Brandon Kraft, Caleb Bauermeister, Chris R, Claudiu Filip, Dan Roundhill, Daniel Walmsley, David Lonjon, Dávid Szabó, Dean Sas, Dion Hulse, Eric, Foteini Giannaropoulou, Glen Davies, Jason Moon, Jasper Kang, Jeremy Herve, John Webb, Karen Attfield, Kim Brown, Matt Gawarecki, Matt Wiebe, Matthew Denton, Matthew Reishus, Miguel Torres, Mohaimenul Adnan, Moon, Mustaque Ahmed, NekoJonez, Ramon, Samiff, Sergey Mitroshin, Staci Cooper, Steve D, William Viana, Yaroslav Kukharuk, leogermani, thingalon

Not all website hosts are created equal, and there may come a day when yours just isn’t cutting it anymore. Migration refers to the process of moving your existing WordPress site to a new host without affecting its functionality or content. It’s something you’ll need to do if you decide to switch hosts. 

There are various reasons why you might want to do this. Maybe you’re having issues with uptime or need more services as your business grows. Perhaps you need a plan with more features, storage capabilities, or faster loading times. Or, maybe you’ve just found a new provider with more competitive pricing. Whatever the reason, site migrations can seem intimidating, particularly if you’ve never done one before. 

Why is site migration intimidating?

Let’s get one thing out of the way — switching your current website over to a new host isn’t exactly simple, and there are completely valid reasons why people dread the task.

1. There are a lot of steps

There are many steps involved when changing hosts and they can be quite complicated. Transferring data, modifying core files, and migrating content using FTP software are all part of the migration process. 

2. It’s time consuming 

Manual migration can sometimes take hours to complete and has the potential to become very expensive. If you’re paying a developer, costs can add up quickly and might negate any potential savings from switching hosts. And, if you’re spending your own time on the migration, you’re robbing yourself of hours that could be spent on more important tasks.

3. Temporary (or permanent) data loss can happen

One of the biggest reasons people are afraid of changing hosts is because they’re worried about temporary or permanent data loss. This can happen, particularly if you try to migrate without using a service or tool. 

What about WordPress migration services?

If you’re not accustomed to handling the backend work on your site, using a WordPress migration service reduces your risk of losing data and experiencing downtime. At the end of the day (and assuming you’re working with a reputable provider), it safeguards you against costly human errors while bringing you peace of mind. 

An experienced company will handle all the technical nuances and configurations of your site migration. Overall, good migration services tend to be pretty smooth and don’t require much technical know-how on your end. 

But paid migration services can run anywhere from $99 – $350 and up. Sure, they’ll get the job done, but they’re not exactly cheap. You’re also giving up control of the migration process while handing over personal information such as user data and passwords. 

Jetpack Backup: an affordable & user-friendly alternative 

If you have Jetpack Backup, you can use cloning to migrate your site. When you’re switching hosts, this is a great alternative to pricey migration services, and it’s still much easier than performing the task on your own. 

In order to clone your website with Jetpack Backup, you will need to make sure that you have a properly functioning site with SFTP, FTP, or SSH credentials added to its settings page. Once this is done, however, the process is very straightforward. 

Why should you use Jetpack Backup for a WordPress site migration?

1. It’s easy to use

Performing the task using Jetpack Backup involves just six easy steps, and there’s no coding necessary — hooray! The tool walks you through the entire process and is very user-friendly. 

2. It includes ongoing backups

Jetpack Backup includes ongoing backups that can be restored even when your site is completely down, so you’ll never have to worry about losing data again. 

3. It puts you in control 

When you use a migration service, you’re giving up control of the process. You’re also handing over files and other personal information like passwords and user data.

Jetpack Backup takes care of all the heavy lifting, but you get to stay in the driver’s seat. You’ll also keep your files, passwords, IDs, and other personal information to yourself. Additionally, it lets you migrate on your schedule so you can avoid downtime during peak hours when your site gets the most traffic, such as weekends or late at night. 

4. It’s affordable

Finally, Jetpack Backup is super affordable and offers plans as low as $4.77 per month for the first term. Plus, you’ll have access whenever you need it, and you can cancel at any time.

Change is good

Fortunately, changing hosts doesn’t happen very often. But, when the need to switch does come up, it doesn’t have to be scary. 

So, should you use a WordPress migration service? Ultimately, that’s up to you, but if you’d like to maintain control over the process, handle things on your time, and save money, why not let Jetpack Backup manage the migration? You’ll see for yourself how simple it is, and you can rest easy knowing that you’re protecting your site with ongoing backups at the same time. 

This week, Jetpack Scan flagged the license file of a premium extension, and the customer reached out to ask us for more information about it. So I put my detective hat on to investigate.

It is not unusual to stumble upon suspicious code that only ended up being an overprotective developer trying to hide code through common obfuscation methods. This is even more common when analyzing license management code. But in this case, it turned out to be something a bit more sinister.

At first glance, I considered the issue to be the way the developer had chosen to hide the URL for the license API or even the customer key (yes, I’ve seen some of those keys being hard coded in the license.php file). 

While inspecting the file, I noticed that it was a custom script based on the https://amember.com/ tool, but after a quick decode on the suspicious portion I could confirm its malicious intentions.

This malware adds a route to the WordPress REST API called am-member/license: which raises the first flag that this was either a targeted attack or the user got this extension on non-official sites. This line of code wasn’t present on any other version of this plugin.

The route will wait for a request with two specific parameters: blowfish and blowf, where the first is just a check and the second carries the final payload which is eval’d if both are not empty. Naming the parameters as blowfish is a nice touch, since the license file uses Crypt_Blowfish to encrypt content.

In order to perform the attack the bad actor just needs to craft an URL like: hxxp://Targeted[.]Domain/wp-json/am-member/license?blowfish=attack&blowf=echo("Hello from Jetpack Scan"); and wait for the results.

The extension developers were contacted in order to make sure that this code wasn’t injected on their codebase by mistake or by an attack. They answered back recommending that we download the latest version and use it.

I’d always recommend that you check your access_logs for any suspicious requests to the REST API (anything to wp-json) that are not expected on your site. It is also an important housekeeping task, along with reviewing your users, periodically changing your passwords, and not downloading pirated versions of WordPress extensions (I have a nice little post about this). 

We strongly recommend that you have a security plan for your site that includes malicious file scanning and backups. Jetpack Security is one great WordPress security option to ensure your site and visitors are safe.

When you sell online, the tools that you use are just as important as the products you create. Choose the right ones and you’ll be more successful, more efficient, and less stressed.

One of the biggest benefits of WordPress is its customizability — you can easily use free or premium plugins to add just about any functionality you can imagine. But the number of choices can become overwhelming. We’ve made this easier by putting together a list of the types of plugins you may need to grow and streamline your business.

Start with WooCommerce

Begin with an eCommerce plugin that allows you to list products, accept payments, and ship items to your customers. We recommend WooCommerce — built and maintained by the Automattic team, it’s incredibly powerful, flexible, and accessible.

With WooCommerce, you have full control and ownership over your brand, products, and store. Build, design, and manage your site without needing to edit a single line of code, and sell everything from physical and digital products to services, memberships, bookings, and tickets. The best part? It includes unrivaled documentation and customer support to help you along the way.

Extend your store

While WooCommerce includes everything you need to run an online store, there may be times in which you want to extend its functionality. Here are a few types of plugins we recommend to make your store more secure, efficient, and user friendly. Of course, you may not need or want to install all of these — pick and choose based on your specific requirements.

A security plugin

Security is incredibly important for an online store. Not only do you need to protect your reputation and hard work, you’re also responsible for your customers’ personal information. 

Jetpack Security includes a full suite of features to protect your store, all in one plugin, without slowing down your site, including:

• Downtime monitoring (free). Get an alert the second your site goes down so you can troubleshoot and fix the issue without losing sales.
• Brute force attack protection (free). Brute force attacks occur when bots guess hundreds of username/password combinations until they find the right one. Prevent them from accessing your site just by enabling the feature.
• Two-factor authentication (free). Require a verification code in addition to a password for your login page.
• Malware scanning (paid). Turn on automatic scans and get an instant alert if any malware is found on your site.
• Spam protection (paid). Prevent spam comments that make you look unprofessional and could send customers to unsafe third-party sites. 

Learn more about Jetpack Security features.

A backup plugin

The last thing you want is to lose all the hard work you’ve put into your store, along with all of your valuable order information. Make sure that doesn’t happen with a high-quality WooCommerce backup plugin.

Look for a solution that stores files off-site, so that you can restore even if your store is down, and separately from your host, so if your server is compromised, your backup won’t be. Jetpack Backup checks both of those boxes, going above and beyond to protect your content and make it easy to restore your site in an emergency.

Choose between daily backups, which save a copy of your site every 24 hours, and real-time backups, which save your site every time a page is updated, product is added, or post is edited. The best part? Whether you restore a backup from an hour ago or a week ago, all of your order information is saved up to the minute, so you never have to worry about losing an order.      

A payment gateway

Of course, every online store needs a way to accept payments. And while there are a variety of excellent payment gateway options, we recommend WooCommerce Payments for its simplicity. Unlike other providers, you can manage everything from transactions to refunds directly in the WordPress dashboard. Plus, customers can purchase products on your site, which keeps them happy and protected.

A shipping plugin

If you sell physical products, you’ll need a way to get them to your customers with as little expense and hassle as possible. WooCommerce Shipping is a great solution: it enables you to print USPS and DHL shipping labels directly from your dashboard and save up to 90% at the same time.

Want to ship with a different provider? Check out the full list of shipping extensions.

A plugin for unique product types

If you sell something a little more complicated than a traditional physical or digital product, you might need an extension to make setup a little easier. There are a variety of options, but here are just a few:

• Subscriptions: Collect recurring revenue with service subscriptions, themed boxes, or annual software packages.   
• Memberships: Offer memberships with recipes, exercise videos, software tutorials, or whatever you can imagine. 
• Bookings: Book classes, appointments, consultations, or restaurant reservations.
• Box Office: Sell tickets for events, concerts, fundraisers, and more.

See a full list of the unique product types you can offer.

A high-quality search plugin

A good search feature is critical to eCommerce success, especially if you have a lot of products. After all, you want customers to be able to find what they’re looking for as easily and quickly as possible, without having to wade through endless pages and menus.

Jetpack Search is a super-fast solution with powerful filters. Customers can narrow down search results by category, date, tag, and more. And if there’s a specific product you want to promote, you can push it to the top of the list.  

A customer chat plugin

When shoppers aren’t physically browsing in a store, they don’t have the opportunity to ask you questions that may help them determine if your product is the right fit. Emulate that experience with a live chat plugin.

LiveChat for WooCommerce is one great option that simplifies setup. Customers can reach out with questions about your products or their existing orders, and you can answer them quickly and efficiently. You can even view the contents of their cart while chatting with them, so you can provide the highest level of customer service.

A CRM

A CRM (customer relationship management system) is a tool for managing relationships. It helps you stay connected with customers, be more efficient, and increase sales.

Jetpack CRM is a simple but powerful solution that was built specifically for WordPress. Pick and choose just the features you need, so you never have to pay for unnecessary options. Customers are automatically added to the CRM, which you can then use to send emails based on their order history, track their purchases over time, and learn information about them to improve marketing and sales. It’s a great way to get you to the next level.   

Plugins for advertising and marketing

If you want to grow your online store, you’ll need a way to drive site traffic and turn that traffic into sales. While you don’t necessarily need plugins to accomplish this, they often empower you with more features and simpler processes. Here are just a few advertising and marketing extensions:

• Facebook for WooCommerce: Sync products to your Facebook store, chat with customers using Facebook Messenger, and get a leg up on advertising.
• MailPoet, AutomateWoo, or Creative Mail: Send abandoned cart emails, offer sales and discounts, and keep customers updated.
• Google Ads: Promote products on Google Shopping, YouTube, Gmail, and more.

Check out all the options in the WooCommerce extension marketplace.

A caching plugin

Speed is critical for eCommerce. The longer your site takes to load, the more likely it is that potential customers will leave and shop somewhere else. And that’s the last thing you want!

