Skip to content
Sign In Get Started

WordPress

Toolkit, staging, LiteSpeed Cache, Redis, and recoveries.

  1. Install WordPress the right wayInstall WordPress the right wayInstall WordPress in the real document root with WP Toolkit, one dedicated database user, and HTTPS on first login so siteurl starts correct.Updated Aug 29, 2026
  2. WP Toolkit stagingWP Toolkit stagingWP Toolkit staging clones your WordPress files and database to a subdomain so you can test safely. Password it, then push files back carefully so live orders are…Updated Aug 29, 2026
  3. LiteSpeed Cache for WordPressLiteSpeed Cache for WordPressLiteSpeed Cache stores logged-out HTML on our WordPress stack and should miss on cart and wp-admin. Confirm with X-LiteSpeed-Cache, and do not run a second page-cache plugin.Updated Aug 29, 2026
  4. AccelerateWP versus a pile of pluginsAccelerateWP versus a pile of pluginsAccelerateWP pairs LiteSpeed cache with image tools on this stack. Running extra cache and minify plugins beside it often means two owners and missed hits. Pick one path…Updated Aug 29, 2026
  5. Object cache with RedisObject cache with RedisA Redis object cache stores WordPress queries in memory through object-cache.php. Bind Redis to localhost, set maxmemory and eviction, and keep the drop-in active so the cache stays…Updated Aug 29, 2026
  6. Updates, users, and XML-RPCUpdates, users, and XML-RPCWordPress security rests on strong admin users, timely updates, and disabling XML-RPC when unused. A security plugin does not replace those habits on your site.Updated Aug 29, 2026
  7. White screen and 500 after a pluginWhite screen and 500 after a pluginA white screen of death after a plugin is usually a PHP fatal. Rename that plugin folder first, log to debug.log with display off, then check .htaccess only…Updated Aug 29, 2026
  8. Permalinks, HTTPS, and mixed contentPermalinks, HTTPS, and mixed contentWordPress permalinks need working .htaccess rules, and siteurl plus home must use https://. Mixed content is leftover http:// data in the database, fixed with careful search-replace—not sed.Updated Aug 29, 2026
  9. wp-config.php constants that actually matterwp-config.php constants that actually matterwp-config.php holds your database credentials, security keys, and the switches that matter most: WP_DEBUG_LOG, DISABLE_WP_CRON, DISALLOW_FILE_EDIT, and FS_METHOD. A BOM or a public .bak copy can take the…Updated Aug 29, 2026
  10. WooCommerce on shared versus a VPSWooCommerce on shared versus a VPSWooCommerce runs on LiteSpeed shared when the catalog caches and cart misses. Move to a VPS when you need root, a daemon, or you have measured LVE during…Updated Aug 29, 2026
  11. WP-CLI on cPanelWP-CLI on cPanelWP-CLI on cPanel manages plugins and search-replace when wp-admin will not load. Run it from the live document root as your account user, not from a downloaded phar.Updated Aug 29, 2026
  12. Disable wp-cron properlyDisable wp-cron properlySet DISABLE_WP_CRON to true and add one five-minute server cron that runs wp-cron.php. Using the constant alone freezes scheduled posts; using both keeps jobs on time.Updated Aug 29, 2026
  13. WordPress debug.log on production, carefullyWordPress debug.log on production, carefullySet WP_DEBUG_LOG true and WP_DEBUG_DISPLAY false on production, then read and truncate debug.log. Deny web access so stack traces with paths or credentials stay private.Updated Aug 29, 2026
  14. WooCommerce sessions and RedisWooCommerce sessions and RedisWooCommerce sessions store cart state in MySQL by default and can grow fast. Learn how cleanup and Redis keep checkout off oversized InnoDB tables.Updated Aug 29, 2026
  15. XML-RPC and application passwordsXML-RPC and application passwordsDisable XML-RPC when nothing you run still needs it. Use application passwords with the REST API for the mobile app and modern integrations instead.Updated Aug 29, 2026
  16. Turn off the theme/plugin file editorTurn off the theme/plugin file editorDISALLOW_FILE_EDIT set to true removes the theme and plugin editors from wp-admin. You still update and deploy code with SFTP, File Manager, or WP Toolkit.Updated Aug 29, 2026
  17. Revisions and autoloaded wp_optionsRevisions and autoloaded wp_optionsCap WP_POST_REVISIONS, then audit autoload yes rows in wp_options. A multi‑megabyte autoload set slows every cache miss more than leftover revisions do.Updated Aug 29, 2026
  18. WordPress multisite on sharedWordPress multisite on sharedWordPress multisite runs many sites from one database and one LVE on shared hosting. It fits related microsites; separate businesses need separate installs.Updated Aug 29, 2026
  19. The REST API and “headless” ideasThe REST API and “headless” ideasThe WordPress REST API powers the block editor and integrations. Disabling it entirely breaks admin; rate-limit abuse, use application passwords, and treat headless as another origin to cache…Updated Aug 29, 2026
  20. Wordfence, Imunify, and not stacking three WAFsWordfence, Imunify, and not stacking three WAFsImunify runs on the server and Wordfence runs in PHP. Stacking both with a CDN WAF often 403s checkout. Pick one WAF layer and read its logs.Updated Aug 29, 2026
  21. Add passkeys to WordPress loginAdd passkeys to WordPress loginAdd WordPress passkeys with one maintained plugin, HTTPS on the live hostname, and a recovery path before you require them for admins.Updated Aug 29, 2026
  22. Recover from a WordPress critical errorRecover from a WordPress critical errorA WordPress critical error is a fatal PHP stop. Rename plugins in File Manager, confirm the site loads, then read error_log for the path before you restore or…Updated Aug 29, 2026
  23. Replace reCAPTCHA with Cloudflare TurnstileReplace reCAPTCHA with Cloudflare TurnstileReplace reCAPTCHA with Cloudflare Turnstile by adding one widget and two keys, then removing the old plugin so both never stack on the same form.Updated Aug 29, 2026