Question 1

WordPress, plugins and theme have gone 6+ months without updates

Accepted Answer

1. Take a full backup now: files plus database
2. Update WordPress core first, then plugins one by one, then theme
3. Check the site still works in a second tab after each step
4. Schedule monthly updates plus a staging test for major versions

When to bring us in: 
If something breaks and you have no backup, stop clicking and call your IT partner for a restore.

Question 2

Theme update broke the layout or threw a fatal error

Accepted Answer

1. Roll back via the backup taken just before the update
2. Create a child theme and move custom CSS and tweaks into it
3. Update again, now your changes survive
4. Document which theme version is live

When to bring us in: 
No backup and no child theme, a dev needs to restore old theme files via FTP.

Question 3

WordPress shows a blank screen after a plugin install or update

Accepted Answer

1. Open wp-content/plugins via FTP or host file manager
2. Rename 'plugins' to 'plugins_off', the site returns without plugins
3. Rename back and re-enable plugins one by one until the crash returns
4. Replace or remove the culprit, report to the plugin author

When to bring us in: 
Blank screen without a recent plugin change can be PHP-version mismatch or a corrupt file, dev needed.

Question 4

Site stuck on 'Briefly unavailable for scheduled maintenance'

Accepted Answer

1. Open FTP or host file manager in the root next to wp-config.php
2. Delete the .maintenance file
3. Refresh the site, it returns immediately
4. Check if the aborted plugin or theme update needs redoing

When to bring us in: 
If the file keeps reappearing, an update script is stuck, dev must inspect cron.

Question 5

Scheduled tasks (emails, backups) fire unreliably

Accepted Answer

1. In wp-config.php set: define('DISABLE_WP_CRON', true)
2. Create a real cron job in your host panel hitting wp-cron.php every 5 or 15 minutes
3. Test by scheduling a post and checking it publishes
4. Confirm WooCommerce emails and backups now run on time

When to bring us in: 
If your host has no cron panel, UptimeRobot can ping wp-cron.php periodically as a workaround.

Question 6

wp-config.php was never hardened and runs default settings

Accepted Answer

1. Set DISALLOW_FILE_EDIT to true so admins can't edit code via the dashboard
2. Set WP_DEBUG to false on production, only enable debug logs when troubleshooting
3. Change the DB table prefix away from 'wp_' on new installs
4. Restrict wp-config.php permissions to 600 or 640

When to bring us in: 
Unsure about chmod and ownership, your host support can set correct permissions.

Question 7

Not sure if WordPress salts have ever been rotated

Accepted Answer

1. Generate new keys via api.wordpress.org/secret-key/1.1/salt/
2. Replace the eight lines in wp-config.php with the new set
3. All users are logged out, log back in yourself
4. Rotate at least yearly plus after any suspicious incident

When to bring us in: 
Locked out after rotation, a caching layer may hold old sessions, host must flush.

Question 8

REST API leaks usernames via /wp-json/wp/v2/users

Accepted Answer

1. Install a security plugin that blocks the REST users endpoint for non-logged-in users
2. Or add a filter on 'rest_authentication_errors' in functions.php
3. Test in incognito: /wp-json/wp/v2/users should return 401 or 403
4. Leave other endpoints open for plugins that need them

When to bring us in: 
Blocking REST entirely breaks Gutenberg and many plugins, only cover the users endpoint.

Question 9

Server load spikes from thousands of POSTs to xmlrpc.php

Accepted Answer

1. Check access logs for spikes on /xmlrpc.php
2. Add a block in .htaccess or nginx config that denies xmlrpc.php
3. Or in functions.php: add_filter('xmlrpc_enabled', '__return_false')
4. Verify Jetpack or mobile apps still work, otherwise selectively whitelist

When to bring us in: 
If you actively need xmlrpc (legacy apps), restrict via a Cloudflare rule with IP whitelist.

Question 10

Hundreds of login attempts hitting /wp-login.php daily

Accepted Answer

1. Move the login URL via a plugin (WPS Hide Login or similar)
2. Force 2FA for all admins and editors
3. Set lockout: 5 failures, 15-minute ban
4. Restrict login to office IP or behind VPN for extra paranoia

When to bring us in: 
Attacks continue after the move, source is a leaking plugin or existing user, security audit needed.