A caching plugin helps solve this issue. Typically, every time someone loads a web page, their browser has to download a lot of data so they can view everything. Caching, however, saves a copy of your files so that the next time that person visits your site, it will load much more quickly. WP Super Cache is one example of a caching plugin that offers additional features like GZIP compression and file minification.

Bonus: Looking for even more speed? Try Jetpack’s WordPress CDN, which delivers content like images, videos, CSS, and Javascript from lightning-fast servers located around the world. 

A tax management plugin

Taxes can be complicated, especially if you sell internationally. But a tax management plugin can take all that hassle off your plate!

WooCommerce Tax automatically calculates sales tax for you based on city, state, and country so you know you’re doing it right every single time. 

Plugins for international stores

If you’re an international store, there are special measures you need to put in place to make the shopping experience excellent no matter where your customers are located. 

First, you’ll need a translation plugin so visitors can read your content and shop in their own language. Two great options are WPML and MultilingualPress — while they take different approaches to multilingual websites, they’re both well-supported and documented.

You’ll also need a tool for currency conversion to make the browsing and checkout experience as easy as possible. We recommend WooCommerce Multi-Currency — automatically calculate exchange rates and display prices to customers in their own currency.

An accounting plugin

Integrating your accounting tool with your online store makes things easy for you and your accountant. Instead of manually importing order and customer information, it’s all synced automatically. This saves you a lot of time and ensures you have everything you need when it comes time to file taxes.

QuickBooks and Xero are just two examples of software you can integrate, but you can view the full list here.

A spam management plugin

Comment spam makes your store look unprofessional and can even direct customers to unsavory and malicious third-party websites. But filtering and managing spam can quickly become overwhelming.

Jetpack Anti-spam solves this problem. It automatically blocks spam for comments and forms, so you never even have to deal with it.

Bonus: An app for on-the-go store management

As a busy entrepreneur, you may not be near your computer all day long. You might be creating products, connecting with vendors, or traveling from your store to your warehouse. 

The WooCommerce App makes it easy to stay on top of your shop no matter where you are. Create products, process orders, and view analytics all on your mobile device. 

Make the most of your store

Plugins are one of the biggest benefits of WordPress. But they don’t have to be confusing! Navigate through the list above to find the best WordPress plugins for eCommerce and customize your store with the exact functionality you need.

Not sure where to start? Pairing WooCommerce with Jetpack sets you up for success. Get everything you need to sell online, along with shipping, payment, and tax tools, security features, search functionality, and more. 

When you own a restaurant, your time is both extremely valuable and extremely limited. Between managing day-to-day operations and new food innovations, you probably don’t have a lot of extra time to invest in your website.

But a high-quality site is critical for success. That’s why choosing the right tools is so important. We’ve put together a list of the best WordPress plugins for restaurants that save you time and help with everything from marketing and security to management.    

An online ordering system 

Online ordering is one of the best ways to streamline your processes and reach more guests. While you could use a third-party ordering system like DoorDash, their fees can be crippling for restaurants with already low margins.

Instead, maintain full control (and profits!) by adding an online ordering system to your WordPress website. All you need is WooCommerce and the Restaurant for WooCommerce extension. Categorize menu items, collect payments, offer multiple delivery options and more. This guide from WooCommerce walks you through the entire process from start to finish.

A menu plugin

Whether you accept online orders or just want to keep potential diners updated on your offerings, a menu plugin is a must. Some WordPress themes include this functionality, but if yours doesn’t, there are some great options available in the WordPress plugin repository.

Before choosing a plugin, think through the layout you’re looking for, along with the needs of your specific food. Do you want to include images? What about descriptions? Search for features specific to your needs.

A reservation system

If reservations are a big part of your dining experience, make it easier for your customers by allowing them to book directly on your site. With the OpenTable block from Jetpack, you can embed your OpenTable reservation form anywhere you’d like. Add it to pages, posts, and more so it’s always accessible. 

A security plugin

Security is one of the most important aspects of a successful website. Not only do you want to protect your hard work and reputation, you also want to lock down any information you collect from diners. 

Choose a security plugin that’s built specifically for WordPress and offers a variety of functionality in one tool. For example, Jetpack’s security package includes:

• 24/7 malware scanning, to immediately identify any corrupt code on your site and fix the majority of issues with one click.
• Spam protection, so you don’t have to waste time manually filtering comments.
• An activity log, which keeps a record of everything that happens on your site, along with who performed each action and when.
• Downtime monitoring, so you know right away if your site goes down and can get it back up and running quickly.
• Brute force attack prevention, which blocks hackers and bots who try to force their way into your site.

Since all of these features are built into one plugin, you get everything you need for excellent security without slowing down your site.

A backup plugin

If your site is ever hacked, or if you make a mistake, backups can be a lifesaver. Instead of having to rebuild from scratch or hire someone to solve the problem, you can just restore a clean, working version of your website in minutes.

Look for a WordPress backup plugin that stores backups separately from your site and from your host, so if your site’s down or your server is compromised, you can still restore a clean version. You also want something that’s easy to use and easy to restore, so you’re not fumbling to figure it out when you’re already stressed.

Jetpack Backup provides all of this, with options for daily backups (which copy your site every 24 hours) and real-time backups (which copy your site any time an action takes place). If you accept online orders or sell merchandise, real-time backups are your best option, so you never lose an order.

Pro tip: Jetpack Backup is also included in the Jetpack Security package mentioned above, so you can get everything you need in one affordable plan!

A maps plugin 

Does your restaurant have multiple locations? Do you run pop-ups from several venues? Does your food truck move around from area to area? Then a good maps plugin is critical to help diners find you at all times.

With the map block from Jetpack, you can easily add a map to pages, posts, and more with as many locations as you need.

A reviews plugin

Reviews are critical for any restaurant. In fact, 88% of people trust online reviews as much as a personal recommendation. Showcase all the praise you’re getting from diners directly on your site to encourage more to visit for the first time.

There are a variety of review plugins available (see a few options from the plugin repository) but take a moment to consider the needs of your restaurant. Do you want to display reviews from Google and Yelp? Or do you want to collect and display reviews of your own?

A speed plugin

If your website loads slowly, then visitors may get frustrated and leave. That’s the last thing you want! A slow site also makes you look unprofessional and can hurt your search engine rankings. 

That’s why you should always have a WordPress speed plugin to keep things loading quickly. Jetpack offers a suite of speed tools that are completely free, including:

• A content delivery network (CDN), which displays your content to site visitors from servers located around the world. This ensures that your pages load quickly. Bonus: it also automatically resizes images for mobile devices!
• A video-hosting service, which lets you embed videos without slowing down your site or having to use third-party tools like YouTube or Vimeo.
• A lazy loading image feature, which automatically delays the loading of images until visitors scroll down to where they appear on the page.

Not sure where you stand? Tools like GTMetrix and Google PageSpeed Insights will give you a clear picture of how quickly your site loads.

An SEO plugin

Search engine optimization (SEO) helps improve your site rankings on search engines so more diners can find you without the need for paid advertising. While there are a variety of factors that impact your rankings (see our SEO for beginners guide) a good plugin will get you started on the right track.

With Jetpack’s free SEO tool, you can see live previews of what your site looks like on Google, gain helpful suggestions for optimizing your content, and customize valuable information like titles and meta descriptions to help boost your rankings.

Plugins for advertising and marketing 

While SEO is important, paid advertising and marketing attract new diners more quickly and keep them coming back time and time again. There are a wide variety of marketing tactics (and the right strategy for you is probably a combination) so you may need multiple plugins like:

• An email marketing plugin. Send emails to people who are interested in your restaurant. Update them on events, specials, coupons, and more. While there are several great email marketing tools, Jetpack blocks make integrating your site with Mailchimp and Creative Mail simple.
• A social media plugin. If you’re creating great content, you want to share that with followers on your social media accounts. Automate this process with Jetpack’s social sharing features which, depending on your plan, automatically shares new blog posts to connected networks, republishes previous posts, and more.
• An analytics tool. How will you know if your marketing efforts are paying off without analytics? By default, Jetpack provides stats like site visits, most viewed pages, and search terms that people used to find you all in an easy-to-use dashboard. Or, for even more information, you can use it to quickly integrate with Google Analytics.

But again, the exact plugins you choose will depend on your marketing strategy. For example, you might want to integrate with your CRM, add lead generation popups, or include a chat box at the bottom corner of your site.

An eCommerce plugin

Do you make a special sauce, patented spice blend, or fun t-shirt? Adding an online store to your WordPress site is a great way to generate extra revenue. 

With WooCommerce, you can create an eCommerce store without needing to hire a developer or know any code. It’s completely free, offers ultimate flexibility — build anything your heart desires! — and provides a large extension library for added functionality. 

Want some inspiration? See how four food businesses started selling online during the COVID-19 pandemic.

A contact form plugin

Of course, you need a way for potential diners to get in touch with you if they have questions. A contact form allows them to do this, even if you’re closed when they’re visiting your site, and provides options for those who prefer not to pick up the phone. 

With Jetpack, you can easily add contact forms anywhere on your site. Use a ready-to-go template or edit the form fields to include (or remove) Name, Email, Telephone, or any number of customizable options.

Choose the right tools now for long-term success

Don’t get bogged down by your website! Choose the best WordPress plugins to help your site find success without taking all of your valuable time.

Jetpack is a great place to start. It offers everything WordPress sites need for security, marketing, speed, design, and more — all in one easy-to-use plugin. See a full list of features.

You’ve heard of a super fan — someone who’s a loyal, excited supporter of a celebrity, sports team, cause, or something in pop culture. Mark-Andrew Nordstrom is the epitome of a super fan for “open source.” And WordPress and Jetpack are Mark-Andrew’s ideal manifestation of the concept. Though, he’d disagree with being called a super fan because of his individualistic, independent, free-spirited nature. 

When we first encountered Mark-Andrew, we had caught word of a man living a simple, nomadic lifestyle who was spreading the word of open source. 

You could call him a traveling salesperson, but he doesn’t do it for profit. He’s not sanctioned. Nobody asked him to do it. But there he is — showing up again and again — from places all around the world. We finally caught up with him and conducted an interview from a hostel in San Diego.

For him, the world is his home and skating is his passion. He was arrested for the first time at the age of 12 for doing what he loves. 

After helping take care of his grandparents at the end of their lives, he took off to explore the world and skate full time. His possessions are little more than the things in his backpack. And with the exception of the ring he wears on his finger — given to him by his mother — he has no loyalty to worldly objects. He doesn’t even have loyalty to the sites he builds on WordPress, happily scrapping them and starting them over on a whim any time he gets the urge to create something new.

The open source mindset

But Mark-Andrew is unequivocally loyal to something: skateboarding and the open source community. He values experiences over things, people over profits, and community over corporations. 

It’s this mindset that’s drawn him to be such a strong supporter of open source, “Open source is kind of like skateboarding,” he says, “It’s not about the money involved — people are doing it for a reason.” 

If you could pinpoint a goal, Mark-Andrew’s would be to provide independence to skateboarders everywhere. As he travels and meets new people each day, he shares how he’s achieved a lifestyle that allows him to be a full-time skateboarder without giving in to commercialism. 

“The younger crowd growing up now thinks the only way to make money with skateboarding is by being on Instagram or growing huge followings on YouTube. But if you do that, you still have a boss. You might not think so, but now Mark Zuckerberg is in charge of your life. Or your sponsors control you.”

Mark has created a website that shows other skaters what can be done with tools like WordPress, Jetpack, WooCommerce, and Pressable.

So what exactly is it that Mark-Andrew does? 

“I skate around somewhere and I’ll end up at a skate park and there will be someone cool. We’ll start chatting like hey what’s up? What do you do? 

People are often like, ‘Oh I’ve got my own clothing thing.’ Or, ‘I’m making videos skateboarding.’ Sometimes they’re trying to raise money to build a new park or fund something else in their city. 

I ask them how they’re doing it or if they have a website. Most people say they don’t really even know where to begin. That’s when I pull up my example. 

They always want to know more. Usually they want me to build something for them, too. They want to know how much it costs.”

