WordPress

WordPress is a popular free software for personal publications (blogs). It uses PHP and MySQL as server-side technologies. Its installation/maintenance is quite easy. Requirements To install WordPress on your hosting account, you need: 80 MB free disk space one free MySQL database slot. The database will be created by the automatic installation script. Installation To install WordPress, please navigate to the WordPress Manager > Install tab of your hosting Control Panel. You will need to fill in the following fields: Site Title: You need to enter the name of your WordPress site. You choose this name. For example, it can be related to the content of the blog, the name of your company, your domain name, etc. Subdomain: Choose the subdomain, in which you want WordPress installed. If you want to install WordPress in a new subdomain, click on the link Create a subdomain, which will take you to the Subdomains section of the Control Panel. Path: If you wish to install WordPress in the main folder of the subdomain you have chosen, you can leave this field empty. If you wish to install in a subfolder, please click the (Folder) icon and choose an installation folder. We advise that you install WordPress in a folder that does not contain other files and folders as they can be overwritten by the installation script.   Use WWW: Prefix the address with www (e.g. http://www.yourdomain.com). Use HTTPS: Set the site to use HTTPS instead of HTTP. This is only possible if there is a valid SSL certificate installed for the host. Server-side cache: Choose whether you wish to enable server-side caching for improved site loading times. It can be enabled after the installation. For more details, check our Enabling server-side caching for WordPress article. MySQL version: Select the MySQL version that you would like to use for WordPress - MySQL 8 (default) or MySQL 5. Username: Enter the username that you want to use for administering your site. You will be able to create additional WordPress users later, through the administrative panel of WordPress. Password: Enter a password for the above username. Password Again: Enter the password again. Е-Mail: Enter the email address of the main user for administration. You will need this email for example to retrieve the password of your WordPress main user for administration (in case it is lost). Automatically upgrade to new major versions: Selected by default due to security, compatibility, and performance reasons. Deselect this option if you do not wish WordPress to update automatically. Accept license agreement:You need to check the license of WordPress and accept it. After you fill in the above fields, click on the Install button. If the folder you are installing to contains files/folders, you will see a warning. If you want to choose another subdomain or subfolder for the installation, you need to click on the Cancel button. Otherwise, you can click on the Continue button. Note that the results of some operations are cached, so you may not see your changes immediately. If that happens, please allow a few minutes for the cache to expire.If the WordPress installation completes successfully, you will see a screen with the installation details: We strongly advise you that you keep your WordPress installation up-to-date, along with the plugins you add. You can perform the updates through the administrative section of WordPress or the hosting Control Panel > WordPress Manager, where you will see notices that new versions of the WordPress core and/or plugins are available. Most operations made in the WordPress Manager of the Control Panel are performed using the WP-CLI tool. These operations are logged in the ~/.wp-cli/history.log file in your hosting account. For instructions on installing WordPress manually, check our Installing WordPress Manually article.

After successfully logging into the hosting Control Panel, your account will be scanned for WordPress installations (running WordPress version 3.9+) that are not imported to the WordPress Manager. If such WordPress installations are found, a notification like the following will be displayed with convenient button to scan and import them: In the WordPress Manager of the hosting Control Panel, you can use the Scan for WordPress installations button to manually scan your hosting account and list the WordPress installations it finds. To import a WordPress installation from the list, you need to check its checkbox and click on the Import button. Some issues with your WordPress installation can be automatically fixed by the Control Panel's WordPress Manager. If an issue like that is detected, you will see an option to attempt a fix on the management page of your WordPress installation. If your WordPress installation does not work and cannot be repaired automatically by the Control Panel, you can contact our support team for assistance. The Log in button next to each administrative username allows you to log in to the WordPress dashboard of your website with that particular username. This way, you can log in without entering a password. Note that the results of some operations are cached, so you may not see your changes immediately. If that happens, please allow a few minutes for the cache to expire. Most operations made in the WordPress Manager of the Control Panel are performed using the WP-CLI tool. These operations are logged in the ~/.wp-cli/history.log file in your hosting account.

Note: It is only possible to force HTTPS for a WordPress installation if there is a valid SSL certificate installed for its domain/subdomain. You can enable a free Let's Encrypt certificate with a single click using the SSL/HTTPS -> Let's Encrypt certificates section of the Control Panel as described in our Let's Encrypt certificates article. You can use the WordPress Manager in the hosting Control Panel to force HTTPS for a WordPress installation by following the steps below: Access the hosting Control Panel. Navigate to the WordPress Manager. Find the WordPress installation in the list, and click on the Manage button next to it. This will take you to the management page for the WordPress installation. Select the Yes checkbox under Use HTTPS. Click on the Change button. When you force HTTPS for WordPress, the tool performs the following actions: Creates a temporary backup of the WordPress installation for quick and easy restoration in case of problems. For more information, you can check our Creating, downloading, and restoring from WordPress backups article. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Replaces the current address with the new address in the database. Note: If there are any hard-coded links of the website's URL in the WordPress files, you will need to update them manually.

You can use the WordPress Manager section of the hosting Control Panel to change the Site URL of a WordPress installation by following the steps below: 1. Open the Manage tab. 2. Find the WordPress installation in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. 3. Select the Site URL using the controls under the Site URL section. A preview of the URL is shown below the controls. The controls are as follows: Use HTTPS: Set the site to use HTTPS instead of HTTP. This is only possible if there is a valid SSL certificate installed for the host. Use WWW: Add www. prefix for the address. Choose subdomain: Choose the subdomain from the list of the subdomains created on the account. Choose domain: Choose the domain from the list of the parked and main domains on the account. Choose directory: Choose a directory in the selected subdomain. Leave empty for the root of the domain/subdomain. If you choose a directory that is different from the current one, you are effectively moving WordPress to that directory. Details about that can be found in our Moving WordPress between directories or subdomains on the hosting account article. 4. Click on the Change button. When you change the address of WordPress, the tool performs the following actions: Creates a temporary backup of the WordPress installation. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Searches and replaces the current address with the new address in the database. Note: If there are any hard-coded links of the website's URL in the WordPress files, you will need to update them manually.

You can enable the recommended output compression, enable browser caching, and prevent 404 (Not found) errors for WordPress very easily by following these steps: Go to the WordPress Manager in the hosting Control Panel. Click on the Manage button next to your WordPress installation. Click on the Enable button next to WordPress optimizations under the Tools section. This will add the following code block to the .htaccess file of your WordPress installation: ### BEGIN Optimization enabled via Control Panel > WordPress ###<IfModule mod_deflate.c>    # Insert filters according to https://codex.wordpress.org/Output_Compression    AddOutputFilterByType DEFLATE text/plain text/html text/xml text/css application/xml application/xhtml+xml application/rss+xml application/javascript application/x-httpd-php application/x-httpd-fastphp image/svg+xml    # Drop problematic browsers    BrowserMatch ^Mozilla/4 gzip-only-text/html    BrowserMatch ^Mozilla/4\.0[678] no-gzip    BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html    # Make sure proxies don't deliver the wrong content    Header append Vary User-Agent env=!dont-vary</IfModule>## LEVERAGE BROWSER CACHING ##<IfModule mod_expires.c>    ExpiresActive On    ExpiresByType image/jpg "access 1 year"    ExpiresByType image/jpeg "access 1 year"    ExpiresByType image/gif "access 1 year"    ExpiresByType image/png "access 1 year"    ExpiresByType text/css "access 1 month"    ExpiresByType application/pdf "access 1 month"    ExpiresByType application/x-javascript "access 1 month"    ExpiresByType application/javascript "access 1 month"    ExpiresByType application/x-shockwave-flash "access 1 month"    ExpiresByType image/x-icon "access 1 year"    ExpiresDefault "access 2 days"</IfModule>## LEVERAGE BROWSER CACHING ##### Skip 404 error handling by WordPress for static files ###<IfModule mod_rewrite.c>    RewriteEngine On    RewriteCond %{REQUEST_FILENAME} !-f    RewriteCond %{REQUEST_FILENAME} !-d    RewriteCond %{REQUEST_URI} !(robots\.txt|sitemap\.xml(\.gz)?)    RewriteCond %{REQUEST_FILENAME} \.(css|js|html|htm|rtf|rtx|svg|svgz|txt|xsd|xsl|xml|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|swf|tar|tif|tiff|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)$ [NC]    RewriteRule .* - [L]</IfModule>#### END Optimization enabled via Control Panel > WordPress #### You can also add the code block listed above to the .htaccess file of your WordPress installation manually using the File Manager in the hosting Control Panel. The Leverage Browser Caching code block is essential for preparing your WordPress installation for server-side caching. You can learn more about getting WordPress working properly with our server-side caching service in the Enabling server-side caching for WordPress article. All WordPress applications pre-installed on the hosting account or installed through the hosting Control Panel > WordPress Manager are optimized by default.