Question 11

Unsure whether an SMB WordPress site needs a WAF

Accepted Answer

1. Free option: Cloudflare proxy plus its free security ruleset
2. Plugin option: Wordfence or Sucuri with the WAF module enabled
3. Pro option: Cloudflare Pro or Sucuri cloud WAF for managed rules
4. Monitor logs the first week, tune false positives

When to bring us in: 
For compliance (finance, healthcare), pick an audited cloud WAF with SLA, not just a plugin.

Question 12

Site has 40+ plugins and nobody knows what they still do

Accepted Answer

1. Export the plugin list and add 'last used' and 'active?' columns
2. Flag duplicates (three SEO plugins, two caches) and pick one
3. Don't just deactivate unused plugins, delete them
4. Target: under 20 plugins, all by actively maintained authors

When to bring us in: 
Unclear which plugin provides which function, a dev must grep code to find used hooks.

Question 13

New site, which plugins are actually essential

Accepted Answer

1. SEO: one of Yoast, Rank Math or SEOPress
2. Caching: one of WP Rocket, W3 Total Cache or LiteSpeed Cache (match your host)
3. Backup: UpdraftPlus or via your host
4. Security: Wordfence or Solid Security plus a 2FA plugin

When to bring us in: 
Adding WooCommerce or memberships, ask a dev to pick a tuned stack.

Question 14

Wondering if ACF Pro is worth the license

Accepted Answer

1. List the custom fields you actually need now
2. If you need repeating blocks (FAQ rows, team members), Pro pays off
3. Without repeaters or options pages free often suffices
4. Pro comes in per-site or unlimited, pick based on portfolio size

When to bring us in: 
Many sites with identical content models, get an agency license or consider native Gutenberg blocks.

Question 15

Elementor, Bricks or Gutenberg, which for a new project

Accepted Answer

1. Gutenberg (block editor): most future-proof, steeper for non-tech editors
2. Elementor: easy but heavy, locks you into its widgets, perf degrades when overused
3. Bricks Builder: lighter and developer-friendly, smaller community
4. Pick deliberately and train editors on that one tool

When to bring us in: 
Migrating an existing site between builders is expensive, scope a dev project before deciding.

Question 16

Builder shortcodes remain after deactivating, content is unusable

Accepted Answer

1. Before migrating, export rendered HTML per page
2. Paste clean HTML into Gutenberg or another builder
3. Only remove the old builder once every page is migrated
4. Plan per template, not everything at once

When to bring us in: 
Hundreds of pages, a dev can script batch-rendering shortcodes to HTML.

Question 17

CPTs registered via a plugin you now want to remove

Accepted Answer

1. Move CPT registration from plugin to your own MU-plugin or theme functions.php
2. Test in staging: deactivate the old plugin, content must remain accessible
3. Only switch in production once CPTs appear stable
4. Document which file registers which CPT

When to bring us in: 
Hundreds of existing posts, a dev must check slug conflicts and taxonomy relations before switching.

Question 18

A plugin you rely on hasn't been updated in years and is pulled from the repo

Accepted Answer

1. Find an actively maintained alternative with matching features
2. Test functional parity in staging before migrating
3. Move data via export-import or a dev script
4. Remove the old plugin fully, including database tables

When to bring us in: 
No alternative exists, a dev can rebuild the feature minimally or you accept lock-in and plan replacement.

Question 19

WP Rocket, W3 Total Cache or LiteSpeed Cache, which fits

Accepted Answer

1. LiteSpeed server (common at NL hosts): pick LiteSpeed Cache, free and server-integrated
2. Apache or nginx without LiteSpeed: WP Rocket (paid, easy) or W3TC (free, complex)
3. Already on Cloudflare APO or an edge cache, pick a plugin that cooperates
4. Never run two caching plugins at once

When to bring us in: 
Performance doesn't improve despite caching, problem is in PHP or DB, not cache.

Question 20

TTFB above 800ms, site feels slow

Accepted Answer

1. Measure TTFB via WebPageTest from an NL location, 3 runs before drawing conclusions
2. Enable page cache so 90% of requests skip PHP
3. Leave shared if TTFB stays slow, move to managed WP or a VPS
4. Add an edge cache (Cloudflare APO, BunnyCDN) if geography matters

When to bring us in: 
TTFB high even with cache on, the issue is DB or a slow plugin, a dev must run Query Monitor.

