Category
The engineering reality of running WordPress at scale: locking down security, debugging plugin conflicts, and configuring caching to pass Core Web Vitals.
25 articles
The most common cause of missing contact form notifications is a form configured to send as the visitor who filled it in. It is an intuitive setting. Putting the enquirer's address in the From field means you can hit reply. Many form plugins default to it, and it worked for years. It fails now, and […]
There are four caching layers on a WordPress site, they cache different things, and stacking two of the same kind causes bugs rather than speed. Layer What it stores Who usually provides it Page cache The finished HTML of a page A plugin, or your host at server level Object cache The results of database […]
Most WordPress compromises come through a vulnerability in a plugin or theme, not through someone guessing a password. That single fact should reorder how a small site spends its security effort, and it usually does not — because password advice is easier to give and easier to follow. Brute force attempts are constant, automated, and […]
"How many plugins is too many?" is the wrong question, and it is the only one most people ask. Twenty lightweight plugins that load nothing on the front end cost less than one page builder. The right question is what each plugin costs on each request, and there are four numbers that answer it — […]
Most WordPress compromises come through a vulnerability in a plugin, not through a guessed password. That makes plugin vetting the highest-value security work available, and it is the part most site owners never do — because it has no dashboard and produces no alert. Five signals separate a plugin worth keeping from a liability, and […]
An SMTP plugin configured with credentials and nothing else leaves your email unauthenticated. That is the gap this article exists to close. The plugin changes how the message leaves your server. Whether the receiving server trusts it is decided by DNS records the plugin cannot publish for you, and skipping them produces a setup that […]
Three metrics, three thresholds, and one rule that decides everything: assessment happens at the 75th percentile of real page loads, segmented across mobile and desktop. Metric Measures Good Needs work Poor LCP Loading ≤ 2.5s 2.5–4.0s > 4.0s INP Responsiveness ≤ 200ms 200–500ms > 500ms CLS Visual stability ≤ 0.1 0.1–0.25 > 0.25 The 75th […]
The number most people try to raise is not the number Google uses. The PageSpeed Insights score is a lab simulation of one page load on a synthetic device. What actually gets assessed is Core Web Vitals measured from real visits, at the 75th percentile, split between mobile and desktop. Those are different things, and […]
Since WordPress 5.2, a fatal error is not supposed to produce a blank white page. It is supposed to show visitors a holding message and email you a secret recovery link that pauses the plugin or theme that broke. So the first diagnostic question is not "what broke?" It is: did you get the email? […]
You already have a sitemap. WordPress has generated one in core since version 5.5, served at /wp-sitemap.xml, with no plugin required. And you may not need it. Google's own threshold: you might not need a sitemap if "Your site is 'small'. By small, we mean about 500 pages or fewer on your site" and it […]
Every transactional email provider claims excellent deliverability, and none of them can promise it, because most of what decides delivery is on your side of the connection. Your domain's reputation, your authentication, your content, your bounce and complaint rates. A provider supplies infrastructure and hygiene. It cannot supply a reputation you have not built. What […]
WordPress makes a set of SEO decisions for you at install, before you write anything. Four of them are wrong for most sites, and none of them is fixed by a plugin. That is the useful frame for this subject, because "WordPress SEO" is usually presented as a plugin choice, and the plugin is the […]