WordPress is the most popular website software application, and one of the reasons is the wide range of themes and plugins which extend its capabilities. This makes WordPress a pretty enticing target for hacker attacks, so taking measures to secure it is strongly recommended. You can perform four simple actions via the hosting Control Panel > WordPress Manager that are very effective and should help you prevent the majority of hacking attempts against your website: Update WordPress and its components regularly Access WordPress via HTTPS (use SSL) Apply an additional layer of protection to the WordPress Dashboard Prevent execution of PHP scripts in folders with website content Update WordPress and its components regularly Software applications which are actively worked on receive regular updates to introduce new features to their customers, apply security fixes, or resolve compatibility issues. With WordPress, there are updates for literally everything (the WordPress core, all installed themes, and all installed plugins), and you have to apply them regularly to have the best defense possible against vulnerability exploits. One solution is to activate automatic updates for the WordPress core, themes, and plugins; however, this may result in unexpected downtime of your website if any of the automatic updates causes your website to malfunction or not work correctly. That is why we would recommend that you regularly and manually check the WordPress core, themes, and plugins for updates. You can find more details about the available update options for WordPress themes and plugins in the How to update a WordPress theme? section of our Managing WordPress themes article and the How to update a WordPress plugin? section of our Managing WordPress plugins article. You can update the WordPress core and all outdated plugins via the hosting Control Panel > WordPress Manager by simply opening the management page for your WordPress installation and pressing the respective Update buttons which will be displayed if updates are available. Access WordPress via HTTPS (use SSL) By installing an SSL certificate on the server and configuring WordPress to work via HTTPS, all data will be transmitted securely between the browser of your website visitors and the server hosting your website. This will help against man-in-the-middle attacks. You can find step-by-step instructions how to do this the right way via the hosting Control Panel > WordPress Manager in our Forcing HTTPS for WordPress article. Apply an additional layer of protection to the WordPress Dashboard Hackers often try to brute-force their way into the WordPress Dashboard, so having a strong password for all administrators of your WordPress website is a must. Details on how to easily change the passwords of WordPress administrators are available in our Managing WordPress administrators article. On our servers, a Web Application Firewall (WAF) helps significantly with the prevention of most attacks. It attempts to filter out abusive traffic and allow only legitimate traffic; however, some brute-force attack (especially slow and/or distributed) are indistinguishable from legitimate traffic, so the WAF may not block them correctly. More information about the WAF available on our servers can be found in the Error "412 Precondition Failed" (mod_security2) article from our online documentation. What you can do to prevent such brute-force attempts altogether is to password protect the wp-login.php file (used for accessing the WordPress Dashboard), which takes just a few steps: Open the management page for the WordPress installation by clicking on the Manage button for it in the hosting Control Panel > WordPress Manager. Scroll down to the Tools section, and click on the Manage button next to Dashboard login protection. You will be redirected to the hosting Control Panel > Protection > Web access protection > Password protection page for the wp-login.php file in your WordPress directory. Choose a username and a password in the form that will be displayed there. We strongly recommend that you use a username that is hard to guess and not associated with your name, hosting account, or website, and that you choose a password after checking our Password tips article with general information on how to choose a strong password and secure it. You can add multiple username/password combinations using that form. A list of all authenticated users will be listed below the form with an option to change their password or delete them. Press the Add button. Now, anyone that tries to open the login page of your WordPress Dashboard (the wp-login.php file of your WordPress installation) via a browser will have to supply a combination of a valid username and password (those from the configured password protection):After successfully authenticating with a valid username and password in the pop-up screen, the login page of the WordPress Dashboard will be displayed where the WordPress user credentials can be entered:As you can see, this will require any brute-force attacks to break two different username-password combinations to gain access to your WordPress Dashboard. This process should take a lot of time and processing power, so it should be a good enough reason for brute-force attack initiators to give up on your website.Important: This extra layer of protection will affect ALL users registered on your WordPress website, so you will need to provide the additional set of credentials to them as otherwise they will be unable to reach the login page and access the WordPress Dashboard. If your website relies on having a lot of visitors or users to be logged in, this type of protection may not be the best solution for you, and we would suggest that you look for a plugin that offers similar protection. Prevent execution of PHP scripts in folders with website content Some vulnerabilities allow hackers to upload files in the wp-admin/includes, wp-content/uploads, and wp-includes directories of a WordPress installation. Hackers try to use this to their advantage by uploading malicious PHP files and trying to execute these files directly. A simple way to stop such attempts in their tracks is to prevent the execution of PHP files in the said folders. The WordPress Manager allows you to do it easily with a click of a button - all you need to do is: Go to the hosting Control Panel > WordPress Manager and click on the Manage button for your WordPress installation. Now, you will be inside the management page for your WordPress installation. Navigate to the Tools section there, and click on the Apply button next to Secure content directories. This will add the following code block to the .htaccess files in the wp-admin/includes, wp-content/uploads, and wp-includes directories of your WordPress installation (the WordPress Manager will create the .htaccess files if they do not exist):# BEGIN rules managed by Control Panel > WordPress### BEGIN PHP Security rules enabled via Control Panel > WordPress ###Options -Indexes -ExecCGI# Execution prevention<Files ~ "\.ph(?:p[345]?|t|tml)$">        deny from all</Files>#### END PHP Security rules enabled via Control Panel > WordPress ##### END rules managed by Control Panel > WordPressImportant: Some plugins or themes may rely on the web execution of PHP files located in the folders mentioned here, which will cause these plugins/themes to stop working correctly. If that happens, you should remove the code block added by the Secure content directories tool manually or use another theme/plugin that offers the same functionality but executes files only from its respective directory within the wp-content/plugins directory of your WordPress installation.