But he doesn’t charge a fee, “I just say, ‘Hey if there’s something you can throw my way to support what I’m doing, I appreciate it.’ Not everybody does, but that’s okay. I just want to spread the word.”

Q. What’s an example of a recent project that you’re proud to have contributed to?

“Vessel Skatepark is a great one.

I met the owner (Stephen Shore) skateboarding. He had moved his family to a new state to start a ministry/church, and wanted to use skateboarding as a place for kids to get together in a positive environment.

He was also looking for a way to make a living, as starting a new church with a skateboarding focus is not going to get much money, of course.

I told him about WordPress, what I do, and that you could go into web development for yourself as well. I’m currently hosting the site on my Pressable plan, and I’m going to get together with him to fine-tune some structural things. But otherwise, he’s built the entire site himself!

So far, he’s raised over $3,500 a month for this free skatepark project in just four months and, with his continued learning of WordPress, I’m thinking it’s only going to get better.”

Q: Why go through all the trouble to help fellow skaters learn WordPress?  

“Skateboarding has always been like open source. The WordPress and skateboarding communities are essentially the same. 

That’s what skateboarding is: an open source community where all of the information is shared. If I learn something, if I’ve got a new trick, if I’ve figured something out, the first thing I want to do is go show everyone.

And skaters don’t do it for money. At most, maybe someone will name a trick after you to throw you some shine.

But the skate community is pretty far removed from tech. Even some of the most famous skate publications…their sites are terrible. 

I hate to see people who want to skate full time think that they have to give into commercialism to do it. So I show them, ‘There’s something like the skate community, that you can use to build your own thing. To own something you create.’”

Q: Why is commercialism frowned upon so much in the skate community?

“For most of its life, skateboarding was not only not accepted, it was illegal.  

When I was a kid, my first arrest was at 12 for skateboarding. We’d get arrested all the time.  

And then we marched and we went to city hall and we eventually got it legalized. 

There was never any money in it when it started; everyone was in it because they loved it. We don’t want to lose that. We don’t want the big, ‘blue chip’ companies coming in to oppress the movement we fought for.” 

Q: Can you elaborate more on the similarities between WordPress / open source and skateboarding? 

“Skate and open source are so much the same that it’s mind blowing. And that’s true of a lot of creative or passion fields. Skate is open source whether they know it or not. It’s organic. It comes from the ground up. There’s not a bunch of money involved.

The communities have a similar feel. 

If you show up at a WordCamp or you talk to someone who’s in the community, you have a built-in friend — ‘Oh you do that? I do too!’ 

And if I show up at a skatepark or if someone has a skateboard wherever they might be on the planet..if I show up with a skateboard, too, we’re friends.”

Q: So, why did you first use Jetpack?

“I started with social integration. I took advantage of related posts and just some things that would have required other plugins to implement. 

I’ve always been of the mindset that plugins are what make WordPress so extendable. But at the same time, just like the way I live my life, I’m a minimalist. 

Whatever the least amount I can get away with, that’s what I want. And that’s what Jetpack lets me do. 

Plus, I’ve seen your product, I’ve met the people at Jetpack. I trust you.”

Q: And now? 

“Security is the most important thing now. Brute force attack protection, downtime monitoring, and all of it.

I know that all I have to do is install Jetpack, turn those things on, and I’m good to go. My mind is clear. 

Oh, and I have Jetpack Backup, but the good news is that I’ve never had to use it.”

Q: Do you use Jetpack on everything you build?

“I use Jetpack on everything. That’s my monitoring; that’s my security. I use it for two factor login. I use it for stats. I don’t need Google Analytics. I don’t want my site connected to all of that data. Jetpack tells me everything I need to know.”

Q: Your example site makes it clear that Pressable is your preferred host. How did the relationship come about? 

“I think I’ve tried them all [hosts]. And I‘ve been with Pressable since there were like four people. So I knew all of the people. And like with Jetpack, the first thing that got me in was the price.

The user interface was easy to work with and the tech aspect was good, too. The resources available, the security, all of that was what I was looking for.

But just like with Jetpack, it’s the support that kept me around. To this day, whenever I need help, they’re there. There’s no ‘I’ll get back to you,’ or ‘You owe us a fee’, or ‘You did it wrong.’ They just take care of it.  

And Jetpack’s included, so that’s a big part of it, too. 

But there is a cool story of working with Pressable: 

I’ve been around since the early days, right? So the prices have gone up over time and I kept my same plan and rates for years. Even though I was still paying monthly, I was grandfathered in and got to pay the annual rate. 

Well I changed plans and lost that rate at one point. But after a web project, I came into some money and I sent them a message. 

I was like, ‘Hey, it’s me. You know I’m pretty poor, but I came across the money and I’d like to pay for a year this time.’ And they actually remembered me and gave me the old, grandfathered rate. It was literally half of what it would have been otherwise. 

I’ve been there since the beginning and they remembered me. They didn’t have to give me a break, but they did. Who else is going to do that when they don’t have to?” 

Q: You have WooCommerce on your site as an example. Are most of the people you encounter open to using WooCommerce? 

“Yeah, if they’re already using something it’s usually something like Big Cartel. Or if they’re doing the Instagram influencer thing, they’ll sometimes be on Shopify. 

And I mean, those things are fine to stick your toes in the water with. But I show them WooCommerce and say, ‘Here’s something you can really grow with.’ 

If you’re on other platforms, you’re going to be limited by the number of products you can have or stuck with a bunch of fees. 

The big thing is that you don’t own your stuff on those platforms. It’s hard to grow, it’s hard to control your SEO and bring people to your site. And if you do, you’re still sending them to something that you don’t own. 

With WooCommerce, you can stick everything you want on there for free and it’s yours.” 

Q: Do you have any fun stories around Jetpack?

“Actually, yeah. I was the recipient of Jetpack’s barbecue giveaway! That was great. But I didn’t receive it because I’m always traveling. Where would they send it?

I still really appreciated winning, though.”

Q: Do you have any advice you’d give to your younger self?

“Ah, you know the saying, ‘The best time to plant a tree is yesterday. The second-best time is today.’ That’s so true. 

And whatever the future brings, even if we’re just talking about your own personal projects, ownership of your content is what’s most important going forward. 

So if you have an idea, just put it out there. Just put it up. It will all come around to you in the end. 

All of my sites are literally a constant work in progress so I can show people how it’s done. ‘Look, watch me work on this just a little at a time.’ That’s how people should move forward. 

Q: So what’s next for Mark-Andrew? 

“Well, as I look around me, I see beautiful San Diego sunshine. Someone asked me just a bit ago before this interview, ‘Hey are you interested in a drink or going down to the beach later?’ 

I said, ‘Yeah, well I’ve got something to do at twelve, but after that I’m free for the rest of my life.’

Follow along with Mark-Andrew.

The internet can seem like everything’s just floating out in space, but when you get down to the nitty gritty, your WordPress website files actually have to physically live somewhere. A hosting company’s job is to store your files and database so that your site can be accessed by anyone from any location around the world.

Ideally, your website can live happily at your hosting company forever and you never have to give the physical files any thought. But there may come a time when you want to move your website. Let’s take a look at a few reasons you might need to migrate to a new host and how you can do this easily.

Reasons to migrate your WordPress site

You need a better host

You’ll know that it’s time for new hosting when your current website has:

1. Too much downtime. Any time your website is inaccessible, it’s simply unacceptable. If you run a business, it can erode trust with your client base and cut off one of your main money-making assets. Timeout errors and what’s called the “white screen of death” are often related to network configuration (meaning it’s the fault of the host), and if they’re happening often, it’s time to think about switching. There are many hosts that guarantee at least 99% uptime. So there’s really no reason to settle for anything less. Pro tip: Use Jetpack downtime monitoring to alert you if there’s a problem. 
2. Slow loading speed. There are many factors that affect the speed of a website, but once you’ve optimized your site as much as you can, it comes down to hosting. If your host doesn’t focus on loading speeds, it could be time to migrate.
3. Poor customer support. Whether you’re experiencing a stressful outage, want to add new features to your hosting, or just have a question about how your site should work, then access to knowledgeable support is key. If your host makes it hard to get in touch, or provides service that doesn’t give you the answers you need, consider moving your website. 
4. Limits on your storage or traffic. Most hosting packages limit both storage space and website traffic. In addition, some sites see spikes of site visitors — for example, when launching a new product or announcing a sale — and these aren’t always handled well by basic hosting packages. If you’ve hit the maximum levels with your current provider, or need to more easily scale during spikes, then it may be time to find a new company.
5. Poor security. Have you been hacked? This is one of the most stressful things that can happen to website owners. Although there are many precautions you can take with your own website’s configuration, part of protecting your site rests with your hosting provider. You want one that knows how to set up their servers for maximum security, and that also includes regular backups of your site for quick restores in the event of a hack. If your host can’t provide those options, consider migrating.
6. Lack of advanced features. Some hosting companies offer cheap packages, but charge extra fees for features like SSL certificates and backups. This can really add up! If your host is nickel-and-diming you with add-ons, it may be time to move your website to a host that offers a more complete package.
7. Doesn’t support the community. WordPress is open source software, and that means it relies on the investment of developers and community members to remain strong, safe, and accessible to everyone. Some hosting companies are good WordPress community members and make it a point to contribute to the software; you can support WordPress indirectly by taking your hosting business to a company that is active in the WordPress community.
8. No special configuration for eCommerce. If you sell online, you want a hosting company that specializes in eCommerce. With a good security configuration and the ability to handle large amounts of important data, the right host can make the difference in your success. 

Remember, when it comes to good hosting, you get what you pay for. So if you’re living with some or all of these issues in the name of saving money, then it’s probably time to admit that the impact to your site isn’t worth it. Time to migrate!

Other reasons to migrate a website

1. Moving from a staging environment to a live environment. When you’ve had a website for a while and need a major design overhaul, it’s hard to make that happen on a live site. The best way to work on major changes is to create a copy of your website — called a staging site — where you can iron out any problems and make everything perfect before launch. Copying your website to a staging site, and then copying it back to your live website, are both migration processes.
2. Launching a new business website with a running start. If you have an existing site and want to create offshoots for specific ideas, you can copy and modify it instead of starting from scratch. This works perfectly if you have a business with multiple locations and want each to have its own site with identical branding and similar content. 

How to easily migrate your WordPress site

Ready to make the move? You don’t have to become a technical guru. The easiest way is to use a plugin to help — like Jetpack, which is built by the creators of WordPress.com.

All you need to do is purchase Jetpack Backup, either on its own, or as part of the Jetpack Security or Jetpack Complete packages. Install and activate it on your existing website.

Then, follow the simple instructions for cloning with Jetpack Backup. You won’t need to deal with complicated server configurations or code — all it takes is a few clicks and a few minutes to migrate your site from one place to another.

You can find even more details in our full Jetpack Backup migration guide.

With luck, moving your website isn’t something you’ll have to do often. But with good planning, it is something that can be easy, safe, and reliable. Jetpack makes it simple to migrate your website quickly and without worries, and get right back to business as usual.

While investigating a security advisory about an arbitrary role change/privilege escalation issue in the HM Multiple Roles WordPress plugin, the Jetpack Scan team discovered that the fix was incomplete and left the plugin still vulnerable.

The issue is fully fixed in version 1.3 of the plugin, and we advise any sites using any earlier version of this plugin to update as soon as possible.

Details

Plugin Name: HM Multiple Roles
Plugin URI: https://wordpress.org/plugins/hm-multiple-roles
Author: HM Plugin
Author URI: https://hmplugin.com/
WPScan Entry: https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5

The Vulnerability

The plugin allows a logged in administrator to assign one or more roles when creating a new user or editing an existing user. Versions before 1.1 would allow any user to assign any combination of roles themselves through the user profile page. Version 1.1 introduced a change that disables the checkboxes for selecting roles for non administrator users. 

However, the fix did not check that the request was valid when submitting changes to the profile page. This allowed a low privileged user to escalate their privileges by simply enabling the check boxes for the roles they want and submitting the page.