Question 21

Pages heavy from uncompressed images

Accepted Answer

1. Source: always export to the right format (SVG for logos, WebP or AVIF for photos)
2. Server: install a plugin that serves WebP/AVIF on the fly (ShortPixel, Imagify, EWWW)
3. Plugin: enable lazy loading, native since WP 5.5
4. Audit the media library periodically for originals over 500KB

When to bring us in: 
Media library with 10,000+ images, a dev can run a batch regenerate script.

Question 22

PageSpeed Insights returns red Core Web Vitals

Accepted Answer

1. Focus on LCP under 2.5s: image compression and load above-the-fold directly
2. CLS under 0.1: set explicit width/height on every image and iframe
3. INP under 200ms: fewer heavy JS plugins, drop unused tracking scripts
4. Retest in PSI on mobile, that's what Google ranks

When to bring us in: 
Vitals stay red despite fixes, you need a dev profiling with DevTools.

Question 23

Many database queries per request, slow dashboard

Accepted Answer

1. Ask your host whether Redis or Memcached is available
2. Install Redis Object Cache plugin or W3TC with object cache enabled
3. Test in staging: dashboard should feel faster, queries-per-page lower
4. Monitor cache hit ratio, target above 90%

When to bring us in: 
No Redis at your host, consider a host that includes it out of the box for a small monthly add.

Question 24

Database has grown into hundreds of MB from revisions and transients

Accepted Answer

1. Take a database backup first
2. Use WP-Optimize or Advanced Database Cleaner
3. Remove old post revisions (keep the last 5 per post)
4. Clear expired transients and optimize tables

When to bring us in: 
wp_options autoload above 1MB is a specific issue, a dev must identify the offending autoload rows.

Question 25

Testing changes on the live site, this needs to change

Accepted Answer

1. Enable staging via your host panel or build locally with Local or Studio
2. Make changes there, test plugin updates and theme tweaks
3. Push changes to production via a merge tool, don't just overwrite the DB
4. Never blindly push the staging DB over production if live orders sit between

When to bring us in: 
Your host has no staging, switch hosts or set up a subdomain yourself.

Question 26

Staging ready, how to push to production without losing orders

Accepted Answer

1. Push code (themes, plugins) via git or file sync, not via DB import
2. Migrate only content changes via WP Migrate selective sync
3. Avoid full DB overwrite unless the site isn't live yet
4. Plan a maintenance window and put the site in maintenance mode briefly

When to bring us in: 
WooCommerce or memberships running, bring in a dev for a staged merge.

Question 27

Routine tasks via the dashboard are slow, want something faster

Accepted Answer

1. Request SSH access from your host, WP-CLI is usually preinstalled
2. Common: 'wp plugin update --all', 'wp core update', 'wp db export'
3. Search-replace on domain swap: 'wp search-replace olddomain.nl newdomain.nl --dry-run'
4. Always start with --dry-run, then real run, always backup first

When to bring us in: 
No SSH at your host, that's a signal to switch hosts.

Question 28

Moving a site, which migration tool

Accepted Answer

1. Small and simple: All-in-One WP Migration, one export file, import on the other end
2. Large or WooCommerce: Duplicator Pro or WP Migrate Pro for incremental sync
3. Domain swap: WP Migrate does search-replace during migration
4. Test on a staging URL before flipping DNS

When to bring us in: 
Site over 5GB, use the command line with WP-CLI plus rsync, plugins time out.

Question 29

Webflow CMS collection hitting the item limit

Accepted Answer

1. Check your current plan and which collections are near the cap
2. Split content across multiple collections if the model allows
3. Upgrade to a higher plan if content genuinely needs to grow
4. For large content libraries, consider headless with Sanity or Contentful

When to bring us in: 
At the top Webflow tier, that's the signal to evaluate headless or WP.

Question 30

Custom code injection in Webflow for tracking or integration

Accepted Answer

1. Global (all pages): site settings, custom code tab
2. Per page: page settings, custom code field, for page-specific scripts
3. Embed blocks for inline snippets inside content
4. Keep one central doc listing what lives where

When to bring us in: 
Tracking via Google Tag Manager, paste only the GTM snippet and manage tags there, not piece by piece in Webflow.

Question 31

Webflow form needs to push leads into HubSpot or Pipedrive

Accepted Answer

1. Site plan: HubSpot and Mailchimp integrations are native, pick those if CRM matches
2. Otherwise use Make or Zapier: Webflow trigger 'New Form Submission' to CRM action
3. More advanced: set form-action to your own webhook (server route that POSTs to CRM)
4. Test with a dummy lead, confirm it lands in CRM with the right fields

When to bring us in: 
GDPR consent required before CRM push, add a checkbox and log consent explicitly.

