Website terms, in plain English.

.htaccess is a hidden text file (its name starts with a dot) that Apache and LiteSpeed read for every request in that folder and its subfolders. WordPress writes its permalink rules between # BEGIN WordPress and # END WordPress markers, and plugins add their own blocks.

Why it matters: one typo or an unsupported directive causes a 500 error for the whole site. Malware also hides redirects in .htaccess files, sometimes only for visitors arriving from search engines or on mobile.

Example: the default WordPress block for a site in the web root is:

• RewriteEngine On
• RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
• RewriteBase /
• RewriteRule ^index\.php$ - [L]
• RewriteCond %{REQUEST_FILENAME} !-f
• RewriteCond %{REQUEST_FILENAME} !-d
• RewriteRule . /index.php [L]

Common confusion: Nginx ignores .htaccess entirely. FTP clients hide dotfiles by default, so turn on "show hidden files" before deciding it does not exist.

3D Secure (EMV 3-D Secure, often written 3DS or 3DS2) adds a step to an online card payment in which the card issuer authenticates the cardholder. The customer may approve the payment in their banking app or type a code, or the bank may approve it silently based on risk data.

Why it matters: it stops many payments made with stolen card numbers, which makes it one of the main defenses against card testing. In the EEA and the UK, Strong Customer Authentication rules mean many card payments need it. Payment gateways usually let you require it on more payments through their fraud or Radar-style rules.

Example: a WooCommerce customer sees a popup from their bank after pressing Place order. If that popup is blocked by a script optimization or a cached checkout, the payment fails with an authentication error.

Common confusion: 3D Secure is run by the card issuer, not by your site, so you cannot style it or skip it for a customer whose bank demands it. For authenticated payments, fraud chargeback liability generally moves to the issuer, but the rules depend on the card network and gateway.

A 301 Moved Permanently response sends the visitor to the URL in the Location header and tells search engines to transfer the old URL’s standing to the new one. It is the right tool for HTTP to HTTPS, www to non-www, domain changes and renamed pages.

Why it matters: browsers cache 301s aggressively, sometimes indefinitely. A wrong 301 (for example to a staging domain or into a loop) can keep affecting visitors after you fix the server, until they clear their cache.

Example: in .htaccess on Apache or LiteSpeed, Redirect 301 /OLD-PAGE/ https://YOURDOMAIN.COM/NEW-PAGE/, where OLD-PAGE and NEW-PAGE are the paths. Test with curl -sI or a fresh private window, not a browser that already cached an old result.

Common confusion: historically browsers could change a POST into a GET when following a 301. 308 Permanent Redirect is the version that guarantees the method and body are kept, which matters for APIs and forms.

A 302 Found response points to a different URL temporarily. Search engines generally keep the original URL indexed, and browsers do not cache it as strongly as a 301.

Why it matters: plugins, maintenance pages and login flows use 302s. A 302 left in place by accident on a permanent move slows search engines in consolidating signals, though Google says it treats a long-lived 302 more like a permanent move over time.

Example: curl -sI https://YOURDOMAIN.COM/ showing HTTP/2 302 and a location: header to a login or maintenance page means something is intercepting the home page. YOURDOMAIN.COM is your domain.

Common confusion: 307 Temporary Redirect is the strict version that keeps the request method. In WordPress, wp_redirect() defaults to 302, so plugin redirects are often temporary unless the code passes 301.

A 404 Not Found response means the server has nothing at that URL. It is normal for mistyped addresses. It is a problem when real pages, images or scripts start returning it.

Why it matters: a sudden wave of 404s after a migration or permalink change usually means rewrite rules are missing (for example .htaccess was not copied, or Nginx lacks the WordPress try_files rule). If every page except the home page is 404, that is the giveaway.

Example: in WordPress, visit Settings, Permalinks and click Save Changes to regenerate rewrite rules, or run wp rewrite flush with WP-CLI. Then retest with curl -sI https://YOURDOMAIN.COM/SOME-POST/, where SOME-POST is a real post path.

Common confusion: 404s are not an SEO penalty by themselves. Redirect moved pages to their new home, but do not redirect every missing URL to the home page; search engines treat that as a soft 404.

410 Gone is a stronger statement than 404: the resource existed and has been deliberately removed. Search engines treat both as "not here", but a 410 can be dropped from the index a little sooner.

Why it matters: after a hack that injected thousands of spam URLs, returning 410 for those URL patterns is a clean way to tell search engines they are permanently gone while you clean up.

Example: in .htaccess, RewriteRule ^SPAM-PATTERN/ - [G] returns 410 for any URL starting with SPAM-PATTERN, where SPAM-PATTERN is the spam path prefix. Test with curl -sI before relying on it.

Common confusion: do not use 410 for pages that moved; use a 301 to the new location. A 410 on a real page removes it from search.

500 Internal Server Error means the server hit an error it could not handle while building the response. It deliberately says nothing specific to visitors; the details are in the logs.

Common causes on WordPress: a PHP fatal error from a plugin or theme update, a PHP version change the code does not support, an invalid directive in .htaccess, exhausted memory_limit, or wrong file permissions on some hosts.

Example: read the newest lines of the error log, for example tail -n 50 ~/logs/error.log (the path varies by host), or enable WP_DEBUG_LOG and read wp-content/debug.log. If the error started after a change, undo that change first.

Common confusion: WordPress recovery mode often catches PHP fatals and shows "There has been a critical error on this website" instead of a bare 500. It is the same class of problem, and it emails the admin a recovery link.

502 Bad Gateway comes from a server acting as a gateway or proxy (Nginx in front of PHP-FPM, a CDN in front of your origin, a load balancer) when the next server up the line returns garbage, closes the connection or refuses it.

Common causes: PHP-FPM is stopped, crashed or out of workers; the PHP process died mid-request (segfault, memory kill); the origin server is down or blocking the CDN’s IP addresses; or a firewall is dropping the proxy’s requests.

Example: if the 502 page is branded by your CDN, the CDN could not reach your origin. Test the origin directly with curl -sI --resolve YOURDOMAIN.COM:443:ORIGIN.IP https://YOURDOMAIN.COM/, where ORIGIN.IP is your server’s IP. On the server, check the PHP-FPM log for "server reached pm.max_children".

Common confusion: a 502 is not a DNS error and usually not a WordPress setting. It is a connection problem between two servers, so look at the layer behind the one that answered.

503 Service Unavailable means the server is up but deliberately not serving. It can include a Retry-After header telling clients when to try again.

Common causes: a WordPress update left a .maintenance file in the site root ("Briefly unavailable for scheduled maintenance"), the account hit a hosting resource limit such as entry processes, PHP workers are all busy, or a firewall or rate limiter is throttling traffic.

Example: if you see the maintenance message long after an update, delete the .maintenance file in the WordPress root over SFTP or with rm ~/public_html/.maintenance (the path varies by host), then rerun the update that was interrupted.

Common confusion: for planned maintenance, a 503 is the correct code because search engines know to come back later instead of dropping pages. Serving maintenance pages with a 200 can get the maintenance text indexed.

504 Gateway Timeout means a gateway (Nginx, a CDN, a load balancer) passed the request on and did not get an answer within its timeout. The backend may still be working on it.

Common causes: slow database queries, a plugin waiting on a slow external API, a large import or backup running in a web request, or a server overloaded enough that PHP cannot start the request in time.

Example: compare the proxy timeout (for example Nginx fastcgi_read_timeout) with PHP’s max_execution_time. Then find the slow part: the slow query log, a profiler, or the timing of the request in the access log.

Common confusion: raising timeouts hides the symptom. A request that takes 90 seconds is a problem for visitors even if it no longer errors. Move long tasks to WP-CLI, cron or a background queue.

An access log records one line per request. The common "combined" format includes the client IP, timestamp, request line, status code, response size, referrer and user agent.

Why it matters: it shows what actually hit the server during an incident: bot floods, brute-force attempts on wp-login.php or xmlrpc.php, the request that preceded an error, or whether a CDN is passing traffic through.

Example: grep "POST /wp-login.php" ACCESS.LOG | awk '{print $1}' | sort | uniq -c | sort -rn | head shows which IPs are hammering the login page, where ACCESS.LOG is the log path.

Common confusion: behind a CDN or proxy, the IP in the log may be the proxy’s unless the server is configured to log the forwarded visitor IP. Cached pages served by a CDN never reach your access log at all.

ACME (Automatic Certificate Management Environment, RFC 8555) defines how a client proves control of a domain to a CA and collects a certificate. Let’s Encrypt and several other CAs support it. Clients include Certbot, acme.sh, and the built-in tools in control panels, web servers and CDNs.

Why it matters: when automatic renewal fails, the ACME client’s log names the failing step: usually a challenge that could not be completed (HTTP-01 or DNS-01), an account problem, or a rate limit.

Example: certbot renew --dry-run runs a full test renewal against the staging environment. Common log lines include "Invalid response from http://YOURDOMAIN.COM/.well-known/acme-challenge/TOKEN", where TOKEN is the challenge file name, meaning the CA reached something other than the expected file.

Common confusion: ACME is the protocol, not a CA. Two tools both trying to manage the same certificate (for example the host panel and your own Certbot) can fight each other.

Action Scheduler queues tasks such as sending webhooks, syncing orders, processing subscriptions and sending emails. It stores actions in tables like wp_actionscheduler_actions and runs them in batches, triggered by WP-Cron and async requests.

Why it matters: if WP-Cron is not running, actions pile up as "past-due" and renewals, emails and syncs stop. Failed or completed actions can also grow to millions of rows and slow the database.

Example: in WooCommerce, Tools, Scheduled Actions (or Status, Scheduled Actions) lists pending, failed and past-due actions with error messages. wp action-scheduler run processes the queue from the command line.

Common confusion: it is a shared library, so several plugins may bundle it, and the newest bundled version is the one loaded.

admin-ajax.php in /wp-admin/ receives AJAX requests and runs the code hooked to the requested action. Heartbeat, many form plugins, filters, carts and live search use it, including on the public site.

Why it matters: every call loads WordPress fully and is not page cached, so a plugin calling it on every page view, or a bot hammering it, uses PHP workers fast. Slow or failing calls break forms and carts without an obvious error on screen.

Example: in the access log, count calls with grep -c "admin-ajax.php" ACCESS.LOG, where ACCESS.LOG is the log path. In the browser’s Network tab, the request payload shows which action each call uses, which points to the plugin.

Common confusion: blocking admin-ajax.php to stop load breaks front-end features. Find and fix the action that is being abused.

Apache HTTP Server is a widely deployed web server. It supports .htaccess files, which let each folder carry its own rewrite rules, redirects and access controls without a server restart. WordPress’s pretty permalinks rely on mod_rewrite rules in .htaccess on Apache.

Why it matters: a single invalid line in .htaccess takes the whole site down with a 500 error. The server error log usually names the bad directive.

Example: if a 500 started after a plugin changed .htaccess, rename it to .htaccess.bak to test, then regenerate a clean one by saving Settings, Permalinks in WordPress.

Common confusion: many hosts that "support .htaccess" actually run LiteSpeed, or Nginx in front of Apache. Rules that depend on specific Apache modules may behave differently there.

The apex (also called the root, naked or bare domain) is the top of your DNS zone: example.com itself. It must hold the zone’s SOA and NS records, so it cannot be a plain CNAME.

Why it matters: CDNs and site platforms that want a CNAME can be awkward at the apex. If only www is set up, people typing the bare domain get an error. Certificates also need both names listed, or one of them shows a security warning.

Example: the apex needs an A record (or an ALIAS/flattened CNAME from your DNS provider), while www can use www CNAME example.com.. Pick one as the canonical version and 301 redirect the other to it.

Common confusion: "root domain" here is not the DNS root zone (the dot at the very top of DNS). It just means your domain without a subdomain.

Application passwords (in core since WordPress 5.6) let a user create a password for one integration, used with HTTP Basic authentication against the REST API and XML-RPC. Each can be revoked separately in the user’s profile.

Why it matters: they bypass two-factor login prompts by design, so after a compromise attackers sometimes add one to keep access. Changing the main password does not revoke them.

Example: wp user application-password list USER lists them and wp user application-password delete USER UUID revokes one, where USER is the username or ID and UUID is the password’s ID from the list.

Common confusion: they need HTTPS and the Authorization header to reach PHP; some server setups strip it, which makes valid credentials fail.

An A record maps a hostname to an IPv4 address such as 203.0.113.10. An AAAA record ("quad-A") does the same for an IPv6 address such as 2001:db8::10. Browsers look these up before they can connect to your server.

When something breaks: if the A record still points at an old server after a migration, visitors land on the old site or an error. A stale or wrong AAAA record is sneakier: visitors with IPv6 connect to the wrong place while IPv4 users are fine, so the site works for you and fails for a customer.

Example: dig YOURDOMAIN.COM A +short and dig YOURDOMAIN.COM AAAA +short, where YOURDOMAIN.COM is your domain. If your new host gave you only an IPv4 address, delete any leftover AAAA record from the old host.

Common confusion: one name can have several A records (round robin), and the apex (example.com) and www are separate names that each need their own record or a CNAME.

ARIA (WAI-ARIA, from the W3C) is a set of attributes such as role, aria-label, aria-expanded and aria-hidden. Screen readers read these to describe custom widgets that plain HTML does not cover.

Why it matters: a menu button with no name, or a dropdown that never reports aria-expanded="true", is confusing or unusable for a screen reader user, and automated accessibility scanners flag it.

Example: an icon-only button needs a name: <button aria-label="Open menu">. A decorative icon inside a labeled link can take aria-hidden="true" so it is not read twice.

Common confusion: more ARIA is not better. The first rule in the W3C guidance is to use a native element (a real <button> or <a href>) when one exists. Wrong ARIA, such as aria-hidden="true" on content people need, makes a page worse than no ARIA.

The eight keys and salts (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY and the matching _SALT constants) are long random strings. WordPress uses them to sign and verify login cookies and nonces.

Why it matters: changing them instantly logs out every user everywhere, because existing cookies no longer verify. That makes rotating them a standard step after a hack or a suspected stolen session.

Example: wp config shuffle-salts replaces them with WP-CLI. You can also generate a fresh set from the official generator at https://api.wordpress.org/secret-key/1.1/salt/ and paste it over the old lines.

Common confusion: salts do not change passwords. After a compromise you still need to reset passwords, remove unknown admin users and revoke application passwords.

Autodiscover is the mechanism Outlook and other Microsoft clients use to find mail server settings from an email address. It looks up addresses such as autodiscover.YOURDOMAIN.COM, where YOURDOMAIN.COM is your domain. Thunderbird uses a similar system called Autoconfig.

Why it matters: if the Autodiscover record points at an old host after you move email, Outlook keeps finding the wrong server, asks for a password over and over, or sets the account up with the wrong ports.

Example: for Microsoft 365, the usual record is a CNAME from autodiscover to autodiscover.outlook.com. Check what yours points at with dig +short autodiscover.YOURDOMAIN.COM.

Common confusion: Autodiscover only helps apps find settings. It does not deliver mail; MX records do that. A wrong Autodiscover record breaks setup, not delivery.

Each row in wp_options has an autoload value. Autoloaded options are fetched in one query at the start of every request. Older rows use yes and no; since WordPress 6.6 core also uses on, off, auto, auto-on and auto-off, and large options added without an explicit choice are not autoloaded.

Why it matters: plugins that autoload large blobs (logs, caches, settings for removed plugins) make every uncached request slower and can push memory over the limit. Site Health warns when autoloaded data is large.

Example: wp db query "SELECT option_name, LENGTH(option_value) AS bytes FROM wp_options WHERE autoload IN ('yes','on','auto-on','auto') ORDER BY bytes DESC LIMIT 20;" lists the biggest autoloaded options. Replace wp_ if your table prefix differs.

Common confusion: deleting options blindly can break active plugins. Identify which plugin owns an option before removing it or switching its autoload off.

AVIF is based on the AV1 video codec. It often gives smaller files than WebP at similar quality, especially for photos, and supports transparency and HDR. WordPress supports AVIF uploads since version 6.5, if the server’s image library supports it.

Why it matters: it can shrink hero images further, but encoding is slower and some server image libraries cannot process it, so thumbnails may fail to generate.

Example: serve AVIF with a fallback using <picture> with an AVIF <source type="image/avif">, a WebP source, then a JPEG <img>. Site Health, Info, Media Handling shows whether the server’s image library supports AVIF.

Common confusion: smaller files are not automatically faster to decode on low-end devices. Measure LCP rather than assuming.

A backdoor is any way an attacker keeps access: a PHP web shell that runs commands from the browser, a snippet added to a theme’s functions.php, a hidden admin user, an application password, an extra SSH key, or a scheduled task that reinstalls malware.

Why it matters: reinfection days after a cleanup almost always means a backdoor was missed. Removing the visible spam while a backdoor remains is like changing the wallpaper and leaving the door open.

Example: list admins with wp user list --role=administrator, check wp cron event list for unfamiliar hooks, and search PHP files for patterns like eval(, base64_decode( and gzinflate(. Legitimate code uses some of these, so review matches rather than deleting blindly.

Common confusion: after a compromise, change every password and key that could have been read: WordPress users, database, hosting, SFTP, SSH keys, API keys and salts.

Backscatter happens when spammers put your address in the envelope sender and receiving servers accept the message, then later send a bounce to the forged address: you.

Why it matters: a sudden flood of bounce messages does not prove your account was hacked, and it can fill a mailbox. It also hints that your domain lacks DMARC enforcement, which would make many receivers reject forged mail outright.

Example: compare the bounced message’s headers with your own sending: if the original came from IPs that are not yours and did not pass SPF or DKIM for your domain, it is backscatter. Publishing SPF, DKIM and DMARC p=reject reduces it over time.

Common confusion: servers that accept mail first and bounce it later cause backscatter. Well-run mail servers reject during the SMTP conversation instead, so no bounce goes to a forged address.

A beg bounty is a message from someone you never hired, saying they found a security problem on your website and asking whether you pay bug bounties. The findings usually come from automated scanners: a missing DMARC record, a missing security header, a visible version number.

Why it matters: these messages are sent in bulk and can be alarming. Most describe low-risk issues, and some are a lead-in to a sales pitch or pressure for payment.

Example: "Your site is vulnerable to clickjacking because X-Frame-Options is not set. What is your bounty?" Check the claim yourself, fix it if it is real and cheap, and reply once politely or not at all.

Common confusion: not every unsolicited report is a beg bounty. A specific, reproducible report about a plugin version you run deserves attention. Publishing a security.txt file tells genuine researchers how to reach you and whether you offer rewards.

BIMI (Brand Indicators for Message Identification) is a TXT record at default._bimi.YOURDOMAIN.COM, where YOURDOMAIN.COM is your domain, pointing to an SVG logo in a restricted profile (SVG Tiny PS) and, for some providers, a mark certificate.

Why it matters: it only works on top of strong authentication. Your domain needs DMARC at enforcement (quarantine or reject), and providers such as Gmail require a Verified Mark Certificate or Common Mark Certificate before showing the logo.

Example: v=BIMI1; l=https://YOURDOMAIN.COM/LOGO.svg; a=https://YOURDOMAIN.COM/CERT.pem, where LOGO.svg is the logo file and CERT.pem the mark certificate.

Common confusion: BIMI does not improve deliverability by itself and is never an emergency fix. If mail is going to spam, fix SPF, DKIM and DMARC first.

A block theme uses HTML block templates in templates/ and parts/ plus a theme.json file, instead of PHP template files. Its header, footer and templates are editable in the Site Editor.

Why it matters: changes made in the Site Editor are saved to the database as wp_template and wp_template_part posts that override the theme’s files. That is why editing the theme files "does nothing", and why a migration that misses those posts loses the design.

Example: Appearance, Editor, Templates shows which templates have been customized; resetting a template removes the database copy and restores the theme file.

The Site Editor (Appearance, Editor, added in WordPress 5.9) is where block theme templates, template parts, navigation and global styles are edited. Saved changes apply site-wide at once, and each template has revisions and a reset option for rolling back a bad change.

Common confusion: classic themes with some block support are not block themes. A block theme is identified by having templates/index.html.

When the editor loads a post, each block’s saved markup is compared with what the block’s code expects. If they differ, block validation fails and the editor shows "This block contains unexpected or invalid content" with options to attempt recovery or convert to HTML.

Why it matters: it often appears after a plugin that registers blocks was updated or removed, after a search-replace changed markup, or after content was edited outside the editor. The front end usually still renders the saved HTML correctly.

Example: try "Attempt recovery" on one block first and compare with the original before saving. If many posts are affected after an update, check the plugin’s changelog for deprecation fixes before mass-editing.

Common confusion: this is an editor warning, not proof the live site is broken. Saving the post without care can lose attributes the old markup held.

A bot is any non-human client. Good bots include search engine crawlers and uptime monitors. Bad bots scrape content, stuff credentials, spam forms, probe for vulnerable plugins, or flood a site with requests.