This can be easily achieved by using the built in developer tools in the web browser as demonstrated in the video below:

Affected versions: <= 1.2
Fixed version: 1.3
CVE-ID: CVE-2021-24602
CWE: CWE-284
CWSS: 79.3

Timeline

2021-07-20: Initial notification to vendor
2021-07-27: Tried contacting vendor again through another channel
2021-07-28: Contact with vendor established
2021-08-02: Received and verified suggested fixes from vendor
2021-08-02: Fixed version released on wordpress.org

Conclusion

If you are using the HM Multiple Roles WordPress plugin version 1.2 or earlier on your site, we recommend that you upgrade to the latest version as soon as possible.

At Jetpack, we work hard to make sure your websites are protected from these types of vulnerabilities. To stay one step ahead of any new threats, check out Jetpack Scan, which includes security scanning and automated malware removal.

Credits

Original researcher: Harald Eilertsen

Thanks to the rest of the Jetpack Scan team for feedback, help, and corrections. Also thanks to the WPScan team for the prompt response to our feedback on the issue, and to HM Plugin for being responsive and promptly fixing the issue.

Security is absolutely imperative whether you own a blog, small business site, or eCommerce store. After all, if your site is ever hacked, you risk damaging your reputation, losing your files and database, hurting your SEO rankings, and turning personal customer and visitor data over to hackers. 

As with many things in life, prevention is much better than treatment. And, thankfully, WordPress makes it easy to secure your site and prevent a hack.

We’re going to take an in-depth look at 12 of the best WordPress security plugins, compare them in a variety of areas, and help you make the right decision for your particular site. Plus, we’ll answer some common WordPress security questions.

Does WordPress have security issues?

WordPress powers over 40% of the web and is the most popular content management system (CMS). While its popularity does make it a target for hackers, the software itself doesn’t have security issues.

You see, hackers rarely access websites through vulnerabilities with WordPress. Instead, most sites are hacked due to preventable security issues like out-of-date plugins and themes, insecure passwords, or a poor hosting environment.

While no content management system is 100% secure, core WordPress developers work very hard to make it as safe as possible with each and every update. And, if you follow some basic best practices, you shouldn’t have anything to worry about.

How can I improve my WordPress security?

1. Choose a quality hosting provider. Security starts with your host, so choose one with a good reputation. Look for features like automatic backups, an SSL certificate, a server-level firewall, and malware protection. And before purchasing a plan, check reviews for common security-related issues. See Jetpack’s recommended WordPress hosting providers.
2. Regularly update WordPress, themes, and plugins. New releases often include patches for security vulnerabilities — along with additional features and functionality — so make sure that you’re updating everything as soon as possible.
3. Choose reliable themes and plugins. Only install plugins and themes that come from a reliable source and have excellent reviews. And never purchase free (also called “nulled”) versions of premium themes and plugins. These are often full of malware and vulnerabilities.
4. Create secure usernames and passwords. Use a unique password for your WordPress site that’s at least 20 characters in length and combines uppercase letters, lowercase letters, numbers, and symbols. This keeps both hackers and bots guessing.
5. Set appropriate user permissions. WordPress user roles define what actions each account can take on your site. Only give people the minimum role they need to do their job and remove any accounts that are no longer being used.
6. Take automatic backups that are stored off-site. Set up automated backups that happen, at a minimum, every 24 hours. Then, store these backups completely separately from your host, so that if anything happens to your server, your backup isn’t affected. 
7. Set up brute force attack protection. Brute force attacks occur when bots guess thousands of username/password combinations every minute to force their way into your site. But a good tool can block suspicious IP addresses before they even get to you. 
8. Scan for malware. While you can’t physically monitor your site for malware 24/7, choose a tool or plugin that can. Finding out the second anything suspicious happens enables you to solve the issue and prevent it from becoming widespread.
9. Set up two-factor authentication. Two-factor authentication requires both a password and physical device to log into your site. Typically, it sends a unique code to your phone, which you have to input to log in. This makes it nearly impossible for hackers to get in with a username and password.
10. Get rid of spam comments. Spam comments aren’t just annoying; they can include links to harmful phishing sites, therefore hurting your website visitors as well. You can get rid of these manually, or install a plugin that automatically filters comments and deletes spam.

Do I need a WordPress security plugin?

You don’t necessarily need a WordPress security plugin to run a safe site. Many best practices — like regular updates and secure passwords — can be implemented without one. However, the best WordPress security plugins take things to the next level, adding an extra layer of security, and making it easier to add advanced protection without the help of a developer.

And security is an area that you don’t want to skimp on. No matter what type of site you run, a hack could seriously impact how visitors, customers, and clients perceive your brand. It can also hurt your search engine rankings (Google doesn’t like unsafe sites), decrease the number of sales and leads you receive, and put information like credit card data at risk.

So, while a WordPress security plugin isn’t necessarily required, it’s a good idea to utilize one for any site.

The best WordPress security plugins

1. Jetpack Security

Unlike many other plugins, Jetpack Security takes care of multiple tasks: free and paid features include everything from brute force attack prevention to downtime monitoring, backups, malware scanning, spam protection, and more. These features combine to create a holistic WordPress security plugin that’s easy for beginners to use but comprehensive enough for the largest site. And, as a bonus, because scans are run on Jetpack servers, they won’t slow down your website.

Jetpack is also built and supported by the people behind WordPress.com, specifically for WordPress. The Jetpack team knows WordPress inside and out and understands the exact problems that WordPress site owners face each and every day, which is exactly why it’s the best security plugin available.

Key features of Jetpack Security:

• Daily and real-time automated backups
• Daily and real-time malware scans
• Automated spam prevention
• A detailed activity log showing everything that happens on your site
• Downtime monitoring
• Brute force attack protection
• Two-factor authentication
• A mobile app with alerts and access to backups, scan results, and the activity log

Let’s dive into a few of these features in a little more detail.

Brute force attack protection

A brute force attack is when hackers use bots to guess username and password combinations until they find the right one. Since they use large networks of computers, they can try thousands of passwords each second.

Jetpack’s brute force attack protection feature blocks unwanted login attempts from malicious IPs before they reach your site.

Downtime monitoring

Jetpack downtime monitoring visits your website from locations around the world and sends you an instant alert if it goes down. Why is this helpful? You can’t fix an issue you don’t know about! If your website goes down for an extended period of time, you could lose traffic, sales — even search engine rankings. With downtime monitoring, you’ll know about problems right away so you can solve them as quickly as possible.

Two-factor authentication

Two-factor authentication adds an extra level of security to your login page by requiring more than just a username and password. When you log into your site, Jetpack will send a code to your phone that you’ll need to enter. This means that, for a hacker to get in, they would have to know your username and password and physically have your mobile device — an unlikely combination.

Automated backups  

If your site breaks for any reason, a full backup will be invaluable. Imagine losing all of your hard work, the money you’ve invested, and your customers’ or visitors’ data. WordPress backups provide peace of mind.

But not all backup solutions are created equal. Jetpack backups are:

• Automated, so you don’t need to manually create backups.
• Secure, so your backups are protected and always available.
• Easy to set up, which is particularly helpful if you’re not familiar with coding or server management.
• Fast to restore, so you can get your site running again as quickly as possible.
• Available in two formats: daily and real-time.

Daily backups automatically happen once a day and are a great solution for restaurants, blogs, and other websites that aren’t updated more than once every 24 hours.

Real-time backups happen automatically as you work, so you have an up-to-the-minute record of your website — every change is saved as you make it. They’re perfect for online stores, membership sites, forums, and any website that’s updated on a regular basis. 

Regardless of the option you choose, you can trust that your site is backed up and can be restored in a few clicks if you ever need it.

Automated malware scanning

If a hacker gains access to your website, they can plant a “backdoor” — a type of malware that allows them to access your site any time they want to steal data or insert malware or viruses without your knowledge. Malware compromises your reputation and puts your information and your customers’ data at risk.

That’s where Jetpack Scan comes into play. It runs automatic daily malware scans of your site code, checking for anything suspicious. The minute it detects a threat, you’ll get an email notification with detailed information about infected files.

And it gets better: Jetpack automatically fixes the majority of known threats. So not only will you know about problems right away, you probably won’t have to lift a finger to fix them.

Automated spam filtering

Spam often comes in the form of irrelevant comments that include links to disreputable websites. With the right software, spammers can leave millions of comments — which quickly become unmanageable.

Jetpack Anti-spam automatically filters comments, pingbacks, and contact form submissions for known spam, saving you hours of time. If you’re worried about real comments being marked as spam, you can review them and restore anything you’d like, or just set Jetpack to get rid of the worst comments so you never have to see them. 

The Jetpack mobile app

Hackers don’t stop just because you’re away from your computer. With the Jetpack mobile app, you can check on site activity, restore a backup, and view malware scan results no matter where you are. 

Plus, you’ll get instant alerts if your website goes down or if any malware is found, for ultimate peace of mind. Find something wrong? You can solve the majority of known threats with one click, right from the app.

Ease of use:

Jetpack is designed so that absolutely any website owner can use it, no matter their technical skill level. All features can be turned on in just a few clicks, with no coding knowledge or developer required.

Support and documentation:

Jetpack is maintained and supported by WordPress experts who truly care about you, your site, and your business — appropriately, they’re called Happiness Engineers. A free plan includes high-quality email support, and paid plans offer faster, prioritized attention so you get the help you need right when you need it.

There is also extensive documentation that walks you through setup and troubleshooting.

Pricing and plan options:

• Jetpack Free includes downtime monitoring, brute force attack protection, and an activity log with the last 20 events at no cost.
• Jetpack Security Daily includes all features, along with daily backups, daily security scans, and a 30-day activity log starting at $11.97 per month.
• Jetpack Security Real-time includes all features, along with real-time backups, real-time security scans, and a one-year activity log starting at $33.57 per month.
• You can also purchase some features individually, like Jetpack Backup, Jetpack Scan, and Jetpack Anti-spam starting at $4.77 per month.

Great for: 

Blogs, eCommerce stores, and websites of any size. Jetpack Security is the most comprehensive, best WordPress security plugin for virtually any scenario. 

2. Wordfence

Wordfence is a web application firewall that also offers a few additional features like malware scanning. Since the firewall is an endpoint firewall, it integrates deeply with WordPress, can’t be bypassed, and can’t leak data. This makes it much more secure than cloud alternatives.

Once you have Wordfence set up, you’ll receive email notifications if it detects anything concerning like an outdated plugin, malicious piece of code, or virus. 

However, Wordfence does have a reputation for slowing down your site, as it adds a lot of heavy database tables and puts strain on your server during malware scans.

Key features of Wordfence:

• A web application firewall
• A security scanner
• Leaked password protection
• Two-factor authentication
• Manual blocking and country blocking
• Automated file repair

Let’s take a closer look at a few of these features.

Web application firewall

The firewall is certainly the most powerful feature of Wordfence. It harnesses the data collected from the more than four million websites that it protects to understand how hackers attack, what attacks look like, and where they come from. They regularly update their firewall rules and the list of malicious IP addresses that they block for constant protection.

Security scanner

The security scanner checks your site for malware, bad URLs, spam, malicious redirects, and code injections. It also reports any changes made to core WordPress files, known security vulnerabilities, and outdated plugins. 

Manual blocking and country blocking

Premium plans provide access to these features, which essentially just add extra power to the firewall. With manual blocking, you can choose to block entire malicious networks or any human or robot activity that you wish. With country blocking, you can block all traffic from a specific country, which can be particularly useful during an attack. Keep in mind that long-term country blocking is not recommended for SEO purposes.

Automated file repair

If Wordfence finds that a core WordPress file has been modified in an unsavory way, you can return the file to its original state with just one click. It is important to note, however, that this is different from removing malware or repairing a hacked site, which will run you an additional $490 from Wordfence.

Ease of use:

While Wordfence can be used by those without technical knowledge, the settings panel can be overwhelming and complicated. All of the features are listed at once and it can be difficult to understand what your site needs. By default, Wordfence also sends a lot of email alerts, many of which don’t require any response from the site owner, and it can be difficult for beginners to understand what they need to do with each one.

Support and documentation:

Wordfence provides free support through the WordPress forums, and premium support through an online ticketing system. They also have a documentation database that provides details about setting up and troubleshooting the plugin.