Question 32

Webflow site, what are the SEO must-dos

Accepted Answer

1. Per page: fill in title tag and meta description in page settings
2. Open Graph: set a default OG image at site level, override per page when needed
3. robots.txt and sitemap.xml: site settings, SEO tab, auto-generated
4. Submit the sitemap URL to Google Search Console

When to bring us in: 
Migrating to Webflow, set 301 redirects for old URLs via site settings.

Question 33

Connecting a webshop to Mollie or Stripe

Accepted Answer

1. Mollie: get API key from the Mollie dashboard, paste into plugin (WooCommerce Mollie or Webflow equivalent)
2. Stripe: API keys from Stripe dashboard, separate test and live keys
3. Configure webhook URL on both ends so status updates flow back
4. Test with test mode plus a 1-cent live order before actually opening

When to bring us in: 
Amounts mismatch or webhook doesn't fire, check webhook logs in Mollie/Stripe dashboard.

Question 34

Considering Next.js frontend with WordPress as CMS

Accepted Answer

1. Backend: WP runs on a subdomain like cms.company.com, only for editors
2. Bridge: WPGraphQL or extend REST API for fields the frontend needs
3. Frontend: Next.js with ISR or Cache Components for publish speed
4. Webhook from WP publish to Vercel rebuild or revalidate

When to bring us in: 
No dev team, headless isn't for you, stay on classic WP.

Question 35

Which headless CMS for a new site

Accepted Answer

1. Sanity: developer-friendly, generous free tier, custom studio
2. Contentful: enterprise, higher price, but SLA and support
3. Strapi: self-hosted, you manage it, no vendor lock-in
4. Decap CMS: git-based, free, content lives in your repo (markdown)

When to bring us in: 
Stuck between three, prototype a week in each and let editors weigh in.

Question 36

Headless frontend shows old content after publishing

Accepted Answer

1. In CMS (Sanity, Contentful): set a webhook on publish event
2. Target URL: a Vercel deploy hook or a revalidate route in your app
3. Test: change a title, watch the site update within seconds
4. Many publishes: use on-demand revalidation per slug, not full rebuild

When to bring us in: 
Builds run long and burn Vercel quota, split the site into ISR per route.

Question 37

Site appears hacked or Google warns about malware

Accepted Answer

1. Take it offline or into maintenance mode first
2. Run Wordfence or Sucuri scan, review every flagged file
3. Compare core files with a clean WP via 'wp core verify-checksums'
4. Remove unknown .php files inside wp-content/uploads

When to bring us in: 
Malware keeps reappearing, a dev must diff to find the backdoor reinjecting it.

Question 38

Search Console shows Japanese pages that aren't yours

Accepted Answer

1. Take an immediate backup of files plus database
2. Identify hacked URLs via Search Console coverage report
3. Remove spam content from DB (wp_posts) and suspicious files in plugins/themes
4. If clean state is unclear, restore a pre-hack backup and migrate changes manually

When to bring us in: 
Hack lives deep in core or DB, full rebuild on clean WP is the safe path.

Question 39

Hack cleaned, what else needs to happen

Accepted Answer

1. Rotate all passwords: WP admins, FTP, hosting, database, mail
2. Rotate security keys in wp-config.php so old sessions die
3. Update WP core, all plugins and theme, remove unused plugins
4. Request a review in Google Search Console to clear the warning

When to bring us in: 
Unsure how the attacker got in, run a security audit before going public again.

Question 40

Rich results missing in Google (LocalBusiness, FAQ, Product)

Accepted Answer

1. Enable the schema module in Yoast or Rank Math
2. Fill LocalBusiness data: NAP (name, address, phone), opening hours
3. Add an FAQ block on service pages for the FAQ rich result
4. Test via Google's Schema Validator

When to bring us in: 
Custom content (events, recipes, jobs) has its own schema types, a dev must add manually.

Question 41

NL and EN versions of the site, Google ranks the wrong version

Accepted Answer

1. Enable hreflang in your SEO plugin or multilingual plugin (WPML, Polylang)
2. Per page: link the NL version to its EN equivalent via the language switcher
3. Generate x-default for visitors outside your target regions
4. Validate in Search Console > International Targeting

When to bring us in: 
Hreflang correct but Google still shows NL to EN visitors, could be a canonical conflict, dev needed.