Why it matters: bot traffic often explains a sudden slowdown or resource limit hit. Bots typically request uncached URLs (search, cart, random query strings, xmlrpc.php), which hit PHP and the database directly.

Example: awk '{print $1}' ACCESS.LOG | sort | uniq -c | sort -rn | head lists the busiest IPs in an access log, where ACCESS.LOG is the log file path. Check what those IPs request and their user agents before blocking.

Common confusion: blocking a whole country or every unknown user agent also blocks real people and useful services. Prefer challenges and rate limits at the CDN or firewall, and verify search engine bots by reverse DNS before trusting their user agent.

A bounce is a delivery failure reported back to the sender. A soft bounce is temporary (mailbox full, server busy, greylisting), signaled by a 4xx SMTP code; the sending server retries for a while. A hard bounce is permanent (address does not exist, domain has no mail server, message rejected by policy), signaled by a 5xx code.

Why it matters: the bounce message contains the exact reason. Keep sending to hard-bouncing addresses and mailbox providers treat you as a spammer, hurting delivery for everyone else.

Example: 550 5.1.1 User unknown is a hard bounce for a bad address; 451 4.7.1 Try again later is a soft deferral; 550 5.7.26 and similar 5.7.x codes often mean the message failed authentication such as DMARC.

Common confusion: a "bounce" can also be a rejection during the SMTP conversation, which the sender’s server then reports. Bounce reports go to the envelope sender, not necessarily the From address, so website mail bounces may land in a mailbox nobody reads.

A brute-force attack automates password guessing against wp-login.php, xmlrpc.php, SFTP, SSH or a hosting panel. Attacks are usually spread across many IP addresses to slip past simple per-IP blocks.

Why it matters: even when no password is guessed, each attempt runs PHP, so a large attack can slow the site or exhaust resource limits. Weak or reused passwords on admin accounts do eventually fall.

Example: grep -c "POST /wp-login.php" ACCESS.LOG counts login attempts in an access log, where ACCESS.LOG is the log path. Defend with strong unique passwords, two-factor authentication, rate limiting at the server or CDN, and blocking xmlrpc.php if unused.

Common confusion: renaming the login URL reduces noise but is not real protection. Brute force is guessing; credential stuffing uses passwords already leaked elsewhere.

A CAA record tells certificate authorities whether they may issue for your domain. Example: example.com. CAA 0 issue "letsencrypt.org". The issuewild tag controls wildcard certificates separately, and iodef gives a contact for violation reports.

When something breaks: if a CAA record allows only one CA and your host or CDN uses a different one, certificate issuance and renewal fail. That surfaces weeks later as an expired certificate, often with an error mentioning CAA in the issuance log.

Example check: dig YOURDOMAIN.COM CAA +short, where YOURDOMAIN.COM is your domain. CAs check the exact name and then walk up toward the apex, so a CAA record on the apex covers subdomains unless they have their own.

Common confusion: having no CAA record at all is fine and means any publicly trusted CA may issue. CAA affects issuance only; it does nothing to certificates already issued.

The canonical URL is the version of a page you want indexed. You declare it with a tag in the page head, <link rel="canonical" href="https://example.com/page/">, or an HTTP Link header. Search engines use it to merge duplicates such as tracking-parameter URLs, http and https, or www and non-www.

Why it matters: a wrong canonical can make a page disappear from search. A common disaster is a site cloned from staging with every canonical still pointing at the staging domain, or an SEO plugin setting every page’s canonical to the home page.

Example: view the page source and search for rel="canonical", or use the URL Inspection tool in Search Console, which shows the user-declared canonical and the one Google actually chose.

Common confusion: the canonical tag is a strong hint, not a command. Google may pick a different canonical if redirects, internal links or sitemaps disagree with it. It is also not a redirect; visitors still see the URL they opened.

A CAPTCHA checks whether a form submission comes from a person. Modern versions mostly work invisibly: Google reCAPTCHA v3 gives each request a score, and Cloudflare Turnstile and hCaptcha run background checks before showing any puzzle.

Why it matters: each CAPTCHA needs a site key in the page and a secret key on the server, both tied to a list of allowed domains. After a domain change or a launch from staging, the key no longer matches and forms fail for everyone.

Example: ERROR for site owner: Invalid domain for site key in the reCAPTCHA box means the hostname is missing from the key’s domain list. Turnstile reports the same problem as error 110200.

Common confusion: a stricter CAPTCHA does not stop people typing spam by hand, and it blocks some real visitors. Puzzle CAPTCHAs can also fail accessibility checks. A honeypot field plus an invisible check usually works better. A CAPTCHA that asks visitors to run a command on their computer is not a CAPTCHA at all; see ClickFix.

Card testing happens when criminals run lists of stolen card numbers through a real checkout, usually with small amounts, to learn which cards are live. The cards that work are sold or used elsewhere.

Why it matters: the store gets dozens or hundreds of failed or pending orders, the gateway may charge fees on attempts depending on your plan, and a high decline rate can lead the gateway to restrict or review your account.

Example: a burst of guest orders for the cheapest product, each with a different card and mismatched names and addresses, mostly declined, often from many IP addresses. Gateway dashboards often label it as card testing.

Common confusion: it is not a hack of your site and no data is stolen from you. Blocking one IP rarely helps because the attempts come from many. Gateway fraud rules, 3D Secure, a challenge on checkout and rate limiting are the usual fixes.

A CDN (content delivery network) sits between visitors and your origin server. It caches static files, and sometimes whole pages, at edge locations, so most requests never reach your server. Many CDNs also act as a reverse proxy, firewall and DDoS shield.

Why it matters: when a CDN is in front, it changes how problems look. Errors may be branded by the CDN, stale content may be served from cache after you fixed something, and the origin sees CDN IP addresses instead of visitor IPs unless it reads the forwarded header.

Example: curl -sI https://YOURDOMAIN.COM/ and look for headers like cf-cache-status, x-cache or age, where YOURDOMAIN.COM is your domain. Purge the CDN cache after fixing content or deploying CSS and JavaScript changes.

Common confusion: a CDN does not replace hosting or backups. If the origin is down and the page is not cached, the CDN can only show an error.

A certificate authority (CA) checks that the requester controls a domain (or, for higher validation levels, verifies the organization) and then signs a certificate. Browsers and operating systems ship a list of trusted root CAs.

Why it matters: if a CA is distrusted, a root expires, or a device has an outdated trust store, certificates that look fine in one browser fail in another or in server-to-server connections such as API calls and payment callbacks.

Example: echo | openssl s_client -connect YOURDOMAIN.COM:443 -servername YOURDOMAIN.COM 2>/dev/null | openssl x509 -noout -issuer shows which CA issued the certificate, where YOURDOMAIN.COM is your domain. CAA records control which CAs may issue for your domain.

Common confusion: paid certificates are not more strongly encrypted than free ones. Encryption strength depends on the key and the TLS settings, not the price or the CA.

Certificate Transparency requires CAs to record certificates in public logs. Browsers such as Chrome and Safari only trust a publicly issued certificate if it carries proof it was logged.

Why it matters: you can see every certificate issued for your domain, which helps you spot certificates you did not request (a sign of compromise or a forgotten service), find old subdomains, and confirm whether a renewal actually happened.

Example: search %.YOURDOMAIN.COM on crt.sh to list certificates for your domain and its subdomains, where YOURDOMAIN.COM is your domain.

Common confusion: because logs are public, the moment you get a certificate for secret-staging.example.com, that name is visible to anyone. Do not rely on hidden subdomains for privacy.

A character set maps characters to bytes. utf8mb4 is full UTF-8, using up to four bytes per character, and has been WordPress’s default since version 4.2. MySQL’s older utf8 (an alias for utf8mb3) cannot store four-byte characters such as emoji.

Why it matters: mismatched character sets during export and import turn accented letters and curly quotes into garbage like ’ (mojibake), or cut posts off at the first emoji.

Example: check DB_CHARSET in wp-config.php (normally utf8mb4) and export and import with --default-character-set=utf8mb4. SHOW CREATE TABLE wp_posts; shows a table’s character set.

Common confusion: the character set and the collation are different settings. Fixing visible mojibake after the fact requires converting the data, not just changing the table’s declared character set.

A child theme has its own folder with a style.css that names its parent in a Template: header, plus any files you want to override. WordPress loads the child’s files first, falling back to the parent.

Why it matters: edits made directly to a parent theme are lost the moment it updates. If the parent is missing or renamed, the child breaks and WordPress may report the theme as broken.

Example: wp theme list shows both, and wp option get template (the parent) versus wp option get stylesheet (the active child) shows the relationship.

Common confusion: a child theme copies nothing automatically. A template file copied into the child stays frozen as it was, so it can break, or miss fixes, when the parent changes its own copy.

ClickFix is a social engineering trick. A page that looks like a CAPTCHA or an error tells the visitor to press Win+R, then Ctrl+V, then Enter (or to paste into Terminal on a Mac). A script on the page has already copied a command to their clipboard, and running it installs malware such as a password stealer.

Why it matters: attackers inject these overlays into hacked WordPress sites, so your visitors are the victims and your domain gets blocklisted. The overlay is often shown only to some visitors, such as first-time Windows users, so the owner may never see it.

Example: visitors report a Cloudflare-style box with numbered steps involving the Run dialog. Searching the page source for clipboard, powershell or mshta can help confirm it.

Common confusion: a genuine Cloudflare or CAPTCHA check never asks anyone to open Run, Terminal or PowerShell. If your site shows one that does, the site is compromised.

Cloaking serves one version of a page to crawlers and another to people, based on user agent, IP address or referrer. Search engines treat deliberate cloaking as a serious spam violation.

Why it matters: hacked sites often cloak injected spam so it only appears to Googlebot or to visitors arriving from search results, which hides the compromise from owners. It can also lead to a manual action.

Example: compare curl -s https://YOURDOMAIN.COM/ | grep -i viagra with curl -s -A "Googlebot" https://YOURDOMAIN.COM/ | grep -i viagra, where YOURDOMAIN.COM is your domain and the search word is whatever spam you suspect. Smarter malware checks real Googlebot IPs, so Search Console’s URL Inspection is the reliable check.

Common confusion: serving responsive layouts, or different content by language with proper signals, is not cloaking. Cloaking is about deceiving search engines.

Cloudflare offers DNS hosting plus a reverse proxy network. When a DNS record is proxied (the orange cloud), visitors connect to Cloudflare, which then fetches the page from your origin server, caching and filtering along the way. A gray cloud record is DNS only, and visitors go straight to your server.

Why it matters: with the proxy on, errors may be Cloudflare’s pages (520 to 526, or 1xxx codes), your server sees Cloudflare IPs unless it reads the forwarded visitor IP, and the SSL mode chosen in Cloudflare decides whether HTTPS works or loops.

Example: curl -sI https://YOURDOMAIN.COM/ showing server: cloudflare and a cf-ray header means the request went through Cloudflare. YOURDOMAIN.COM is your domain.

Common confusion: Cloudflare is not your host. If your origin server is down, Cloudflare can only show an error. Moving nameservers to Cloudflare also moves every DNS record, including email records, which must be copied correctly.

The SSL/TLS encryption mode in Cloudflare controls the connection between Cloudflare and your origin server. Flexible uses plain HTTP to the origin. Full uses HTTPS but accepts any certificate, even expired or self-signed. Full (strict) uses HTTPS and requires a valid certificate for your hostname, either publicly trusted or a Cloudflare Origin CA certificate. Newer zones may use an automatic setting that picks a mode for you.

Why it matters: Flexible combined with a WordPress site or server that forces HTTPS causes ERR_TOO_MANY_REDIRECTS, because the origin keeps redirecting the HTTP requests Cloudflare sends. Full (strict) with an expired origin certificate causes error 526.

Example: in the Cloudflare dashboard, open SSL/TLS, Overview to see the current mode. With a valid certificate on the server, choose Full (strict).

Common confusion: visitors see a padlock in every mode except Off, because the browser only sees Cloudflare’s certificate. Flexible looks secure while the second half of the trip is unencrypted.

LVE (Lightweight Virtual Environment) is how CloudLinux isolates shared hosting accounts. Each account gets limits on CPU speed, physical memory, number of processes, entry processes, and disk I/O.

Why it matters: when an account hits a limit, requests are slowed or refused. Visitors see a slow site, a 503, or "508 Resource Limit Is Reached". The site is not broken; it has outgrown its allowance or is being hammered.

Example: in cPanel, the Resource Usage page shows which limit was hit and when. Compare those times with your access log to find the bot, cron job or slow page responsible.

Entry processes (EP) count how many requests are inside the account at the same moment, roughly concurrent PHP requests. When the EP limit is reached, new requests get "508 Resource Limit Is Reached" or a 503. Slow requests hold their slot longer: with an EP limit of 20 and 3 seconds per request, about 20 requests every 3 seconds is the ceiling, and halving request time doubles it. Entry processes are not visitors; cached pages barely touch them.

Common confusion: a memory fault under LVE can kill a PHP process abruptly, showing as a 500 or 503 without a clear PHP error message. Raising limits only helps if traffic is genuine.

Cumulative Layout Shift adds up unexpected movements of visible content, grouped into bursts, and reports the largest burst. Shifts right after a user interaction do not count.

Why it matters: shifting layouts make people tap the wrong thing. Common causes are images and embeds without width and height, ads and banners injected above content, cookie notices pushing content down, and web fonts swapping with different sizes.

Example: give images and iframes width and height attributes (or CSS aspect-ratio), reserve space for ads, and overlay cookie banners instead of inserting them above content.

Common confusion: CLS has no unit; it is a score. Shifts can happen long after load, for example from lazy-loaded content without reserved space, so field CLS is often worse than lab CLS.

CNAME flattening (also sold as ALIAS or ANAME records) lets you point the apex at a hostname. The DNS provider resolves the target itself and returns ordinary A and AAAA records, so the rule against CNAMEs at the apex is not broken.

Why it matters: it is the usual fix when a platform says "point your domain at our hostname" and your apex cannot hold a CNAME. Because the provider resolves the target from its own location, geo-routed CDNs may give slightly less optimal answers.

Example: in a provider that supports it, create @ CNAME target.platform.example or @ ALIAS target.platform.example; dig YOURDOMAIN.COM A +short then returns IPs, not a CNAME. YOURDOMAIN.COM is your domain.

Common confusion: this is a provider feature, not a standard record type. ALIAS and ANAME are not portable between DNS providers, so check for them before you move DNS.

A CNAME (canonical name) record says "this name is really that other name". For example www.example.com. CNAME example.com. or shop.example.com. CNAME stores.platform.example.. Resolvers then look up the target and use its A and AAAA records.

Why it matters: SaaS platforms, CDNs and site builders usually ask for a CNAME so they can change their IPs without you touching DNS. A typo in the target, or a target that no longer exists, breaks the name completely.

The key rule: a name with a CNAME cannot have any other record type. That is why you cannot put a plain CNAME on the apex (example.com), which must hold SOA and NS records. Some DNS providers work around this with CNAME flattening or ALIAS records.

Common confusion: a CNAME is not a redirect. The browser address bar does not change, and it does not affect the URL path or HTTPS. A CNAME also cannot point at a URL, only at a hostname.

A collation belongs to a character set and decides how text is compared and sorted. For example, utf8mb4_unicode_ci is case-insensitive (ci). MySQL 8 defaults to utf8mb4_0900_ai_ci, and recent MariaDB versions use their own newer defaults.

Why it matters: importing a dump from MySQL 8 into MariaDB or an older MySQL can fail with "Unknown collation: 'utf8mb4_0900_ai_ci'". Mixed collations between tables can cause "Illegal mix of collations" errors in queries that join them.

Example: to import a MySQL 8 dump into MariaDB, replace the collation name in the dump with one the target supports, such as utf8mb4_unicode_ci, or export with an explicit compatible collation.

Common confusion: changing the collation does not convert stored bytes. It changes comparisons and sorting, and can alter which values count as duplicates in unique indexes.

Consent Mode lets a consent banner pass the visitor’s choices to Google tags (Analytics, Ads, Tag Manager) as signals such as analytics_storage, ad_storage, ad_user_data and ad_personalization. Version 2 added the last two.

Why it matters: if the banner sends no signal, or sends "denied" by default and never updates, Analytics shows a sudden drop in visitors even though traffic did not change. Google also requires consent signals for some advertising features with visitors in the EEA.

Example: in Tag Assistant, a page load should show a default consent state first and an update after the visitor clicks Accept. If the update never appears, the banner and the tag are not connected.

Common confusion: Consent Mode is not a consent banner and does not make a site compliant by itself. It only passes on a choice that your banner collected. Whether you need a banner at all depends on where your visitors are; this is not legal advice.

A contrast ratio compares the relative luminance of text (or an icon) and its background, from 1:1 (identical) to 21:1 (black on white).

Why it matters: WCAG level AA asks for at least 4.5:1 for normal text and 3:1 for large text (about 18 point, or 14 point bold) and for the visible parts of controls such as input borders and focus indicators. Low contrast is one of the most common failures that automated scanners report.

Example: light gray #999999 text on white is about 2.8:1 and fails. Darkening it to around #767676 reaches about 4.5:1. Check pairs with a contrast checker rather than by eye.

Common confusion: contrast is measured on the actual colors shown, including text over photos and hover or disabled states. Brand colors that pass on white can fail on a tinted section.

A hosting control panel is the browser interface for managing a hosting account. Common ones are cPanel, Plesk and DirectAdmin; many hosts build their own. It is where you find the file manager, databases, phpMyAdmin, email accounts, SSL, PHP version, logs and backups.

Why it matters: when WordPress is down, the panel is often the only way in. Error logs, the PHP version switch, backups and the SSH or SFTP details all live there.

Example: cPanel puts the PHP version under MultiPHP Manager or a host-specific PHP selector, and raw access logs under Metrics. Menu names vary by panel and host, so the hosting control panel cheat sheet lists where each item lives.

Common confusion: the hosting panel login is not the WordPress login, and neither is the registrar login. Keep all three in a password manager, and do not let only one person hold them.

Core Web Vitals are LCP (Largest Contentful Paint), INP (Interaction to Next Paint) and CLS (Cumulative Layout Shift). A page passes when the 75th percentile of real visits is "good" for all three: LCP up to 2.5 seconds, INP up to 200 milliseconds and CLS up to 0.1.

Why it matters: they measure what visitors feel, and Google uses them as one of many page experience signals in search. A sudden drop after a theme change, plugin update or new ad script is a common performance emergency.

Example: PageSpeed Insights shows field data from the Chrome UX Report for a URL and origin, alongside a Lighthouse lab test. Search Console’s Core Web Vitals report groups affected URLs.

Common confusion: INP replaced First Input Delay (FID) as a Core Web Vital in March 2024. The Lighthouse score is a lab estimate, not the Core Web Vitals assessment.

CORS (cross-origin resource sharing) relaxes the browser’s same-origin policy in a controlled way. A server opts in by sending headers such as Access-Control-Allow-Origin. For some requests the browser first sends an OPTIONS "preflight" request to ask permission.

Why it matters: CORS errors break fonts loaded from a CDN or another subdomain, headless front ends calling the WordPress REST API, and scripts calling APIs. The browser console shows messages like "blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present".

Example: curl -sI -H "Origin: https://OTHER-SITE.COM" https://YOURDOMAIN.COM/FONT.woff2 shows whether the response includes the allow header for OTHER-SITE.COM, where FONT.woff2 is the file that fails.

Common confusion: CORS is enforced by browsers, not servers, and it is not a security wall for your server: curl and bots ignore it. An origin is scheme, host and port together, so http and https, or www and non-www, count as different origins.

Crawling is the fetching step: bots such as Googlebot request URLs found through links and sitemaps. robots.txt controls what they may fetch.

Why it matters: if crawlers get 5xx errors, timeouts or firewall blocks, Google slows crawling and may drop pages. A WAF or rate limit that blocks Googlebot can quietly remove a site from search.

Example: Search Console’s Crawl stats report shows response codes and host status. Verify real Googlebot by running host IP.ADDRESS (the name should end in googlebot.com or google.com) and then resolving that name back to the same IP, where IP.ADDRESS is from your access log.

Common confusion: crawled does not mean indexed, and blocking a URL in robots.txt does not remove it from the index.

Credential stuffing replays real username and password pairs from data breaches against other services. Success rates are low per attempt, but reused passwords make it effective at scale.

Why it matters: an admin account can be taken over on the first try with no warning signs of guessing, because the password was correct. Customer accounts on stores are frequent targets, leading to fraud and support load.

Example: unique passwords from a password manager and two-factor authentication stop it. Login logs showing successful logins from unfamiliar countries or many accounts tried once each from the same IP ranges are typical signs.

Common confusion: "we have strong password rules" does not help if the strong password was reused and leaked. Uniqueness matters more than complexity.

Critical CSS is extracted for the visible part of a page and placed inline in the head, while the full stylesheet loads without blocking rendering.

Why it matters: it can improve FCP and LCP. When it is generated wrong or goes stale after a design change, visitors see a flash of unstyled or mis-styled content, or content that jumps (CLS) when the full CSS arrives.