In this article, you can find the following information about WordPress themes: What is a WordPress theme? How to choose a WordPress theme? How to install a WordPress theme? Installing and activating a WordPress theme via the Dashboard Activating a WordPress theme via the Dashboard Installing and activating a WordPress theme with WP-CLI Activating a WordPress theme with WP-CLI Installing a WordPress theme by uploading it to your account and activating it How to update a WordPress theme? Utilizing automatic theme updates Updating a theme through the WordPress Dashboard Updating a theme with WP-CLI Updating a theme via the File Manager or FTP How to disable a WordPress theme? How to delete a WordPress theme? Deleting a theme through the WordPress Dashboard Deleting a theme using WP-CLI Deleting a theme via the File Manager or FTP How to use a child theme in WordPress? How to secure a WordPress theme? What is a WordPress theme? Themes in WordPress were originally only used for changing the design (layout) of a website. Nowadays, there are a lot of themes that are very complex and totally change the way a WordPress installation functions. For example, some themes come with their own website builders that allow you to edit the website content very easily, others overhaul the default WordPress back and front-end. How to choose a WordPress theme? There are thousands of free themes available for preview and activation directly in the WordPress Dashboard. These themes can also be downloaded from the WordPress theme repository. Of course, this includes the default WordPress themes (like TT1 Blocks, Twenty Twenty-Three, Twenty Twenty-Two, Twenty Twenty-One, Twenty Twenty, etc.). Commercial themes can be found in the WordPress repository or dedicated theme-selling websites. Some commercial themes are available for purchase and download only through the websites of their vendors. There are basically themes available for all tastes. Of course, if you need something that is not available yet, there is always the option to hire a theme developer to build you the exact theme that you want and need. When choosing a theme for your WordPress website, you should also consider checking if the theme receives regular updates, and if its developers, support team, or community offer any assistance. Regular updates are important as they will help prevent or fix potential compatibility issues with the theme and future versions of the WordPress core or plugins. If you run into any issues related to the theme, the chances of getting the issues resolved will increase significantly if the theme developers can help or there are active and knowledgeable members in the theme's community. You can also refer to the official WordPress community for assistance, but they may not be always able to help. How to install a WordPress theme? After you have found the theme that you wish to use, there are several ways to actually install it on your WordPress website - via the WordPress Dashboard, with the help of the WordPress command-line interface - WP-CLI, or by manually uploading it to the account. Installed themes can be activated via the WordPress Dashboard, as well as via WP-CLI. Some themes may require additional steps for their proper installation or activation (adding files, installing plugins, or purchasing a license for example), so please refer to the official instructions of the theme that you wish to use on your website. You can install and test new themes on existing WordPress websites risk-free by using a staging instance. More information on how to set up a staging instance of your existing WordPress website via the hosting Control Panel is available in our Creating and using WordPress staging sites article. Installing and activating a WordPress theme via the Dashboard Installing a new theme via the WordPress Dashboard is the easiest and most user-friendly method which requires just a few steps. You only need to log in to your WordPress Dashboard (you can access it by adding "/wp-admin" to your website's URL - for example, http://your_domain.com/wp-admin) or even easier, use the "Log in" feature available in the hosting Control Panel > WordPress Manager as explained in our Managing WordPress administrators article. Once logged in, navigate to the Appearance > Themes section.Click on the Add New button or the Add New Theme block.Now, there will be two installation options available depending on whether your new theme is listed in the public WordPress repository or not. If your new theme is available in the WordPress theme repository, you can search for the theme directly through the WordPress Dashboard and use the Install button when you hover over its block.And if your new theme is not listed in the WordPress repository, you will need to obtain it in a ZIP format from its vendor. In this example, we are using the ZIP file of the free Hello Elementor theme.After you have the ZIP file, you need to click on the Upload Theme button within the Add Themes page of the WordPress Dashboard.Use the Browse button to locate the ZIP file on your device, or simply drag the file from your device to the Upload Theme section. After that, click on the Install Now button. Your new WordPress theme should now be installed successfully, and all that is left is to activate it by simply clicking on the Activate button:or the Activate link if you uploaded your theme as a ZIP file:Your new theme should now be activated. Installing and activating a WordPress theme with WP-CLI WP-CLI is supported on our servers, and you can use it with all hosting accounts. It basically allows you to use a command-line interface to manage your WordPress websites. For more information about WP-CLI, you can check our WP-CLI Tutorial article. To install and activate a new theme via WP-CLI, you need to follow these steps: Enable SSH access for your account, and connect to it via SSH. Once you have connected to your account via SSH, navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you need to navigate to the ~/www/www directory of your account with the following command:cd ~/www/www If you are trying to install a new theme from the WordPress repository, you will need to find the slug of the theme. For example, the slug of the Hello Elementor theme is hello-elementor, so the WP-CLI command to install and activate this theme will be:wp theme install hello-elementor --activateThe output of the command should look like this:Installing Hello Elementor (2.6.1)Downloading installation package from https://downloads.wordpress.org/theme/hello-elementor.2.6.1.zip...Unpacking the package...Installing the theme...Theme installed successfully.Activating 'hello-elementor'...Success: Switched to 'Hello Elementor' theme.Success: Installed 1 of 1 themes.In case your new theme is not available in the WordPress repository, you should obtain it as a ZIP file from the vendor and upload it to your account. Instructions on how to upload files to your account are available in the Uploading files section of our online documentation. So if you wish to install and activate a theme from a ZIP file named new_theme.zip that is uploaded to the Private directory of the account, you should use the following WP-CLI command:wp theme install ~/private/new_theme.zip --activateYou should see a result like the following:Unpacking the package...Installing the theme...Theme installed successfully.Activating 'new-theme-slug'...Success: Switched to 'New Theme' theme.Success: Installed 1 of 1 themes.If your new theme is already installed and you just want to activate it, you should use the following command and make sure you replace new-theme-slug with the actual slug of the new theme:wp theme activate new-theme-slug That is it. Your new theme has been installed and activated successfully. Installing a WordPress theme by uploading it to your account and activating it This method is the least preferred as different actions have to be performed and that is why it is usually the slowest. To start, you need to: Retrieve the files of the theme from its vendor. Usually, the theme files will be bundled in an archive. Upload the archive containing the theme to the /wp-content/themes directory of your WordPress website in the account. If your website is installed on the main domain, you should upload the archive to the ~/www/www/wp-content/themes directory. You can use the hosting Control Panel > File Manager section or an FTP program. More details on how to upload files to your account can be found in the Uploading files section of our online documentation. Extract the theme files from the archive using the hosting Control Panel > File Manager section. Instructions on how to achieve this are available in our File Manager article. In general, the theme files will be located in a directory with the theme slug. Activate the theme via the WordPress Dashboard or via WP-CLI. How to update a WordPress theme? Updating your active WordPress theme may cause your website to malfunction or even fully crash. For this reason, it is very important that you check your website thoroughly after a theme update and always have a working recent backup of your WordPress installation. Although our automatic backups are generated twice per day and kept for seven days, we strongly recommend that you create a full backup of your WordPress installation right before updating your theme. This way you will have a restore point generated moments before the update, so you will be able to restore the website without any loss of data or information in the event of a problem. You can create backups of your WordPress websites with just a single click via the hosting Control Panel > WordPress Manager as explained in our Creating, downloading, and restoring from WordPress backups article. Some themes may support automatic updates or updates through the WordPress Dashboard which allows for quick and easy updates. Other themes may require manual actions like downloading the latest version of the theme from the vendor, changing custom settings, or uploading the theme manually to your account. In the latter case, you should refer to the official documentation of your theme for instructions on how to update it correctly. Utilizing automatic theme updates There are WordPress themes that support automatic updates. Automatic updates for themes are disabled by default. You can enable them in one of two ways - the WordPress Dashboard or via WP-CLI. Automatic updates are processed twice per day by default, and you will see how much time is left before the automatic update will be processed for a theme next to it in the WordPress Dashboard > Updates section. After a theme has been updated automatically, an email message will be sent to the website owners about the event. To enable automatic updates for a theme via the WordPress Dashboard, you need to: Log in to your WordPress Dashboard. Navigate to the Appearance > Themes section. Click on the block of the theme that you wish to update to view its details. Click on the "Enable auto-updates" link. The theme will be updated automatically from now on. You should follow these steps to enable automatic updates for a WordPress theme via WP-CLI: Enable SSH access for your account, and connect to it via SSH. After you connect to your account via SSH, go to the directory of your WordPress installation. For example, you will need to go to the ~/www/www directory of your account if WordPress is installed on your main domain by using this command:cd ~/www/www Execute the following WP-CLI command to enable automatic updates for your active theme:wp theme auto-updates enable $(wp theme list --status=active --field=name)If you wish to enable automatic updates for all themes installed on your WordPress website, you can use the following WP-CLI command:wp theme auto-updates enable --all --disabled-only You have successfully enabled automatic updates for your WordPress theme/s. Updating a theme through the WordPress Dashboard Themes can be updated through the WordPress Dashboard after logging in as an administrator and going to the Updates section: In the Themes section, select the theme/s that you wish to update, and click on the Update Themes button: Alternatively, you can update a theme from the Appearance > Themes section of the WordPress Dashboard by clicking on the Update now link from the New version available notice of the theme with an available update: Updating a theme with WP-CLI Updating a theme with WP-CLI is very quick. All you need to do is: Enable SSH access for your account, and establish connection to it via SSH. After connecting, go to the directory of your WordPress installation. Let's say WordPress is installed on your main domain, so you will need to go to the ~/www/www directory of your account by using this command:cd ~/www/www You can update your active theme with the following WP-CLI command:wp theme update $(wp theme list --status=active --field=name)To update all themes with pending updates, you can use this WP-CLI command:wp theme update --all Your WordPress theme/s should be updated now. Updating a theme via the File Manager or FTP The process of updating a theme via the File Manager or FTP requires that you replace the directory (and files) of the outdated version of the theme with the directory (and files) of the latest version of the theme. So, the process is almost the same as installing a new theme, which is covered in the Installing a WordPress theme by uploading it to your account and activating it section of this article. The only difference is that you will need to choose whether you wish to remove the contents of the outdated theme from the account, or upload the latest version of the theme and overwrite any existing files. How to disable a WordPress theme? To disable a WordPress theme, you simply have to set another theme as active for your website. More instructions on the process of installing and activating a theme are available in the How to install a WordPress theme? section of this article. Note: We recommend that you delete any themes which you do not plan to use as third parties may be able to exploit vulnerabilities of both enabled and disabled themes and plugins. How to delete a WordPress theme? If you need to delete a theme from your WordPress website, this can be achieved in one of three ways: through the WordPress Dashboard, using WP-CLI, or by deleting the theme's folder from your account. In general, you should not have more than two themes (three if you use a child theme) installed on the account at all times. Your main (and child) theme, and one default WordPress theme that will be used as a fallback option in case of issues with your main (and child) theme. Deleting a theme through the WordPress Dashboard To delete a theme with the WordPress Dashboard, you need to log in as an administrator to your WordPress website. After that, you should navigate to the Appearance > Themes section and click on the block of the theme that you wish to delete: Click on the Delete button that will be visible in the box showing details about the theme: A prompt will appear asking you to confirm your action. Click on the OK button, and the theme will be deleted. Note: The active theme of a WordPress website cannot be deleted via the Dashboard. Deleting a theme using WP-CLI The deletion of themes takes just four steps when using WP-CLI: Enable SSH access for your account, and connect to it via SSH. Go to the directory of your WordPress installation. If WordPress is installed on your main domain, you will need to navigate to the ~/www/www directory of your account. You can do this with the following command:cd ~/www/www To delete all inactive (and non-parent) themes from your WordPress website, you can use the following WP-CLI command:wp theme delete --allIf you wish to delete just a specific theme (e.g. a theme with slug unused_theme), execute this WP-CLI command:wp theme delete unused_themeYou can find the slugs of the themes installed on your WordPress website with the following WP-CLI command:wp theme list Note: WP-CLI can be used with the --force option to delete themes that cannot be deleted by default or for some other reason. Please use this option with care as you may potentially break your website with it. Deleting a theme via the File Manager or FTP Important: This method should be used only if you are very familiar with the WordPress directory/file structure. With this method, you can delete your active (or parent) theme which will result in downtime of your website. If you still wish to give this method a try, we recommend that you create a WordPress backup of your website beforehand via the hosting Control Panel > WordPress Manager as explained our Creating, downloading, and restoring from WordPress backups article. To delete a theme via the hosting Control Panel > File Manager section or FTP, you have to delete the theme's directory from the /wp-content/themes directory of your WordPress website in the account. If WordPress is installed on the main domain of your account, you will find your themes in the ~/www/www/wp-content/themes directory. Navigate to that directory using the File Manager section or your FTP program, and delete the directory. Details on how to connect to your account via FTP are available in the Uploading files section of our online documentation. How to use a child theme in WordPress? A child theme in WordPress is essentially your own version of another (parent) theme. You can define and use custom elements like stylesheets, functions, and scripts in your child theme, but at the same time, the child theme will inherit the parent theme's look, feel, and functionality. The best thing about using a child theme is that all of its custom elements will remain intact if the parent theme is updated. If you were to make changes to the files of the parent (original) theme, they would be lost upon update. Depending on the (parent) theme that you are using on your WordPress website, you should refer to its documentation for instructions on configuring a child theme. By default, you can create a new child theme by simply creating a new directory for it using the hosting Control Panel > File Manager section or an FTP client. The recommended naming pattern for child themes is to have the slug/directory name of the parent theme (e.g. twentytwentythree) appended with the "-child" string (e.g. twentytwentythree-child). You should create the directory in the /wp-content/themes directory of your WordPress website in the account, so for a WordPress installation on the main domain of your account, you should create the directory at ~/www/www/wp-content/themes. For the child theme to work correctly and be recognized by WordPress, you need to create a styles.css file in its directory (e.g. ~/www/www/wp-content/themes/twentytwentythree-child/styles.css) with the following content: /*Template: twentytwentyone*/The Template definition is required as it indicates the slug/directory name of the parent theme, but you may add other definitions as necessary. To get your theme to use the default stylesheet of the parent theme, you will need to use the enqueue technique. If you would like to learn more about it and child themes in general, we would recommend that you check the official WordPress Child Themes article. After you are ready with the changes to your child theme, you have to activate it via the WordPress Dashboard or via WP-CLI. How to secure a WordPress theme? Free and commercial WordPress themes are generally secure. In case any vulnerability is found for a theme and reported in the WordPress community, the developers of the theme are informed, and it is up to them to release a new version of the theme where the vulnerability has been fixed. Commercial themes are usually less likely to get affected by such issues or exploits as their source code is not publicly available; however, that is not always the case. When it comes to the security of a WordPress theme, be it free or commercial, there are two major factors: 1. Obtaining your WordPress theme from a legitimate source You should always obtain WordPress themes from official vendors or reputable sources. If you are interested in using a free theme on your WordPress website, you should obtain it from the WordPress theme repository. Commercial themes should be purchased and downloaded ONLY from their vendor or official resellers. There are many leaked or pirated versions of both free and commercial themes; however, they often come at a high cost - malware or malicious code injected in the core files of the theme. Of course, this allows the bad actors to access all your website data (including all files of your hosting account) and use your account to perform malicious activities (like attacking third-party websites or networks and sending spam messages). 2. Updating and maintaining your WordPress themes regularly The best way to keep your WordPress installation and themes protected is to perform updates regularly. Newer versions usually offer security, stability, and performance improvements as well as new features. You can find how to update your themes in the How to update a WordPress theme? section of this article. In general, you should have just one or two themes installed on the website. If you are using a default WordPress theme, you should keep only this theme installed on your website and remove all other themes. In case you use a non-default WordPress theme, you should keep the non-default and one default WordPress theme installed on your website. Having a default WordPress theme installed is recommended as it will be used as a fallback option if a major problem occurs with your active theme.