Question 42

Visitors hit 404s and internal links are partly broken

Accepted Answer

1. Crawl the site monthly with Screaming Frog (free up to 500 URLs) or Ahrefs
2. Filter on 404 and 5xx, build a list
3. Fix each via a 301 redirect to the right new URL or repair the source link
4. Set up Search Console reports for crawl errors

When to bring us in: 
Hundreds of broken links after migration, a dev can generate a redirect map from the old structure.

Question 43

Mollie payment succeeds but order stays pending in WooCommerce

Accepted Answer

1. Open the Mollie dashboard, go to the transaction and review webhook logs
2. See 4xx or 5xx, copy the webhook URL and open in browser, must not 403
3. Common cause: WAF blocks Mollie IPs, add a whitelist in firewall or plugin
4. Test with a 1-cent transaction until status posts correctly

When to bring us in: 
Webhook works sometimes, often a caching layer in front of /wc-api/, host must exclude.

Question 44

Migrating from WordPress to Webflow

Accepted Answer

1. Export WP content via XML export or a CSV plugin
2. Import into Webflow CMS collections, mapping field by field
3. Rebuild the design in Webflow, the old theme doesn't carry over
4. Build an old-to-new redirect map and load into Webflow site settings

When to bring us in: 
Hundreds of posts plus custom fields, bring in a dev for scripted import via the Webflow API.

Question 45

Moving the site to a new host without visitors seeing downtime

Accepted Answer

1. Drop DNS TTL to 5 minutes at least 24h in advance
2. Bring up the site on the new host under a temporary URL and test fully
3. Sync the latest content (orders, comments) just before DNS flip
4. Change DNS, monitor both hosts for 48h until all traffic goes through the new one

When to bring us in: 
WooCommerce live, schedule a 15-minute maintenance window for the final DB sync, downtime is unavoidable there.

Question 46

wp-config.php with DB password ended up in Git.

Accepted Answer

1. Change the DB password on the host immediately
2. Regenerate auth keys and salts in wp-config
3. Add the file to .gitignore, rewrite history
4. Review logs for suspicious logins or queries

When to bring us in: 
Repo was public or a fork exists: assume everything is leaked, also rotate Stripe or mail relay keys.

Question 47

Strapi v4 to v5 upgrade breaks content types or plugins.

Accepted Answer

1. Upgrade locally first with a clone of the production DB
2. Run the Strapi codemod for entity to document
3. Upgrade plugins one by one, not all at once
4. Migrate the frontend only after the backend is stable

When to bring us in: 
Custom plugins with deep v4 internals: consider rebuilding or replacing the plugin, patching a port rarely ends well.

Question 48

After a deploy visitors still see old content on Next.js.

Accepted Answer

1. On content change use revalidateTag or revalidatePath, not just a redeploy
2. Webhook from CMS to a revalidate endpoint
3. Invalidate CDN cache (Vercel, Cloudflare) explicitly on asset changes
4. Keep browser-cache headers for HTML short

When to bring us in: 
Cache strategy turned into patchwork: redesign from Next 16 cache components instead of patches on patches.

Question 49

Do we need Sentry or similar error tracking?

Accepted Answer

1. Decide which apps are real custom code (not pure SaaS)
2. Drop the Sentry SDK in front-end and back-end with release tagging
3. Alert on new error types, not on known ones
4. Link issues into your work tracker so they are not forgotten

When to bring us in: 
For security-sensitive apps, look at PII scrubbing and self-hosted forks like GlitchTip.

Question 50

Site acts up after a plugin update and you don't know which plugin caused it.

Accepted Answer

1. Reproduce precisely first: which page, which action, which browser, logged in or out. Without a repro, debugging is guessing.
2. Switch to a stock theme (Twenty Twenty-Four) on staging. Still broken? It is a plugin, not the theme.
3. Deactivate all plugins, confirm the issue is gone, then re-enable in blocks of five until it returns. Bisecting 40 plugins takes six clicks.
4. Enable WP_DEBUG and WP_DEBUG_LOG in wp-config.php. The fatal trace in wp-content/debug.log usually points to the offending file directly.
5. Update the culprit to its latest version or find an actively maintained alternative. Report the bug in the plugin support forum.
6. Document the plugin stack and what each does, otherwise you'll hit the same wall in six months.

When to bring us in: 
If you can't reproduce or you find nothing after a full bisect, it likely sits in a hosting layer or mu-plugin. Ask your host or a WP engineer to look.