Example: after a redesign or theme update, regenerate critical CSS in the optimization plugin and purge caches. Test with a cleared cache on a slow mobile connection in developer tools.

Common confusion: one critical CSS block for every template rarely fits all. Different page types need their own.

Cron runs commands on a schedule defined by five time fields (minute, hour, day of month, month, day of week). Each user has a crontab, edited with crontab -e or through the hosting panel.

Why it matters: real cron is the reliable way to run WordPress scheduled tasks, backups and cleanup. A cron job that runs too often, overlaps itself or emails output on every run can overload the server or fill a mailbox.

Example: */5 * * * * cd /PATH/TO/SITE && wp cron event run --due-now >/dev/null 2>&1 runs due WordPress events every 5 minutes, where /PATH/TO/SITE is the WordPress folder. Pair it with define( 'DISABLE_WP_CRON', true ); in wp-config.php.

Common confusion: cron uses the server’s time zone, which may not match WordPress’s. Cron also runs with a minimal environment, so use full paths to php and wp.

The Chrome User Experience Report collects anonymized performance data from opted-in Chrome users and publishes it per origin and, where traffic allows, per URL. It powers the field data in PageSpeed Insights and Search Console.

Why it matters: it is what Google uses to assess your Core Web Vitals. It reports the 75th percentile over the previous 28 days, so a fix takes up to four weeks to show fully.

Example: PageSpeed Insights shows CrUX data for the URL and the whole origin. Low-traffic pages may show "no data", in which case origin-level data or your own monitoring is all you have.

Common confusion: CrUX only includes Chrome users who meet its criteria, so it is not every visitor, but it is the dataset that counts for Google’s assessment.

A Content Security Policy is sent as a Content-Security-Policy header listing allowed sources per resource type, for example script-src 'self' https://cdn.example.com. The browser blocks anything not on the list, which limits damage from injected scripts.

Why it matters: a strict CSP can break a site the moment you add a new embed, analytics tag or payment widget, because the browser blocks the new source. The console shows "Refused to load the script ... because it violates the following Content Security Policy directive".

Example: start with Content-Security-Policy-Report-Only, which reports violations without blocking, then tighten. Check what a site sends with curl -sI https://YOURDOMAIN.COM/ | grep -i content-security.

Common confusion: WordPress and many plugins rely on inline scripts, which a strict CSP blocks unless you allow them with nonces or hashes. Adding 'unsafe-inline' makes the policy much weaker against injected scripts.

A CVE ID such as CVE-YEAR-NUMBER names one publicly disclosed vulnerability so everyone can refer to the same issue. CVSS (Common Vulnerability Scoring System) rates severity from 0.0 to 10.0 using factors like whether login is needed and what an attacker gains. Version 4.0 is the latest; many databases still show 3.1 scores.

Why it matters: plugin vulnerability notices cite CVEs and CVSS scores. A critical score for something exploitable without login (unauthenticated) in a plugin you run means update now, or virtually patch it while you update.

Example: wp plugin list --fields=name,version,update_version shows installed versions; compare them against the fixed version listed in the advisory for the CVE.

Common confusion: CVSS measures technical severity, not your actual risk. A high score in a feature you do not use may matter less than a medium score in your checkout.

A database index is like the index at the back of a book. With an index on a column, the database jumps to matching rows instead of scanning every row. Primary keys are indexes; WordPress core adds indexes on common lookups such as meta_key.

Why it matters: a missing index on a large table makes a query read millions of rows, which slows pages and can lock up the database under load. Too many indexes slow down writes and use disk.

Example: prefix a slow query with EXPLAIN to see whether it uses an index; type: ALL with a large rows value means a full table scan.

Common confusion: "indexing" in SEO means search engines adding pages to their index, which has nothing to do with database indexes.

A DDoS (distributed denial of service) attack uses many sources, often botnets, to exhaust bandwidth, connections or application resources. Application-layer floods target expensive pages like search, carts and login, and can look like normal traffic.

Why it matters: a small server can be overwhelmed by traffic that a CDN or edge firewall would absorb easily. Blocking at the server only helps once requests have already arrived, and large floods saturate the network before that.

Example: in the access log, look for a surge on one URL or from one network or user agent, then add a rate limit or challenge at the CDN or firewall. Keep the origin IP private so attackers cannot go around the CDN.

Common confusion: not every traffic spike is an attack. A viral post or an aggressive crawler can look similar; read the logs before blocking.

DKIM (DomainKeys Identified Mail) signs selected headers and the body of each message. The signature names a domain (d=) and a selector (s=); receivers fetch the public key from the TXT record at SELECTOR._domainkey.DOMAIN, where SELECTOR and DOMAIN come from those tags.

Why it matters: valid DKIM is needed for good deliverability and for DMARC. Common failures are a key that was never published, a key copied with missing characters, a selector that changed after switching providers, or a mailing list or forwarding service that modified the message.

Example: in a received message’s headers, find DKIM-Signature: ... d=YOURDOMAIN.COM; s=SELECTOR;, then run dig SELECTOR._domainkey.YOURDOMAIN.COM TXT +short. The Authentication-Results header shows dkim=pass or the reason it failed.

Common confusion: each sending service uses its own selector, so a domain can have many DKIM keys at once. Deleting an "old" selector can break a service still using it.

DMARC is a TXT record at _dmarc.YOURDOMAIN.COM, for example v=DMARC1; p=quarantine; rua=mailto:REPORTS@YOURDOMAIN.COM, where YOURDOMAIN.COM is your domain and REPORTS is a mailbox for aggregate reports. The policy p= is none (monitor), quarantine (spam folder) or reject.

A message passes DMARC when SPF or DKIM passes and the domain it passed for is aligned with the visible From domain. Relaxed alignment (the default) accepts the same organizational domain, such as a subdomain; strict alignment requires an exact match.

Why it matters: a service that sends as your domain but signs DKIM with its own domain passes DKIM yet fails DMARC, so with p=reject its mail disappears. Large mailbox providers expect bulk senders to have at least a DMARC record.

Example: dig _dmarc.YOURDOMAIN.COM TXT +short. Start with p=none, read the aggregate reports until every legitimate sender aligns, then tighten.

Common confusion: the DMARC specification was updated in 2026 (RFC 9989 and companions). The pct tag was replaced by a t testing tag, but receivers adopt changes gradually and v=DMARC1 records keep working.

DNS (Domain Name System) is a distributed database that answers questions like "what is the IP address for www.example.com?" or "which server accepts mail for example.com?". Your domain’s answers live in a zone on its authoritative nameservers, and resolvers around the world ask those servers and cache what they hear.

When a site or email suddenly stops working after a hosting move, domain renewal or "small DNS change", DNS is the first thing to check. A wrong record, an expired domain or nameservers pointing at the wrong provider all look like "the site is down" to visitors.

Example: dig YOURDOMAIN.COM A +short asks your resolver for the A record of YOURDOMAIN.COM (replace it with your domain). dig @NS1.PROVIDER.COM YOURDOMAIN.COM A asks one specific nameserver directly, which skips caches.

Common confusion: DNS is not hosting. Your registrar, your DNS provider and your web host can be three different companies, and changing records in the wrong dashboard does nothing.

In DNS-01 validation, the client publishes a TXT record at _acme-challenge.YOURDOMAIN.COM, where YOURDOMAIN.COM is the domain being validated, containing a value derived from the CA’s token. The CA looks it up and issues if it matches.

Why it matters: it works even when the site is not yet live or sits behind a proxy, and it is the only way to get wildcard certificates from Let’s Encrypt. It fails if the TXT record is created at the wrong DNS provider, has not reached the authoritative servers yet, or the DNS API credentials expired.

Example: dig _acme-challenge.YOURDOMAIN.COM TXT +short @NS1.PROVIDER.COM, where NS1.PROVIDER.COM is one of your authoritative nameservers, confirms the record exists at the source.

Common confusion: you can delegate just _acme-challenge to another zone with a CNAME, so the ACME client does not need full API access to your main DNS.

A DNS blocklist (DNSBL or RBL) is queried with a DNS lookup. If a sending IP or domain appears, receiving servers may reject or filter its mail. Lists are run by organizations such as Spamhaus, and each has its own listing and delisting rules.

Why it matters: if your server’s IP is listed, often because a compromised site or mailbox sent spam, mail from every site on that IP can bounce. Rejections usually name the list in the bounce message.

Example: to check IP 203.0.113.10 against a list, reverse the octets and query the list’s zone, for example dig +short 10.113.0.203.zen.spamhaus.org. An answer in 127.0.0.x means listed. Spamhaus may not answer queries from large public resolvers, so use its web lookup tool.

Common confusion: requesting delisting before fixing the cause gets you listed again, sometimes for longer. Find the compromised account or script first.

DNS propagation is a loose name for the time it takes resolvers worldwide to drop cached answers and fetch new ones. Nothing is actively pushed out; caches simply expire according to the TTL that was on the old record.

Why it matters: during this window some visitors reach the new server and some the old one, so orders, form entries and comments can land on the wrong copy of a site. Nameserver changes take longer than record changes because the parent zone’s NS records carry long TTLs.

Example: compare dig @1.1.1.1 YOURDOMAIN.COM A +short with dig @8.8.8.8 YOURDOMAIN.COM A +short, where YOURDOMAIN.COM is your domain. Asking an authoritative nameserver directly with dig @NS1.PROVIDER.COM shows what the source says now.

Common confusion: "wait 48 hours" is a rule of thumb, not a law. If the authoritative server still returns the old value, the problem is your edit, not propagation.

A resolver (recursive resolver) receives a question from your device, walks the DNS hierarchy from the root to the authoritative nameservers, and caches the answer for the record’s TTL. Examples are your ISP’s resolver, your office router, or public resolvers like 1.1.1.1 and 8.8.8.8.

Why it matters: when a site works on mobile data but not on office Wi-Fi, the two networks are often using different resolvers with different cached answers. Resolvers that validate DNSSEC also return SERVFAIL for a domain with broken signatures.

Example: dig @RESOLVER.IP YOURDOMAIN.COM A asks a specific resolver, where RESOLVER.IP is its address and YOURDOMAIN.COM is your domain. Your computer also keeps its own small cache, which you can flush.

Common confusion: resolvers do not hold your records; they borrow them. Editing your zone does not clear anyone’s resolver cache.

DNSSEC signs the records in a zone. The parent zone publishes a DS record that vouches for your zone’s key, creating a chain of trust from the DNS root. Validating resolvers reject answers whose signatures do not check out.

Why it matters when something breaks: DNSSEC protects against spoofing, but a mistake makes the domain vanish for validating resolvers. The classic case is moving DNS providers while the old DS record is still at the registrar: the new provider’s records do not match the old key, and lookups return SERVFAIL.

Example: dig YOURDOMAIN.COM DS +short shows the DS record at the parent, and dig +dnssec YOURDOMAIN.COM A shows signatures, where YOURDOMAIN.COM is your domain. Online DNSSEC analyzers draw the chain and point at the broken link.

Common confusion: DNSSEC does not encrypt DNS and has nothing to do with SSL certificates. When moving DNS, remove the DS record (or add the new one) at the registrar before or as part of the switch.

A registry operates a top-level domain (TLD). It maintains the authoritative database of every registered name in that TLD and publishes the TLD’s nameservers. Registrars sell names; the registry is the wholesale layer behind them.

Why it matters: registry status codes such as serverHold or serverTransferProhibited can stop a domain from resolving or transferring, and only the registrar can work with the registry to clear them. Registry rules also set renewal grace and redemption periods.

Example: an RDAP lookup for YOURDOMAIN.COM (your domain) lists status codes. Codes starting with client are set by the registrar; codes starting with server are set by the registry.

Common confusion: you never deal with the registry directly for a normal domain. Each country code TLD can have its own rules on eligibility, transfers and disputes.

A drop-in is a file with a reserved name in wp-content/. Examples: advanced-cache.php (page caching, used when WP_CACHE is true), object-cache.php (persistent object cache), db.php (database class), db-error.php, maintenance.php and fatal-error-handler.php.

Why it matters: drop-ins are not removed when you deactivate the plugin that installed them. A leftover object-cache.php pointing at a Redis server that no longer exists, or an advanced-cache.php from an uninstalled cache plugin, causes errors or stale pages after a migration.

Example: Plugins, Drop-ins in wp-admin lists them, or run wp plugin list --status=dropin. Renaming the file (for example to object-cache.php.off) disables it.

Common confusion: drop-ins are not must-use plugins, though both live in wp-content and both load without being activated.

A DSN (Delivery Status Notification) is the formal bounce message. It includes a human-readable explanation plus a structured part with the recipient, an enhanced status code such as 5.1.1, and the remote server’s diagnostic text. Microsoft calls these NDRs (non-delivery reports).

Why it matters: the Diagnostic-Code line usually quotes exactly why the remote server refused the message, which is the evidence you need before changing DNS or contacting a provider.

Example: look for Status: 5.7.1 and Diagnostic-Code: smtp; 550 5.7.1 ... in the report. The first digit (2, 4 or 5) means success, temporary failure or permanent failure.

Common confusion: delay notices ("message not yet delivered, will retry") are DSNs too and are not failures yet. Fake DSNs for mail you never sent are backscatter.

A DS (delegation signer) record holds a hash of your zone’s key-signing key. It sits in the parent zone (for example the .com registry), and you add or remove it through your registrar. It tells validating resolvers which key to trust for your zone.

Why it matters: a DS record that does not match the keys your current DNS provider uses breaks resolution for everyone behind a validating resolver. That often happens after a DNS provider change, or when DNSSEC is turned off at the provider but the DS record is left at the registrar.

Example: dig YOURDOMAIN.COM DS +short, where YOURDOMAIN.COM is your domain, returns a key tag, algorithm, digest type and digest. Your DNS provider shows the values the DS record should have.

Common confusion: the DS record is not in your own zone file. Deleting DNSSEC at the DNS provider is not enough; the DS must be removed at the registrar too.

The envelope sender is given in the SMTP MAIL FROM command. After delivery it appears as the Return-Path header. It can differ from the visible From: address, and newsletter services often set it to their own domain to process bounces.

Why it matters: SPF checks this address, not the visible From. WordPress mail sent through PHP’s mailer often gets an envelope sender like USER@SERVER.HOSTNAME, where USER and SERVER.HOSTNAME are the server’s account and host names, so SPF and DMARC alignment fail and mail lands in spam.

Example: view the full headers of a received message and compare Return-Path: with From:. An SMTP plugin that authenticates as your domain’s mailbox usually fixes the mismatch.

Common confusion: the Reply-To header is a third, separate address that only affects where replies go.

An EPP code (also called auth code or transfer code) is a password for a domain transfer. You get it from the current registrar and give it to the new one. EPP is the protocol registrars use to talk to registries.

Why it matters: you cannot move a domain without it, and a registrar or former web designer who will not hand it over can block a move. The domain must also be unlocked (status clientTransferProhibited removed), and most generic TLDs restrict transfers for a period after registration or a previous transfer, commonly 60 days.

Example: in the registrar dashboard look for "transfer out", "get auth code" or "unlock domain". Some country code TLDs use a different process entirely.

Common confusion: transferring a domain does not move DNS or hosting by itself, and it is a bad idea to transfer during an outage. Fix the outage first, then move the domain calmly.

An error log records problems. The web server’s error log captures configuration errors, permission problems and upstream failures. The PHP error log records PHP fatals, warnings and notices, often with a stack trace pointing to the plugin or theme at fault.

Why it matters: a white screen, 500 error or critical error message tells you nothing; the error log tells you exactly which file and line failed. It is the first place to look.

Example: tail -n 100 PATH/TO/error.log shows the latest entries, where PATH/TO/error.log is the log path shown in your hosting panel or set by PHP’s error_log setting. Look for "PHP Fatal error" and the path inside wp-content/plugins/ or themes/.

Common confusion: some hosts write an error_log file in each folder where errors happen. WordPress’s own debug.log is a separate file that only fills when WP_DEBUG_LOG is on.

fail2ban reads log files such as the SSH or web server log, matches patterns like failed logins, and adds a firewall rule that bans the offending IP for a set time.

Why it matters: it quietly stops brute-force attempts, but it can also ban you. Mistyping an SFTP password a few times, or an office full of people behind one IP address, can trigger a ban, and the site then times out for you while working for everyone else.

Example: sudo fail2ban-client status sshd on a server you manage lists banned IPs for the SSH jail, and sudo fail2ban-client set sshd unbanip YOUR_IP lifts a ban, where YOUR_IP is your public IP. On shared hosting, ask the host instead.

Common confusion: a fail2ban ban looks like the site being down (ERR_CONNECTION_TIMED_OUT), not like an error page. Test from mobile data before assuming the server crashed.

First Contentful Paint marks the moment the first piece of content (text, image, SVG or non-white canvas) appears. It shows when the visitor first sees that something is happening.

Why it matters: slow FCP points at the start of loading: slow TTFB, redirects, render-blocking CSS and JavaScript in the head, or web fonts hiding text while they load.

Example: in a Lighthouse report, compare FCP with TTFB. If TTFB is fast but FCP slow, look at render-blocking resources; if TTFB itself is slow, fix the server or caching first.

Common confusion: FCP is not a Core Web Vital. It is a diagnostic that helps explain LCP.

fetchpriority takes high, low or auto. Browsers start images at low priority until layout shows they are visible; fetchpriority="high" on the LCP image lets it start at high priority straight away.

Why it matters: it is one of the simplest LCP improvements. WordPress (since 6.3) tries to add fetchpriority="high" to the image it expects to be the LCP element, but themes and page builders do not always cooperate.

Example: <img src="HERO.webp" fetchpriority="high" alt="..."> on the hero, and fetchpriority="low" on carousel slides that start hidden, where HERO.webp is the hero image.

Common confusion: marking many images high defeats the purpose. Use it on one or two truly critical resources.

Field data (real user monitoring) comes from actual visits on many devices and networks, such as the Chrome UX Report or your own analytics. Lab data comes from a tool like Lighthouse loading the page once under fixed, simulated conditions.

Why it matters: Core Web Vitals assessments in Search Console and PageSpeed Insights use field data. Lab tests are repeatable and good for debugging and checking a fix before it reaches users, but they do not prove what visitors experience.

Example: PageSpeed Insights shows both: the top "Discover what your real users are experiencing" section is field data; the scored Lighthouse section below is lab data.

Common confusion: a perfect lab score with failing field data is common, and so is the reverse. Field data also lags, because CrUX uses a rolling 28-day window.

A checksum (hash) is a short fingerprint calculated from a file’s contents; change one byte and the checksum changes. File integrity monitoring records checksums of known good files and alerts when files are added, removed or modified.

Why it matters: it catches injected code in core, plugin and theme files quickly, and it tells you exactly which files to examine after a compromise. WordPress.org publishes checksums for core and for plugins in its directory.

Example: wp core verify-checksums compares core files with the official checksums for your version, and sha256sum FILE prints the SHA-256 checksum of FILE for comparison with a published value.

Common confusion: integrity checks only work where a trusted reference exists. Uploads, custom code and premium plugins have no public checksums, so they need your own baseline or a backup to compare with.

Unix file permissions grant read (4), write (2) and execute (1) to three groups: the owner, the group and everyone else. They are written as three digits: 644 means owner can read and write, others can only read. chmod changes them and chown changes the owner.

Why it matters: wrong permissions cause 403 errors, failed updates ("could not create directory"), upload failures, or on some servers a 500 error. Overly open permissions such as 777 let other processes or accounts modify your files.

Example: typical WordPress values are 755 for folders and 644 for files, with wp-config.php tighter, such as 640 or 600 where the server allows. find /PATH/TO/SITE -type d -exec chmod 755 {} + sets folders, where /PATH/TO/SITE is the site folder.

Common confusion: ownership often matters more than the numbers. If files belong to a different user than PHP runs as, no sensible permission setting lets WordPress update them.

A firewall filters network connections. A server firewall (iptables or nftables rules, often managed by tools such as CSF, Imunify360 or fail2ban) decides which IPs may connect to which ports: 443 for HTTPS, 22 for SSH, 587 for mail and so on.

Why it matters: when a firewall blocks your IP, the site seems to be down for you alone. A rule that silently drops packets gives ERR_CONNECTION_TIMED_OUT; one that rejects them gives ERR_CONNECTION_REFUSED. Firewalls also block CDNs, payment webhooks or monitoring services by mistake.

Example: if the site works on your phone’s mobile data but not on office Wi-Fi, send your host your public IP (search "what is my IP") and ask them to check the firewall for a block.

Common confusion: a network firewall is different from a WAF. A firewall looks at addresses and ports; a WAF reads the content of web requests. A 403 page is usually a WAF; a timeout is usually a firewall.

A focus indicator marks the element that will respond to the keyboard. Browsers draw one by default, usually an outline. Keyboard users and many people with motor or vision impairments rely on it to know where they are.

Why it matters: themes often remove it with outline: none because it looks untidy on mouse click. That fails WCAG 2.4.7 Focus Visible (level AA), and keyboard users get lost on the page.