Pricing and plan options:

• Wordfence Free includes the basic web application firewall, malware scanner, and brute force attack protection at no cost.
• Wordfence Premium adds features like real-time firewall updates, IP blocklist checks, and country blocking for $99 per year.

Great for: 

Small websites that are looking specifically for a firewall and don’t need to protect important data like credit card information. While Wordfence does include additional features, it’s not the most comprehensive WordPress security plugin on this list. The web application firewall is what makes it stand out.

3. iThemes Security

iThemes Security is a freemium plugin that focuses more on hardening your site — adding layers of protection — than identifying and solving hacks. They do this through security measures like setting correct file permissions, enforcing strong passwords, and changing login URLs. 

Key features of iThemes Security:

• Brute force protection
• File change and 404 detection
• Database backups
• Hiding login and admin page
• Strong password protection
• Two-factor authentication

Here are more details about some of these features:

Brute force protection

Locks people out when they try to get in multiple times and fail. This keeps bots from guessing your password and username combination thousands of times in a short timespan.

Database backups

Automatically generate backups of your database, which are then emailed to you. Note that this includes only the database, not any of your files, media, plugins, or themes.

Hide login page

By default, all WordPress sites use the URL /wp-admin for the login and dashboard page. This, of course, makes it very easy for hackers to find that page, since it’s always the same. Changing the URL to something else, which iThemes Security allows you to do without custom code, adds an additional layer of protection.

Ease of use:

Like Wordfence, the iThemes settings dashboard can be overwhelming for beginners and non-technical users. There are a lot of small settings that can be turned on or off and it’s tricky to know which ones are right for your site.

Support and documentation:

The free version of iThemes Security is run through the WordPress.org forums. The premium version includes a ticketed support system. There is also extensive documentation available.

Pricing and plan options:

• iThemes Security Free includes hardening measures, database backups, brute force attack protection, and file change protection (among other features) at no cost.
• iThemes Blogger (Premium) adds scheduled malware scans, two-factor authentication, and reCAPTCHA (among other features) and is $80 per year per site. 

Great for: 

Login protection and site hardening. Though there are a variety of other features included, many of the other WordPress security plugins handle them better, in a way that’s easier for users.

4. Sucuri

Sucuri is a cloud-based WordPress security solution, which means that it runs completely on its own servers, preventing yours from lagging. It wasn’t built specifically for WordPress, and works with any platform or content management system. While it does offer web application firewall and malware scanning tools, its cleanup services really shine. 

It is important to note that Sucuri very clearly separates its free and premium features. The free plugin offers malware scanning and WordPress hardening, while the premium version includes the web application firewall and hack cleanup services.

Key features of Sucuri:

• Malware scanning
• Blocklist status monitoring
• A web application firewall
• Distributed Denial of Service (DDoS) mitigation
• Brute force attack prevention
• Website cleanup services

Let’s examine a few of these even closer.

Blocklist status monitoring

Sucuri runs your URL through a variety of services to see if you’re blocklisted. And, since blocklisted sites lose a significant amount of traffic, this can be a huge plus.

Distributed Denial of Service (DDoS) mitigation

DDoS attacks are malicious attempts to disrupt the traffic of a server by overwhelming it with a flood of fake traffic. This essentially prevents normal, legitimate visitors and customers from getting to your website. Sucuri’s DDoS mitigation feature blocks these attacks.

Website cleanup services

Sucuri’s expert team is available to repair and restore your site after a hack. They remove malicious code from your files and database, submit blocklist removal requests, and repair SEO spam (like link injections).

Ease of use:

Setup of the premium version of Sucuri can get a bit tricky for non-developers, as you have to change your domain DNS settings to use Sucuri’s servers. Setup for the free WordPress plugin is much simpler and easier for non-developers.

Support and documentation:

Support for the free version is offered through the WordPress support forums while the premium version uses a ticketing system. There’s also an extensive knowledge base available to answer common questions.

Pricing and plan options:

• Sucuri Free includes malware scanning, blocklist monitoring, and WordPress hardening at no cost.
• Sucuri Basic adds a web application firewall and cleanup services for $199 per year. However, there is no guaranteed cleanup response time and malware scans are run every 12 hours.
• Sucuri Pro is $299.99 per year and includes everything in the Basic plan, but increases the frequency of malware scans to six hours.
• Sucuri Business increases the frequency of malware scans to every 30 minutes and guarantees a response time to hacks of six hours. These benefits come with a yearly fee of $499.99.

Great for: 

Hardening and cleaning up a website after it’s been hacked. Since the free version of the plugin doesn’t include essential features like a firewall, it’s best to stick with the premium version or choose another plugin option.

5. All in One WP Security and Firewall

The All in One WP Security and Firewall plugin is a completely free, comprehensive WordPress solution, as its name implies. It divides its features into categories based on their security level (and the likelihood that they might break something on your site), so there’s something for everyone, regardless of skill level. 

However, all of the features are focused on protecting your site against hacks rather than scanning for malware and cleaning up a hacked site.

Key features of All in One WP Security and Firewall:

• User account hardening
• Login page security
• Database backups
• File system security
• Blacklist functionality
• A firewall
• A security scanner
• Brute force attack protection

Here’s some more information on a few of these features:

Login page security

The plugin blocks users after a certain number of login attempts, forces logout after a set time period, adds reCAPTCHA to the login page, and records every login and logout. This helps protect your site against both hackers and bots.

File system security

All in One WP Security and Firewall checks your files and folders for permissions issues and lets you fix them with a single click. It also allows you to prevent hackers and bots from viewing easily-compromised files (like readme.html, license.txt) and disables file editing.

Security scanner

The security scanner checks for changes in your files by comparing them to the default, core WordPress files. Note that this does not fix the issues for you or scan for malware.

Ease of use:

Because features are divided up by security level — separating those that could break your site from those that couldn’t — it’s an easy plugin for beginners to use. It also features a security strength meter that gives you a quick overview of where you stand at any given moment.

Support and documentation:

Support is only available through the WordPress.org forums and documentation is limited about some features.

Pricing and plan options:

There is only one version of this plugin — the free version — which includes all features.

Great for: 

Beginners and basic websites. It’s easy to get started relatively quickly without breaking your site. But, since there’s not a premium version of this plugin, it does lack valuable features like malware scanning and removal. This could be a good solution for hobby blogs that don’t want to invest a lot into their website’s security.

6. Defender Pro

Defender Pro was created by WPMU DEV, a WordPress development company that builds solutions for everything from security and opt-ins to quizzes and analytics. It can be purchased separately or as part of a suite of website tools.

Key features of Defender Pro:

• Security scanning
• Login protection
• Two-factor authentication
• Blocklist monitoring
• Changed file restore and repair

Ease of use:

Defender Pro includes an easy-to-use setup wizard that’s great for beginners.

Support and documentation:

WPMU Dev offers live chat support, along with forums, emails, and detailed documentation.

Pricing and plan options:

• Defender Pro only is $60 a year for the features listed above.
• The Security and Backups pack adds on additional products, like backup and migration tools, for $90 a year.
• The WPMU Dev Membership is the full suite of tools — including opt-ins, analytics etc. — and is $190 per year.

Great for: 

Sites that want to purchase the full tool suite rather than just security. While Defender Pro is a decent security option, it lacks key features like a firewall and spam prevention. However, when included with the full suite of WPMU Dev tools, it’s a nice bonus. 

8. Bulletproof Security

Bulletproof Security is a freemium WordPress plugin targeted specifically at developers. It’s comprehensive, and allows for a lot of backend tweaking, but is difficult for beginners to use.

Key features of Bulletproof Security:

• Malware scanner
• Hidden plugin folders
• Login security and monitoring
• Idle session logout
• Auth cookie expiration
• Security logs
• A variety of other advanced security features

Ease of use:

Again, this is not a plugin designed for beginners. While it does provide a setup wizard, changing or tweaking settings gets very complicated and could break your site. 

Support and documentation:

Support for the free plugin is provided through WordPress.org forums. Premium support is provided through a special support forum. Limited documentation and video tutorials are available.  

Pricing and plan options:

• BulletProof Security Free offers many of the features listed above at no additional cost.
• BulletProof Security Pro includes unlimited installations and advanced features (like database backups and monitoring, a plugin firewall, and auto-restore of website files) for $69.95.

Great for: 

Developers and advanced users who want to personally customize all aspects of their website security.

8. Security Ninja

While Security Ninja is a relatively comprehensive security solution, its “claim to fame” is the 50+ security checks that are built-in. These tests cover everything from up-to-date themes and plugins to WordPress versions, file accessibility, and database table prefixes. 

Key features of Security Ninja:

• A web application firewall
• Malware scanning
• Login form protection
• Plugin vulnerability scans
• Event logging

Ease of use:

This plugin is relatively easy to use, but does require you to put in some work. It doesn’t automatically fix the issues it finds. Instead, you’re completely responsible for your site and security fixes. This, of course, can be a benefit for those who know what they’re doing, but can also be difficult for beginners. Note that the Pro version does, however, fix around 30 issues automatically, should you choose to take that route.

Support and documentation:

Support for the free version is provided through WordPress.org forums, while the Pro version includes a support ticketing system. Detailed documentation is available.

Pricing and plan options:

• Security Ninja Free includes the 50+ security checks mentioned above at no cost.
• Security Ninja Starter adds on a firewall, malware scanner, auto fixer, and more for $49 a year for one site. If you want to cover more than a single site, you can purchase their plus plan (three sites) for $129 per year or pro plan (five sites) for $199 annually. Each plan also has the option for a lifetime license at a premium cost. 

Great for: 

Sites that want a very clear picture of where they stand, along with those who have at least a medium-level knowledge of WordPress and security.

9. SecuPress

SecuPress packs a lot of security features into one plugin without putting too much strain on your site. Both the free and premium versions are easy to use for people of all skill levels. One of the best features is the Security Report, which lets you know where your site stands and provides clear recommendations for improvement.

Key features of SecuPress:

• A site health scanner
• Limit login attempts
• WordPress hardening features
• Two-factor authentication
• Malware scanning
• Database and file backups

Ease of use:

SecuPress has a simple interface that’s easy to navigate for site owners of any skill level. It categorizes features based on their purpose and explains what each one does on-site.

Support and documentation:

The free version includes support through the WordPress forums, while the premium version includes a ticketing system. 

Pricing and plan options:

• SecuPress Free includes the health scanner, many hardening features, and limit login attempts (among other features) at no cost.
• SecuPress Pro adds on two-factor authentication, malware scanning, and backups, among other advanced features, for $69.99 per year.

Great for: 

Small businesses, especially ones that can invest some money into a WordPress security plugin. Since the free version doesn’t include the most valuable features like malware scanning, it’s recommended that you purchase the premium version.

10. Astra Security

Astra Security is a premium-only security tool that describes itself as an “all-in-one security suite for complete protection, minus the hassle.” It is important to note that, while it does protect WordPress sites, it was not built specifically for WordPress and works for any type of site. Since it’s not WordPress-focused, you may miss out on valuable features specific to the platform.

Key features of Astra Security:

• A website firewall
• Malware scanning and cleanup
• Blocklist monitoring
• Bad bot protection
• IP and country blocking

Ease of use:

Astra Security is easy to set up and relatively easy to configure. The premium support team is also available to help.

Support and documentation:

The level of support you get depends on the plan you purchase. Support is provided through a 24/7 live chat and there is both documentation and a knowledge base to get you started.

Pricing and plan options:

• The Pro Plan includes a firewall, malware cleanup within 12 hours, a malware scanner, bad bot protection, and bronze support (among other features) for $228 a year.
• The Advanced Plan adds 300+ security tests, malware cleanup within eight hours, spam prevention, and silver support (among other features) for $468 a year.
• The Business Plan adds malware cleanup within six hours, 500+ security tests, and gold support (among other features) for $1428 a year. 

Great for: 

Larger businesses, especially those with multiple sites on different platforms. Since this is a more pricey option and wasn’t built specifically for WordPress, it’s most likely not the best choice for the majority of WordPress blogs and businesses. 