In this article, you can find the following information about WordPress plugins: What is a WordPress plugin? How to find WordPress plugins? How to install and activate a WordPress plugin? Installing and activating a WordPress plugin via the Dashboard Activating a WordPress plugin via the Dashboard Installing and activating a WordPress plugin with WP-CLI Activating a WordPress plugin with WP-CLI Installing a WordPress plugin by uploading it to your account and activating it Where to find all plugins already installed on WordPress? How to update a WordPress plugin? Utilizing automatic plugin updates Updating plugins via the hosting Control Panel > WordPress Manager Updating a plugin through the WordPress Dashboard Updating a plugin with WP-CLI Updating a plugin via the File Manager or FTP How to downgrade a WordPress plugin? Downgrading a plugin through the WordPress Dashboard Downgrading a plugin with WP-CLI Downgrading a plugin via the File Manager or FTP How to deactivate a WordPress plugin? Deactivating a plugin through the WordPress Dashboard Deactivating a plugin using WP-CLI Deactivating all plugins via the hosting Control Panel > WordPress Manager How to delete a WordPress plugin? Deleting a plugin through the WordPress Dashboard Deleting a plugin using WP-CLI Deleting a plugin via the File Manager or FTP How to perform bulk actions with plugins? What are must-use plugins? How to handle issues with a WordPress plugin? How to secure a WordPress plugin? What is a WordPress plugin? WordPress plugins are essentially script bundles that add or remove functionality to a WordPress installation. Some plugins allow you to disable or modify existing functions and features of a WordPress installation, while others allow you to add new features or functions. You can convert your WordPress installation to a forum, install a WYSIWYG website builder to build a complex website very easily, or add custom forms. There are plugins available for almost everything you can imagine. The best thing about plugins is that you can have multiple plugins active at once, so you can add complexity to your website and add or remove features whenever you want. Of course, when you add more plugins, you should ensure that the plugins you use are compatible with each other, your theme, and the version of WordPress used on your website. If you encounter compatibility issues, you can always report them to the developers of the plugin/s and theme, so they can release an updated version where the issues are resolved. How to find a WordPress plugin? There are tens of thousands of freely available plugins for activation directly via the WordPress Dashboard. You can also download these plugins from the WordPress plugin repository. There are also commercial plugins which can be obtained through the websites of their vendors or through plugin-selling websites. If you need a feature that is not already available or supported by a plugin, you can always hire a plugin developer to create it for you. When considering a plugin for your WordPress website, you should also check if the plugin is updated regularly, and if assistance is offered by its developers, support team, or community. Plugins without regular updates are very likely to stop working due to compatibility issues with newer versions of your WordPress core, theme, or other plugins. This is also why the developers and community of the plugin are important as they may offer solutions to all kinds of problems that you may encounter while using the plugin. You can also seek help from the official WordPress community; however, communities of the specific plugin should be more knowledgeable and capable of helping you with issues related to that plugin. How to install and activate a WordPress plugin? You can install plugins on your website in one of three ways - through the WordPress Dashboard, using the WordPress command-line interface - WP-CLI, or by manually uploading them to the account. After a plugin is installed, it can be activated only via the WordPress Dashboard or WP-CLI. Please note that additional steps may be required for the proper installation or activation of some plugins, like adding files, installing extra plugins, or purchasing a license. You should refer to the official instructions of the plugin that you wish to use on your website for more information. A staging instance can be used to install and test new plugins on an existing WordPress website. You can find more details on how to set up a staging instance of your existing WordPress website via the hosting Control Panel in our Creating and using WordPress staging sites article. Installing and activating a WordPress plugin via the Dashboard The easiest way to install a new plugin is via the WordPress Dashboard. All you need to do is log in to your WordPress Dashboard (you can access it by adding "/wp-admin" to your website's URL - for example, http://your_domain.com/wp-admin) or use the "Log in" feature available in the hosting Control Panel > WordPress Manager as explained in our Managing WordPress administrators article. Once you have logged in, go to the Plugins > Add New section.There will be two installation options available depending on whether your new plugin is listed in the public WordPress repository or not. If the plugin is available in the WordPress plugin repository, you can use the search field in the WordPress Dashboard:After you find the plugin that you wish to install, hover over its block, and use the Install Now button.You can use the More Details button to view more details about the plugin, which will basically open the plugin's page from the WordPress repository in a pop-up window within the WordPress Dashboard. There you will also find an Install Now button that you can use to install the plugin.In case the plugin that you wish to install is not present in the WordPress repository, you will need to obtain it in a ZIP format from its vendor. In the below example, we are using the ZIP file of the free Elementor Website Builder plugin.Once you have the ZIP file of the plugin that you wish to install, click on the Upload Plugin button within the Add Plugins page of the WordPress Dashboard, and an upload form will be displayed.Click on the Browse button, and locate the ZIP file on your device, or just drag the file from your device to the Upload Plugin form. Once the file is selected/detected, all you have to do is click on the Install Now button. Your new WordPress plugin should now be installed successfully, and all that is left is to activate it by simply clicking on the Activate button:If you installed the plugin via a ZIP file, you can use the Activate Plugin button from the screen that indicates the installation of the plugin was successful:You can also activate installed plugins from the WordPress Dashboard > Plugins > Installed Plugins section:After the plugin is activated, you should see a message that the activation was successful: Installing and activating a WordPress plugin with WP-CLI The Command Line Interface for WordPress (WP-CLI) is supported on our servers by default for all hosting accounts. It provides the ability to use a command-line interface for the management of WordPress websites. You can find some information about WP-CLI in our WP-CLI Tutorial. Installing and activating a plugin using WP-CLI is actually very easy. All you need to do is follow these steps: Enable SSH access for your account, and connect to it via SSH. Once connected to your account via SSH, navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you need to navigate to the ~/www/www directory of your account with the following command:cd ~/www/www If you want to install a plugin that is available in the WordPress repository, you should find the slug of the plugin. For example, the slug of the Elementor Website Builder plugin is elementor, so to install and activate this plugin via WP-CLI, you should use this command:wp plugin install elementor --activateThe output of the command should look like this:Installing Elementor Website Builder (3.8.1)Downloading installation package from https://downloads.wordpress.org/plugin/elementor.3.8.1.zip...Unpacking the package...Installing the plugin...Plugin installed successfully.Activating 'elementor'...Plugin 'elementor' activated.Success: Installed 1 of 1 plugins.If you wish to install and activate a plugin that is not available in the WordPress repository, you will have to obtain it as a ZIP file from its vendor and upload that ZIP file to your account. You can find instructions on how to upload files to your account in the Uploading files section of our online documentation. For example, if you have a plugin as a ZIP file named new_plugin.zip that is uploaded to the Private directory of the account, you should use the following WP-CLI command to install and activate that plugin:wp plugin install ~/private/new_plugin.zip --activateYou should see a result like the following:Unpacking the package...Installing the plugin...Plugin installed successfully.Activating 'new_plugin-slug'...Plugin 'new_plugin-slug' activated.Success: Installed 1 of 1 plugins.If you have already installed the plugin and only wish to activate it, execute the following command, and ensure that you replace new-plugin-slug with the actual slug of the new plugin:wp plugin activate new-plugin-slug You have successfully installed and activated the plugin. Installing a WordPress plugin by uploading it to your account and activating it The methods listed so far were very easy to follow and use as they allow you to install plugins with the WordPress built-in plugin wizard or a single command via WP-CLI. The next method is more cumbersome as it requires manually downloading the plugin to your device, manually uploading it to your hosting account, and activating it via the WordPress built-in plugin wizard or WP-CLI. To use this manual approach, you should: Obtain the files of the plugin from its vendor, which should be compressed into one .ZIP archive file. Get the archive containing the plugin files in the /wp-content/plugins directory of your WordPress website in the account. For example, you will need to upload the archive to the ~/www/www/wp-content/plugins directory if your website is on the main domain of your account. You can do this with the hosting Control Panel > File Manager section or an FTP program. Step-by-step instructions on the process of uploading files to your account are available in the Uploading files section of our online documentation. After the plugin archive is uploaded, decompress the archive using the hosting Control Panel > File Manager section by following the instructions from our File Manager article. By default, the plugin files will be located in a directory with the plugin slug, and it is recommended to keep that structure for maintenance reasons. For example, if your plugin's slug is new-plugin-slug, the plugin's files should be in the ~/www/www/wp-content/plugins/new-plugin-slug directory of the account. Finally, you will have to activate the plugin. You can do this via the WordPress Dashboard or via WP-CLI. Where to find all plugins already installed on WordPress? You can find a list of all installed plugins on your WordPress website in the WordPress Dashboard, using WP-CLI, or by checking the wp-content/plugins folder. The list of installed plugins in the WordPress Dashboard can be found within the Plugins > Installed Plugins section.Using WP-CLI, you can retrieve a list of all plugins installed on your WordPress website by following these steps: Enable SSH access for your account, and connect to it through SSH. Go to the directory where your WordPress installation resides. If you have WordPress installed on your main domain, you need to go to the ~/www/www directory of your account, and the command that you should use is:cd ~/www/www Use the following WP-CLI command to have a list of all installed plugins displayed in the command line interface:wp plugin list The last way to find a list of all plugins installed in your account is to check the contents of the wp-content/plugins/ directory of WordPress (e.g. the exact directory will be ~/www/www/wp-content/plugins if WordPress is installed on your main domain). You can use the hosting Control Panel > File Manager section or your favorite FTP/SSH client to do this. More details on how to use the File Manager or how to connect via FTP are available in the Uploading files section of our online documentation. Note: Plugins that are essential for the operation of your WordPress website (e.g. plugins that came bundled with your theme or another plugin) are known as "Must-use" plugins. It is recommended that you do not delete/deactivate these plugins as your website may stop working correctly. You can learn more about this type of plugins in the What are must-use plugins? section of this article. How to update a WordPress plugin? It is important to keep all software applications installed on your account up to date as new versions usually include performance, security, or other improvements. However, you should always keep in mind that with every update the source code of the plugin is changing, so your website may start displaying warnings, errors, or even stop working altogether due to the changes. That is why we strongly recommend that you have a backup of your working WordPress installation before applying updates, and that you check your website for issues after updating any plugins. We generate full account backups automatically twice per day and keep them for seven days, which should have you covered in most cases. To be extra safe and make sure there is minimal data loss should an update cause any problems, we would advise that you create a personal backup right before you process the update. In our Creating, downloading, and restoring from WordPress backups article, you can find instructions on how to create and restore from WordPress backups very quickly through the hosting Control Panel. With commercial or custom-built plugins, you may be required to perform manual actions to perform updates (like installing additional plugins, downloading the latest version of the plugin from the vendor's website and installing it, or making changes to your WordPress core files, theme, or other plugins). There are many commercial plugins which also support updates via the Updates section or the plugin's page within the WordPress Dashboard. For such plugins, you should refer to the vendor's manual on how to apply updates correctly. Utilizing automatic plugin updates Automatic updates are supported by a lot of WordPress plugins, which is very convenient, but it can also result in unexpected website downtime, and that is why this feature is disabled by default. Automatic updates can be enabled via the WordPress Dashboard and WP-CLI. WordPress will check for new versions of automatic updates two times per day by default. If an update is available for a plugin with enabled automatic updates, you will be able to see the time left before the plug gets updated automatically within the WordPress Dashboard > Plugins section in the Automatic Updates column. Upon completion of the automatic update, the WordPress installation will generate an email message and send it to all website owners.One way to enable the automatic updates for a plugin is through the WordPress Dashboard by following these steps: Access your WordPress Dashboard. Go to the Plugins > Installed Plugins section. Click on the "Enable auto-updates" link next to the plugin that you wish to update automatically. WordPress will try to automatically update the plugin. You can also enable automatic updates for a WordPress plugin using WP-CLI. Here is how to do it: Enable SSH access for your account, and connect to it via SSH. Once connected, go to the directory of your WordPress installation. You should go to the ~/www/www directory of your account if you have installed WordPress on your main domain. To do this, use the following command:cd ~/www/www In the directory of your WordPress directory, run the following WP-CLI command to enable automatic updates for all activated plugins:wp plugin auto-updates enable $(wp plugin list --status=active --field=name)If you wish to enable automatic updates for all plugins installed on your WordPress website, you can use the following WP-CLI command:wp plugin auto-updates enable --all --disabled-only You have successfully enabled automatic updates for your WordPress plugin/s. Updating plugins via the hosting Control Panel > WordPress Manager By opening the management page for a particular WordPress website via the hosting Control Panel > WordPress Manager, you can see if the WordPress core and plugins are running the latest available versions. If updates are available for some plugins, a link showing the exact number of outdated plugins will be listed. By clicking on the link with the number of plugins that can be updated, a table will appear showing the names of the outdated plugins and their current and latest versions. To update these plugins, just click on the Update button on the right. In case all plugins are up to date, an  (OK) icon will be displayed alongside a message that all of your plugins are running the latest available version. Note: The WordPress Manager relies on WP-CLI to determine if a newer version is available for a plugin, so the update feature may not work correctly for some commercial plugins. Updating a plugin through the WordPress Dashboard The preferred way to update plugins is through the WordPress Dashboard > Updates section: There you can find all elements of your WordPress website with pending updates. Under the Plugins section, you can select the outdated plugins that you would like to update. After that, click on the Update Plugins button:Alternatively, you can update plugins one by one from the Plugins > Installed Plugins section of the WordPress Dashboard by using the update now link within the plugin's information box: After the updates are ready, you should see a success message like the following if you used the Dashboard > Updates section:or the following message if you updated a plugin through the Plugins > Installed Plugins section: Updating a plugin with WP-CLI If you wish to update a WordPress plugin using WP-CLI, there are just a few simple steps that you need to take: Enable SSH access for your account, and establish connection to it via SSH. Once logged into your account via SSH, you need to navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you will need to navigate to the ~/www/www directory of your account by using this command:cd ~/www/www To update all plugins with pending updates, you can use this WP-CLI command:wp plugin update --allIf you wish to update only your active plugins, you can do it with the following WP-CLI command:wp plugin update $(wp plugin list --status=active --field=name)To update just a specific plugin, you will need to find its slug, which is possible by listing all outdated plugins installed on your WordPress website with this command:wp plugin list --update=available --field=nameFor example, the output from the command should look like this if there is only one outdated plugin named Elementor (with slug elementor):elementorUsing the slug of the plugin (e.g. elementor for the Elementor plugin), you can update it with the following command:wp plugin update elementorNote: Make sure to replace the elementor string from the example above with the slug of the plugin that you wish to update.If the newer version of a plugin is not available in the WordPress repository (e.g. a commercial plugin), but it was provided to you as a ZIP file from the plugin developer or vendor, you will need to upload that file to your account. Instructions on how to upload files to your account are available in the Uploading files section of our online documentation. If the newer version of the plugin is in a new_plugin.zip archive file that you have uploaded to the Private directory of the account, you can update the plugin with the following WP-CLI command:wp plugin install ~/private/new_plugin.zip --force A message should be displayed indicating the result of the update process. Updating a plugin via the File Manager or FTP To have a plugin updated through the File Manager or FTP, you should replace the directory (and files) of the outdated version of the plugin with the directory (and files) of the latest version of the plugin. This means that updating a plugin is basically identical to installing a new plugin, which is covered in the Installing a WordPress plugin by uploading it to your account and activating it section of this article. The only differences are that you will not need to activate the plugin after the update (for WP-CLI, you will have to remove the --activate string from the command), and that you will need to remove the contents of the outdated plugin from the account prior to the update or just upload the latest version of the plugin and overwrite the existing files of the outdated plugin with the files of the newer version of the plugin. How to downgrade a WordPress plugin? Using outdated software is not advisable due to performance, compatibility, and security concerns, so you should downgrade a plugin to an older version ONLY if: Your WordPress website or some of its vital functions or features stopped working after a plugin update. You have reported the problem to the vendor or developer of the software application, so they can release a new version of the plugin where the problem is addressed. You have checked all possible sources that may be able to offer a permanent or temporary solution to the problem without downgrading the plugin - the vendor/developers/community of the plugin, the WordPress forums, or other communities that could potentially have information, like WordPress Stack Exchange. If the latest version of a plugin causes only minor issues like PHP warnings in the WordPress Dashboard, you can ignore them if they do not cause any inconvenience to your website audience. If any PHP warnings, for example, are displayed on your website, you can disable the reporting of errors for PHP scripts via the hosting Control Panel > PHP Settings section. Downgrading a plugin via the WordPress Dashboard The process of downgrading a plugin via the WordPress Dashboard is almost identical to the process of Manually installing a plugin via the WordPress Dashboard described earlier in this article. The only difference is that an extra screen will be displayed with information about the current version and the uploaded older version of the plugin. To downgrade the plugin from the currently installed version to the uploaded older version, you just need to click on the Replace current with uploaded button. After the old version of the plugin is installed, you have to activate it by clicking on the Activate Plugin button. Downgrading a plugin via WP-CLI Downgrading a WordPress plugin using WP-CLI is very easy and uses the wp plugin install command. Just follow these steps: Enable SSH access for your account, and connect to it via SSH. After you log into your account via SSH, navigate to the directory of your WordPress installation. If WordPress is installed on your main domain, you will need to navigate to the ~/www/www directory of your account by using this command:cd ~/www/www Use the following WP-CLI command to downgrade a plugin (e.g. with slug elementor) to a specific version (e.g. version 3.8.1):wp plugin install elementor --version=3.8.1 --forceNote: You will need to replace the elementor string and the version number from the example above with the slug and version number of the plugin that you wish to downgrade. The --force option is mandatory as the command will return a message that the plugin is already installed without it and the downgrade will not take place. If the old version of the plugin is not available in the WordPress repository (if you have to downgrade a commercial plugin, for example), but you have obtained it as a ZIP file from the plugin developer or vendor, you will need to upload that file to your account. You can find instructions on how to upload files to your account in the Uploading files section of our online documentation. If the old version of the plugin is in an archive named old_plugin_version.zip that you have uploaded to the Private directory of the account, you can downgrade the plugin with the following WP-CLI command:wp plugin install ~/private/old_plugin_version.zip --force After the command is executed, a message indicating the result of the downgrade process will be displayed. Downgrading a plugin via the File Manager or FTP You can downgrade a plugin via the hosting Control Panel > File Manager or FTP by replacing the files of the installed plugin with the files of the older version of the plugin. To achieve this, you basically have to install the older version of the plugin, which is covered in the Installing a WordPress plugin by uploading it to your account and activating it section of this article. The only difference between downgrading a plugin and installing a new one will be that, as part of the downgrading process, you should delete or overwrite the files of the currently installed version. Since the plugin should already be activated, it will not be necessary to activate it after the downgrade. How to deactivate a WordPress plugin? We strongly recommend that you delete all deactivated plugins from your WordPress website. This is important as bad actors can use vulnerabilities of both activated and deacticated themes and plugins to abuse your website and account. You can find instructions on how to delete a plugin in the How to delete a WordPress plugin? section of this article. Important: Since some plugins modify core files or functions of WordPress, they can continue to affect your WordPress installation even after they are deactivated. For this reason, you should always try to disable all features of the plugins that you plan to deactivate within their management page inside the WordPress Dashboard before deactivating the plugins. You should also consider removing any data generated by the plugins (depending on the plugin, this could be forms, pages, contacts, etc.) within their management page within the WordPress Dashboard to have these entries removed from your database, as otherwise these entries will remain in your database forever as obsolete records. Deactivating a plugin through the WordPress Dashboard To deactivate a WordPress plugin, you can go to the Plugins > Installed Plugins section of the WordPress Dashboard and click on the Deactivate link.After that you should see a notification indicating that the plugin has been deactivated successfully. Deactivating a plugin using WP-CLI Another way to deactivate a plugin is via WP-CLI by following these steps: Enable SSH access for your account, and connect to it through SSH. Go to the directory where your WordPress installation resides. If you have WordPress installed on your main domain, you need to go to the ~/www/www directory of your account, and the command that you should use is:cd ~/www/www In case you want to deactivate just a single plugin (e.g. a plugin with slug unused_plugin_slug), you should use the WP-CLI command listed below:wp plugin deactivate old-plugin-slugIf you do not know the exact slug of a plugin, you can use the following command to retrieve a list of all plugins installed on your WordPress website:wp plugin list Deactivating all plugins via the hosting Control Panel > WordPress Manager Should you need to deactivate all plugins for your WordPress website, the fastest way to do this is via the hosting Control Panel > WordPress Manager. Detailed instructions on the process are available in our Disabling all WordPress plugins article. How to delete a WordPress plugin? If you need to delete a plugin from your WordPress website, this can be achieved in one of three ways: through the WordPress Dashboard, using WP-CLI, or by deleting the plugin's folder from your account. We strongly recommend that you delete all plugins that you do not use or do not intend to use. Important: Some plugins modify existing or add new files to your WordPress installation that are outside the plugin's folder. Some of the most commonly changed files are the .htaccess, wp-config.php, php.ini, or .user.ini files in the root WordPress folder (e.g. the ~/www/www folder of your account if WordPress is installed on your main domain). If new files are created by the plugins, they are also usually stored in the root folder of WordPress. After you delete or disable such plugins, it is possible that they will not perform a full cleanup, and the changed or created files may remain, and may cause your website to stop working at that moment or at a later stage without there being any obvious reason. It is also possible for plugins to leave obsolete records in your database after being deleted or deactivated. You should be able to find information about such issues and how to fix them in the official documentation or community forums of the specific plugin. Alternatively, you can simply disable all settings and features of the plugin as explained earlier in the How to deactivate a WordPress plugin? section of this article. Deleting a plugin through the WordPress Dashboard To delete a plugin using the WordPress Dashboard, you need to log in as an administrator to your WordPress website. After that, you should navigate to the Plugins > Installed Plugins section and click on the Delete link below the name of the plugin you wish to delete. Note: The Delete link is displayed only for deactivated plugins, so if you do not see the Delete link, you should first deactivate the plugin. A prompt will appear asking you to confirm your action. Click on the OK button, and the plugin will be deleted. Deleting a plugin using WP-CLI You can delete plugins using WP-CLI by following these simple steps: Enable SSH access for your account, and connect to it via SSH. Navigate your WordPress installation's directory. This will be the ~/www/www directory of your account if WordPress is installed on your main domain. You can navigate to this folder using this command:cd ~/www/www If you wish to delete all disabled/deactivated plugins from your WordPress website, you can use the following WP-CLI command:wp plugin delete $(wp plugin list --status=inactive --field=name)In case you want to delete just a single plugin (e.g. a plugin with slug unused_plugin_slug), you should use the WP-CLI command listed below:wp plugin delete unused_plugin_slugYou can find the slugs of the plugins installed on your WordPress website with the following WP-CLI command:wp plugin list Note: WP-CLI can be used with the --force option to delete plugins that cannot be deleted by default or for some other reason. Please use this option with care as you may potentially break your website with it. Deleting a plugin via the File Manager or FTP Important: You should use this method only if you are very familiar with the WordPress directory/file structure as deleting plugins this way is very likely to result in errors on your website or even downtime. We recommend that you create a WordPress backup of your website via the hosting Control Panel > WordPress Manager as explained our Creating, downloading, and restoring from WordPress backups article if you plan to use this method. You can delete a plugin via the hosting Control Panel > File Manager section, or via FTP by deleting its directory from the /wp-content/plugins directory of your WordPress website in the account. If WordPress is installed on the main domain of your account, you will find the plugins in the ~/www/www/wp-content/plugins directory. Go to that directory with the File Manager section or your FTP program of choice, and delete the directory. Details on how to connect to your account via FTP are available in the Uploading files section of our online documentation. After deleting a plugin this way, the first time you open the WordPress Dashboard > Plugins > Installed Plugins section a notice will be displayed indicating that the plugin files cannot be found: How to perform bulk actions with plugins? You can use the Plugins > Installed Plugins section of the WordPress Dashboard to manage all or select plugins quite easily. Just mark the checkboxes next to the plugins that you wish to manage, choose the action that you wish to perform from the Bulk actions drop-down menu, and click on the Apply button next to it. You can mark the topmost checkbox to select all plugins. The Bulk actions drop-down menu allows you to perform the following actions for the selected plugins: Activate Deactivate Update Delete Enable Auto-updates Disable Auto-updates WP-CLI can also be used to perform actions for multiple or all plugins at once. To perform actions for all installed plugins, simply add the --all option to the WP-CLI command. For example, to deactivate all installed plugins, you can execute this command:wp plugin deactivate --allTo perform an action for multiple plugins at once, you have to list the slugs of the plugins one after the other. If you wish to deactivate the Elementor plugin (with slug elementor) and the Akismet plugin (with slug akismet), you have to execute the following WP-CLI command:wp plugin deactivate elementor akismet What are must-use plugins? If one or multiple plugins are essential for the operation of a WordPress website, theme, or another plugin, it is best they be configured as must-use WordPress plugins. "Must-use" plugins are always enabled and cannot be managed via the WordPress Dashboard > Plugins > Installed Plugins section. The must-use plugins reside in a special directory (by default, the directory is wp-content/mu-plugins within the root directory of your WordPress website), and they will be displayed with Status mu-plugin in the plugin list that can be obtained with WP-CLI. The best way to update such plugins is by updating the theme or plugin they were installed with and that relies on them. Alternatively, you can manually update them via the hosting Control Panel > File Manager section or FTP, but this may cause your website to return errors or stop working correctly. Please check the official article on Must Use Plugins at WordPress.org to learn more about their benefits and specifics. Note: We recommended that you do not delete/deactivate "Must Use" plugins for your WordPress website as it may stop working correctly. How to handle issues with a WordPress plugin? A plugin that you have been using on your WordPress website can stop working partially or fully for many reasons, and it may even break your website. Most often this happens due to compatibility issues after an update of the WordPress core, the active theme, or the plugin in question. It is also possible for a plugin to stop working correctly due to compatibility issues after a new plugin is installed or another one gets updated. This is especially true after WordPress 5.6 where the automatic core updates policy has changed from performing only minor version updates to both minor and major version updates. Important: The best defense against plugin issues is to always keep the WordPress core, the active theme, and all installed plugins updated to the latest version as this is one of the main reasons newer versions are usually released. If you can determine which plugin is causing problems, you can try to deactivate it and activate it again, or you can try to re-install it to see if this will resolve the problem. More details on how to perform these actions are available in the How to deactivate a WordPress plugin?, How to delete a WordPress plugin?, and How to install and activate a WordPress plugin? sections from this article. If the issues appeared after a recent plugin update, you can downgrade the plugin to a previous version by following the steps listed in the How to downgrade a WordPress plugin? section from this article. It is not always possible to find which plugin or combination of plugins is causing problems, so you can temporarily disable all plugins using the hosting Control Panel > WordPress Manager and start enabling them one by one to find the faulty plugin/s. This solution can also be used if you are having problems accessing the WordPress Dashboard after a recent plugin update. If the problem remains after trying the aforementioned methods, you can try to restore your website from a WordPress backup or restore your website files and database from a system backup. We would strongly recommend that you create a manual WordPress backup via the hosting Control Panel > WordPress Manager just in case something else goes wrong. More information about using the backups created through the WordPress Manager are available in our Creating, downloading, and restoring from WordPress backups article. You can reach out to the community, support team, or developers of the plugin for advice on how to solve the particular problem you encounter. They should have sufficient knowledge about the plugin. You can also search for help in the WordPress community, but assistance may be limited there especially for plugin-specific issues. How to secure a WordPress plugin? Both free and commercial WordPress plugins are generally secure as their developers are informed if a vulnerability is found and reported in the WordPress community. However, it is up to the developers to release new versions of their plugins in such events. In general, it is less likely for commercial plugins to get affected as their source code is not publicly available. To ensure that your plugins are not potential security hazards for your WordPress installation and account, you should always: 1. Get your WordPress plugins from a legitimate source Free plugins are publicly available in the WordPress plugin repository, and can be downloaded and installed very easily. Commercial plugins should be purchased and downloaded ONLY from their official vendors or resellers. This way you will get the latest and non-modified versions of the plugins as intended by their authors. Many leaked or pirated versions of both free and commercial plugins can be found online, and almost always they contain malware or malicious code that allows unauthorized access to the files and databases of your website and hosting account. With such access, the bad actors can retrieve private information from your website and account for blackmailing purposes or use your website and account for other malicious intents like hosting of phishing websites, sending spam messages, or attacking/scanning remote websites and networks. 2. Regularly update and maintain your WordPress plugins The second most important measure you can take is to regularly update all plugins installed on your WordPress website. Plugin authors usually try to release new versions to introduce new features, but the most common reasons for releasing a new version are security, stability, and/or performance improvements. It is a common practice for WordPress administrators to only update the enabled plugins on their website; however, disabled plugins should also be updated regularly as the files of all installed plugins (no matter enabled or disabled) exist on the server, and they can be used as an attack vector by third parties. Detailed instructions on the process of updating your plugins are available in the How to update a WordPress plugin? section of this article.