Example: press Tab repeatedly on your home page. If you cannot see where you are at every step, add a clear style using :focus-visible, which shows the outline for keyboard users without showing it on every mouse click.

Common confusion: a faint color change is not enough. The indicator needs enough contrast against its surroundings, and in WCAG 2.2 it must not be hidden behind sticky headers or cookie banners.

FTP (File Transfer Protocol) moves files between your computer and a server, usually on port 21, in clients such as FileZilla, Cyberduck or WinSCP. Plain FTP sends the username, password and files unencrypted. FTPS is FTP wrapped in TLS. SFTP is a different protocol that runs over SSH, usually on port 22.

Why it matters: when wp-admin is broken, a file client is how most people rename a plugin folder or delete a stuck .maintenance file. Passwords sent over plain FTP can be captured, and stolen FTP credentials are a common way sites get infected.

Example: in FileZilla, choose SFTP as the protocol, enter the host, username and password or key from your hosting panel, and port 22. If only FTP is offered, choose "Require explicit FTP over TLS".

Common confusion: if WordPress asks for "FTP credentials" when you update a plugin, it is not a request to set up FTP. It means WordPress cannot write to its own files, usually a file ownership problem your host can fix.

The GD library is a PHP extension for creating and editing images. WordPress uses an image editor to make thumbnails and resized copies on upload, and falls back to GD when the Imagick extension is missing.

Why it matters: if neither GD nor Imagick is installed, uploads succeed but no thumbnails are made. Format support also depends on how GD was built: a GD without WebP or AVIF support cannot create those formats.

Example: Tools, Site Health, Info, Media Handling shows the active editor and the supported formats. php -m | grep -i gd over SSH shows whether the extension is loaded for the command line PHP, which may differ from the site’s.

Common confusion: GD and ImageMagick are alternatives, not layers. Switching one on or off changes which formats WordPress can process and how much memory large images need.

The GDPR (Regulation (EU) 2016/679) has applied since 25 May 2018. It sets rules for collecting and using personal data such as names, emails and IP addresses, and gives people rights to access and delete their data. The UK has its own version, usually called the UK GDPR.

Why it matters for websites: contact forms, analytics, embedded fonts and videos, newsletters and order records all involve personal data. You need a lawful basis for each, a privacy notice that describes it, and a way to handle access and deletion requests. Serious breaches can bring fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.

Example: WordPress includes Tools, Export Personal Data and Erase Personal Data to help answer requests, and a privacy policy page template under Settings, Privacy.

Common confusion: the GDPR is not only about cookie banners, and a banner does not make a site compliant. Whether it applies to you depends on who you serve and how; this is not legal advice, so check with a lawyer or data protection specialist where you operate.

A glue record is an A or AAAA record stored at the registry alongside your NS records. It is needed when a nameserver’s name is inside the zone it serves, such as ns1.example.com serving example.com. Without glue, resolvers would need to resolve example.com to find the server that resolves example.com.

Why it matters: if you run your own nameservers and change their IP addresses without updating the glue at the registrar, the domain (and possibly every domain using those nameservers) stops resolving.

Example: dig +norecurse @a.gtld-servers.net YOURDOMAIN.COM NS asks a .com registry server directly; glue appears in the additional section, where YOURDOMAIN.COM is your domain. Registrars often call glue "host records" or "child nameservers".

Common confusion: most sites using a host’s or DNS provider’s nameservers never need to touch glue. It matters only for "vanity" or self-run nameservers under your own domain.

gzip and Brotli compress text responses. The browser says what it supports in Accept-Encoding; the server answers with Content-Encoding: gzip or br. Brotli usually produces smaller files for text and is supported by modern browsers over HTTPS.

Why it matters: missing compression makes pages much heavier. Double compression or a wrong Content-Encoding header, often from a plugin compressing output that the server or CDN also compresses, shows as garbled characters or ERR_CONTENT_DECODING_FAILED.

Example: curl -sI -H "Accept-Encoding: br, gzip" https://YOURDOMAIN.COM/ | grep -i content-encoding, where YOURDOMAIN.COM is your domain.

Common confusion: images such as JPEG, PNG, WebP and AVIF are already compressed, so gzip or Brotli adds nothing for them. Compression is best handled by the web server or CDN, not by a PHP plugin.

The Heartbeat API makes the browser call admin-ajax.php on a timer, typically every 15 to 60 seconds depending on the screen. It powers post locking, autosave, session expiry warnings and live updates in some plugins.

Why it matters: every open admin tab sends these requests, and each one runs PHP. Several editors leaving tabs open can use a noticeable share of PHP workers or entry processes on small plans, showing up as many POST /wp-admin/admin-ajax.php lines in the access log.

Example: look for action=heartbeat in request bodies via the browser’s Network tab. Plugins can lengthen the interval with the heartbeat_settings filter or limit it to the editor.

Common confusion: turning Heartbeat off completely breaks post locking and autosave. Slowing it down is usually enough.

A honeypot is a form field hidden from people with CSS. Many spam bots fill in every field they find, so a submission with something in the honeypot can be rejected quietly.

Why it matters: it stops a lot of simple form spam with no puzzle for real visitors, which helps accessibility and conversions. Most form plugins have a honeypot option.

Example: turn on the honeypot setting in your form plugin, then submit a test entry in a private window to make sure real submissions still arrive.

Common confusion: a honeypot does not stop people typing spam by hand, or smarter bots. Combine it with an invisible CAPTCHA or content filtering when spam continues. Autofill in some browsers can fill hidden fields, so good plugins label the field to discourage that.

HPOS (High-Performance Order Storage) stores WooCommerce orders in their own tables (wp_wc_orders, wp_wc_order_addresses, wp_wc_orders_meta and others) rather than as posts in wp_posts and wp_postmeta. It is the default for new stores.

Why it matters: plugins that read or write orders directly in wp_posts do not see HPOS orders, which shows as missing orders in reports or integrations. With compatibility mode (synchronization) on, both stores are kept in sync, at some cost in writes.

Example: WooCommerce, Settings, Advanced, Features shows which order storage is active and whether incompatible plugins are installed. wp wc hpos count_unmigrated shows how many orders still need syncing.

Common confusion: switching storage on a busy store without syncing first can make recent orders seem to disappear. Always back up and sync before switching.

HSTS is sent as Strict-Transport-Security: max-age=SECONDS; includeSubDomains, where SECONDS is how long browsers remember the rule. During that time the browser upgrades every HTTP request to HTTPS itself and does not let visitors click through certificate errors.

Why it matters: with HSTS on, an expired or wrong certificate becomes a hard stop with no "proceed anyway" link. includeSubDomains also forces HTTPS on every subdomain, which breaks any subdomain that has no valid certificate.

Example: curl -sI https://YOURDOMAIN.COM/ | grep -i strict-transport, where YOURDOMAIN.COM is your domain. Roll out with a short max-age such as 300, then increase once every subdomain is ready.

Common confusion: the preload list built into browsers is very hard to undo quickly. Only submit a domain once you are certain every subdomain will always have HTTPS.

In HTTP-01 validation, the CA asks for http://YOURDOMAIN.COM/.well-known/acme-challenge/TOKEN, where YOURDOMAIN.COM is the domain being validated and TOKEN is a random file name. The server must answer with the expected content. Redirects to HTTPS are followed.

Why it matters: it fails if DNS points at a different server, a CDN or firewall blocks or caches the path, port 80 is closed, a security plugin or rewrite rule intercepts /.well-known/, or an AAAA record points at a server that is not answering.

Example: create a test file in .well-known/acme-challenge/ under the web root and fetch it with curl -i http://YOURDOMAIN.COM/.well-known/acme-challenge/TESTFILE over both IPv4 (-4) and IPv6 (-6), where TESTFILE is its name.

Common confusion: HTTP-01 cannot issue wildcard certificates. Every name on the certificate must point at the server doing the validation.

HTTP/2 keeps HTTP’s meaning (methods, status codes, headers) but changes how it travels: many requests and responses share one TCP connection in parallel (multiplexing), and headers are compressed. Browsers only use it over HTTPS.

Why it matters: it removes the old need for domain sharding and heavy file bundling. If a server or proxy misbehaves with HTTP/2, you can see odd errors like ERR_HTTP2_PROTOCOL_ERROR, often from a broken response, a header the proxy rejects or a security module cutting the connection.

Example: curl -sI --http2 https://YOURDOMAIN.COM/ shows HTTP/2 on the first line if it is supported, where YOURDOMAIN.COM is your domain.

Common confusion: HTTP/2 server push is effectively dead; major browsers removed support. Use preload hints instead.

HTTP/3 carries HTTP over QUIC, a transport protocol built on UDP with TLS 1.3 built in. It sets up connections in fewer round trips and avoids one lost packet stalling every stream, which helps on mobile networks.

Why it matters: browsers discover HTTP/3 through an alt-svc header or DNS HTTPS records, then try UDP port 443. If a firewall blocks UDP 443, browsers fall back to HTTP/2, so problems usually show up as inconsistency rather than total failure.

Example: curl -sI https://YOURDOMAIN.COM/ | grep -i alt-svc shows whether HTTP/3 is advertised, where YOURDOMAIN.COM is your domain. Developer tools show the protocol per request in the Network tab (enable the Protocol column).

Common confusion: HTTP/3 does not change your site’s code or URLs. It is a server, CDN and network setting.

A cookie is set with a Set-Cookie response header and sent back by the browser in a Cookie request header on later requests to the same site. Attributes control its scope and safety: Domain, Path, Expires, Secure, HttpOnly and SameSite.

Why it matters: WordPress logins depend on cookies tied to the site’s domain and path. After a domain or HTTPS change, mismatched cookies cause login loops. Page caches usually bypass anyone with a login or cart cookie, so a plugin setting a cookie on every visitor can quietly disable caching.

Example: open developer tools, Application (or Storage), Cookies to see what a site sets. A response header like Set-Cookie: NAME=VALUE; Path=/; Secure; HttpOnly; SameSite=Lax sets a cookie called NAME holding VALUE.

Common confusion: clearing cookies fixes many login loops but does not fix the cause. If siteurl and home do not match the address you log in from, the loop comes back.

HTTP headers are key and value pairs sent before the body of a request or response. Request headers carry things like Host, User-Agent and cookies. Response headers carry the status, Content-Type, caching rules, redirects (Location) and security policies.

Why it matters: headers reveal what is really happening. A server or x-cache header shows which layer answered, cache-control shows whether a page may be cached, and a stray x-robots-tag: noindex header can keep a site out of search without any visible change.

Example: curl -sI https://YOURDOMAIN.COM/ prints the response headers, where YOURDOMAIN.COM is your domain. In a browser, open developer tools, Network tab, click the document request and view Headers.

Common confusion: header names are case-insensitive, and HTTP/2 and HTTP/3 send them in lowercase. A header set by WordPress can be overwritten or stripped by a CDN or proxy further out.

Every HTTP response starts with a status code. The first digit gives the class: 2xx success, 3xx redirect, 4xx a problem with the request (missing page, forbidden, too many requests), 5xx a failure on the server side.

Why it matters: the code tells you which layer broke before you read a single log. A 404 is a content or routing problem, a 403 is permissions or a firewall, a 500 is usually PHP, and a 502 or 504 points at the connection between a proxy and the application behind it.

Example: curl -sI https://YOURDOMAIN.COM/PATH prints only the response headers, with the status on the first line, where YOURDOMAIN.COM/PATH is the page you are testing. Add -L to follow redirects and see every hop.

Common confusion: the error page a visitor sees can be styled by a CDN, host or theme, and some broken setups send a friendly error page with a 200 code. Always check the actual code, not just the page wording.

ImageMagick is image processing software. PHP reaches it through the Imagick extension, and WordPress prefers it over the GD library when both are available.

Why it matters: large photos can make ImageMagick use more memory or time than the server allows, giving Post-processing of the image failed or an HTTP error on upload. Hosts sometimes limit ImageMagick’s resources or threads, which affects this.

Example: Tools, Site Health, Info, Media Handling shows whether ImageMagick is the active editor, its version and its resource limits.

Common confusion: the program and the PHP extension are separate. ImageMagick can be installed on the server while the Imagick extension is not loaded for your site’s PHP version, so WordPress falls back to GD.

IMAP lets a mail app read and manage messages stored on the mail server. Changes you make on one device (read, moved, deleted) show on all the others. It normally uses port 993 with TLS, or port 143 with STARTTLS.

Why it matters: IMAP keeps mail on the server, so mailbox quotas fill up over time. When the quota is full, new mail bounces with a mailbox full error.

Example: incoming server mail.YOURDOMAIN.COM, port 993, SSL/TLS, with your full email address as the username. YOURDOMAIN.COM is your domain; use the server name your provider gives.

Common confusion: IMAP is for reading only. Sending uses SMTP with its own server, port and login settings, which is why a mail app can receive but not send.

Indexing comes after crawling: the search engine processes the page, picks a canonical URL and decides whether to store it. Only indexed pages can rank.

Why it matters: a site that drops out of search usually has an indexing blocker: a noindex tag or header left from staging, the WordPress "Discourage search engines" setting switched on, canonical tags pointing elsewhere, or server errors when Google crawls.

Example: in Search Console, URL Inspection shows whether a URL is indexed and why not, and the Pages report groups reasons such as "Excluded by 'noindex' tag". In WordPress, check Settings, Reading, Search engine visibility.

Common confusion: a site: search is a rough check, not a full count. Requesting indexing does not guarantee it.

InnoDB is the storage engine behind modern WordPress tables. It supports transactions, row-level locking and automatic crash recovery. The older MyISAM engine locks whole tables and is more prone to corruption after a crash.

Why it matters: old sites may still have MyISAM tables, which lock up under concurrent writes and can need repair after a crash. InnoDB data is cached in the buffer pool, so its size has a large effect on database speed.

Example: wp db query "SELECT TABLE_NAME, ENGINE FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE();" lists the engine of each table. ALTER TABLE TABLENAME ENGINE=InnoDB; converts one, where TABLENAME is the table; back up first.

Common confusion: REPAIR TABLE works on MyISAM, not InnoDB. InnoDB recovers itself on restart, and serious InnoDB corruption needs a restore from backup or specialist recovery.

An inode stores a file’s metadata (owner, permissions, size, location on disk). Every file, folder and symlink uses one. Shared hosts usually cap inodes per account in addition to disk space.

Why it matters: you can hit the inode limit with disk space to spare. Cache plugins, session files, backup archives, unpacked updates and malware dropping thousands of files are common causes. When the limit is reached, uploads, updates, caching and email can fail with "disk quota exceeded".

Example: df -i shows inode usage per filesystem. du --inodes -d 2 ~ | sort -n | tail shows which folders hold the most files (GNU du).

A disk quota caps an account’s space, and often its inode count. When either is full, writes fail in confusing ways: uploads and updates fail, sessions cannot be saved so logins loop, the database cannot write, and email bounces as "mailbox full". du -sh ~/* | sort -h shows the biggest folders; old backups, large logs and a forgotten debug.log are the usual culprits.

Common confusion: deleting large files frees space but few inodes. Clear cache folders, old backups and stray session files to bring the count down.

Interaction to Next Paint observes interactions during a visit and reports one of the slowest (close to the worst, ignoring rare outliers on busy pages). It measures the delay until the next frame is painted after the interaction.

Why it matters: poor INP feels like a frozen or laggy page: menus that open late, buttons that seem ignored. Causes are usually heavy JavaScript on the main thread, such as tag managers, chat widgets, sliders, page builder scripts and large DOM updates.

Example: in Chrome’s Performance panel, record while clicking and look for long tasks after the interaction. Removing or delaying third-party scripts is often the biggest win.

Common confusion: INP is a field metric needing real interactions; lab tools cannot measure it directly and use Total Blocking Time as a rough proxy.

CAs sign site certificates with an intermediate certificate, which is itself signed by a root that browsers trust. The certificate chain is the ordered list: your certificate, then intermediates, ending at a root the client already has. The server must send its certificate and the intermediates; the root is not sent.

Why it matters: a missing intermediate is the classic "works in my desktop browser, fails on some phones, in curl or in payment gateway callbacks" problem. Desktop browsers often fill the gap from cache or by fetching it; other clients do not.

Example: openssl s_client -connect YOURDOMAIN.COM:443 -servername YOURDOMAIN.COM -showcerts lists each certificate the server sends, where YOURDOMAIN.COM is your domain. With Certbot, configure the server with fullchain.pem, not cert.pem.

Common confusion: "CA bundle" in a hosting panel means the intermediates. Pasting the root or the wrong order rarely helps; paste the intermediates the CA provided.

IPv6 addresses are 128 bits long and written in hexadecimal groups, such as 2001:db8::10. They live alongside the older IPv4 addresses. A site reachable over IPv6 has an AAAA record in DNS.

Why it matters: many mobile and home networks prefer IPv6. If an AAAA record points at an old server, those visitors reach the wrong place while IPv4 users are fine. Let’s Encrypt also validates over IPv6 when an AAAA record exists, so a stale one breaks certificate renewal.

Example: dig +short AAAA YOURDOMAIN.COM shows any IPv6 address for your domain. If your new host gave you only an IPv4 address, delete the old AAAA record.

Common confusion: "works on my phone, not on Wi-Fi" can be IPv6 rather than a firewall: one network may use IPv6 and the other IPv4. Compare what each one resolves.

jQuery is a JavaScript library for page interactions. WordPress includes it, and many themes and plugins load scripts that need it to run first.

Why it matters: when a speed plugin defers, delays or combines JavaScript, scripts can run before jQuery has loaded. The console shows Uncaught ReferenceError: jQuery is not defined or $ is not a function, and menus, sliders and forms stop working.

Example: open developer tools, Console, reload the page and look for those errors. Excluding jQuery (and the script that fails) from delay or defer in the optimization plugin usually fixes it.

Common confusion: the fix is the load order, not reinstalling jQuery. Old plugins written for very old jQuery versions can also break on the modern version WordPress ships; the console names the file.

Lazy loading uses the native loading="lazy" attribute on images and iframes so the browser fetches them only when they near the viewport. WordPress adds it automatically to most images and tries to skip the first ones likely to be visible.

Why it matters: lazy loading the hero or other above-the-fold image delays LCP, a common self-inflicted slowdown, especially when a plugin also adds its own JavaScript lazy loading on top.

Example: make sure the LCP image does not have loading="lazy" and, ideally, has fetchpriority="high". Check the HTML source, since some optimization plugins rewrite src into data-src.

Common confusion: JavaScript lazy loading hides images from browsers until scripts run. Native lazy loading is simpler and works without JavaScript.

Largest Contentful Paint marks when the largest visible element (usually a hero image, a video poster or a large heading) is rendered. It reflects perceived loading speed.

Why it matters: slow LCP usually comes from a slow server response (TTFB), the LCP image being discovered late (CSS backgrounds, sliders, lazy loading), render-blocking CSS and JavaScript, or an oversized image.

Example: Lighthouse and the Performance panel name the LCP element. Make sure that image is in the HTML, not lazy loaded, sized properly, and marked fetchpriority="high", for example <img src="HERO.webp" fetchpriority="high" width="1200" height="600" alt="...">, where HERO.webp is the image.

Common confusion: the LCP element can differ between mobile and desktop, and between visitors, so field data may disagree with a single lab test.

Let’s Encrypt issues free domain-validated certificates, renewed automatically by ACME clients such as Certbot or by your host’s control panel. Its default certificates have been valid for 90 days; it has announced a staged move to shorter lifetimes, reaching 45 days by 2028, and it already offers shorter opt-in profiles.

Why it matters: if automatic renewal silently fails, the certificate expires and the site shows a security warning. Typical causes are DNS pointing elsewhere, a redirect or firewall blocking the HTTP-01 challenge path, a CAA record that excludes Let’s Encrypt, or hitting rate limits from repeated failed attempts.

Example: certbot certificates lists certificates and expiry dates on servers using Certbot, and certbot renew --dry-run tests renewal without issuing. On managed hosting, the control panel’s SSL section shows the renewal error.

Common confusion: Let’s Encrypt has stopped running OCSP and relies on certificate revocation lists, so OCSP stapling settings do nothing for its certificates. It issues only domain-validated certificates, not organization or extended validation.

LiteSpeed Web Server is a drop-in replacement for Apache common on shared hosting. It reads .htaccess, runs PHP through its own LSAPI, and includes a server-level page cache controlled from WordPress by the LiteSpeed Cache plugin. OpenLiteSpeed is the free edition, which reads .htaccess rewrites only after a restart.

Why it matters: LiteSpeed Cache serves pages from the server before PHP runs, so changes may not appear until the cache is purged, and logged-in or cart behavior depends on correct cache vary rules. Its own error pages, such as 503 or 508, often indicate resource limits.

Example: response headers like x-litespeed-cache: hit show a page came from cache. Purge from the LiteSpeed Cache toolbar menu or with wp litespeed-purge all if the plugin’s WP-CLI commands are available.