Question 51

We're rebuilding the site, how do we avoid an SEO crash.

Accepted Answer

1. Pull the current URL list with Screaming Frog or Search Console export. Sort by organic traffic and backlinks, those are the URLs that actually matter.
2. Build a mapping sheet: old URL, new URL, status code (301), notes. For pages that vanish pick the closest new page, not the homepage.
3. Preserve existing URL structure where reasonable. A category-slug cleanup is tempting but every change is a redirect risk.
4. Implement redirects at server level (.htaccess or nginx) or via a redirect plugin. Test every 301 with a crawler before launch, not after.
5. Keep title, H1 and internal links as similar as possible. If content stays practically the same, relevance follows.
6. Submit the new sitemap.xml in Search Console and monitor 404s and crawl errors daily for the first two weeks.

When to bring us in: 
If you have a lot of legacy content (5000+ URLs), international variants or a heavy backlink profile, hiring an SEO specialist for the migration pays back.

Question 52

Contact form drowns in spam, but reCAPTCHA is annoying.

Accepted Answer

1. Add a honeypot field: a text input hidden via CSS with a normal-looking name (website, fax). Bots fill it, humans don't.
2. Add a timing check: forms submitted within three seconds of page load are almost certainly bots. Reject or send to bin.
3. Add a required field with a simple context question (which city, which year). No maths, just a check a generic bot fails.
4. Plugins like Fluent Forms, WPForms and Gravity Forms ship honeypot. Turn it on; only enable reCAPTCHA if spam still leaks through.
5. Block known spam IPs via Cloudflare WAF. A free Cloudflare account stops a lot of bot traffic before it reaches your server.
6. Monitor for a week. Zero spam and all real leads landing means the job is done.

When to bring us in: 
If targeted spam attacks (e.g. directed vulnerability scans) keep getting through, hCaptcha or Cloudflare Turnstile are privacy-friendlier alternatives to reCAPTCHA.

Question 53

Our cookie banner half-works, or loads scripts before consent.

Accepted Answer

1. List every script: analytics, marketing pixels, chat, embedded video, maps. Tag each as functional, statistics, marketing or social.
2. Pick a banner tool that actually blocks: Cookiebot, CookieFirst, Complianz or a custom solution using data attributes. Banners that only 'inform' aren't enough.
3. Configure categories correctly: only functional defaults to on. Statistics and marketing only after explicit opt-in. No pre-checked boxes.
4. Test in incognito with devtools open: before clicking, no request should fire to Google Analytics, Meta or TikTok. Only to functional endpoints like your own API.
5. Log evidence of consent (timestamp, categories chosen, IP hash). On complaint, you must show the user said yes.
6. Document the banner in your GDPR register and check every six months for new scripts that snuck in unblocked.

When to bring us in: 
If you operate in healthcare or government, or run tracking-heavy marketing, a GDPR lawyer should review the banner and cookie policy before the regulator does.

Question 54

Backups run but we've never tested a restore.

Accepted Answer

1. Set RPO and RTO. How much data can you lose (one hour, one day) and how fast do you need to be back (four hours, one day). That sets frequency and approach.
2. Pick off-host storage: BlogVault, UpdraftPlus to S3 or Google Drive, or your host's native off-site option. Backups on the same server don't count.
3. Run at least daily files plus DB. A busy webshop wants hourly or incremental, otherwise you lose orders.
4. Run a restore test on staging at least quarterly. Document steps and time. A six-hour restore is a wake-up call.
5. Keep at least 30 days of history. Hacks often surface after weeks and your latest backup is already infected.
6. Write a runbook with steps, contacts and credentials. In a crash you won't remember where to start.

When to bring us in: 
If you handle customer data, payments or medical records, you need a verified backup strategy with a separate audit trail (and a DR plan). Bring in an experienced WP engineer.

Question 55

Customers report the site was down but we never noticed.

Accepted Answer

1. Pick a tool that pings every 1 to 5 minutes from at least two regions. A single Amsterdam check misses regional network issues.
2. Don't just monitor the homepage. Ping /wp-login.php (expect 200), your checkout and your API endpoints. A working homepage isn't enough.
3. Set sane alerting: not on every flap, but on two consecutive fails. Pushover, Slack or SMS, not just email.
4. Add an SSL monitor. An expired cert kills the site as effectively as a crash.
5. Build a public status page (Statuspage or BetterStack's native option) if B2B customers ask about SLAs.
6. Review incidents quarterly. Patterns appear (Sunday-night backup, deploy window) that you can fix structurally.