11. WPScan

WPScan is a freemium, single-feature plugin that focuses specifically on testing the security of your site. While it’s the only single-feature plugin on this list, it’s included because it excels at what it does and offers something that most other plugins don’t have. It contains a large database of vulnerabilities that it references when scanning.

Key features of WPScan:

• Scans for 21,000+ known security vulnerabilities in WordPress, plugins, and themes
• Checks debug.log files, wp-config.php backup files, and exported database files that could pose security risks
• Looks for weak passwords
• Checks to see if XML-RPC and default secret keys are enabled or used

Ease of use:

The plugin is very easy to set up. All you need to do is register for an API key on their website, add that key to the installed plugin, and choose between very basic settings.

Support and documentation:

Support is provided through the WordPress forums and there are basic instructions available.

Pricing and plan options:

Pricing is based on the number of API requests you need per day. WPScan makes one API request for WordPress core, one for each theme installed, and one for each plugin you use. So if you have ten plugins installed and one theme, that would be 12 API requests per day.

• The Free plan includes 25 API requests. The vast majority of sites will fall into this.
• The Starter plan includes 75 API requests and is €5 per month.
• The Professional plan includes 300 API requests and is €25 per month.

Great for: 

Any site that wants to monitor for security vulnerabilities and doesn’t use a security plugin that includes this feature. However, it is important to note that this is not a complete security package and should be used in addition to something else.

12. Shield Security

Shield Security uses a simple strategy: start with prevention, then also provide a fix if a site is ever hacked. And since bots are responsible for the majority of security issues, Shield Security is dedicated specifically to blocking them from ever getting to your site. They also offer functionality that protects common WordPress plugins like Yoast, Gravity Forms, Advanced Custom Fields, Contact Form 7, and Elementor.

Key features of Shield Security:

• An anti-bot detection engine
• A malware and vulnerability scanner
• Spam detection
• Two-factor authentication
• A web application firewall

Ease of use:

It’s relatively straightforward to get started, but does provide a lot of information and settings that can be overwhelming for beginners.

Support and documentation:

Free support is provided through the WordPress.org forums. Premium support is offered through a ticketing system. There is also extensive documentation available, along with online courses.

Pricing and plan options:

• ShieldFREE includes bot detection, two-factor authentication, and a firewall (among other features) at no cost.
• ShieldPRO adds a malware scanner, vulnerability scanner, and spam prevention (among other features) for $79 per year.

Great for: 

Website owners with a moderate understanding of security, who can invest some money into a premium plugin. Since the free version doesn’t include a malware scanner, it’s best to purchase the pro version.

Final conclusion: What is the best WordPress security plugin? 

While WordPress is very safe, it’s always a good idea to add extra protection to secure your hard work and visitors’ information. Sites can be targeted at any size, but the importance of extra security grows along with a site’s popularity and volume of content. 

The easiest way to boost security is through a reputable plugin. But choosing the best WordPress security plugin for your site can get tricky because there are so many different options! Site owners should consider available prevention and cleanup features, along with cost and required technical knowledge. 

Backed by a team of WordPress experts, Jetpack is the top choice for WordPress website security. It balances robust prevention and resolution features with reasonable costs, easy setup, and superior support. 

If you’re just looking for a security scanning tool and don’t want all the other features and functionality, WPScan is a great choice. Not only is it completely free, it also excels at identifying security vulnerabilities to help you harden and lock down your WordPress site.

Or if you’re a developer who’s looking for an advanced, customizable option, you may want to consider BulletProof Security. It allows you to tweak just about everything in the backend so that you can provide unique, comprehensive security features for all of your client sites.

Frequently asked WordPress security questions

Can WordPress plugins contain viruses?

Yes, unsafe WordPress plugins can contain viruses. Since WordPress is open source, anyone can modify and use its code to create new plugins. This is incredibly beneficial because it means that there’s a solution for nearly any need, but it also means that unsavory developers can take advantage of the system.

But all you need is a little due diligence when selecting plugins. Always install them from trusted sources (like the WordPress.org repository) and check reviews thoroughly for signs of any issues. And, most importantly, never install nulled (or free) versions of premium plugins. These are often full of malware and vulnerabilities. 

Can WordPress be hacked?

Yes, WordPress, like any other content management system, can be hacked. But the majority of hacks happen through completely preventable methods. If you put a few best practices into place — like choosing a high-quality host, setting secure passwords, updating your software, and installing a WordPress security plugin — there’s no reason your site will be more vulnerable than any other. 

What types of sites are most likely to be hacked?

While it may seem like hackers only target large websites with a lot of traffic, that’s not really the case. The reality is that small businesses and blogs are just as likely to be attacked, but often have fewer security measures in place.

The majority of hackers don’t target specific sites. Instead, they use automated bots to search the web, looking for easy opportunities. And automated bots don’t discriminate.

Does my website need a firewall?

A good firewall is recommended for any website, because it acts as a shield between your site and all incoming traffic. A firewall should be included with any hosting plan you choose — this protects your site on a server level — but you should also install a web application firewall to secure your website against attacks specific to content management systems.

Think of a firewall as a guard standing at the door of your website. It monitors every visitor and bot that stops by, identifies suspicious characters (like bad IP addresses, botnets, and traffic to hidden pages) and blocks them before they even have a chance to attack. The best and easiest way to add a firewall to your WordPress site is with a plugin.

Is WordPress secure for eCommerce websites?

When it comes to WooCommerce security, it makes sense to be vigilant. After all, you’re responsible for protecting customer data in addition to your site files and database. However, WordPress is an excellent, secure choice for an online store.

As the most popular content management system, it can be a target for hackers. However, it has a plethora of built-in security measures that will keep your site safe. And with a few best practices in place — like strong passwords, a quality host, and a great WordPress security plugin — you’ll be set for success. 

How do I check my WordPress security?

The best place to start is with a malware scanning tool. This will scan your website for any suspicious code and alert you if it finds anything. Some also fix any problems they find automatically.

Here are a few more ways to check your WordPress security:

• Make sure your SSL certificate is working. An SSL certificate protects the data transmitted on your site, like payment and contact information. To make sure yours is working, simply check for the lock icon next to your URL in your browser.
• Monitor downtime. If your site goes down, it could be an indication of a hack. Install an automated tool that alerts you if your website is inaccessible so you can troubleshoot right away.
• Ensure there’s no browser security warning. If your site has been hacked, browsers like Google Chrome and Safari will display a security warning when you type in your URL. You may want to visit your website in an incognito or private window for the most accurate results.
• Check notifications in Google Search Console. If you have a Google Search Console account, you can quickly access the Security Issues Report, which will let you know if your site has been hacked or if it’s following any insecure practices.
• Follow security best practices. The best way to ensure that your WordPress site is safe is by implementing good security measures. Take the proper steps to harden your site (using a guide from a trusted source like Jetpack) and you’ll feel confident that you can stand up to hackers. 

To celebrate our 10th birthday earlier this year, we launched Jetpack Turns 10, a microsite to highlight how Jetpack has helped millions of people speed up and secure their WordPress sites.

In this release, we have shipped several under-the-hood improvements for an enhanced Jetpack experience.

In this release:

• We have improved compatibility with WordPress version 5.8 which was released on July 20, 2021.
• This release also includes many other bug fixes and improvements — check the changelog for more details.

To use the latest version of Jetpack on your site, update your existing installation or install Jetpack.

Jetpack is more than the sum of its code — it is the collective work of an amazing group of designers, product experts, Happiness Engineers, and code wranglers at Automattic. Does distributed work sound interesting to you? Check out our CEO Matt Mullenweg’s Distributed podcast.

A big thank you to everyone who contributed to this release:

Adrian Moldovan, Allison Levine, Andrew Serong, Andy Peatling, Ben Dwyer, Bogdan Ungureanu, Brad Jorsch, Brandon Kraft, Chris R, Dean Sas, Eru Penkman, Foteini Giannaropoulou, Glen Davies, Grant Kinney, Harris Papazolgou, Jason Moon, Jasper Kang, Jeremy Herve, John Webb, Kim Brown, Matt Gawarecki, Matt Wiebe, Matthew Denton, Miguel Torres, Patrick McMullen, Ramon, Samiff, Sergey Mitroshin, Sérgio Gomes, Staci Cooper, Steve D, Tom Cafferkey, Yaroslav Kukharuk, ashiagr, gavande1, leogermani, niranjan-uma-shankar, robertbpugh, simonktng, stacimc

If you have a website with global visitors, high traffic spikes, or a lot of images or videos, your page load time may be less than ideal. Even after optimizing images, implementing server-side caching, and minimizing content, you may still want to make improvements to your site’s performance. One of the best ways to achieve this is by setting up a Content Delivery Network (CDN). 

A CDN is a series of networked, geographically-distributed servers that store and deliver a site’s content using the server that is closest to each individual visitor. Normally, your host delivers content from a single server in a set place regardless of each visitor’s location. This can weigh down that server and reduce performance. 

A CDN distributes that weight more efficiently, improving page speed and reducing load on your server. 

Once you’ve determined that your site needs a CDN, you’ll want to find the provider that best fits your needs. There are a variety of things to consider including ease of use, performance and reliability, useful features, and cost. 

What makes a good CDN?

1. It loads content faster than your host’s server

This may seem obvious, but you’ll want to run a speed test from locations closest to where most of your traffic comes from. Do this before and after you set up your CDN so that you can measure the impact. There are several site speed testing tools out there, but Pingdom Website Speed Test will allow you to test from several different locations around the world for free, without having to create an account.

2. It has a large network of well-distributed data centers

A large network of servers is an important part of increasing performance, reliability, and scalability. Make sure the CDN you choose has a good number of data centers distributed globally and, specifically, data centers near where most of your traffic originates. 

3. It offers unlimited data without pricey upgrades

Many CDNs offer a free or low-cost plan that includes limited features and low data transfer limits. For smaller sites, this might not be an issue, but if you serve a lot of video and image assets or have very high traffic, you might need to pay for upgrades. Depending on your budget, you may want to consider a CDN with unlimited data transfers.

4. It increases the number of visitors your site can support

If your site’s going viral for all the right reasons, you don’t want to limit access because your server can’t handle the volume. A good CDN reduces the burden on your site by offloading some visits to their own servers. 

5. It has regular updates

Most major CDN providers regularly update their equipment and code, but if you’re looking at smaller providers, make sure that they’re investing in their technology and infrastructure. If they have related WordPress plugins, check that they’re updated regularly and are compatible with the latest version of WordPress. 

6. It automatically resizes images for mobile devices

One of the nice things about WordPress is that it automatically resizes images to be used in different contexts. However, if you’ve manually set an image to display at full size in a post or page, it will do so regardless of the device your visitors are using. A quality CDN will automatically resize images for mobile devices. This saves you time and provides a better experience for your audience. 

7. It hosts your videos

If you have a lot of video content on your website, it could have a large impact on site speed. To solve this, you might consider embedding content from a third-party provider like YouTube to save server space and reduce buffering. This method has some benefits — like visibility from YouTube’s built-in audience. However, YouTube doesn’t allow you to fully control how your video displays and might recommend other videos that you don’t want to promote to your audience.

Some CDNs allow you to present videos without third-party formatting, advertising, or other things that might distract viewers. 

8. It has excellent customer support

Whether you’re a new or experienced CDN user, quality customer support is a must. Research each CDN’s customer support options to ensure you get quick response times from knowledgeable staff. 

9. It has good reviews

Check reviews of the CDN providers you’re considering. Most review sites have some kind of affiliate revenue tied to them, so look for reviews from respected WordPress developers, read those in the WordPress.org repository, and seek the opinions of web professionals in your network to see what they like and dislike about their CDN.

Jetpack CDN checks all the boxes

Looking for a solution with all the must-haves but none of the complicated setup? Jetpack CDN is your best choice. 

And while some CDNs meet many or all of your needs, there’s a big advantage to using one that’s built specifically for WordPress. Jetpack CDN was developed by Automattic, the people behind WordPress.com, so you know it works well. There’s no need to jump through hoops or fiddle with complex settings and you can be assured of its stability, reliability, and compatibility with your site. Plus, we found that Jetpack CDN can at least double the number of concurrent visitors your site can handle and supports WebP image optimization.