Common confusion: the LiteSpeed Cache plugin’s page caching only works on a LiteSpeed server, though some of its other features, like image optimization, work anywhere.

localhost refers to the machine you are on. Its IPv4 address is 127.0.0.1 and its IPv6 address is ::1. On a web server, DB_HOST set to localhost means the database runs on that same server.

Why it matters: MySQL and MariaDB clients treat localhost specially and connect through a local socket file, while 127.0.0.1 uses a network connection. Database users can be granted access for one and not the other, so swapping them can cause "Error establishing a database connection".

Example: in wp-config.php, define( 'DB_HOST', 'localhost' );. Some hosts use a separate database server and give you a hostname or IP to use instead. Use exactly what your host shows.

Common confusion: a site built "on localhost" in a local development tool runs only on your computer. Nobody else can see it until it is moved to a real server.

A loopback request is WordPress calling its own address, as if it were a visitor. WP-Cron uses one to run scheduled tasks, and the theme and plugin file editors use one to check that an edit did not break the site.

Why it matters: if the server cannot reach itself (a firewall, wrong DNS on the server, HTTP authentication on staging, or a security plugin blocking it), scheduled posts are missed, background jobs stall, and Site Health reports Your site could not complete a loopback request.

Example: curl -sI https://YOURDOMAIN.COM/wp-cron.php run on the server itself over SSH, where YOURDOMAIN.COM is your domain, shows whether the server can reach its own site. A timeout or a 401 or 403 explains the failure.

Common confusion: the site can work perfectly for visitors while loopback fails, because the request comes from inside the server, often to a different IP or through a different route.

Malware on websites includes injected JavaScript that redirects visitors or skims card numbers, PHP files that run attacker commands, spam pages, and code that sends email. It usually arrives through a vulnerable plugin or theme, stolen credentials, or another compromised site on the same account.

Why it matters: it can get the site flagged by browsers and search engines, blocklist the server’s IP for email, leak customer data, and come straight back after cleanup if the entry point and every backdoor are not removed.

Example: wp core verify-checksums and wp plugin verify-checksums --all flag modified core and plugin files, and find wp-content -name "*.php" -newer wp-config.php lists PHP files changed more recently than wp-config.php. Neither catches everything.

Common confusion: a clean scan does not prove a site is clean. Malware hides in the database, in mu-plugins, in .htaccess and in files with innocent names, and may show only to search engines or first-time visitors.

A manual action is a reviewer’s decision that pages or a whole site violate Google’s spam policies, for example through user-generated spam, hacked content, unnatural links, thin content or cloaking. Affected pages rank lower or are removed.

Why it matters: it is listed under Security and Manual actions in Search Console with the reason and examples. Nothing improves until the issue is fixed and a reconsideration request is approved.

Example: fix every instance (not just the examples shown), document what you did, then submit a reconsideration request explaining the cause, the fix and how you will prevent it. Reviews can take days or weeks.

Common confusion: most ranking drops are not manual actions; they come from algorithm updates or technical problems. If the Manual actions report says no issues, look elsewhere.

max_execution_time is a php.ini setting. When a web request runs longer, PHP stops it with "Maximum execution time of SECONDS seconds exceeded", where SECONDS is the limit. The command line has no limit by default.

Why it matters: imports, backups, large updates and slow external calls hit this limit and leave half-finished work. Proxies and web servers have their own timeouts too, and the shortest one wins, often showing as a 504 instead of a PHP error.

Example: run long jobs with WP-CLI over SSH instead of in the browser, for example wp import FILE.xml --authors=create, where FILE.xml is the export file.

Common confusion: on Linux, time spent waiting for the database or network is not counted toward this limit, so a request can run far longer than the setting before something else (usually a proxy timeout) cuts it off.

max_input_vars caps the number of input variables PHP accepts in a single request. The default is 1000. Anything past the limit is dropped, and PHP may log Input variables exceeded 1000.

Why it matters: saving a large menu, a WooCommerce product with many variations, or a complex page builder layout can send more fields than that. The save looks successful, but items at the end silently disappear.

Example: wp eval 'echo ini_get("max_input_vars"), "\n";' over SSH shows the limit WP-CLI sees; confirm under Tools, Site Health, Info, Server. Raise it in the hosting panel’s PHP settings or .user.ini, for example to 3000 or 5000.

Common confusion: it cannot be raised with ini_set() in wp-config.php, because PHP reads it before WordPress starts. It is also unrelated to memory: raising memory_limit does not help.

Memcached is a fast key and value store held in memory. With an object-cache.php drop-in, WordPress can keep the results of database queries there between requests, like it can with Redis.

Why it matters: it speeds up busy and logged-in pages, but a misconfigured or shared instance can serve stale data, mix up two sites that use the same cache keys, or fill up and evict items constantly.

Example: wp cache type over SSH reports which object cache is in use. wp cache flush empties it after a migration or when settings refuse to change.

Common confusion: everything in Memcached disappears on restart, by design. It is a cache, never a place to keep data you need, and it is different from a page cache.

memory_limit is a php.ini setting such as 256M. WordPress also has WP_MEMORY_LIMIT (defaults to 40M, or 64M on multisite) and WP_MAX_MEMORY_LIMIT (256M by default, used in the admin), which can raise PHP’s limit at runtime but cannot exceed what the host allows.

Why it matters: the error "Allowed memory size of BYTES bytes exhausted (tried to allocate MORE bytes)" means a request hit the cap, where BYTES is the limit. It usually shows as a white screen, a 500 error or a critical error message, and is common with large imports, page builders and image processing.

Example: in wp-config.php, above the "stop editing" line, define( 'WP_MEMORY_LIMIT', '256M' );. Check the effective value in Tools, Site Health, Info, Server.

Common confusion: raising the limit treats the symptom. If a page needs 1 GB of memory, something is loading far too much data, often an autoloaded option, a huge query or a plugin loop.

Minification rewrites code into a compact form without changing what it does. Build tools, CDNs and optimization plugins do it automatically.

Why it matters: it saves some bytes, but plugin minification is a common cause of broken sites: a script that breaks when combined with others, a missing semicolon, or a stale minified file served from cache after an update.

Example: if a layout or menu breaks after enabling optimization, turn off JavaScript minification and combining first, purge every cache, and check the browser console for errors. Re-enable options one at a time.

Common confusion: minification adds much less than compression (gzip or Brotli) already gives. Combining files is often unnecessary over HTTP/2.

Mixed content happens when a secure page includes http:// images, scripts, styles, fonts or iframes. Browsers block insecure scripts, styles and frames, and try to upgrade images, audio and video to HTTPS, blocking them if the upgrade fails.

Why it matters: after switching a site to HTTPS, old http:// URLs stored in posts, theme settings and page builder data cause broken layouts, missing images and a missing padlock. Blocked scripts can break menus, sliders and checkout.

Example: the browser console lists each blocked URL. On WordPress, fix the stored data with wp search-replace 'http://YOURDOMAIN.COM' 'https://YOURDOMAIN.COM' --all-tables --dry-run, then run it again without --dry-run, after a backup. YOURDOMAIN.COM is your domain.

Common confusion: plugins that rewrite URLs on the fly hide the problem but leave old data in the database. The header Content-Security-Policy: upgrade-insecure-requests is a valid stopgap, but fixing the stored URLs is the real fix.

ModSecurity inspects requests using rule sets, commonly the OWASP Core Rule Set or a commercial set from the host. Matching requests are logged and can be blocked, usually with a 403 or 406 response.

Why it matters: it is a frequent cause of "it works for me but this one form or save button returns 403" on shared hosting. Posts containing SQL-like text, script tags or long encoded strings can trip rules.

Example: hosts log hits to an audit log with an ID like [id "RULEID"], where RULEID is the number of the rule that fired. Give your host the time, your IP and the URL so they can find it and exclude that rule for that path.

Common confusion: disabling ModSecurity in .htaccess is not possible on many modern setups and is a bad idea if it is. Ask for a targeted exclusion.

mod_rewrite processes RewriteCond conditions and RewriteRule rules, usually in .htaccess. Rules can silently map a pretty URL to index.php, or send a visible redirect with a flag like [R=301,L].

Why it matters: WordPress pretty permalinks depend on it on Apache and LiteSpeed. If it is disabled or the rules are missing, every post returns 404 while the home page works. Bad rules cause redirect loops.

Example: forcing HTTPS: RewriteCond %{HTTPS} off followed by RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]. Behind a CDN or proxy that connects over HTTP, this loops forever; check X-Forwarded-Proto instead.

Common confusion: rule order matters, and the [L] flag only stops the current pass, not all rewriting. Put redirects above the WordPress block.

MTA-STS has two parts: a TXT record at _mta-sts.YOURDOMAIN.COM with an id, and a policy file served over HTTPS at https://mta-sts.YOURDOMAIN.COM/.well-known/mta-sts.txt, where YOURDOMAIN.COM is your domain. The policy lists your MX hosts and a mode: testing, enforce or none.

Why it matters: in enforce mode, senders that support it will not deliver if your MX certificate is invalid or the MX host is not listed. Changing email providers without updating the policy can make inbound mail fail.

Example: the policy file contains lines like version: STSv1, mode: enforce, mx: MX.PROVIDER.COM and max_age: 604800, where MX.PROVIDER.COM is your mail host. Change the TXT id whenever the policy changes.

Common confusion: the mta-sts subdomain needs its own valid HTTPS certificate. TLS-RPT (a _smtp._tls TXT record) is the separate reporting companion.

Multisite turns one WordPress install into a network of sites, using subdomains or subfolders. Sites share core, plugins and themes and one database, with separate tables per site (for example wp_2_posts).

Why it matters: a network-activated plugin that crashes takes down every site. Domain changes and migrations are harder because URLs live in network tables (wp_site, wp_blogs, wp_sitemeta) and in each site’s options.

Example: wp site list shows every site, and WP-CLI commands take --url=SITE.URL to target one, where SITE.URL is that site’s address. Search-replace across a network uses --network.

Common confusion: only Super Admins can install plugins or themes on a network. Subdomain networks need wildcard DNS and a certificate that covers every site name.

Must-use plugins are PHP files placed directly in wp-content/mu-plugins/. WordPress loads them automatically before normal plugins, and they appear only under a separate "Must-Use" list in the Plugins screen.

Why it matters: hosts use them for caching, security and platform features. Malware also hides here, because files do not show in the normal plugin list and cannot be switched off from wp-admin. A broken mu-plugin crashes every page.

Example: ls -la wp-content/mu-plugins/ lists them. To disable one in an emergency, move it out of the folder, for example to a mu-plugins-disabled folder.

Common confusion: WordPress does not load mu-plugins from subfolders automatically. A plugin folder placed in mu-plugins needs a small loader file at the top level.

An MX record lists the mail servers for a domain, each with a priority number. Lower numbers are tried first. Example: example.com. MX 10 mx1.mailhost.example. and example.com. MX 20 mx2.mailhost.example..

When email stops arriving after a DNS or hosting change, the MX records are usually why: they were lost when nameservers moved, or they still point at the old host. Outgoing mail and website hosting are unaffected, which makes the problem easy to miss.

Example check: dig YOURDOMAIN.COM MX +short, where YOURDOMAIN.COM is your domain. Compare the answer with what your email provider’s setup page says.

Common confusions: the MX target must be a hostname with A or AAAA records, never an IP address and never a CNAME. MX controls inbound mail only; outgoing authentication is SPF, DKIM and DMARC.

MySQL and MariaDB are relational database servers. MariaDB began as a fork of MySQL and remains largely compatible, so WordPress runs on either. Posts, users, settings, orders and most plugin data live here; files and media do not.

Why it matters: if the database server is down, overloaded, out of connections or out of disk, WordPress shows "Error establishing a database connection". Crashed tables, especially old MyISAM ones, can cause missing content or errors until repaired.

Example: wp db check runs a table check using the credentials in wp-config.php, and wp db query "SELECT VERSION();" shows which server and version you are on.

Common confusion: the two have drifted apart in newer versions. Dumps from MySQL 8 can use a default collation (utf8mb4_0900_ai_ci) that MariaDB does not recognize, causing "Unknown collation" errors on import.

mysqldump writes a database out as SQL statements that recreate the tables and data. MariaDB ships the same tool, also called mariadb-dump. WP-CLI’s wp db export calls it using the credentials from wp-config.php.

Why it matters: a database dump is the heart of any WordPress backup or move. A dump taken without care can lock tables on a busy site or capture an inconsistent state.

Example: mysqldump --single-transaction --default-character-set=utf8mb4 -u DBUSER -p DBNAME > BACKUP.sql, where DBUSER and DBNAME come from wp-config.php and BACKUP.sql is the output file. --single-transaction gives a consistent snapshot of InnoDB tables without locking them.

Common confusion: never pass the password on the command line where other users can see it in the process list; use -p to be prompted or an option file. Store dumps outside the web root, since they contain password hashes and customer data.

A nameserver answers DNS queries. The term covers two jobs: authoritative nameservers that hold the official records for a domain, and resolvers that look things up on behalf of users. When people say "change your nameservers", they mean the authoritative ones listed at your registrar.

Why it matters: the nameservers decide which DNS dashboard is real. If they point at your old host, edits at your new host are ignored. If they point at servers that no longer serve your zone, the whole domain stops resolving, including email.

Example: dig YOURDOMAIN.COM NS +short lists them, where YOURDOMAIN.COM is your domain. Typical values look like ns1.provider.example and ns2.provider.example.

When debugging, ask the authoritative servers directly: dig @NS1.PROVIDER.COM YOURDOMAIN.COM A, where NS1.PROVIDER.COM is one of your listed nameservers. Look for aa (authoritative answer) in the flags. If they return the right value, any remaining problem is caching; if they return the wrong value or do not answer, the zone or delegation is broken.

Common confusion: nameserver changes go through the registry and can take hours to be seen everywhere because the parent NS records are often cached for a day or two.

Nginx is a high-performance web server, reverse proxy and load balancer. It hands PHP requests to PHP-FPM and handles static files itself. All rules live in central configuration files that require a reload to apply.

Why it matters: .htaccess files are ignored on Nginx, so security rules, redirects and caching headers written by plugins for Apache do nothing. WordPress permalinks need a try_files $uri $uri/ /index.php?$args; rule, or every page except the home page returns 404.

Example: nginx -t tests the configuration syntax before reloading, which prevents a typo from taking every site on the server down. Errors from PHP show in the Nginx error log as "FastCGI sent in stderr".

Common confusion: Nginx often sits in front of Apache as a reverse proxy. In that setup .htaccess still works for the Apache part, but some headers and caching are controlled by Nginx.

noindex is set with <meta name="robots" content="noindex"> in the page head, or with an X-Robots-Tag: noindex HTTP header (useful for PDFs and other files).

Why it matters: a noindex left on after launch, set by an SEO plugin on a whole post type, or added sitewide by the "Discourage search engines" setting removes pages from search over time.

Example: curl -s https://YOURDOMAIN.COM/ | grep -i noindex and curl -sI https://YOURDOMAIN.COM/ | grep -i x-robots check both places, where YOURDOMAIN.COM is your domain.

Common confusion: for noindex to work, the page must be crawlable. Blocking it in robots.txt hides the noindex from Google.

A WordPress nonce is a token tied to a user, an action and a time window, sent as a field like _wpnonce. It protects against cross-site request forgery. By default a nonce is valid for 12 to 24 hours.

Why it matters: when a page is cached with a nonce in it, users later get "The link you followed has expired" or "Cookie check failed", or forms and AJAX quietly return -1 or 403. That is a classic sign of page caching applied to dynamic content.

Example: if a form on a cached page fails after a day, exclude that page from the cache or have the form fetch a fresh nonce with AJAX.

Common confusion: despite the name, a WordPress nonce can be used more than once within its window. It is not authentication; capability checks are still required.

NS records say which servers are authoritative for a zone. They exist in two places: at the parent (the registry for your TLD, set through your registrar) and inside your own zone. The parent copy is what the world actually follows.

When the NS records at the registrar point at provider A but you are editing records at provider B, none of your changes will ever show up. This is one of the most common causes of "I changed DNS and nothing happened".

Example: dig YOURDOMAIN.COM NS +short shows what resolvers see, and whois YOURDOMAIN.COM or an RDAP lookup shows the nameservers set at the registrar. YOURDOMAIN.COM is your domain.

Common confusion: changing nameservers moves your whole zone. Any records you did not recreate at the new provider (MX, TXT, subdomains) disappear the moment the change is picked up.

NXDOMAIN is the DNS response code for "no such name". It differs from a name that exists but has no record of the type you asked for (often called NODATA, which returns no error with an empty answer).

Why it matters: an NXDOMAIN for your own domain often means it has expired, was put on hold by the registry, or its nameservers do not have the zone. For a subdomain, it usually means the record was never created or was lost in a DNS move. Browsers show messages such as DNS_PROBE_FINISHED_NXDOMAIN.

Example: dig SUB.YOURDOMAIN.COM A shows status: NXDOMAIN in the header when the name is missing, where SUB.YOURDOMAIN.COM is the name being tested.

Common confusion: NXDOMAIN answers are cached too, for the time set in the SOA record. A record you just created can keep returning NXDOMAIN to a resolver that asked moments before.

WordPress has a built-in object cache (wp_cache_get() and wp_cache_set()) that stores results in memory for one request. A persistent object cache, enabled by an object-cache.php drop-in and a service like Redis or Memcached, keeps those results across requests, cutting database load for uncached pages.

Why it matters: it speeds up logged-in users, WooCommerce and admin screens. When it breaks, symptoms include stale settings that will not change, users logged out, or fatal errors if the cache server is unreachable. A cloned site sharing a cache with its source can show the other site’s data.

Example: wp cache flush empties it. If the cache server is gone, rename wp-content/object-cache.php to disable the drop-in.

Common confusion: an object cache does not cache whole pages; that is a page cache. Sites sharing one Redis server need distinct key prefixes or databases.

OCSP (Online Certificate Status Protocol) lets a client ask the CA whether a certificate was revoked. OCSP stapling has the server fetch and attach that answer itself, saving the browser a lookup and protecting privacy.

Why it matters: the industry is moving away from OCSP. Let’s Encrypt shut down its OCSP service in 2025 and relies on certificate revocation lists (CRLs), which browsers aggregate. Servers configured to require stapling may log warnings for certificates without an OCSP URL.

Example: in Nginx, ssl_stapling on; has no effect for a certificate without an OCSP URL. openssl x509 -in CERT.PEM -noout -ocsp_uri shows whether a certificate file has one, where CERT.PEM is the certificate file.

Common confusion: major browsers do not rely on live OCSP checks for normal certificates, so a slow or failing OCSP responder rarely explains a site outage on its own.

OPcache stores the compiled version of PHP files in shared memory. It is built into PHP and is one of the biggest free speedups for WordPress.

Why it matters: with opcache.validate_timestamps off, or with a long opcache.revalidate_freq, PHP keeps running the old compiled code after you edit or replace a file. Fixes that "did nothing" and errors that persist after you removed the bad file are often stale OPcache.

Example: restarting or reloading PHP-FPM clears OPcache for that pool. php -i | grep opcache shows CLI settings, which can differ from the web server’s; check the web settings in Site Health or a temporary phpinfo page you delete right after.

Common confusion: OPcache caches code, not pages or database results. It is unrelated to page cache and object cache plugins, and the OPcache used by the command line is separate from the web server’s.

The Open Graph protocol defines meta tags in the page head, such as og:title, og:description, og:url and og:image. Social networks and messaging apps read them to build the link preview.

Why it matters: without them, platforms guess, often picking a logo, a tiny icon or nothing. Platforms also cache previews, so a fixed tag can keep showing the old image until the platform scrapes the page again.

Example: curl -s https://YOURDOMAIN.COM/PAGE/ | grep -io '<meta property="og:[^>]*>' lists the tags on a page, where YOURDOMAIN.COM and PAGE are your domain and path. Then use Facebook’s Sharing Debugger or LinkedIn’s Post Inspector to fetch a fresh preview.

Common confusion: two plugins each printing Open Graph tags (an SEO plugin and a social plugin) produce conflicting images. Keep one source. The image URL must be public and absolute, not blocked by robots.txt or hotlink protection.

A Cloudflare Origin CA certificate secures the connection between Cloudflare and your origin server. You create it in the Cloudflare dashboard under SSL/TLS, Origin Server, install it on your server, and choose a validity of up to 15 years.

Why it matters: it lets you use Full (strict) mode without renewing a public certificate on the server, which removes a common cause of error 526.

Example: after installing it, curl -sI --resolve YOURDOMAIN.COM:443:SERVER_IP https://YOURDOMAIN.COM/ fails with a certificate error, because curl does not trust it. That is expected; only Cloudflare does. YOURDOMAIN.COM is your domain and SERVER_IP your server’s IP.

Common confusion: browsers do not trust Origin CA certificates. If you switch a record to DNS only (gray cloud) or pause Cloudflare, visitors get NET::ERR_CERT_AUTHORITY_INVALID. Keep the proxy on, or use a public certificate instead.