When to bring us in: 
If you have real SLA commitments or a revenue-critical shop, a synthetic-monitoring suite (DataDog, Checkly) plus an on-call rotation is the next step.

Question 56

Lighthouse score stuck at 60-70 and the client wants 90+.

Accepted Answer

1. Run Lighthouse in incognito with cache off, mobile preset. Ignore desktop scores; Google ranks on mobile.
2. Tackle 'Reduce unused JavaScript' first. Disable page-builder features you don't use, or drop the builder for a custom theme.
3. TTFB under 200ms usually needs page caching (WP Rocket, LiteSpeed Cache, Cloudflare APO) and a good host. Shared hosting under 200ms is rare.
4. Inline critical CSS and defer the rest. WP Rocket and most caching plugins do this automatically.
5. Drop superfluous fonts. Three Google Font families is usually two too many. One, self-hosted, helps LCP.
6. Re-test, screenshot the result, keep the evidence. Lighthouse fluctuates, average three runs.

When to bring us in: 
Can't hit 90 on a builder-heavy site? A rebuild on a leaner theme (Kadence, GeneratePress, Astra) or headless is the honest route. Bring in a performance engineer.

Question 57

We want rich results in Google, how to handle schema.org.

Accepted Answer

1. Decide which types fit: a brick-and-mortar wants LocalBusiness, a services firm wants Service, a shop wants Product and BreadcrumbList.
2. WordPress: Yoast and RankMath add LocalBusiness and BreadcrumbList automatically once you fill in business details. That's the baseline.
3. FAQ schema: use Yoast's FAQ block or a dedicated plugin. Don't paste raw JSON-LD; it gets lost on theme changes.
4. Webflow: add JSON-LD via Custom Code in page settings or an Embed block. Test each template separately.
5. Test every template via search.google.com/test/rich-results. A typo in JSON-LD removes the entire markup from the index.
6. Watch Search Console under Enhancements to see which types Google recognises and which errors exist.

When to bring us in: 
If you operate in a niche where specific schema types matter (healthcare, legal, recipes, events), an SEO specialist with domain knowledge beats generic plugins.

Question 58

Unclear if sitemap.xml and robots.txt are set up correctly.

Accepted Answer

1. Open yourdomain.tld/robots.txt. No Disallow: / on the whole site (that blocks everything), do reference the sitemap at the bottom: Sitemap: https://yourdomain.tld/sitemap.xml.
2. Open yourdomain.tld/sitemap.xml. Should be valid XML with the URLs you want indexed. Yoast and RankMath generate this automatically in WordPress.
3. Only block what truly should not be crawled: /wp-admin, /cart, /checkout, search results. The rest stays crawlable.
4. Submit sitemap.xml in Search Console. That shows which URLs get indexed and which errors Google sees.
5. Webflow: sitemap.xml is auto-generated under Project Settings > SEO. robots.txt is configurable there too.
6. Re-check quarterly. A new plugin or an accidental 'Discourage Search Engines' tick can ruin everything.

When to bring us in: 
Suspect the site dropped out of Google due to a robots or sitemap mistake? Run a technical SEO audit or have an SEO specialist review Search Console with you.

Question 59

Should we use www.yourdomain.tld or the apex as primary.

Accepted Answer

1. Pick a primary, often based on branding. Short brands tend to pick apex, larger brands tend to pick www. No wrong answer.
2. Set a 301 from the non-chosen variant to the chosen one. Apex to www, or the other way. Dual indexing hurts SEO.
3. DNS: apex uses an A record (or ALIAS/ANAME at hosts that support it) and can't always elegantly point at a CDN. www can use CNAME, which is more flexible.
4. Set the canonical URL consistently. WordPress: General Settings > Site Address (URL). Webflow: Project Settings.
5. Search Console: add both variants as properties but mark the chosen one as canonical via a Domain Property.
6. Update all external links: email signatures, social profiles, invoice templates, ad campaigns. All to the chosen variant.

When to bring us in: 
Site has been running on the unintended variant for years with many backlinks? Migrate carefully with monitoring rather than hard-switching. Bring in an SEO engineer.

Question 60

We're moving to a new domain, how to keep SEO and bookmarks.