System backups are created automatically every day for all hosting accounts and kept for at least seven days on our servers; however, we would recommend that you always create manual backups before making any major changes to your WordPress websites. The management page of a WordPress installation in the hosting Control Panel's WordPress Manager allows you to easily create, download, delete, and restore from WordPress backups via the Backup section. More details about the information and features of the section are available in our WordPress Manager article. Note: WordPress Manager will create temporary backups automatically when you perform actions through it that may cause your website to stop working correctly or at all. The automatic backups will remain on the server for seven days, and you can see when exactly they expire by clicking on the  (Warning) icon next to the backup's creation date in the management page of the WordPress installation.All backups generated from the WordPress Manager section can be found in the wp_backups directory of your account's Private directory, so they are only accessible via FTP/SSH or the hosting Control Panel > File Manager section. Creating a WordPress backup To manually create a WordPress backup, all you need to do is: Go to the hosting Control Panel's WordPress Manager section. Find the desired WordPress installation in the list, and click on the Manage button next to it. This will take you to the management page for the WordPress installation. In the Backup section, click on the Backup now button at the bottom to create a new backup. Downloading, deleting, or restoring from a WordPress backup To download, delete, or restore from a WordPress backup on your account, follow these steps: Navigate to the WordPress Manager section of the hosting Control Panel. Click on the Manage button next to the WordPress installation associated with the backup. In the Backup section, use the Download, Delete, or Restore buttons next to a specific backup to download, delete, or restore your WordPress installation from that backup. If you wish to delete all backups for the particular WordPress installation, use the Delete аll button. You can also manually download backups created through the hosting Control Panel's WordPress Manager section directly from the ~/private/wp-backups/ directory of your account. Restoring from an off-site WordPress backup If you have created a backup of a WordPress installation through WordPress Manager and have downloaded it to an off-site location, you can use that backup to restore your website. You can also copy or move WordPress installations between hosting accounts on our servers by simply downloading the backup from one account and importing it to another account. Here are the exact steps that you need to take: Go to the hosting Control Panel > WordPress Manager. Click on the Manage button for the specific WordPress installation that you would like to restore. From the WordPress management page, click on the Delete button. This step is necessary as the WordPress Manager will not allow you to import the WordPress installation from your backup to the existing WordPress installation. An automatic backup of the WordPress installation will be created before its deletion, so you will be able to restore the installation to its previous state if you encounter any issues. Open the Import tab of the WordPress Manager. Click on the input field, and select the backup file on your local computer. If the backup file size is more than 200 MB, you should upload it to the server through the hosting Control Panel > File Manager or via FTP and use the or select an uploaded file link to select the uploaded backup. Select the Site URL for your WordPress installation using the controls in the Select WordPress import destination section. A preview of the URL is shown below the options, which are as follows:Use HTTPS: Configure the site to use HTTPS instead of HTTP. This is only possible if there is a valid certificate issued for the host.Use WWW: Add the www. prefix to the WordPress address.Choose subdomain: Choose the subdomain from the list of subdomains created on the account. Select www to use your domain.Choose domain: Choose the domain from the list of parked and main domains on the account.Choose directory: Choose a directory in the selected subdomain. Leave empty for the root of the domain/subdomain. In the Select MySQL version section, choose the MySQL version that you would like to use. Click on the Import button. If the import process takes too long, it will continue to run in the background. When you use the Import tool of the WordPress Manager, it performs the following actions: Imports the files to the directory from the backup. Creates a database and database user. Imports the database structure and data. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Performs a search and replace operation in the database, replacing the address from the backup with the new address.