The origin server runs your application (for example WordPress on PHP and MySQL) and holds the real files. CDNs, reverse proxies and load balancers sit in front of it and forward requests they cannot answer from cache.

Why it matters: when a CDN shows a 52x or 50x error, the question is whether the origin is up and reachable from the CDN. Testing the origin directly, bypassing the CDN, splits the problem in half.

Example: curl -sI --resolve YOURDOMAIN.COM:443:ORIGIN.IP https://YOURDOMAIN.COM/ connects straight to ORIGIN.IP (your server’s IP) while sending the right hostname, where YOURDOMAIN.COM is your domain.

Common confusion: "origin" in CORS means scheme, host and port of a page, which is a different idea from the origin server.

A page cache stores the final HTML of a page and serves it to the next visitors. It can live in a plugin (often via advanced-cache.php), the web server (LiteSpeed, Nginx FastCGI cache, Varnish) or a CDN.

Why it matters: it is the biggest single performance and capacity win for most sites. It is also why a fix "does not show": visitors keep getting the old cached page until it is purged. Caching pages that should be personal, such as cart or account pages, leaks one user’s content to another.

Example: headers like x-cache: HIT, cf-cache-status: HIT or x-litespeed-cache: hit show a cached response. Purge every layer after a change: plugin, server and CDN.

Common confusion: logged-in users usually bypass the page cache, so the site may look fixed to you and broken to visitors, or the other way round. Check in a private window.

A payment gateway (Stripe, PayPal, Square and many others) handles the card or wallet payment. In WooCommerce, a gateway plugin connects the checkout to the gateway’s API with API keys, and the gateway reports results back, often through webhooks.

Why it matters: most "paid but the order is still pending" problems are a broken link between the gateway and the site: wrong or test keys, a blocked webhook, or a signing secret that changed. The gateway dashboard shows what really happened to each payment.

Example: look up a failed order’s payment ID in the gateway dashboard and read the decline reason and webhook delivery attempts for it.

Common confusion: with modern gateways the card number goes to the gateway, not to your server. That reduces your risk but does not remove it: a skimmer on the checkout page can still capture what the customer types.

Permalinks are the permanent URLs of posts and pages, set in Settings, Permalinks (for example /%postname%/). WordPress stores the matching rewrite rules in the rewrite_rules option and relies on the web server sending unknown URLs to index.php.

Why it matters: if the server rule is missing (no .htaccess rules on Apache or LiteSpeed, no try_files on Nginx), every page but the home page returns 404. If a plugin adds a custom post type and the rules were not refreshed, its URLs return 404.

Example: save Settings, Permalinks without changing anything, or run wp rewrite flush (add --hard to also rewrite .htaccess where possible). wp rewrite list shows the current rules.

Common confusion: changing the permalink structure on an established site changes every URL. Add redirects from the old pattern or you lose links and search traffic.

A phishing kit is a zip of HTML, PHP and images imitating a bank, email provider or delivery company, plus a script that emails or posts stolen credentials to the attacker. Kits are often dropped into deep or oddly named folders on compromised sites.

Why it matters: hosting a phishing page gets your domain flagged by Safe Browsing, blocked by email filters and reported to your host, who may suspend the account. The site itself can look completely normal.

Example: look for recently added folders and zip files: find ~/public_html -newermt "YYYY-MM-DD" -type f lists files modified since that date, where YYYY-MM-DD is when trouble started. Abuse reports usually include the exact phishing URL.

Common confusion: deleting the kit is not enough. Find and close how it was uploaded, or the next one appears.

PHP runs on the web server and builds pages on the fly. WordPress, its themes and plugins are PHP code, and the PHP version (for example 8.2 or 8.3) controls what code will run and how fast.

Why it matters: changing the PHP version is one of the most common causes of sudden fatal errors. Old plugins using removed functions break on newer PHP; newer plugins requiring modern syntax break on older PHP. Running an end-of-life PHP version also means no security fixes.

Example: wp --info or Tools, Site Health, Info, Server in WordPress shows the PHP version the site runs. Note that the command-line php -v can report a different version than the web server uses.

Common confusion: each PHP version has separate settings (php.ini) and extensions. Switching versions can drop an extension a plugin needs, such as imagick or intl.

PHP-FPM (FastCGI Process Manager) runs PHP as a separate service. The web server (Nginx, Apache or others) passes each PHP request to an FPM pool, which hands it to a worker process. Pool settings such as pm.max_children cap how many requests run at once.

Why it matters: if FPM is down, the web server returns 502 Bad Gateway. If every worker is busy, new requests queue and eventually time out with 504 or 503. Slow plugins tie up workers, so a small amount of traffic can exhaust the pool.

Example: the FPM log warning "server reached pm.max_children setting (NUMBER), consider raising it" means the pool hit its worker cap, where NUMBER is the configured limit. Raising the cap without enough memory can make things worse.

Common confusion: each pool usually has its own user and settings, and restarting or reloading FPM is the usual way to clear stuck workers and apply new php.ini values.

phpMyAdmin gives you the WordPress database in a browser: tables, rows, an SQL box, and export and import. Most hosting panels include it.

Why it matters: when you have no SSH, it is how you fix the site address in wp_options, reset a password, or check the table prefix. It is also the easiest way to delete the wrong thing, because there is no undo.

Example: before any change, select the database, click Export, and save a copy. To fix the site address, edit the siteurl and home rows in the options table, using your real table prefix.

Common confusion: imports through phpMyAdmin are limited by PHP upload size and execution time, so large databases fail part way. Import big files over SSH or with your host’s tools instead.

A session remembers a visitor across requests. PHP’s built-in sessions start with session_start() and set a PHPSESSID cookie. WordPress core does not use them. WooCommerce has its own session system, stored in the PREFIX_woocommerce_sessions table and linked by a wp_woocommerce_session_ cookie.

Why it matters: if a cache serves the cart or checkout to everyone, or strips the session cookie, carts empty and customers see Sorry, your session has expired. A plugin that starts a PHP session on every request can also block page caching and break loopback and REST API requests.

Example: Site Health warns An active PHP session was detected when a plugin calls session_start() without closing it. Deactivate plugins one at a time to find it.

Common confusion: a session is not a login. Logged-in users are identified by WordPress authentication cookies; a session can exist for a guest with a cart.

A PHP worker is a single PHP process. It takes one request, runs WordPress to produce the page, then moves on. Hosts often advertise plans by worker count.

Why it matters: cached pages do not use a worker, but logged-in users, carts, checkouts, searches, admin-ajax calls, REST requests and bots hitting uncached URLs all do. If every worker is busy with slow requests, everyone else waits, and the site looks down even though CPU may not be maxed.

Example: if four workers each take 2 seconds per request, the site can finish at most about two uncached requests per second. Making requests faster raises capacity as much as adding workers.

Common confusion: more workers help only if there is memory and CPU to run them. The usual root cause of exhausted workers is slow code, slow queries or external API calls, not too few workers.

POP3 downloads messages from the mail server to a single app. It normally uses port 995 with TLS, or port 110 with STARTTLS. Many apps remove the messages from the server after downloading, unless set to leave a copy.

Why it matters: with POP3 on one computer, mail can vanish from the phone and webmail, and if that computer dies the mail goes with it. Moving to a new provider also misses anything only stored locally.

Example: in a mail app’s account settings, look for the account type. If it says POP and you use more than one device, set the account up again as IMAP.

Common confusion: POP3 and IMAP are only for receiving. Sending uses SMTP in both cases.

Google Postmaster Tools shows data about mail your domain sends to Gmail users, including the user-reported spam rate, SPF, DKIM and DMARC results, and whether you meet Gmail’s sender requirements. You verify the domain with a DNS TXT record.

Why it matters: if Gmail starts rejecting or filtering your mail, this is one of the few places Google tells you why from its side.

Example: add your domain at postmaster.google.com, publish the TXT record it gives you, and check the spam rate after a newsletter goes out.

Common confusion: it only shows data when you send enough mail to Gmail each day, so a small business with low volume may see empty charts. Microsoft offers its own separate programs for Outlook.com.

A preload hint, <link rel="preload" href="FILE" as="TYPE">, where FILE is the URL and TYPE is font, image, style or script, starts a high-priority download early. It helps for resources discovered late, such as fonts referenced inside CSS or a hero image set as a CSS background.

Why it matters: preloading the LCP image or key fonts can noticeably improve LCP. Preloading too much competes with critical resources and makes things slower.

Example: <link rel="preload" href="/fonts/FONT.woff2" as="font" type="font/woff2" crossorigin>, where FONT.woff2 is the font file. Fonts need crossorigin even on the same origin, or they download twice.

Common confusion: the browser console warns when a preloaded file is not used within a few seconds. Preconnect, prefetch and preload do different jobs.

A PTR record answers "what name belongs to this IP address?". It lives in a special reverse zone (in-addr.arpa for IPv4, ip6.arpa for IPv6) controlled by whoever owns the IP block, usually your host or ISP, not your domain’s DNS provider.

Why it matters: receiving mail servers check that a sending server’s IP has a PTR record, and many also check that the name resolves back to the same IP (forward-confirmed reverse DNS). A missing or generic PTR on a server that sends mail is a common reason mail is rejected or filtered.

Example: dig -x SERVER.IP +short, where SERVER.IP is the server’s IP address. Then run dig RESULT.HOSTNAME A +short on the answer and confirm it returns the same IP.

Common confusion: you cannot add a PTR record in your domain’s DNS dashboard. Ask the provider that owns the IP address to set it.

Query Monitor is a developer tools panel for WordPress. Once active, it adds a menu to the admin bar for logged-in administrators showing database queries by plugin, PHP errors and notices, hooks, HTTP API calls, and the template in use.

Why it matters: it turns "the site is slow" into "this plugin runs 400 queries" or "this page waits 10 seconds on an outside API". It also shows PHP warnings without turning on WP_DEBUG for visitors.

Example: open a slow page while logged in, then look at Queries by Component and HTTP API Calls in the Query Monitor panel.

Common confusion: visitors do not see the panel, but it still adds work to each request. Deactivate it when you have finished investigating.

A query string follows ? in a URL and holds name and value pairs joined by &, for example ?s=shoes&page=2. Ads and email tools add tracking parameters such as utm_source, gclid or fbclid.

Why it matters: many caches treat each query string as a different page, so ad traffic can bypass the cache and hit PHP on every visit. Bots crawling filter and search URLs with endless parameter combinations can also overload a site.

Example: compare curl -sI https://YOURDOMAIN.COM/ with curl -sI "https://YOURDOMAIN.COM/?utm_source=test" and look at the cache headers. A HIT on the first and a MISS on the second means tracking parameters skip the cache.

Common confusion: query strings are part of the URL, so they are visible to everyone and logged. Never put passwords or personal data in them.

Rate limiting counts requests per IP, user or key and rejects or delays the excess, usually with 429 Too Many Requests and sometimes a Retry-After header. It is applied at CDNs, firewalls, web servers, APIs and login forms.

Why it matters: it stops brute-force logins and scraping from overwhelming PHP. Set too tight, it locks out real users behind one shared IP (an office or school), blocks your own monitoring, or breaks payment and webhook callbacks.

Example: in Nginx, limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m; combined with a limit_req zone=login line in a block for wp-login.php limits login attempts to 5 per minute per IP.

Common confusion: behind a CDN, rate limiting on the origin must use the real visitor IP from the forwarded header, or every visitor shares the CDN’s IP and gets limited together.

A Ray ID identifies one request that passed through Cloudflare. It appears at the bottom of Cloudflare error and block pages and in the cf-ray response header.

Why it matters: with the Ray ID you can find the exact request in the Cloudflare dashboard, including which security rule blocked it, so you can change that rule instead of guessing.

Example: a customer sends a screenshot of "Sorry, you have been blocked" with a Ray ID. In the dashboard, open Security, Events, filter by that Ray ID, and read the rule and action.

Common confusion: a Ray ID only exists for requests through the Cloudflare proxy. If a block page has no Ray ID, it came from somewhere else, such as your server’s firewall or a security plugin.

Since WordPress 5.2, recovery mode catches PHP fatal errors. Visitors see "There has been a critical error on this website", and the admin email address receives a message naming the plugin or theme that failed, with a special recovery link.

Why it matters: the recovery link logs you in with the faulty extension paused just for your session, so you can deactivate or update it from wp-admin. The email itself is a quick clue to the culprit.

Example: if the email never arrives (often because the site cannot send mail), find the error in the PHP error log or debug.log, then deactivate the plugin with wp plugin deactivate PLUGIN-SLUG --skip-plugins or by renaming its folder over SFTP, where PLUGIN-SLUG is the plugin’s folder name.

Common confusion: recovery mode does not fix anything on its own. The extension is only paused for you; visitors still see the error until it is deactivated or fixed.

After a domain expires, the registrar first holds it in a grace period during which a normal renewal usually still works. If it is not renewed, the registrar deletes it and, for most generic TLDs, it enters a 30-day redemption period. The registrant can still get it back then, but registrars charge a restore fee on top of the renewal. After that comes a short pending delete stage, and then the name is released for anyone to register.

Why it matters: a site and its email stop working during this time, and the restore fee is often much higher than a renewal. Once the name is released, recovery may be impossible.

Example: whois YOURDOMAIN.COM showing redemptionPeriod in the status lines means the domain is in this stage. Contact your registrar today.

Common confusion: grace periods, fees and timings differ by registrar and by country code TLD, so check your registrar’s terms for your extension. Turn on auto-renew and keep the registrar’s billing details current so you never get here.

A redirect chain happens when URL A redirects to B, which redirects to C, and so on. A redirect loop is a chain that circles back, and browsers stop with errors like ERR_TOO_MANY_REDIRECTS.

Why it matters: each hop adds a round trip and slows the page, and search engines may stop following after several hops. Loops take the site down entirely. A classic loop: the CDN connects to the origin over HTTP, the origin redirects to HTTPS, and the CDN asks over HTTP again.

Example: curl -sIL https://YOURDOMAIN.COM/ | grep -iE "^(HTTP|location)" lists every hop, where YOURDOMAIN.COM is your domain. Aim for one hop at most from any old URL to its final URL.

Common confusion: on WordPress, loops often come from siteurl and home disagreeing with the server or proxy about HTTP versus HTTPS, or www versus non-www. Fix the source settings rather than adding another redirect.

Redis keeps key and value data in memory and answers in well under a millisecond on the same server. In WordPress it is connected through an object-cache.php drop-in, usually installed by a plugin such as Redis Object Cache or by the host.

Why it matters: if Redis is down, full, or the connection details change, the site can throw errors, slow down sharply or show stale data. When it runs out of memory without an eviction policy, writes start failing.

Example: redis-cli ping should answer PONG, and wp redis status (with the Redis Object Cache plugin) shows whether WordPress is connected.

Common confusion: staging copies and clones must not use the same Redis database and key prefix as the live site, or they will read and overwrite each other’s cached options.

The registrant is the person or organization named as the holder of a domain registration. The registrar’s account holder (whoever can log in and pay) is often the same, but not always.

Why it matters: registrars act on instructions from the account holder and the registrant. If a web designer registered the domain in their own name, getting it back can need their cooperation or a formal dispute, even though you paid for it.

Example: check the registrant details in your registrar account, and make sure the name and organization are your business and the email address is one you control.

Common confusion: many registries now hide registrant details from public WHOIS and RDAP lookups for privacy, so a lookup showing "REDACTED" does not tell you who the registrant is. Changing the registrant can also trigger a transfer lock at some registrars.

A registrar is an accredited company that sells domain registrations and manages them on your behalf with the registry for each TLD. You set the domain’s nameservers, contacts, locks and auto-renew at the registrar.

Why it matters: an expired domain, an unpaid renewal, a card that bounced or a registrar account nobody can log into will take a site and its email down regardless of how healthy the hosting is. Losing access to the registrar account is one of the hardest emergencies to fix, because ownership has to be proven.

Example: whois YOURDOMAIN.COM or an RDAP lookup shows the registrar name, expiry date and status codes like clientTransferProhibited, where YOURDOMAIN.COM is your domain.

Common confusion: the registrar is not necessarily your DNS provider or your web host. Keep the registrar login in a password manager that more than one trusted person can reach.

Render-blocking resources are stylesheets in the head and synchronous scripts that stop the browser from painting until they load. Every one adds delay, especially on slow mobile connections.

Why it matters: they directly slow FCP and LCP. Themes and plugins that load large CSS and JavaScript files on every page are a common cause.

Example: add defer to scripts that do not need to run before the page renders (<script src="APP.js" defer></script>, where APP.js is the script), load only the CSS a page needs, and consider inlining critical CSS.

Common confusion: deferring or delaying scripts that other code depends on (like jQuery for an inline script) breaks menus, sliders and forms. Test thoroughly, including logged-out views.

The REST API exposes WordPress data as JSON at URLs under /wp-json/, for example /wp-json/wp/v2/posts. The block editor depends on it, as do many plugins, mobile apps and integrations.

Why it matters: if security plugins, firewalls, broken permalinks or PHP notices corrupt REST responses, the block editor shows "Updating failed" or "The response is not a valid JSON response". Site Health reports REST API problems.

Example: curl -s https://YOURDOMAIN.COM/wp-json/ | head -c 300 should return JSON, not HTML, where YOURDOMAIN.COM is your domain. If permalinks are plain, the API is at /?rest_route=/ instead.

Common confusion: disabling the REST API entirely breaks the editor. Restrict specific endpoints instead, such as the user list, if you want less exposure.

A reverse proxy sits in front of application servers. Nginx in front of Apache or PHP-FPM, Varnish in front of a site, and CDNs are all reverse proxies. They can cache, compress, terminate TLS, filter attacks and spread load.

Why it matters: the application behind a proxy sees the proxy’s IP and often a plain HTTP connection. Unless it trusts headers like X-Forwarded-For and X-Forwarded-Proto, WordPress may log the wrong visitor IP, block the proxy itself, or create HTTPS redirect loops.

Example: a 502 or 504 is generated by a reverse proxy describing trouble with its backend. The proxy’s error log usually names the upstream and the reason, such as "connect() failed" or "upstream timed out".

A load balancer is a reverse proxy that spreads requests across several backend servers and drops unhealthy ones after failed health checks. With several backends, a problem can hit only some requests (one server running old code or missing an upload), so errors that come and go on refresh are a clue. Uploads, sessions and the object cache must be shared by every backend.

Common confusion: a forward proxy acts on behalf of users (like an office proxy); a reverse proxy acts on behalf of servers.

robots.txt lives at https://YOURDOMAIN.COM/robots.txt, where YOURDOMAIN.COM is your domain. It contains User-agent groups with Disallow and Allow rules, and can list sitemaps. WordPress serves a virtual one if no physical file exists.

Why it matters: a stray Disallow: /, often copied from staging, blocks search engines from the whole site. Blocking CSS and JavaScript stops Google from rendering pages properly.

Example: a typical WordPress file: User-agent: *, Disallow: /wp-admin/, Allow: /wp-admin/admin-ajax.php and Sitemap: https://YOURDOMAIN.COM/wp-sitemap.xml.

Common confusion: robots.txt is not security; it is public and bad bots ignore it. It also cannot remove pages from the index. A blocked page can still be indexed from links, and Google cannot see a noindex on a page it is not allowed to crawl.

Google Safe Browsing flags sites hosting malware, phishing or unwanted software. Browsers that use it show full-page warnings such as "Deceptive site ahead" or "The site ahead contains malware", and Search may label results.

Why it matters: a warning stops almost all traffic and is often how owners learn they were hacked. It can also affect ads and email links that point to the domain.

Example: check the domain at Google’s Safe Browsing site status page, and see details under Security Issues in Search Console. After cleaning, request a review in Search Console; it explains what you fixed.

Common confusion: the warning is a symptom. Requesting a review before the cause is removed tends to fail and can slow later reviews.

The Subject Alternative Name extension lists every hostname a certificate covers, such as example.com and www.example.com. Browsers check the visited name against this list; the old Common Name field is ignored for this purpose by modern browsers.

Why it matters: a certificate issued only for example.com fails on www.example.com with a name mismatch error. Adding a new subdomain or parked domain later means reissuing the certificate with the new name.

Example: echo | openssl s_client -connect YOURDOMAIN.COM:443 -servername YOURDOMAIN.COM 2>/dev/null | openssl x509 -noout -ext subjectAltName prints the list, where YOURDOMAIN.COM is your domain.

Common confusion: a wildcard entry like *.example.com covers shop.example.com but not example.com itself and not a.b.example.com.

A screen reader turns what is on screen into speech or braille and lets the user move by headings, links, landmarks and form fields. Common ones are NVDA and JAWS on Windows, VoiceOver on Apple devices, and TalkBack on Android.

Why it matters: screen readers depend on the page’s HTML. Images without alt text, buttons with no name, fields with no labels and headings used for styling all make a page confusing or unusable.

