Written from over 25 years of hands-on troubleshooting by Jim Walker, The Hack Repair Guy™. Filter by topic below or search for any WordPress error, plugin issue, or hardening step.
How to block brute-force botnets, lock down XML-RPC, spot hijacked plugins, and clean hidden backdoors.
Fixes for common WordPress emergencies: stuck .maintenance files, PHP 8.x compatibility warnings, critical error screens, lost admin passwords, and 404 pages.
Clearing stuck wp-cron tasks, taming the WordPress Heartbeat API, cleaning bloated wp_options tables, and setting up clean SEO taxonomies.
Why relying only on your web host for backups is risky, how shared hosting accounts infect addon domains, and how to move WordPress domains cleanly.
Showing 26 of 26 WordPress guides
Why WordPress gets locked on "Briefly unavailable for scheduled maintenance" during updates and how to clear the hidden .maintenance file in under 5 minutes via FTP or File Manager.
How threat actors purchase abandoned WordPress plugins and push malicious updates into trusted websites, plus how human update vetting protects your site.
How to enable WP_DEBUG, read PHP parse error line numbers, isolate conflicting plugins or themes via FTP, and recover from the White Screen of Death.
Why hosting company backups fail when you need them most, how 503 resource limits happen during local backups, and why independent 60-day cloud archives matter.
Practical steps to speed up WordPress: controlling the WordPress Heartbeat API, removing heavy plugins, resizing images before upload, and choosing fast hosting.
Server-side WordPress speed tuning: memory limits, php.ini configuration, page caching, and cutting slow external scripts.
Why botnets target wp-login.php, why replacing the default "admin" username is necessary, and how login lockouts stop password guessing.
Jim Walker's four-part BUMM routine for WordPress care: Backup offsite, Update weekly by hand, Maintain the database, and Monitor 24/7.
Lessons from 25+ years of cleaning hacked websites: why bots target small sites, why SSL certificates do not stop malware, and why manual oversight matters.
How old scheduled tasks pile up inside wp_options cron arrays after plugins are deleted, and how to inspect and clear stuck WordPress cron events.
A practical look at free uptime ping tools and page-change monitors compared with 24/7 human-managed WordPress security monitoring.
How Jim Walker pairs 25+ years of hands-on malware cleanup experience with AI tools for faster code review, research, and client security reporting.
How a single vulnerable addon domain compromises every other WordPress site in the same cPanel account through shared file permissions.
Common WordPress plugins that cause high server load, database bloat, or security risks, plus lighter alternatives.
How to fix PHP version mismatch alerts in WordPress and upgrade your hosting account to PHP 8.2 or 8.3 without breaking older plugins or themes.
How attackers abuse WordPress xmlrpc.php for amplified password-guessing and DDoS pingback floods, plus the .htaccess rule to block it.
Locked out of your dashboard or lost touch with a former developer? Here are 4 ways to reset your administrator password via email, functions.php, emergency script, or phpMyAdmin.
What to look for when comparing WordPress web hosts: account isolation, responsive US-based phone support, server resources, and clear renewal pricing.
Where your web hosting company's security job ends and where your WordPress application security responsibility begins.
How to customize your WordPress 404 error page so visitors and search crawlers find your main pages instead of leaving.
Why default WordPress category, tag, and author archives create duplicate content and index bloat, and how to clean up your SEO settings.
How to run a multi-author or community WordPress blog safely by using Contributor or Author roles and reviewing uploads.
Checklist for moving a WordPress site to a new domain name, updating serialized database URLs safely, and setting up 301 redirects.
Built your WordPress site inside a subfolder like /new/ or /wp/? Here is how to serve it from your root domain URL.
How to tell the difference between genuine WordPress fatal error recovery emails and phishing emails sent to steal your admin login.
How to promote a user account to Administrator in the WordPress dashboard or inside the wp_usermeta database table when locked out.