You can use the WordPress Manager in the hosting Control Panel to create staging sites of your WordPress installations, make and preview your changes on them, and finally, publish those changes to the main site. Creating a staging site Navigate to the hosting Control Panel's WordPress Manager. Find the WordPress site in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. Select the Site URL of the staging site using the controls under the Site URL section. A preview of the URL is shown below the controls. The controls are as follows: • Use HTTPS: Set the site to use HTTPS instead of HTTP. This is only possible if there is a valid SSL certificate installed for the host. • Use WWW: Add www. prefix for the address. • Choose subdomain: Choose the subdomain from the list of the subdomains created on the account. • Choose domain: Choose the domain from the list of the parked and main domains on the account. • Choose directory: Choose a directory in the selected subdomain. Leave empty for the root of the domain/subdomain. Please note that you need to choose a location that is different from the current one. Our recommendation is to use a different subdomain. Here, we are using a subdomain named "staging" as an example. Click on the Create staging button. This will create a separate staging site at the chosen location by copying the files there. It will also use separate MySQL database and user, so you can edit the new installation without affecting the original site in any way. The staging site will be automatically added to the WordPress Manager. Publishing the staging site to the main one Open the WordPress Manager section in the hosting Control Panel. Find the main WordPress site in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. Find the staging site in the Staging section of the page, and click on the Set as live button. A prompt will appear asking you if you would like to overwrite the live WordPress site with the staging one (this includes the files and the database) or try to merge them. Choose the desired approach, and wait for the operation to finish.Note: Full backups will be created automatically of both websites before the operation, which you can use in case a problem with either of the sites occurs.

