Every field guide, by topic

WordPress loaded but could not log in to its database. Test the credentials in wp-config.php, then check the database server, connection limits, disk space and damaged tables, in that order.

PHP hit a fatal error, almost always in a plugin, theme or after a PHP upgrade. Use the recovery mode email, read the exact error in the log, and switch off the culprit without losing anything.

Two rules are sending visitors back and forth. Trace the loop with curl or the Network tab, then fix the WordPress URLs, the HTTPS setup behind your CDN, or the duplicate redirect rule causing it.

Your SSL certificate expired, or the visitor’s clock is wrong. Confirm which with one command, renew the certificate, and fix the DNS, CAA or blocked-challenge problem that stopped it renewing.

Contain it, preserve evidence, find how they got in, then rebuild from clean sources and rotate every credential. The order matters, and skipping a step is how sites get reinfected.

A DNS or hosting move often drops the records that prove your email is genuine. Check MX, SPF, DKIM and DMARC with dig, read the Authentication-Results header, and fix WordPress mail sending.

Editor stuck loading, or pages lost their styling after an update? Regenerate the builder’s CSS, clear caches in the right order, read the console and logs, then find the conflict or roll back.

Times New Roman means the browser tried to load your font and failed. Find the failing file in the Network tab, then fix the old URL, the missing CORS header, mixed content or the plugin blocking it.

Plain unstyled text, huge images and menus as bullet lists mean a stylesheet is not arriving. Find the failing CSS file in the Network tab, then fix the stale cache, wrong URL, permissions or security rule behind it.

Sideways scrolling, tiny text or overlapping sections on phones usually come down to one element wider than the screen, a missing viewport tag or a cached desktop version. Here is how to find each one.

Many slow sites are slow by design. Find the LCP element in PageSpeed Insights, then fix the hero image, trim font files, tame sliders and animations, and stop layout shift.

The web server hit something it could not handle and gave up. Read the error log, test .htaccess, then check permissions, the PHP handler and security rules, in that order.

A proxy in front of PHP got a broken answer (502) or no answer in time (504). Read the upstream error, check PHP-FPM, then find the slow request.

Your account or server ran out of PHP workers, processes or CPU. Find which limit was hit, find the URLs and bots eating it, then cache, block or upgrade.

Cloudflare is up, but it could not get a good answer from your server. Each code names a different failure. Test the origin directly, then fix firewall, SSL or timeout.

The browser could not turn your domain into an IP address. Check the domain status in RDAP, then nameservers, records, glue and DNSSEC, then your own DNS cache.

Your WordPress site shows a completely blank page with no message. Find the hidden error in the logs, then rule out theme code, empty files, stale cache and opcache.

You enter the right password and land back on wp-login.php, or see “Cookies are blocked”. Trace the auth cookies, then fix URL, HTTPS proxy, cache and session problems.

Stuck on “Briefly unavailable for scheduled maintenance” or seeing “Update failed” or “Could not create directory”? Clear the update, then fix locks, ownership, disk space and downloads.

Seeing “Sorry, you are not allowed to access this page”, lost your admin role, your password, your 2FA device or tripped a security lockout? Get back in from the server, safely.

The block editor says “Updating failed” or “Publishing failed” because the REST API returned something other than JSON. Find what answered instead: a firewall, a redirect, a 404 or a PHP notice.

Google shows Japanese, pharmacy or casino pages under your domain that you never wrote. Find the cloaked spam, remove it at the source, then get the junk URLs dropped from Google.

Visitors land on a scam, dating or fake prize site, often only on mobile, only from Google or only once. Reproduce the conditional redirect, then remove it from the database, files or CDN.

Browsers show a red warning before your site loads. Confirm which blocklist flagged you, find the phishing kit or malware behind it, then get reviewed by Google and the other vendors.