Every field guide, by topic

Your host suspended the account over malware, phishing or outgoing spam. Decode the abuse notice, find the mailer script or stolen mailbox, clean every site on the account and get reinstated.

You cleaned the site and the malware came back. Something survived: a backdoor, hidden admin, cron job, stolen password or unpatched plugin. Find it and prove the site is clean.

Your certificate is valid but was issued for a different name. Learn how to read the SAN list, fix www and subdomain gaps, and stop the server sending the wrong certificate.

Your certificate works but the padlock is missing or parts of the page fail to load. Find every http:// reference and fix it at the source, including builder data.

The TLS handshake fails before any certificate check. Find out whether port 443 speaks HTTP, has no certificate, or offers no shared TLS version or cipher.

HSTS removes the “proceed anyway” link, so any certificate fault locks visitors out. Learn how the header works, how to clear it for testing, and how to roll it out safely.

Works in your browser but fails on Android, curl or an API client? The server is probably missing its intermediate certificate. Learn to test and fix the chain.

PageSpeed says the server responds slowly. Measure TTFB with curl, prove whether page cache is working, then find the PHP, query or HTTP call eating the time.

The front end is fine but wp-admin crawls. Find the real cause: Heartbeat and admin-ajax, update checks, WP-Cron, Action Scheduler backlogs or heavy list screens.

A bloated database slows every uncached page. Measure autoloaded options, transients, revisions and orphaned meta with exact SQL, then clean up safely after a backup.

Search Console shows INP in red and buttons feel sticky. Learn what INP measures, find the long tasks behind it in Chrome devtools, and fix the scripts causing them.

CPU pegged and pages crawling, but no real traffic spike? Read your access logs to find the bots, verify fake Googlebots, and rate limit or block them at the right layer.

Your homepage loads but every other page says 404 Not Found. The server is not handing pretty URLs to WordPress. Fix .htaccess, mod_rewrite, Nginx try_files or the rewrite rules.

Changed your URLs or domain? Build a complete old-to-new map, pick the right status code, put the rules in the right layer and test every line before and after launch.

Four versions of your address should reach one canonical URL in a single redirect. Test all four, set WordPress to match, then write one combined rule at the server or CDN.

Moved a WordPress site and it keeps sending you to the old domain or staging address? Find which layer is redirecting, then fix the database URLs safely, constants, DNS and CDN origin.

A page redirects somewhere you never set up, or takes three hops to load. Trace each hop with curl, read the headers to find the layer that sent it, then fix it at the source.

Contact form messages, password resets or order emails never arrive? Find out why PHP mail() fails and how to route WordPress mail through authenticated SMTP.

Got a “Mail delivery failed” or “Undeliverable” message? Learn to read the bounce, decode the status code and fix the actual cause.

Bounces mention Spamhaus, Barracuda or “blocked using”? Learn how DNS blocklists work, how to check them by hand, and how to fix the cause before you request removal.

Mail to Gmail, Yahoo or Outlook bouncing or landing in junk? Learn the current sender requirements, how to read Postmaster Tools and SNDS, and how to fix PTR and HELO.

Getting bounces for mail you never sent, or customers reporting fake emails from your domain? Learn how spoofing works and how to lock your domain down with DMARC.

Your speed plugin reordered or delayed JavaScript and now menus, sliders, popups or forms are dead. Find the failing script and exclude it properly.

Broken image icons, blank boxes or images that never appear. Read the status code, then fix paths, permissions, hotlink rules, WebP, lazy load or srcset.