Example: on a Mac, press Command+F5 to turn VoiceOver on, then use the Tab key and VoiceOver commands to move through your contact form. Listen for each field’s name and any error message.

Common confusion: screen reader users do not only listen to the page from top to bottom. Many jump between headings and links, so headings and link text need to make sense on their own.

A search-replace updates every occurrence of a string in the database, most often an old URL during a migration or HTTPS switch. WP-CLI’s wp search-replace handles serialized data; plugins such as Better Search Replace do too.

Why it matters: a missed or bad replace leaves links and images pointing at a staging domain, causes mixed content, or breaks serialized settings. Replacing too broadly (for example a short word) corrupts unrelated content.

Example: back up, then preview with wp search-replace 'https://OLD.DOMAIN' 'https://NEW.DOMAIN' --all-tables --precise --dry-run, where OLD.DOMAIN and NEW.DOMAIN are the domains. Remove --dry-run to run it. Add --skip-columns=guid to leave post GUIDs alone.

Common confusion: also search for the escaped JSON form (https:\/\/OLD.DOMAIN) and protocol-relative //OLD.DOMAIN, and flush caches afterward.

Google Search Console reports indexing status, search queries, Core Web Vitals, crawl stats, security issues and manual actions for a verified property. URL Inspection shows how Google sees one page.

Why it matters: it is where you find out about hacks (Security Issues), penalties (Manual actions) and indexing blockers, and where you request reviews and reindexing after fixing them.

Example: verify the domain property with a DNS TXT record so it covers every subdomain and protocol. Domain properties survive site rebuilds better than a verification file or meta tag.

Common confusion: data is delayed by a day or more, and the Performance report samples and anonymizes some queries. Bing Webmaster Tools is the separate equivalent for Bing.

A self-signed certificate encrypts traffic but proves nothing about identity to the public, because no trusted authority vouched for it. Browsers show warnings such as NET::ERR_CERT_AUTHORITY_INVALID.

Why it matters: servers often fall back to a self-signed or default certificate when the real one is missing, has not been issued yet or the hostname does not match a configured site. Seeing one in production usually means the site is not set up for that hostname on the server that answered.

Example: echo | openssl s_client -connect YOURDOMAIN.COM:443 -servername YOURDOMAIN.COM 2>/dev/null | openssl x509 -noout -subject -issuer; if subject and issuer are identical, it is self-signed. YOURDOMAIN.COM is your domain.

Common confusion: self-signed certificates are fine for private testing and some internal services. Behind some CDNs, an origin with a self-signed certificate works only in a non-strict mode, which removes protection between CDN and origin.

SEO spam covers hacks that add spam pages, links or keywords to a site, such as the "Japanese keyword hack" or "pharma hack". Spam often shows only to search engine crawlers or visitors arriving from search results, so the owner sees nothing wrong.

Why it matters: search results show spam titles under your domain, Search Console may report a security issue, and rankings fall. Thousands of injected URLs can be indexed before anyone notices.

Example: search site:YOURDOMAIN.COM and look for foreign-language or pharmacy titles, where YOURDOMAIN.COM is your domain. Check Search Console’s Security Issues and Pages reports, and use URL Inspection to see the page as Google fetched it.

Common confusion: after cleanup, return 404 or 410 for the spam URLs, then request a review if a security issue was flagged. Do not redirect spam URLs to your home page.

Serialized data is how PHP turns an array or object into a string for storage, for example a:1:{s:3:"url";s:19:"http://example.com/";}. The s:19 says the string is exactly 19 characters long.

Why it matters: WordPress options, widget settings, theme mods and page builder data are often serialized. A plain find-and-replace on a database dump that changes http:// to https:// changes the length without updating the count, and PHP then refuses to unserialize it, so settings and layouts silently reset.

Example: use wp search-replace, which unserializes, replaces and reserializes correctly. Do not use sed on an SQL dump for domain changes.

Common confusion: JSON stored in the database (common in newer plugins) has no length counts, but may escape slashes, so https:\/\/example.com may not match a plain search string.

SERVFAIL means the resolver tried and failed. It does not say the name is missing; it says something went wrong getting the answer.

Common causes: broken DNSSEC (a DS record that does not match the zone’s keys, or expired signatures), authoritative nameservers that are down or refuse queries, or a delegation pointing at servers that do not host the zone (a "lame delegation").

Example: dig YOURDOMAIN.COM A shows status: SERVFAIL; run it again with +cd (checking disabled). If the +cd query works, DNSSEC validation is the problem. YOURDOMAIN.COM is your domain.

Common confusion: because only validating resolvers fail, a DNSSEC problem can look random: the site works on one network and not another.

On shared hosting, your site runs alongside other customers' sites on the same server. Accounts are usually separated and capped with limits on CPU, memory, processes, entry processes and inodes, often using CloudLinux LVE.

Why it matters: when you hit a limit, the site slows down or returns 503 or 508 errors even though nothing is "broken". You usually cannot change server-wide settings or see other accounts' activity, and some tools like SSH may be restricted.

Example: the control panel’s resource usage page shows when CPU, memory or entry process limits were hit. Match those times to traffic spikes or cron jobs in your access log.

Common confusion: "unlimited" plans still have limits, usually CPU, processes or inodes. Moving to a bigger plan helps only if resources really are the bottleneck and not a slow plugin.

Site Health (Tools, Site Health) arrived in WordPress 5.2. The Status tab runs checks such as PHP version, HTTPS, scheduled events, loopback and REST API requests, and background updates. The Info tab lists the server, PHP limits, database, constants, plugins and media handling.

Why it matters: it shows the settings WordPress actually runs with, which may differ from what the hosting panel claims or what WP-CLI sees.

Example: Info, then Copy site info to clipboard, gives you a text report you can paste into a support ticket. Remove anything private before sending.

Common confusion: a "recommended improvement" is not an emergency. Focus on critical issues and anything matching your symptom, such as a failed loopback request when scheduled posts are missed.

An XML sitemap lists canonical URLs, optionally with last-modified dates. WordPress core generates one at /wp-sitemap.xml; SEO plugins often replace it with their own, such as /sitemap_index.xml.

Why it matters: sitemaps help discovery, especially for new or large sites. A sitemap full of redirected, noindexed or 404 URLs sends mixed signals, and a broken one (PHP notices before the XML, or a cached HTML page) cannot be read at all.

Example: open the sitemap URL in a browser or with curl -s https://YOURDOMAIN.COM/wp-sitemap.xml | head, where YOURDOMAIN.COM is your domain. The first characters must be the XML declaration or opening tag, with nothing before it.

Common confusion: listing a URL in a sitemap does not force indexing, and leaving one out does not hide it.

A web skimmer is JavaScript or PHP planted on a compromised store. It captures card numbers, expiry dates and security codes as customers type them, or shows a fake payment form, and sends the data to the attacker. Magecart is a common umbrella name for these campaigns.

Why it matters: customers' cards get used fraudulently, and the gateway or card processor may trace the fraud back to your store. Skimmers often hide in the database (options, widgets, code snippet plugins) or fake plugins, so file scans miss them.

Example: compare the checkout page’s scripts with your developer tools Network tab: an unfamiliar domain receiving data when you type in the card fields is a red flag. Searching the options table for <script can find injected code.

Common confusion: hosted payment fields (in an iframe from the gateway) reduce the risk but do not remove it; a skimmer can still overlay a fake form on top. Who you must notify after a skimmer depends on your gateway contract and local law, so check with your payment provider, your insurer and a lawyer licensed where you operate.

A skip link is usually the first focusable element on the page, labeled something like "Skip to content", and points at the main content area. It is often hidden until it receives keyboard focus.

Why it matters: without one, a keyboard user has to tab through every menu item on every page. It is the usual way to meet WCAG 2.4.1 Bypass Blocks (level A).

Example: load your home page and press Tab once. A "Skip to content" link should appear; pressing Enter should move focus to the main content, not just scroll the page.

Common confusion: a skip link that points at an ID that no longer exists (after a theme or builder change) does nothing. Check the target id is still on the page.

The slow query log records statements slower than long_query_time seconds, optionally including those that use no index. Each entry shows the query, its time, rows examined and rows sent.

Why it matters: when uncached pages or wp-admin crawl, a few repeated slow queries are often the cause, such as a search on a huge wp_postmeta table, an unindexed plugin table or a bloated wp_options. Fixing them can help more than any cache.

Example: on servers you control, enable it with SET GLOBAL slow_query_log = 1; and SET GLOBAL long_query_time = 1;, then summarize with mysqldumpslow. On shared hosting ask the host, or use the Query Monitor plugin to see slow queries per page.

Common confusion: a query that is slow once under load is not always a bad query. Look for queries that are slow repeatedly and examine many rows to return few.

SMTP (Simple Mail Transfer Protocol) moves email from a sender to a receiving server. An MTA (mail transfer agent) such as Postfix or Exim speaks SMTP to deliver and relay messages. Clients and websites submit mail on port 587 (or 465 with implicit TLS); servers talk to each other on port 25.

Why it matters: sending WordPress email through an authenticated SMTP service instead of the server’s local mailer is the usual fix for forms and receipts that never arrive. SMTP response codes explain failures: 4xx means try again later, 5xx means rejected.

Example: openssl s_client -starttls smtp -connect SMTP.HOST:587 tests a connection to SMTP.HOST, the provider’s SMTP server. Many hosts block outbound port 25, so use 587 with authentication.

Common confusion: SMTP sends mail; IMAP and POP3 are for reading a mailbox. "SMTP plugin" in WordPress means a plugin that routes wp_mail() through an external SMTP or API service.

SNI (Server Name Indication) lets the client send the hostname at the start of the TLS handshake. The server uses it to pick the right certificate when many sites share one IP address, which is how almost all shared hosting and CDNs work.

Why it matters: if a request arrives without SNI, or with a hostname the server does not know, the server presents its default certificate, which shows as a name mismatch. Old tools and some scripts forget to send it.

Example: openssl s_client -connect SERVER.IP:443 -servername YOURDOMAIN.COM tests a specific server, where SERVER.IP is the server’s IP and YOURDOMAIN.COM is your domain. Leaving off -servername shows what clients without SNI receive.

Common confusion: SNI is normally sent unencrypted, so network observers can see which site you are visiting even with HTTPS. Encrypted Client Hello (ECH) is the newer extension that hides it.

The SOA (start of authority) record contains the primary nameserver, a contact mailbox written with a dot instead of @, a serial number, and refresh, retry and expire timers for secondary servers. Its last field sets how long resolvers cache "this name does not exist" answers (negative caching).

Why it matters: if the serial is not increased after an edit on a traditionally managed zone, secondary nameservers keep serving the old data, so some lookups get new answers and some get old ones. The negative caching value also explains why a record you just created can stay "not found" for a while if someone looked it up before it existed.

Example: dig YOURDOMAIN.COM SOA +short, where YOURDOMAIN.COM is your domain. Compare the serial across each nameserver with dig @NAMESERVER YOURDOMAIN.COM SOA +short, where NAMESERVER is each listed nameserver.

Common confusion: the SOA TTL and the minimum field are not the default TTL for your other records. Most managed DNS dashboards handle the SOA for you.

A soft 404 is reported by Google when a URL returns a success code but looks like an error or empty page, such as a "nothing found" message, an empty category, or a missing product page that returns 200.

Why it matters: those pages are dropped from the index anyway, and real pages that look thin can be misclassified. Redirecting many missing URLs to the home page is also treated as a soft 404.

Example: curl -sI https://YOURDOMAIN.COM/MISSING-PAGE/ should return 404 or 410, not 200, where MISSING-PAGE is a URL that should not exist. Search Console’s Pages report lists URLs flagged as soft 404.

Common confusion: the fix is to return a real 404 or 410, or a 301 to a closely matching page, not to add filler text.

SPF (Sender Policy Framework) is a TXT record such as v=spf1 include:_spf.PROVIDER.COM ip4:203.0.113.10 -all, where PROVIDER.COM is your email provider’s domain. Receiving servers check whether the connecting server’s IP is allowed to send for the domain in the envelope sender (Return-Path).

Why it matters: a missing or wrong SPF record sends mail to spam or gets it rejected, especially for website mail sent from a server that is not listed. Adding a new service (a newsletter tool or helpdesk) without updating SPF breaks its mail.

Example: dig YOURDOMAIN.COM TXT +short | grep spf1, where YOURDOMAIN.COM is your domain. There must be exactly one SPF record per name. SPF also has a limit of 10 DNS lookups across all include, a, mx and similar mechanisms; going over causes a permanent error.

Common confusion: SPF checks the envelope sender, not the visible From address, so SPF alone does not stop spoofing of the From line. DMARC adds that link.

Spoofing forges the From address (and often the envelope sender) so a message appears to come from you or your company. SMTP itself does not verify the From line; SPF, DKIM and DMARC exist to let receivers detect forgeries.

Why it matters: spoofed invoices and payment requests are a common fraud. Without DMARC at quarantine or reject, receivers have no instruction to block mail forged in your domain’s name.

Example: in the message’s Authentication-Results header, a spoofed message typically shows spf=fail or dkim=none and dmarc=fail for your domain. Lookalike domains (an extra letter, a different TLD) are not spoofing your domain and DMARC cannot stop them.

Common confusion: receiving spoofed mail "from yourself" does not mean your mailbox was hacked. Check the headers before resetting passwords in a panic, though resetting is still harmless.

An SRV record publishes the location of a service with a priority, weight, port and target host. The name follows the pattern _SERVICE._PROTOCOL.example.com, for example _sip._tls.example.com. SRV 100 1 443 sipdir.online.lync.com..

Why it matters: Microsoft 365, some email autodiscovery setups, SIP phones and game servers rely on SRV records. They are often forgotten during a nameserver move, and the service quietly stops connecting while the website looks fine.

Example check: dig _SERVICE._tcp.YOURDOMAIN.COM SRV +short, where SERVICE is the service name from the provider’s docs and YOURDOMAIN.COM is your domain.

Common confusion: web browsers do not use SRV records for normal websites, so an SRV record cannot change which server serves your site.

SSH (Secure Shell) gives you a terminal on the server over an encrypted connection. You log in with a password or, better, a key pair. It is the fastest way to read logs, run WP-CLI and fix a site that will not load.

Why it matters: when wp-admin is unreachable, SSH lets you disable plugins, check disk space and roll back changes. Many shared hosts disable SSH by default or restrict it to certain IPs or keys.

Example: ssh USERNAME@SERVER.HOST logs in, where USERNAME and SERVER.HOST come from your hosting panel. Add -p PORT if the host uses a nonstandard port.

SFTP transfers files over the same SSH connection and login, in clients such as FileZilla, Cyberduck or WinSCP (host from your panel, usually port 22). It is how you rename a broken plugin folder, for example wp-content/plugins/PLUGIN-NAME to PLUGIN-NAME.off where PLUGIN-NAME is its folder, or remove a stuck .maintenance file when the site is down. Avoid plain FTP, which sends passwords unencrypted, and note that SFTP is not FTPS.

Common confusion: SSH is not FTP. SFTP runs over SSH and uses the same login. "Permission denied (publickey)" means the server only accepts keys and yours is not authorized.

A staging site mirrors the live site’s code and data on a separate URL. You test updates, redesigns and fixes there, then push changes live or repeat them.

Why it matters: it is how you avoid breaking production. But staging copies cause their own emergencies: they get indexed by search engines, send real emails to customers, process real payments or webhooks, or overwrite live orders when pushed back.

Example: block indexing (password protection beats a noindex setting), disable outgoing mail, use test payment keys, give it a separate cache and object cache key, and never push the database over a live store that took orders since the copy was made.

Common confusion: pushing "files only" usually still leaves database changes behind, and pushing the database overwrites everything that happened on live since the clone.

A subdomain is any name below your domain: www, shop, mail, staging. Each can have its own records and point at a different server or service.

Why it matters: subdomains often get forgotten in migrations, so a nameserver move can quietly break the shop, the help desk or webmail while the main site works. Forgotten subdomains pointing at deleted cloud services can also be taken over by someone else ("subdomain takeover").

Example: dig SHOP.YOURDOMAIN.COM +short, where SHOP.YOURDOMAIN.COM is the subdomain. Certificate Transparency logs (search your domain at crt.sh) are a handy way to discover subdomains you have used.

Common confusion: a subdomain is a DNS name, not a folder. example.com/shop and shop.example.com are different things with different setups.

The table prefix is set by $table_prefix in wp-config.php. With wp_, tables are named wp_posts, wp_options and so on. One database can hold several installs with different prefixes.

Why it matters: if the prefix in wp-config.php does not match the tables in the database, WordPress thinks it is not installed and shows the installation screen. That often happens after restoring a backup made by a tool that changed the prefix.

Example: wp db tables lists the tables WordPress can see, and wp config get table_prefix shows the configured prefix. They must agree.

Common confusion: changing the prefix is not just renaming tables. The prefix also appears inside data: the PREFIX_user_roles option and the PREFIX_capabilities and PREFIX_user_level user meta keys must be renamed too, where PREFIX is the table prefix, or every user loses their role. A custom prefix adds little real security.

Total Blocking Time adds up the portion of each long task (over 50 milliseconds) beyond that 50 milliseconds, between First Contentful Paint and when the page becomes reliably interactive. It is measured in lab tools like Lighthouse.

Why it matters: high TBT usually means too much JavaScript running at load: page builders, sliders, analytics, ads and chat widgets. It correlates with poor INP in the field.

Example: Lighthouse lists the scripts with the most main-thread time under "Reduce JavaScript execution time" and "Minimize main-thread work". Remove unused scripts, load them only on pages that need them, or delay third-party scripts.

Common confusion: TBT is not a Core Web Vital and has no field equivalent. Use it to diagnose, then confirm improvements with field INP.

The TDRP (Transfer Dispute Resolution Policy) is the ICANN procedure for disputes about transfers of generic TLD domains between registrars. Under the current policy, a registrar files the complaint with an approved dispute provider, and it must be filed within 12 months of the alleged violation.

Why it matters: if your domain was transferred to another registrar without your authorization, this is one of the formal routes to get it back. You start by asking your former registrar to act.

Example: after a hijack, give your registrar the dates, the account evidence and proof you are the registrant, and ask whether they will pursue a transfer dispute.

Common confusion: the TDRP is about transfer rules being broken, not about trademarks; that is the UDRP. Registrants cannot file a TDRP complaint themselves under the current policy, and ICANN has adopted changes to its transfer rules that registrars will apply from a future date, so check the current policy on ICANN’s site. This is not legal advice.

theme.json declares settings (palettes, font sizes, spacing scale, layout widths) and styles (defaults for elements and blocks). WordPress turns it into CSS custom properties and editor controls.

Why it matters: user changes made in the Site Editor’s Styles panel are saved in the database and override the file, so editing theme.json may appear to have no effect. Invalid JSON makes WordPress ignore the file entirely.

Example: validate it with php -r 'json_decode(file_get_contents("theme.json")); echo json_last_error_msg();' run in the theme folder; it should print "No error".

Common confusion: classic themes can use theme.json too, for editor settings, without becoming block themes.

TLS (Transport Layer Security) encrypts the connection between a browser and a server and, using a certificate, proves the server is allowed to use the domain name. HTTPS is simply HTTP sent inside TLS. SSL is the name of its retired predecessor, but "SSL certificate" stuck as everyday language.

Why it matters: browsers treat TLS failures as hard errors. An expired certificate, a missing intermediate, a name mismatch or an outdated protocol version all stop visitors at a full-page warning.

Example: openssl s_client -connect YOURDOMAIN.COM:443 -servername YOURDOMAIN.COM shows the negotiated protocol, the certificate chain and any verification error, where YOURDOMAIN.COM is your domain.

Common confusion: TLS 1.2 and 1.3 are current; SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1 are deprecated and refused by modern browsers. "SSL" in a control panel almost always means TLS.

A TLS certificate (still usually called an SSL certificate) binds one or more domain names to a public key and is signed by a certificate authority that browsers trust. It has a start and end date, and lists every name it covers in its SAN field.

Why it matters: an expired certificate, one that does not list the exact name being visited (for example www missing), or one signed by an untrusted issuer produces errors like NET::ERR_CERT_DATE_INVALID or NET::ERR_CERT_COMMON_NAME_INVALID.

Example: echo | openssl s_client -connect YOURDOMAIN.COM:443 -servername YOURDOMAIN.COM 2>/dev/null | openssl x509 -noout -dates -ext subjectAltName prints the validity dates and the names covered, where YOURDOMAIN.COM is your domain.

Common confusion: certificate lifetimes are getting shorter across the industry. Under CA/Browser Forum rules the maximum dropped to 200 days in March 2026 and is scheduled to fall further, reaching 47 days in 2029. Automated renewal is no longer optional.

The TLS handshake runs before any HTTP is sent. The client offers protocol versions and cipher suites and sends SNI; the server picks settings and sends its certificate chain; both derive session keys. TLS 1.3 completes this in one round trip, faster than TLS 1.2.