Accepted Answer

1. Build a redirect map: old URL to new URL, one-to-one. Don't blanket-redirect to the homepage; that throws Google's link equity away.
2. Implement 301s at server level (.htaccess for Apache, server block for nginx) or via a redirect plugin. Permanent, not 302.
3. Test every redirect with a crawler (Screaming Frog) before the DNS switch. No redirect chains of three or more hops, that weakens the signal.
4. Update internal links to new URLs where possible. Redirects work, but direct links are always cleaner.
5. Add the new domain in Search Console and use the Change of Address tool. That speeds up ranking transfer.
6. Keep the old domain registered and hosted for at least a year. Otherwise all 301s break and you're in cold storage.

When to bring us in: 
Lots of backlinks or a complex URL structure? An external SEO engineer for the migration is worth it. A wrong switch costs much more than that consult.

Question 61

WP-admin is sluggish, sometimes 10 seconds per page.

Accepted Answer

1. Open Tools > Site Health. WordPress often tells you literally what's wrong: old PHP, low memory, a bad plugin.
2. Test in incognito with a fresh user. Only an admin issue or everyone? Narrows the search.
3. Database cleanup: purge revisions, old transients and autoloaded options with WP-Optimize or Advanced Database Cleaner. A 1GB+ DB should ring alarms.
4. Identify slow plugins with Query Monitor. It shows per page which plugin costs time, which queries are slow and which hooks burn cycles.
5. Disable dashboard widgets that fetch external data (RSS, news, productivity gauges). They wait on external APIs.
6. Bump WP_MEMORY_LIMIT to 256M or 512M in wp-config.php. The 64M default is too tight for modern sites.

When to bring us in: 
Admin still slow after cleanup and plugin audit? It sits in PHP, MySQL config or the host. Ask the host for PHP OPcache, MySQL tuning or an upgrade to managed WP.

Question 62

Server hammered daily by brute-force attempts on /wp-login.

Accepted Answer

1. Front the site with Cloudflare (free tier is enough) and add a WAF rule: block all POST to /wp-login.php except from your office IP.
2. No Cloudflare? Install Wordfence or Limit Login Attempts Reloaded. Both block IPs after X failed attempts.
3. Don't rename /wp-login.php as a security move; that's security through obscurity and often breaks plugins. Throttle and monitor instead.
4. Enable two-factor authentication for every admin. With 2FA, a stolen password is still useless.
5. Disable XML-RPC if you don't use it. Many bots go in via system.multicall and bypass rate limits.
6. Monitor login attempts weekly. A spike sometimes means a specific user is targeted; reset their password.

When to bring us in: 
Hit by coordinated attacks from many IPs at once (botnet)? A paid Cloudflare plan with Bot Management or a dedicated WAF (Sucuri) is sensible.

Question 63

Unclear what the right file permissions for WordPress are.

Accepted Answer

1. SSH into the server. SFTP clients show permissions too, but SSH is faster for bulk changes.
2. Set all dirs to 755: find /path/to/wp -type d -exec chmod 755 {} \;
3. Set all files to 644: find /path/to/wp -type f -exec chmod 644 {} \;
4. wp-config.php to 600: chmod 600 wp-config.php. Only the owner (PHP user) reads it.
5. Owner must be the web server user (www-data, apache, or your cPanel user), not root. Wrong owner produces 'unable to write' on updates.
6. Test: WordPress should install plugins, upload media and run updates. If not, owner or group is wrong.

When to bring us in: 
Persistent 'cannot write to wp-content' despite correct permissions? Ask the host for the PHP user and any separate FTP user. The mismatch sits there.

Question 64

Admins log in with password only, no 2FA.

Accepted Answer

1. Pick a 2FA plugin: Wordfence Login Security (free), Two Factor (from Plugin Contributors, free) or WP 2FA. All work with Google Authenticator or Authy.
2. Make it mandatory for all admin roles. Give users a week to set it up, after that no access without.
3. Document recovery codes. Lost phone means lost access; storing recovery codes in a password manager is mandatory.
4. Test on your own account first before forcing it on other admins. Nothing worse than locking yourself and the team out.
5. Combine with strong passwords via a password manager. 2FA on a weak password is still risk under phishing.
6. For low-risk roles (authors, editors) make 2FA optional or recommended, not mandatory. Friction should match risk.

When to bring us in: 
Handle customer data, finance, healthcare or government clients? Beyond 2FA, SSO (Microsoft Entra ID, Google Workspace) is sensible. That moves you toward WP SAML or Auth0.

Web and CMS