You can use the WordPress Manager in the Control Panel to move or copy WordPress installations between directories or subdomains on the same hosting account by following the steps below: Access the hosting Control Panel. Navigate to the WordPress Manager section. Click on the Manage button next to the WordPress installation that you would like to move or copy. This will take you to the management page for the WordPress installation. Select the target subdomain and/or directory on the account. At the same time, you can optionally choose a different domain, start using HTTPS, or prefix the address with www. The Choose domain drop-down menu lists the main and parked domains associated with the account. Click on the Change button. You will be asked if you wish to move or copy the WordPress installation. Click on the Copy button if you wish to keep the original WordPress installation, or click on the Move button if you wish to delete it. If you choose to copy the WordPress installation, the original and new installations will use different MySQL databases and usernames.Depending on the size of the WordPress installation, the process might run in the background. If the source and target directories are overlapping, you won't have the option to copy WordPress, and only the Move option will be available. When you move or copy a WordPress installation to another location, the tool performs the following actions: Copies/moves the files to the new directory. Creates a new database and database user. Copies/moves the data from the current database to the new one. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Performs a search and replace operation in the database, replacing the current address with the new address. The usernames and passwords for the WordPress installation will remain the same.

You can use the WordPress Manager in the hosting Control Panel to move or copy WordPress installations between different hosting accounts on our servers. The process requires that you create a backup of the original WordPress installation and import it to the account where you wish to copy or move that WordPress installation. You can refer to the respective sections about these actions in our Creating, downloading, and restoring from WordPress backups article or follow the steps below: Access the hosting Control Panel for the account with the original WordPress installation. Navigate to the WordPress Manager. Find the WordPress installation in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. Click on the Backup now button. This will generate a backup of your entire WordPress installation - the database and the files. Download the backup to your local computer by clicking on the Download button. Open the Import tab of the WordPress Manager in the Control Panel for the account where you wish to move/copy the WordPress installation. Click on the gray area to select the backup file on your local computer. If the file size is bigger than 200 MB, you need to upload it to the server via the hosting Control Panel's File Manager or with FTP first, and then select the uploaded backup using the or select an uploaded file link. Select the Site URL of the new WordPress installation using the controls in the Select WordPress import destination section. A preview of the URL is shown below the controls. The controls are as follows:Use HTTPS: Set the site to use HTTPS instead of HTTP. This is only possible if there is a valid certificate issued for the host.Use WWW: Add the www. prefix to the WordPress address.Choose subdomain: Choose the subdomain from the list of subdomains created on the account.Choose domain: Choose the domain from the list of parked and main domains on the account.Choose directory: Choose a directory in the selected subdomain. Leave empty for the root of the domain/subdomain. Select the MySQL version for the new WordPress installation from the MySQL version drop-down menu. Click on the Import button. Depending on the size of the WordPress installation, the process might run in the background. When you import WordPress from a backup, the tool performs the following actions: Imports the files to the directory. Creates a database and database user. Imports the database structure and data to the database. Changes the Site URL (WordPress Address) setting. Changes the Home (Site Address) setting. Performs a search and replace operation in the database, replacing the address in the backup with the new address. The usernames and passwords for the WordPress installation will remain the same.

Public access to the XML-RPC file (xmlrpc.php) on our servers is blocked by default, because the file is a common target for hackers. More details are available in our Error "412 Precondition Failed" (mod_security2) article. You can now easily enable access to it by following these steps: 1. Open the WordPress Manager in the hosting Control Panel. 2. Find the WordPress installation in the list, and click on the Manage button for it. This will take you to the management page for the WordPress installation. 3. Scroll down to the Tools section, and locate the option called Enable access to XML-RPC. 4. Click on the Enable button next to it.This is it - you can now successfully install and use any plugin that requires access to XML-RPC.

Server-side caching may help reduce page load times by a significant margin if configured properly. You can learn more about the server-side caching service in the General information about server-side caching article. Automatic server-side caching configuration for WordPress You can configure server-side caching for a WordPress website with just a few clicks using the hosting Control Panel: Open the WordPress Manager section of the hosting Control Panel. Navigate to the management screen of your WordPress installation by clicking on the Manage button next to the WordPress installation. Click on the Enable button next to Server-side Caching under the Tools subsection. A pop-up message will appear with information about the changes that will be made to the account and the WordPress installation to enable server-side caching - WordPress optimizations must be enabled for the WordPress installation, server-side caching must be enabled for the domain/subdomain, and the Server-Side Cache Autopurge plugin must be installed and activated for the WordPress installation.Click on the OK button to proceed. Manual server-side caching configuration for WordPress To manually configure server-side caching on a WordPress website, you need to: Configure WordPress to cache content. Choose how to clear the cache. Enable server-side caching. 1. Configure WordPress to cache content You should configure your WordPress installation to send the correct caching headers. If you have installed your WordPress instance using the WordPress Manager section of the hosting Control Panel, content caching should be already enabled for your WordPress installation. Otherwise, you can enable it by following the instructions from our Optimizing WordPress article. By optimizing your WordPress installation through the hosting Control Panel, the following line of code will be added to your .htaccess file, which will guarantee that a separate cache entry gets created for every different User Agent (browser): Header append Vary User-Agent env=!dont-vary If you don't want to have a separate cache entry for every User Agent, you should comment or remove that line from the main .htaccess file of your WordPress installation. Alternatively, you can install a plugin that allows you to set caching headers. The Cache-Control plugin has proven to work correctly on our servers. Note: We advise that you do not combine multiple tools/methods that set HTTP Cache-Control headers as this may lead to unexpected results. 2. Choose how to clear the cache You can configure WordPress to clear the server-side cache automatically whenever content is changed. All you need to do is download and activate the Server-Side Cache Autopurge plugin for your WordPress installation. The plugin works correctly out of the box, so no additional configuration is required. This plugin also allows you to purge the cache on demand via the "Purge Server-Side Cache" button at the top left side of the WordPress Dashboard, as well as via WP-CLI with the following command: wp surecache purge If you do not wish to install or use the Server-Side Cache Autopurge plugin, or you do not update content regularly, you can purge the server-side cache manually by using any of the methods listed in our Purging the server-side cache article. 3. Enable server-side caching Once you have prepared WordPress for server-side caching, you can enable the server-side caching service by navigating to the hosting Control Panel's Server-side Caching section and clicking on the Enable button next to the domain/subdomain where your WordPress is installed.

You can view a full list of the WordPress administrators on your websites, change their passwords, and also log in with their username via the WordPress Manager in the hosting Control Panel. To use these features and view this information, click on Manage button next to the WordPress installation in the list inside the WordPress Manager. Under the WordPress administrators subsection, you will see a list of all the administrators on your WordPress website showing their respective login usernames, display names, and email addresses. Next to each administrator, you will find two buttons - Log in and Password. The Log in button allows you to log into the WordPress Dashboard as that user, and the Password button allows you to change the password for that user. General advice on how to choose a strong password and secure it can be found in our Password tips article.