Why it matters: errors such as ERR_SSL_PROTOCOL_ERROR, ERR_SSL_VERSION_OR_CIPHER_MISMATCH or "handshake failure" mean the two sides could not agree, the certificate was rejected, or something in the middle (a firewall, a misconfigured CDN or a server listening with plain HTTP on port 443) broke the exchange.

Example: openssl s_client -connect YOURDOMAIN.COM:443 -servername YOURDOMAIN.COM -tls1_2 forces TLS 1.2, and -tls1_3 forces TLS 1.3, where YOURDOMAIN.COM is your domain. Compare which one succeeds.

A cipher suite is the named set of algorithms the two sides agree on, for example TLS_AES_128_GCM_SHA256 in TLS 1.3. If client and server share no suite, the handshake fails with a cipher mismatch. nmap --script ssl-enum-ciphers -p 443 YOURDOMAIN.COM lists what a server offers. On managed hosting and CDNs, pick the provider’s modern or intermediate profile rather than hand-tuning suites.

Common confusion: a handshake failure is not the same as an expired certificate, though both stop the page loading. Read the exact browser error code.

A transfer lock prevents a domain from being transferred away. The registrar lock you control appears as clientTransferProhibited in WHOIS or RDAP; a registry-level lock appears as serverTransferProhibited. There are also time-based locks: under the current ICANN rules, a registrar may refuse a transfer within 60 days of registration or a previous transfer, and a change of registrant can trigger a 60-day lock unless you opted out.

Why it matters: the lock is a key defense against hijacking. Keep it on, and remove it only when you are moving the domain yourself.

Example: whois YOURDOMAIN.COM | grep -i status shows the current statuses, where YOURDOMAIN.COM is your domain.

Common confusion: these are the current rules, but ICANN has adopted changes, including shorter locks, that registrars will apply from a future date, so check your registrar’s current terms. Country code TLDs follow their own rules. A lock does not stop someone with your registrar login from changing nameservers; two-factor authentication does.

Transients are a simple cache API: set_transient( 'NAME', VALUE, SECONDS ) stores a value for up to SECONDS, where NAME is a key. Without a persistent object cache, they are rows in wp_options named _transient_NAME and _transient_timeout_NAME.

Why it matters: buggy plugins can create huge numbers of transients, bloating wp_options and slowing every query against it. Stale transients can also make a fix look like it did nothing until the cached value expires.

Example: wp transient delete --expired removes expired ones, and wp transient delete --all clears all transients stored in the database. Plugins rebuild what they need.

Common confusion: a transient can disappear before its expiry at any time, especially with an object cache, so code must not rely on it as permanent storage.

TTFB (time to first byte) covers redirects, DNS, the connection, TLS setup and the server’s time to start responding. For a dynamic WordPress page without a page cache, most of it is PHP and database work.

Why it matters: a slow TTFB delays everything else, including LCP. Web.dev suggests aiming for roughly 0.8 seconds or less as a rough guide, but treats TTFB as a diagnostic rather than a Core Web Vital.

Example: curl -o /dev/null -s -w "%{time_starttransfer}\n" https://YOURDOMAIN.COM/ prints the TTFB in seconds, where YOURDOMAIN.COM is your domain. Run it a few times and compare a cached page with a logged-in or uncached one.

Common confusion: a fast TTFB on the home page may just mean it is cached. Test pages that bypass cache (cart, search, admin) to see the real backend speed.

TTL (time to live) is a number of seconds attached to every DNS record. A record with TTL 3600 may be cached for up to an hour by any resolver that looked it up. Lower TTLs mean changes are seen sooner; higher TTLs mean fewer lookups and more resilience if your DNS provider has an outage.

Why it matters in an emergency: TTL is the real reason "propagation" takes time. If an A record had a TTL of 86400 (one day), some visitors can keep reaching the old server for up to a day after you change it, and nothing you do afterward speeds that up.

Example: dig YOURDOMAIN.COM A shows the remaining TTL in the second column of the answer, where YOURDOMAIN.COM is your domain. Before a planned migration, lower the TTL to 300 at least one old TTL period in advance.

Common confusion: lowering the TTL only helps for caches that fetch the record after you lowered it. Some resolvers also enforce their own minimum or maximum, so treat TTL as an upper bound you request, not a guarantee.

Two-factor authentication (2FA, a form of multi-factor authentication) adds something you have, such as an authenticator app code, a passkey or a hardware security key, on top of something you know.

Why it matters: it stops most stolen or guessed passwords from being enough. Turning it on for registrar, hosting, DNS, email and WordPress admin accounts is among the most effective protections there is. Losing the second factor without backup codes can lock you out during an emergency.

Example: store backup codes somewhere safe and separate, and enroll more than one factor (for example two security keys, or an app plus codes). For WordPress, a 2FA plugin protects wp-login.php; application passwords bypass it by design, so review them.

Common confusion: SMS codes are better than nothing but can be intercepted or lost to SIM swapping. App codes, passkeys and security keys are stronger.

A TXT record stores text strings on a name. It started as a general notes field and now carries email policy (SPF, DKIM keys, DMARC) and verification tokens for Google, Microsoft and certificate authorities.

When something breaks: a missing or malformed TXT record can send mail to spam, fail a domain verification, or stall a DNS-01 certificate challenge. Two separate SPF TXT records on the same name is a classic mistake that makes SPF fail.

Example: dig YOURDOMAIN.COM TXT +short lists TXT records on the apex, and dig _dmarc.YOURDOMAIN.COM TXT +short shows the DMARC policy, where YOURDOMAIN.COM is your domain.

Common confusion: one TXT string is limited to 255 characters, so long values such as DKIM keys are split into several quoted strings that are joined together. Many dashboards do this for you; pasting the quotes in yourself can break the record.

The UDRP (Uniform Domain-Name Dispute-Resolution Policy) lets a trademark holder file a complaint against a domain with an approved provider such as WIPO. The complainant must show the domain is identical or confusingly similar to their mark, the holder has no rights or legitimate interests in it, and it was registered and is being used in bad faith.

Why it matters: it is the standard route against cybersquatting, and is usually faster and cheaper than court. The only outcomes are transfer or cancellation of the domain, not damages.

Example: a business with a registered trademark finds a look-alike domain hosting a phishing copy of its site, and files a UDRP complaint after gathering screenshots and trademark records.

Common confusion: the UDRP is for trademark abuse, not general ownership arguments. A dispute with a former designer who registered your domain may fit it or may need a different route. This is not legal advice; ask a lawyer licensed where you operate.

upload_max_filesize sets the largest single file PHP accepts. post_max_size sets the largest whole request, including every file and field, so it must be larger. PHP’s own defaults are 2M and 8M; hosts usually set higher values.

Why it matters: uploads over the limit fail with The uploaded file exceeds the upload_max_filesize directive in php.ini., or with "The link you followed has expired" when post_max_size is exceeded and WordPress receives an empty request. A 413 Request Entity Too Large comes from the web server’s own limit, which is separate.

Example: the Media, Add New screen shows "Maximum upload file size". Raise the values in the hosting panel’s PHP settings or .user.ini, keeping post_max_size above upload_max_filesize.

Common confusion: these cannot be changed with ini_set() in wp-config.php, because PHP has already read the request by then. memory_limit is a different setting.

The User-Agent request header identifies the client: a browser, a search engine crawler, a monitoring service or a script. Servers and plugins use it for statistics, bot rules and sometimes to serve different content.

Why it matters: access logs record it, which helps you separate real visitors from crawlers during a traffic spike. Firewall rules often block or rate limit by user agent.

Example: awk -F'"' '{print $6}' ACCESS.LOG | sort | uniq -c | sort -rn | head lists the most common user agents in a combined-format access log, where ACCESS.LOG is the log file path.

Common confusion: the user agent is trivially faked. Bad bots claim to be Googlebot all the time; verify real Googlebot with a reverse DNS lookup on the IP, not by the user agent string.

UTF-8 encodes every Unicode character in one to four bytes, and is the encoding nearly all web pages use. In MySQL and MariaDB, full UTF-8 is called utf8mb4; the older utf8 cannot store four-byte characters such as emoji.

Why it matters: text saved in one encoding and read as another turns curly quotes into ’. A related trap is the invisible byte order mark (BOM) some Windows editors add at the start of a file: in a PHP file it is sent before WordPress can set headers.

Example: Cannot modify header information - headers already sent by (output started at /PATH/wp-config.php:1) right after editing a file often means a BOM or a stray space before <?php. Save the file as "UTF-8 without BOM".

Common confusion: the character set and the collation are separate settings; see the character set entry. Converting a table’s declared encoding does not repair text that is already garbled.

Varnish is an HTTP cache that sits in front of the web server and stores full pages in memory. Repeat requests are answered from Varnish without running PHP. It usually sits behind something else that handles HTTPS.

Why it matters: it makes cached pages fast, but changes you make in WordPress do not appear until Varnish is purged, and dynamic pages such as cart and checkout must be excluded or carts break.

Example: curl -sI https://YOURDOMAIN.COM/ showing headers such as x-varnish, via: 1.1 varnish or age suggests Varnish is in front. Use the host’s purge button or plugin after updates.

Common confusion: purging your WordPress cache plugin does not purge Varnish unless the plugin is set up to. Clear each layer: plugin, Varnish, then CDN.

A VPS (virtual private server) gives you your own operating system, root access and dedicated allocations of CPU, memory and disk, sharing only the physical hardware with other virtual machines.

Why it matters: you get control and isolation, but also responsibility. Unless it is managed, you handle security updates, firewalls, backups, monitoring and recovery yourself. A full disk, an expired certificate or a crashed service on an unmanaged VPS stays broken until someone notices.

Example: first checks on a sick VPS are uptime (load), free -m (memory), df -h and df -i (disk space and inodes), and systemctl --failed (services that stopped).

Common confusion: a VPS is not automatically faster than good shared hosting. Performance depends on the resources allocated and how well the stack is tuned.

A WAF (web application firewall) examines HTTP requests against rules and blocks or challenges suspicious ones. It can run at a CDN edge, on the server (for example ModSecurity), or inside WordPress as a plugin.

Why it matters: WAFs block real attacks but also cause false positives: a 403 Forbidden when saving a post containing code, a page builder that will not save, or a payment callback that never arrives. The block is often silent on the WordPress side.

Example: when a specific action returns 403, note the exact time and URL, then check the WAF or ModSecurity log for a rule ID at that time. Whitelist the rule for that URL rather than turning the whole WAF off.

Common confusion: a WAF does not patch vulnerable code. It reduces exposure (virtual patching) while you update. A plugin firewall only runs once PHP starts, so it cannot absorb a large flood the way an edge WAF can.

WCAG (Web Content Accessibility Guidelines) is published by the W3C. Version 2.2 became a Recommendation in October 2023. It is organized into success criteria at three levels: A, AA and AAA.

Why it matters: accessibility complaints, demand letters, public sector rules and contracts usually measure a site against WCAG level AA. Common failures are low contrast, missing alt text, unlabeled form fields, keyboard traps and invisible focus.

Example: run an automated checker, then test by hand: use the keyboard only, zoom to 200%, and try a screen reader on your key pages. Automated tools find only part of the problems.

Common confusion: which WCAG version and level applies, and to whom, depends on the law or contract involved, not on WCAG itself; this is not legal advice, so check the law or contract that applies to you. Overlay widgets do not make a site conform.

A webhook is an HTTP request, usually a POST, that a service sends to a URL you register (the endpoint) when an event occurs. Payment gateways, form tools and email platforms use them to tell your site about payments, refunds, sign-ups and bounces.

Why it matters: if the endpoint is blocked by a firewall or security plugin, redirects, returns an error, or rejects the signature, your site never hears about the event. In a store, that leaves paid orders stuck in Pending payment or On hold.

Example: in the gateway dashboard, open the webhook endpoint and read recent delivery attempts and responses. A 403 points to a firewall; a 404 to a wrong URL; a signature error to an outdated signing secret.

Common confusion: changing the site’s domain or the gateway keys means updating the webhook URL and secret too. Many services retry failed webhooks for a while, so fixed endpoints often catch up on their own.

Webmail is a mail client that runs in the browser. Hosted email often comes with one (Roundcube is common on hosting panels), and Google Workspace and Microsoft 365 have their own.

Why it matters: it is the quickest way to tell whether a problem is the mailbox or your mail app. If webmail works with the same password, the mailbox is fine and the app’s settings or saved password are wrong.

Example: when Outlook keeps asking for a password, log in to webmail with the same address and password. Success there means you should fix the app’s server, port or authentication settings.

Common confusion: webmail at your old host still works after you move email elsewhere, but new mail no longer arrives there once MX records change. Check which provider your MX records point to.

WebP supports lossy and lossless compression, transparency and animation. All current major browsers support it, and WordPress accepts WebP uploads natively.

Why it matters: switching large JPEGs and PNGs to WebP cuts page weight and improves LCP. Problems arise when a conversion plugin serves WebP files that are missing, or uses rewrite rules the server or CDN ignores, causing broken images.

Example: cwebp -q 80 INPUT.jpg -o OUTPUT.webp converts an image, where INPUT.jpg is the original and OUTPUT.webp the new file. In the browser’s Network tab, the content-type column shows what was actually served.

Common confusion: a file named .jpg can be served as WebP by a CDN, and a .webp can be larger than a well-compressed JPEG. Check real sizes.

WHOIS is the old text-based protocol for looking up domain registration data. RDAP (Registration Data Access Protocol) returns the same kind of data as structured JSON with standard fields. ICANN has made RDAP the definitive source for generic TLDs, and many registries have retired or reduced their WHOIS service.

Why it matters: in an outage, a lookup tells you fast if the domain expired, which registrar holds it, which nameservers are set, and which locks or holds are active. Owner contact details are usually redacted for privacy.

Example: whois YOURDOMAIN.COM on a terminal, or an RDAP client or web lookup for YOURDOMAIN.COM, where YOURDOMAIN.COM is your domain. Look at the expiry date, the status codes and the name server lines.

Common confusion: the "Updated Date" is not proof of a recent change you made; registries update it for many reasons. The nameservers here are the delegation, which may differ from what a DNS dashboard claims.

A wildcard certificate lists *.example.com in its SAN field and is accepted for any single-label subdomain like shop.example.com or www.example.com.

Why it matters: it simplifies multisite networks and many subdomains, but it does not cover the apex example.com unless that name is added too, and it does not cover deeper names like dev.shop.example.com. Let’s Encrypt only issues wildcards through DNS-01 validation.

Example: a typical request covers both example.com and *.example.com. With Certbot that means two -d flags and a DNS plugin or manual TXT records.

Common confusion: a wildcard certificate does not create subdomains. Each still needs DNS (or a wildcard DNS record) and a server configured to answer for it. One leaked private key exposes every subdomain at once.

A wildcard record such as *.example.com. A 203.0.113.10 answers lookups for names like anything.example.com that do not exist explicitly. Multisite networks and SaaS platforms use them to serve many subdomains from one setting.

Why it matters: wildcards hide typos and missing records, because every name seems to resolve. They can also send mail lookups or verification checks to unexpected places, and they make subdomain takeovers and phishing lookalikes easier if left pointing at an old server.

Example: dig RANDOMTEST123.YOURDOMAIN.COM +short, where YOURDOMAIN.COM is your domain. If it returns an IP, a wildcard exists.

Common confusion: a wildcard matches only one label at its position and does not cover the apex. It also stops applying below any name that exists explicitly. A wildcard DNS record is not a wildcard certificate; you need both for HTTPS on arbitrary subdomains.

WP-CLI runs WordPress commands from a terminal over SSH. It loads WordPress the same way a page load does, so it can install and deactivate plugins, reset passwords, run search-replace, export the database and run cron events, even when wp-admin is broken.

Why it matters: when a plugin causes a fatal error, wp plugin deactivate PLUGIN-SLUG fixes it in seconds, where PLUGIN-SLUG is the plugin’s folder name. If the fatal happens while WordPress loads, add --skip-plugins or --skip-themes so WP-CLI can still start.

Example: wp plugin list --status=active, wp core verify-checksums, wp db export BACKUP.sql (where BACKUP.sql is the file name to write) and wp user update USERNAME --user_pass=NEWPASSWORD are everyday emergency commands.

Common confusion: run it from the WordPress folder (or pass --path=/PATH/TO/SITE) and as the site’s own user, not root, so files keep the right owner. Some hosts name the binary wp-cli rather than wp.

wp-config.php sits in the WordPress root (or one folder above it). It defines DB_NAME, DB_USER, DB_PASSWORD, DB_HOST, the $table_prefix, authentication keys and salts, and optional constants such as WP_DEBUG, WP_MEMORY_LIMIT and DISABLE_WP_CRON.

Why it matters: "Error establishing a database connection" usually means a value here does not match the database. A stray character or a file saved with a byte order mark breaks the whole site. Attackers target it because it holds the database password.

Example: custom constants go above the line /* That's all, stop editing! Happy publishing. */. Anything added below it, after wp-settings.php is loaded, comes too late to take effect.

Common confusion: some settings, such as WP_HOME and WP_SITEURL, override the database values, so changing the URL in Settings, General does nothing while they are defined here.

wp-content contains themes/, plugins/, mu-plugins/, uploads/ (media files, usually organized by year and month) and drop-ins. WordPress core files live outside it and can be replaced at any time.

Why it matters: along with the database, wp-content is what a backup must include. It is also where malware hides: PHP files inside uploads/ are almost never legitimate and are a classic sign of compromise.

Example: find wp-content/uploads -name "*.php" lists PHP files in the uploads folder. Many hosts and security setups block PHP execution there entirely.

Common confusion: reinstalling WordPress core does not touch wp-content, so it does not remove malware hidden in plugins, themes or uploads.

WP-Cron checks for due events on page loads and fires a background request to wp-cron.php to run them. It handles scheduled posts, update checks, plugin cleanup and many plugin jobs.

Why it matters: on a low-traffic site tasks run late or not at all ("missed schedule" posts). On a busy site it can spawn many overlapping requests. If loopback requests are blocked by a firewall, basic auth or DNS, nothing scheduled runs.

Example: add define( 'DISABLE_WP_CRON', true ); to wp-config.php and run a real cron job every few minutes with wp cron event run --due-now. wp cron event list shows what is scheduled and when.

Common confusion: DISABLE_WP_CRON stops the automatic page-load trigger only. Events still exist and still run when wp-cron.php is called by real cron.

WP_DEBUG makes WordPress and PHP report errors, warnings and notices. WP_DEBUG_LOG writes them to wp-content/debug.log (or a path you give it), and WP_DEBUG_DISPLAY controls whether they are printed on the page.

Why it matters: when you see a white screen or a critical error, turning on the log usually reveals the exact plugin file and line. Showing errors on a live site leaks file paths and breaks layouts, AJAX and REST responses.

Example, in wp-config.php above the "stop editing" line:

• define( 'WP_DEBUG', true );
• define( 'WP_DEBUG_LOG', true );
• define( 'WP_DEBUG_DISPLAY', false );

Common confusion: debug.log in its default location can be downloaded by anyone who guesses the URL, and it grows without limit. Turn logging off, or point it outside the web root, when you are done.

wp_mail() is the function core and plugins call to send email: password resets, new order notices, form notifications. It uses the bundled PHPMailer library, which by default calls PHP’s mail() and the server’s local mail program.

Why it matters: mail sent this way often fails SPF, DKIM or DMARC for your domain and ends up in spam or rejected. Some hosts disable mail() entirely. When "the contact form stopped working", the form usually works and the email does not.

Example: route mail through an authenticated SMTP or email API service with an SMTP plugin, set the From address to a real mailbox on your domain, and use the plugin’s test email and log. The wp_mail_failed action fires with the error when PHPMailer reports a failure.

Common confusion: wp_mail() returning true only means the message was handed off. It does not mean it reached the inbox.

wp_options (with your table prefix) holds key and value pairs: siteurl, home, active_plugins, template and stylesheet (the active theme), widget settings, plugin settings and, without an object cache, transients.

Why it matters: many emergencies are fixed here. A wrong siteurl or home causes redirect loops; clearing active_plugins deactivates every plugin at once; a bloated table with huge autoloaded rows slows the whole site.

Example: wp option get siteurl and wp option update home 'https://YOURDOMAIN.COM', where YOURDOMAIN.COM is your domain. Without WP-CLI, edit the same rows in phpMyAdmin.

Common confusion: many values are serialized PHP arrays. Editing them by hand in phpMyAdmin without fixing the length counts corrupts them.

xmlrpc.php implements the XML-RPC API that apps and services used before the REST API. It is still enabled by default for compatibility with some tools and services that rely on it.

Why it matters: its system.multicall method lets attackers try many passwords in one request, and pingbacks can be abused to make your site attack others. Floods of POST /xmlrpc.php in the access log are a common cause of high load.

Example: if nothing you use needs it, block it at the web server or firewall. On Apache or LiteSpeed in .htaccess: a <Files xmlrpc.php> block containing Require all denied.

Common confusion: some services still depend on XML-RPC, so check before blocking it. Blocking at the server is cheaper than a plugin, because the request never reaches PHP.