But Jetpack is known as the ultimate WordPress toolkit because it gives your site a boost in almost every critical area: security, speed, design, and more. 

Whether you’re a WordPress professional or are just getting started, you can speed up your site quickly. Learn more about Jetpack CDN.

Maintaining a positive user experience is a huge part of what makes a WordPress blog successful, especially if you’ve created a lot of content. However, it can be tough to keep in mind, especially if your site has hundreds or thousands of articles. How do you find that happy balance between a seamless user experience and a flow of fresh, new content?

The secret? Implementing site search for your WordPress blog. 

A WordPress search plugin creates a more positive experience for your visitors. Check out these five reasons why you need to add a search plugin to your site:

1. Help your audience find what they’re looking for

Whether someone comes to your WordPress site from a search engine, social media platform, or another source, a search plugin can help them identify articles that answer their question or solve their problem. Without one, people may leave in frustration and you’ll miss the opportunity for new followers. 

2. Recommend related posts

Have you ever searched for an article on a site and the results suggested several, even better options you never knew existed? This is a search plugin at work! With a list of additional articles on a similar topic, your blog can provide greater value to visitors.

Giving someone exactly what they’re looking for is great. But it’s become expected. It’s average. However, when you anticipate people’s needs, you establish yourself as a helpful resource. You seem more insightful, more trustworthy, and like a greater authority on the subject you cover. With a single plugin, you can increase the chances that visitors not only make a return visit, but become loyal fans.

3. Make your blog more user-friendly

There’s nothing more frustrating than trying to find something on a site that just doesn’t want to be found. A WordPress search plugin can alleviate frustrations for site visitors as they’re exploring, especially if you have a robust blog with lots of articles. 

Your visitors will have the opportunity to scour through posts quickly and efficiently, narrowing down the results to the ones they’re most interested in. 

4. Save time and effort

When someone needs something specific from your blog, a search plugin helps them find it much more quickly than if they had to ask you or a member of your team. This reduces the need for unnecessary messages.

With the time you save, you can focus on creating quality content, building your email list, developing meaningful relationships, and following your passion.

5. Generate more revenue

A search plugin helps you generate revenue from sources like affiliates and advertising partners. The idea is to create a seamless user experience so that visitors stay on your site longer. The longer people stay on your site, the more pages they’ll view. This means more opportunities for clicks on affiliate links and more display ads viewed. Ultimately, this results in more income.

It’s easy to see why a search plugin is a useful tool for your blog, but now comes the tricky part: with so many options available, how do you know which one to use? 

Jetpack Search: the premier WordPress search plugin

Jetpack Search is a lightning-fast tool that allows people to look for a variety of blog posts and helpful resources while giving your website a sleek, innovative feel. With results that populate as visitors type, it’s an instantaneous experience that will keep people on your site. 

In addition to quickly providing results, Jetpack Search supports 29 languages and allows users to start new searches again and again without having to reload the page. They can filter results in real time, and Jetpack Search will even correct spelling errors and provide results that include post comments! 

But it doesn’t just save visitors time. You won’t have to wait for the search index to update whenever you add new posts or edit existing ones. Jetpack Search updates results automatically, so the information shown to visitors is always up to date.

Ready to use Jetpack Search? Get started today!

During an internal audit of the woocommerce-currency-switcher plugin, we uncovered a very severe local file inclusion vulnerability. 

This security flaw could enable attackers to leak sensitive information like database credentials, cryptographic keys, and may allow arbitrary code execution in some instances.

We reported the vulnerabilities to the WOOCS team via email last week, and they released version 1.3.7 to fix this issue. If you are using an older version of this plugin, we encourage you to update immediately.

Details

Plugin Name: WOOCS – WooCommerce Currency Switcher
Plugin URI: https://wordpress.org/plugins/woocommerce-currency-switcher/
Author: PluginUs.net

The Vulnerability

Due to the seriousness of this vulnerability, and the number of affected sites, we will delay posting the proof of concept to give users time to upgrade.

Authenticated Local File Inclusion

Affected Versions: < 1.3.7
CVE-ID: TBD
CVSSv3.1: 9.9
CWE: CWE-98
CWSS: 96.5

public function render_html($pagepath, $data = array()) {
    @extract($data);
    ob_start();
    include($pagepath);
    return ob_get_clean();
}

The render_html method, which is used by the [woocs] shortcode to display the currency switcher on a page, does not correctly handle arguments sent to PHP’s extract function. 

//[woocs]
    public function woocs_shortcode($args) {
        if (empty($args)) {
            $args = array();
        }
 
        $args['shortcode_params'] = $args;
 
        if (isset($args['sd']) AND intval($args['sd']) > 0) {
            wp_enqueue_style('woocs-sd-selectron23', WOOCS_LINK . 'css/sd/selectron23.css', [], WOOCS_VERSION);
            wp_enqueue_script('woocs-sd-selectron23', WOOCS_LINK . 'js/sd/selectron23.js', [], WOOCS_VERSION);
            wp_enqueue_script('woocs-sd-front', WOOCS_LINK . 'js/sd/front.js', ['woocs-sd-selectron23'], WOOCS_VERSION);
 
            if ($this->shop_is_cached) {
                wp_enqueue_script('woocs-sd-front-cache', WOOCS_LINK . 'js/sd/front-cache.js', ['woocs-sd-front'], WOOCS_VERSION);
            }
 
            global $WOOCS_SD;
            $args['sd_id'] = intval($args['sd']);
            $args['sd_settings'] = $WOOCS_SD->get(intval($args['sd']));
        }
 
        return $this->render_html(WOOCS_PATH . 'views/shortcodes/woocs.php', $args);
    }

Since $data contains all of the shortcode’s attributes, $pagepath can be overwritten with arbitrary file paths, which will then be included in the site’s execution context.

Since WordPress allows any logged-in users to render shortcodes, regardless if they have post-editing privileges or not, this is a pretty severe bug. 

Proof of concept

To be released.

Timeline

2021-07-09 – Initial contact with PluginUs.net
2021-07-14 – We sent them details about this vulnerability
2021-07-15 – PluginUs.net sendt us a tentative patch, and scheduled release on the 19th
2021-07-19 – WooCommerce Currency Switcher version 1.3.7 was released

Conclusion

We recommend that you check which version of the WooCommerce Currency Switcher plugin you are using on your site, and if it is less than 1.3.7 update it as soon as possible! 

At Jetpack we work hard to make sure your websites are protected from these types of vulnerabilities. To stay one step ahead of any new threats, check out Jetpack Scan, which includes security scanning and automated malware removal.

Credits

Original researcher: Marc Montpas

Thanks to the rest of the Jetpack Scan team for feedback, help, and corrections. Also, thanks to PluginUs.net for swiftly addressing this issue and releasing the updated version.

A study by Google states that if your site takes more than 3 seconds to load, the probability of a bounce increases by 32%. Given this, website performance is crucial for eCommerce stores or any other type of website.

A natural cost of adding features to your site through plugins could have an impact on site speed. Even so, some plugins are designed to speed up your site. In turn, this can boost conversions, reduce bounce rate, and improve your organic search rank.

WordPress speed plugins can work in multiple ways; some optimize your content by compressing images or minifying JavaScript, while others move your content to servers that are “closer” to the user through a Content Delivery Network (CDN). There are also some plugins that let the browser prioritise the most important parts of a page.

In the past, a lot of emphasis was put on faster hosting for performance. For the modern web, bottlenecks such as the end-user’s device and network are crucial. This is why performance plugins can potentially have a much bigger impact than switching hosting providers. 

In this post, we’ll take a look at some top-notch solutions to determine the best speed plugin for WordPress.

We’ll be including Jetpack Boost in our testing. This is our product and we love it, but we encourage you to dig into the numbers and judge for yourself. In short, the numbers put Boost ahead in every category – we’ll have more about this next.

How We Carried Out the Test

Before we get into the testing itself, let’s give you an overview of what we did. There are six plugins in total (and we’ll introduce them later). We looked at 1,000 real-world sites for each contending plugin.

The sites are all live sites across a variety of hosting environments. This let us get accurate and representative results of how the WordPress speed plugins performed in the wild.

This is at-scale testing of 1,000 sites, that provides an unbiased look at which WordPress speed plugin reigns supreme. This gives you a true overview of how the top WordPress plugins will impact your site, and ultimately, which one to use.

It’s also worth noting that this test is based on a random sample of sites. What’s more, we didn’t control for any hosting provider, traffic numbers, or any other metric.

We used the Google PageSpeed Insights API to carry out the testing. The tests were performed over one week in June 2021. There are two metrics that determine performance:

• First Contentful Paint (FCP). This measures when the first image or text is displayed on screen.
• Largest Contentful Paint (LCP). The opinion is that this is the most important metric. It measures when the largest piece of content is rendered on screen, relative to when the page first started loading.

Together, they make up an accurate picture of a site’s loading performance and speed. Let’s get into it!

Which Is the Best WordPress Speed Plugin? 6 Top Solutions Tested

We’ve handpicked the best WordPress speed plugins available, most of which are available for free on WordPress.org: Jetpack Boost, WP Rocket, Hummingbird, WP-Optimize, W3 Total Cache, and LiteSpeed Cache.

There are over four million installs between the plugins available on WordPress.org, and BuiltWith reports that WP Rocket is used on over two million live sites. This means over six million live WordPress sites have one of these plugins activated. It also means these are the most popular WordPress speed plugins on the market – perfect for comparing with Jetpack Boost.

Here’s an overview of the results:

Each plugin is tested for First Contentful Paint and Largest Contentful Paint. The results are in seconds.

Jetpack Boost performs better than the others on this list, especially for FCP. The numbers between every plugin are a lot closer for LCP, but Jetpack Boost still wins the contest.

Also, Boost is better than the average of all the plugins we tested in a big way – nearly 18 percent for FCP and 6 percent for LCP. These are big numbers, and show the real-world quality of the plugin.

Though, if you want to find out more about these results, let’s start with Jetpack Boost, the first plugin on our list.

1. Jetpack Boost

Jetpack Boost by Automattic (the same company that makes WooCommerce and WordPress.com) strives to provide you with the same performance benefits as the world’s leading websites, without having to fiddle with advanced technical concepts. 

It has a simple interface that anyone can easily understand and use, regardless of their skill level. As we’ll see in a moment, there are three settings that you can toggle on or off. 

The features you get in Jetpack Boost include optimization of CSS structure for every page, delayed non-essential JavaScript until after the page load, and lazy image loading. This means an image loads only when a user scrolls to where it’s placed on a page. 

At face value, it looks as though other plugins in our list may have more features than Jetpack Boost. Though, our plugin follows a new, unique approach to WordPress speed optimization. 

Instead of providing hundreds of customization settings that might confuse an average user, Jetpack Boost is very opinionated about what works for most sites and makes those decisions for you by default. As a result, you get an instant performance boost with no extra effort.

Setting Up Jetpack Boost

Since the Jetpack team has already decided most of the default settings for you, setting up the plugin is quick and easy.

To get started, search for “Jetpack Boost” in the WordPress Plugin Directory to install and activate the plugin. Then, click Jetpack Boost in the left sidebar menu. You’ll see a welcome screen appear. Click Get Started to create a WordPress.com account or log in to an existing account.

On the next screen, simply turn on the performance modules one by one.  

All in all, you can set up the plugin in under two minutes. 

Website Performance with Jetpack Boost

As the report shows, the FCP metric is well within the 1.8 second benchmark. LCP is great too, with a healthy 1.86 seconds – well under benchmark.

In this test, the plugin beat all other WordPress speed plugins we tested. Most of these are leading contenders. In fact, the numbers tell us that Jetpack Boost outperforms the next best plugin – W3 Total Cache – by nearly 16 percent, and 2 percent respectively. What’s more, it has less setup time, and zero cost.

Jetpack Boost has stellar numbers for website speed, with just two minutes of effort. This makes it a strong contender for the position of the best speed plugin for WordPress.

2. WP Rocket

WP Rocket is our only premium solution on this list, and comes with a fervent fanbase.

It provides standard page caching, and also gives you cache preloading, browser caching, and eCommerce optimization.

You can also integrate WP Rocket with a host of CDNs with a minimal number of clicks. As an alternative, you could also use RocketCDN from the developer.

Setting Up WP Rocket

80 percent of WP Rocket’s caching features are turned on by default. This means, once you install and activate the plugin, there’s very little you need to do.

There are a bunch of other settings you can toggle – that’s the final 20 percent of optimizations – but we’ve only tested the default setup of the plugin.

Much like Jetpack Boost, setup is about two or three minutes, given that you don’t have to toggle or tweak any settings. Of course, we’re fans of this approach, but the real quality will be within the testing.

Website Performance with WP Rocket

While WP Rocket delivers on its promise of fast website speed, and has some impressive numbers across the board, Jetpack Boost performs better.

With figures of 0.88 and 1.97 for FCP and LCP, it’s a full tenth of a second behind Boost across the board. This might not seem like much, but it could be an eternity for your visitors.

What’s more, Boost is free while WP Rocket is a premium-only solution. Of course, both tools have quick setup time, but given that the results and price fall behind, Boost is best here.

3. LiteSpeed Cache

LiteSpeed Cache is another popular caching plugin for WordPress. It makes use of server-level caching to accelerate your web pages.

Even so, LiteSpeed is a server-side technology. Unless you’re an advanced webmaster, or you use hosting that employs LiteSpeed, you are not likely to be able to use all of its features – especially caching.  

What’s more, trying to make sense of the interface and why you need certain server specifications to use the plugin can be confusing. 

LiteSpeed Cache offers object cache, browser cache, OPcode cache, multiple CDN support, HTTP/2 CSS/JS push, Cloudflare API, DNS prefetch, and compatibility with popular plugins like WooCommerce and Yoast SEO. In addition, you have the option to reduce HTML, CSS, and JavaScript, including inline XML and CSS. 

Setting Up LiteSpeed Cache

To reiterate, if you’re not using a LiteSpeed server, none of the caching functionality is available to you.  

However, if you do have a LiteSpeed-supported server, you can install and activate the plugin. The basic cache features will get enabled by default, which you can modify from LiteSpeed Cache > Cache. However, there are several settings to go through, which may take a while.

Website Performance with LiteSpeed Cache

Despite the plaudits that LiteSpeed Cache gets, Jetpack Boost outperformed the  WordPress speed plugin here.

While it does beat the benchmarks, it’s nowhere near Boost. Metrics of 0.93 for FCP, and 1.92 for LCP aren’t a match, especially as it’s one to two tenths behind Boost in every category.

Bearing in mind our random testing sample, Jetpack Boost could be your go-to solution, even if you run a LiteSpeed server.

4. W3 Total Cache

W3 Total Cache is a comprehensive WordPress caching plugin. It provides many features to optimize your website for high performance. 

It can improve performance by caching almost every part of your site, including CSS, JavaScript, pages, posts, search results, and RSS feeds. 

Other notable features are minification of your pages, posts, HTML, CSS, and JavaScript, along with support for CDN integration. 

However, a downside of this plugin is that having so many features makes it slightly complicated for users without technical know-how. If you’re a beginner in the world of WordPress, the backend options may confuse you.

Setting Up W3 Total Cache

After activating the plugin in your WordPress admin dashboard, go to Plugins > Installed Plugins. In the list of installed plugins, find W3 Total Cache and click Settings. 

Next, you’ll see a setup guide. Hit Next to get the Page Cache settings, run a test, and pick a storage option that shows the best performance. 

Next, just follow the steps as guided to similarly configure settings like Database Cache, Object Cache, and so on. Overall, it took us about 7–8 minutes to complete the steps and set up caching. 

Website Performance with W3 Total Cache

Considering how long it took to complete the basic configuration, we were expecting significant performance improvement.

Of course, both this and Jetpack Boost are free plugins. Though, Boost has a super-quick setup time, and better numbers after testing. It’s ahead of W3 Total Cache by about a tenth in all categories. While 0.88 (FCP) and 1.97 (LCP) aren’t bad, they’re no match for Boost.

5. WP-Optimize

WP-Optimize is another well-known solution among the best cache plugins for WordPress. It started as a database optimizer but has since added caching features to its core offering. 

As a result, it is now an all-in-one solution to enable caching on your website, optimize the database, and compress images.  

It’s loaded with essential features such as device-specific cache, cache preloading, advanced cache exclusion rules, browser cache, and minification of CSS, HTML, and JavaScript.

Setting Up WP-Optimize

Once you have activated the WP-Optimize plugin, go to WP-Optimize > Cache > Enable Page Caching. Save the settings.

However, note that your pages will be cached only when users visit them. To cache the pages straight away, you’ll need to perform one more step – preloading your pages. 

It took our team a few extra minutes to figure this out because the documentation is a bit misleading. It mentions the pages will start to cache as soon as we enable caching, which is not the case.

To preload the pages, go to the Preload tab next to the Page Cache tab, and click Run Now. 

Depending on how many pages you have on your website, the preloading process can take anywhere between 5–15 minutes. 

The total time from activation to enabling cache and figuring out the preloading step was about 5 minutes, which is longer than the other plugins we have tested so far. 

Website Performance with WP-Optimize

It’s a pattern we’ve seen so far, but the performance figures for WP-Optimize can’t stand up to Boost across all 1,000 random sites we tested. Results such as 0.91 put WP-Optimize behind boost by about 0.15 seconds.

Though the plugin performs much better with LCP, it still lags behind Boost. In fact, it’s close to the two-second benchmark for LCP, while Boost is nowhere near.

6. Hummingbird

Hummingbird, developed by WPMU DEV, is an established entry in the WordPress speed space. 

Its caching abilities consist of browser caching, page caching, RSS caching, and Gravatar caching. It also integrates with CDNs such as Cloudflare. 

Hummingbird is one of the most feature-rich plugins available. However, if you’re a beginner-level WordPress user, the various options can get overwhelming. 

While Hummingbird attempts to map out and explain everything when activated, you may not get a clear picture of what exactly you need to do or use.

Setting Up Hummingbird

Once the plugin has been installed and activated in your WordPress admin dashboard, go to Hummingbird > Caching > Page Caching to turn on the caching features. Click Activate.

From there, you can configure options such as cache preload, excluding certain pages or posts, and enabling caching for mobile devices. Next, there are separate sections for browser caching and other forms of caching.

There are many settings here to go over and understand one by one, so we’re going to stick to the default settings and see how the performance has changed. With the default configuration, the time to set up was under two minutes.

Website Performance with Hummingbird

Despite Hummingbird being a veteran among WordPress speed plugins, it couldn’t touch Jetpack Boost’s numbers over our random sample size.

Compared to Jetpack Boost, it’s behind nearly three tenths. Largest Contentful Paint stands out, with nearly half a second difference between Hummingbird and Boost.

There’s no contest for this comparison, and Boost has clipped Hummingbird’s wings on performance, usability, and price.

The Results Are In: Which Is the Best WordPress Speed Plugin?

In this post, we’ve tested six of the best speed plugins for WordPress. Most of these, apart from WP Rocket, are available on the WordPress Plugin Directory for no charge.

Given that you can spend two minutes to install the free Jetpack Boost plugin, the Return On Investment (ROI) is astounding. 

Jetpack Boost beat out every other plugin – some with years of stellar performance – in every area. Boost offers compelling value: a significant increase to your site speed, and simple setup. The numbers show that Boost is best across every area, for some metrics as much as 18 percent better than average.

The real winner of the experiment to find the best speed plugin for WordPress is not going to be a plugin, but your website visitors. By providing them faster access to your site, you’ll pave the way for a great user experience, and consequently more conversions.

There are a variety of reasons you might want to migrate your WordPress site. You could be unhappy with your current hosting provider. Or you may be launching a new version of your website. Either way, Jetpack Backup makes it easy thanks to the website cloning feature.

We want the entire process to be as simple as possible, so this WordPress site migration checklist will walk you through all the considerations for a seamless move.

Before you migrate your WordPress site:

1. Consider your timing

When migrating your site, you always want to consider the best date and time for you. What does that look like? Typically, it’s the time that your website receives the least traffic.

Are you a B2B company that’s closed on weekends? Then Saturday or Sunday might be the perfect choice. Do most people visit your site between 3:00 and 8:00 PM? Consider migrating late at night or early in the morning. Are you launching a new product or hosting a sale? Plan your migration before or after that event.

If you’re not sure when your site is most popular, use a tool like Jetpack Stats or Google Analytics to find this information.

2. Put your site on hold 

When you back up your site prior to migrating, anything that happens after that backup won’t be moved over to your new host. So take the time to press “pause” on your site.

If you’re an eCommerce store, pause orders for the time being. If you’re a blog, wait to publish new content. Make sure to inform anyone working for you (employees, contractors, etc.) to do the same. You may even want to consider a popup or banner letting your site visitors and customers know that you’ll be temporarily down for maintenance.

3. Ensure you have a backup ready to go

Take a minute to make sure that you have a successful backup on hand:

1. Log into your WordPress.com account.
2. Go to Jetpack → Backup.
3. There, you’ll see a confirmation of a successful backup.

During and after site migration:

1. Point your domain name to your new host 

The first thing you want to do is connect your domain name to your new hosting provider. The specific steps you take depend on your host, but they typically provide detailed documentation walking you through the process. You can also reach out to the customer support team for help, if needed.

It can take up to 48 hours for the connection to update across the world (a process called DNS propagation), but typically takes only a few hours. You can use tools like DNS checker to see if your domain name is fully connected.

Note: If you have a staging environment set up on your new host, you may want to migrate to the staging URL and check that the backup restored properly before pointing your domain name. This will prevent any downtime while migrating your site.

2. Migrate your site files and database

Thankfully, this process is a lot simpler with Jetpack Backup than with a manual migration! All you have to do is follow the steps in our cloning guide, and everything will be taken care of for you. There’s no need to hire a developer or understand code.

3. Make sure your SSL certificate is working

After migration is complete, make sure that your SSL certificate is working. You can do this by loading your site in an incognito window. If you don’t see a security warning and if there’s a lock icon displayed next to your URL in the browser, then you’re good to go. Make sure to check multiple pages, too, not just your homepage.

If it’s not working, double check that you’ve set up an SSL certificate through your host and reach out to their support team if you need help.

4. Check website functionality

Click through each of your pages and check that they all look great and are functioning as expected. Fill out contact forms to ensure that you receive submissions. If you own an eCommerce store, go through the entire checkout process and test payment functionality. If site visitors have accounts, make sure their dashboard and login work as expected. Check links throughout the site and see if they go to the right place.

5. Test backend functionality

Test all of your “hidden” site functionality as well. Is Jetpack Backup saving copies of your site? Are your security scans running? Are your social media feeds still connected? Are your email captures working? If not, you may need to reconnect plugins or extensions.

6. Check site speed

Use tools like GTMetrix or Google PageSpeed Insights to see how quickly (or slowly) your site loads. If it seems slower than before your migration, consider the differences in your hosting plans. Did your previous host include a CDN? You may want to implement Jetpack CDN to make up the difference. Did your previous plan include more resources? You may want to look into upgrading with your new host.

7. Make sure your site can be indexed by search engines

If search engines like Google can’t index your site, then you can’t show up in results. This shouldn’t have changed during site migration, but it’s always a good idea to double check.

If you have a Google Search Console account, you can quickly use the URL inspection tool to check any page you’d like. If there are any problems, Google will point out the issue and provide troubleshooting tips.

8. Monitor Google Search Console and Google Analytics over time

Continue to monitor your accounts and watch for any errors or changes in traffic that could indicate an issue. Again, when using a WordPress migration tool like Jetpack Backup, you shouldn’t encounter anything, but it’s always good to be aware of what’s happening so you can troubleshoot if necessary.

9. Close your old hosting account

Once everything’s working properly, you can cancel your old hosting plan and close your account. But be careful! If you have other services with that provider — like email accounts or domain names — don’t delete those without moving them elsewhere.

WordPress migration made easy

Jetpack Backup makes the website migration process simple, requiring no developers, experience, or coding knowledge. And if you run into any issues, the Jetpack support team is available to help.