If the appearance or behavior of your site has changed, this may mean that it has been compromised. In this article, we will cover how our Incident Response Team handles such cases. We have selected a WordPress installation for this example, and while the details will be different, the logical framework of the investigation is nearly identical for all common web applications. The Incident Any WordPress installation will contain a number of standard core files in its main directory, and the same goes for all major CMS applications, so you should look for unexpected and unusual files and subdirectories in your web root directory. In this case, the user has the following two files in their WordPress installation directory:   133ja3lore.php  a1cw42ipim.php We will be using some of the standard Unix command line tools in order to gain more information about these files, and about how they originally appeared on the account. We provide SSH access out of the box, as well as full Apache access logs, so you could reproduce these steps on your own. Obtaining Timestamps The stat utility gives us a lot of information about files, and this is how its output looks like: [17:09:32] server~$ stat ~/www/www/133ja3lore.php   File: ~/www/www/133ja3lore.php   Size: 4909          Blocks: 16         IO Block: 4096   regular file Device: fc00h/64512d    Inode: 202768472   Links: 1 Access: (0664/-rw-rw-r--)  Uid: ( 4731/user)   Gid: ( 4674/user) Access: 2018-02-02 15:16:02.000000000 +0800 Modify: 2018-02-02 15:16:02.000000000 +0800 Change: 2018-08-07 20:49:47.771134758 +0800  Birth: [17:09:43] server~$ stat ~/www/www/a1cw42ipim.php   File: ~/www/www/a1cw42ipim.php   Size: 4909          Blocks: 16         IO Block: 4096   regular file Device: fc00h/64512d    Inode: 202768462   Links: 1 Access: (0664/-rw-rw-r--)  Uid: ( 4731/user)   Gid: ( 4674/user) Access: 2018-02-02 15:16:02.000000000 +0800 Modify: 2018-02-02 15:16:02.000000000 +0800 Change: 2018-08-07 19:41:46.676971426 +0800  Birth: The "~" symbol stands for "/home/$USER" where $USER is your hosting username. The main difference between the mtime (modification time) and ctime (change time) is that mtime shows the last change of the contents of the file, while ctime shows the last change of the contents of the file or of one of its attributes (such as permissions or owner). Depending on the situation, we may search our logs for the ctime attribute, the mtime attribute, or even both. In this case, we will take the ctime timestamp for further analysis, because for both files, it is the more recent attribute. We will also start by searching for the ctime timestamp we obtained from a1cw42ipim.php, because it was changed about an hour earlier than the same attribute of the other file. We will assume that it was uploaded first and should take us closer to the original Point of Entry. Log Analysis Current, real-time access logs are available from the Logs section of the Control Panel – this is helpful if the attack was very recent. In this case, the original event occurred a long time ago, so we will be using archived copies of the logs. These archives are stored in the Logs directory of the account, and can be viewed from the File Manager, via FTP, or through SSH. The archives are in the gzip format, so you can use the zgrep command to search in them. Furthermore, log archives are split into individual files, with names based on subdomain and day, so this is how a search for the timestamp obtained previously would look like: zgrep "19:41:" ~/logs/2018-08/www-07.log.gz When checking the access logs, we pay special attention to any POST requests that we discover. Unlike GET requests, where all data is encoded in the URL, POST requests include data in the body of the request. Most file uploads and setting updates use this method, and this is how malware is usually uploaded, too. The search yields the following lines of interest to our investigation: www.domain.com 192.0.2.1 - - [07/Aug/2018:19:41:44 +0800] "POST /um-api/route/um!core!Files/ajax_image_upload/a2c75736fe HTTP... www.domain.com 192.0.2.2 - - [07/Aug/2018:19:41:45 +0800] "POST /wp-content/uploads/ultimatemember/temp/Ao3uKpx8B9klgpJ6Ra7A8... You should not expect to discover the Point of Entry on the first try. The malware that we investigate may have been uploaded by another malicious file, and more often than not, the same process will have to be repeated several times before the Point of Entry can be identified. It is also entirely possible that the account was compromised on another server and was then migrated. Additionally, this process is tuned and specific for our environment. However, any respectable hosting provider should be able to provide you with the access and tools required to perform these steps. Once we have identified the original Point of Entry, we can begin working on cleaning up the account and hardening it against similar issues in the future. Unless a safe backup exists, this task can appear daunting, but it is actually pretty straightforward with a modern CMS. Finding all executable files on your account and manually reviewing them for malware (since automated scanners do not work well enough for obfuscated PHP code) can range from difficult to outright impossible. Luckily, with a modern web application such as WordPress, you can simply re-install it while preserving your uploaded files. This is the fastest and the most effective method to bringing your site back up in a clean and secure state. We use it every day on all but the most specific and niche cases. Save the wp-config.php file, your images, and your personal files The wp-config.php file contains the basic configuration for your site, including the information necessary to connect to the database server. When saving it, open it and inspect its contents for anything suspicious, like a very long first line containing unusual characters. As a rule of thumb, if your text editor has an unusually long horizontal scroll bar, the file that you are editing is likely to be compromised. If that’s the case with the wp-config.php file, copy the database connection strings to a clean wp-config.php file from a fresh WordPress archive. Your images and personal files should be stored in the wp-content/uploads directory. Ideally, there should be no PHP files at this location. Unfortunately, some plugins and themes may store some of their files in subdirectories there, making the task of correctly identifying and removing malware even harder. An easy way to list all PHP files in a given directory is to run the following command via SSH: find ~/www/www/wp-content/uploads/ -iname "*.php" If you receive no output, you can safely copy the uploads directory. Otherwise, you should review the identified PHP files manually in order to see if they were placed there by a harmless plugin, or by an attacker. Before you delete anything, you should first get a list of your active plugins. You can either do this from the WordPress Dashboard, or by typing the following command in the SSH terminal inside your WordPress directory (e.g. ~/www/www): wp plugin list --status=active This is how the command’s output may look like: +----------------------------------+----------+-----------+---------+ | name | status | update | version | +----------------------------------+----------+-----------+---------+ | classic-editor | active | none | 1.5 | | really-simple-ssl | active | none | 3.2.3 | +----------------------------------+----------+-----------+---------+ You can do the same for your active theme: wp theme list --status=active Delete the entire folder where WordPress is installed The wp-config.php file and the uploads directory are all the files that you need to preserve from your current WordPress installation, since most of your site resides in the database. In some cases, the database needs cleaning, too – but these are relatively rare, and not as trivial to secure. By now, you should also have a list of your active plugins and themes, so that you can download their latest versions from the official vendors. Upload a new clean full package of the latest WordPress version You can obtain WordPress from their official website and install it manually, or you could use our automated installer. In either case, you can now copy the previously saved wp-config.php file and the uploads directory. You can also install all plugins and themes that you had been using previously. If they are publicly available in the WordPress repository, you can do so from the terminal: wp plugin install really-simple-ssl classic-editor --activate At this point, you can test your site – ideally, it should work just like it did before the incident. In the odd chance that it does not, you should contact our Support Team. Additional precautions When a WordPress site has been compromised, we assume that the attackers know its administrative credentials. This is why you should review and update the passwords for all administrative users. You should also double-check for any unusual users created around or after the attack. We also encourage you to update your Control Panel password, as well as the passwords for all MySQL users. You should note that following a password change for your MySQL user, you should also update your wp-config.php file accordingly.

It is possible for a WordPress website to stop working correctly after a new plugin is installed, or an existing plugin is updated. If the WordPress Dashboard remains active, you can temporarily disable or remove the problematic plugin; however, some plugins also cause the WordPress Dashboard to stop working. In such cases, you can easily disable all plugins on your WordPress website via the hosting Control Panel's WordPress Manager by following these steps: Find the WordPress installation in the list inside the WordPress Manager, and click on the Manage button for it. Under the Tools subsection, click on the Apply button next to Deactivate all plugins. This should allow you to log in your WordPress Dashboard, and resolve the problem with the misbehaving plugin. You can find step-by-step instructions on how to re-activate your plugins through the WordPress Dashboard in our Managing WordPress plugins article.

This tutorial covers the following topics: Obtaining a list of the available WP-CLI commands Updating the WordPress core Updating WordPress plugins Installing and activating/deactivating plugins Managing WordPress themes Managing WordPress users Changing the WordPress URL   WP-CLI is the command-line interface for WordPress, allowing you to manage all aspects of the application from the command prompt, without having to use a web browser. It's a very powerful tool that could help you complete complex tasks that would otherwise require additional plugins or would take much more time to accomplish. This tutorial focuses on using WP-CLI to complete typical WordPress administration tasks, such as updating themes and plugins, managing the dashboard users, and changing the site's URL settings. Note that WP-CLI is available on all servers, but it requires SSH access. Thus, you will first need to make sure that you have enabled SSH access for your account. You can do that through the "SSH Access" section of the hosting Control Panel. More information on SSH is available in the following articles from our online documentation: Enabling SSH Connecting to your account over SSH Once logged into your account over SSH, you will need to navigate to the location of your WordPress site. If you are looking to manage the site for your main domain name and you have not changed the default web root folder, you will need to run the following command: cd ~/www/www/ If your WordPress site is located in another directory, you will need to navigate to that directory instead. Now that you are in the WordPress directory, you can start executing WP-CLI commands. Obtaining a list of the available WP-CLI commands You can obtain a list of all the available WP-CLI commands by running the following wp help Updating the WordPress core You should first check the current version of your WordPress installation by running the following command: wp core version You can start the update with the following command: wp core update If there are no updates available, you will receive the following message: Success: WordPress is up to date. Updating WordPress plugins Again, you should first check the status of the installed plugins, and that's done by running: wp plugin list +---------------------+--------+-----------+---------+| name | status | update | version |+---------------------+--------+-----------+---------+| all-in-one-seo-pack | active | none | 2.9.1 || contact-form-7 | active | none | 5.0.5 || fusion-builder | active | available | 1.1.6 || fusion-core | active | available | 3.1.6 || jetpack | active | none | 6.7 || LayerSlider | active | available | 6.3.0 || revslider | active | none | 5.4.2 || the-events-calendar | active | available | 4.6.25 || wp-mail-returnpath | active | none | 1.0.3 |+---------------------+--------+-----------+---------+ We have a total of nine plugins installed in our sample WordPress project. You can see under the Status column that all of them are currently active and there are updates available for four of them. Here is how we can update one of the plugins: wp plugin update fusion-builder Enabling Maintenance mode...Downloading update from https://updates.theme-fusion.com/?avada_action=get_download&item_name=Fusion%20Builder&nonce=27c6b23b34&t=1542808142&ver=5.7.1...Unpacking the update...Installing the latest version...Removing the old version of the plugin...Plugin updated successfully.Disabling Maintenance mode...+----------------+-------------+-------------+---------+| name | old_version | new_version | status |+----------------+-------------+-------------+---------+| fusion-builder | 1.1.6 | 1.7.1 | Updated |+----------------+-------------+-------------+---------+ Installing and activating/deactivating plugins  Here are the commands for installing, activating, and deactivating plugins: wp plugin install plugin_name wp plugin activate plugin_name wp plugin deactivate plugin_name You should replace the plugin_name string with the actual name of the plugin. Deactivating plugins via the command line can be quite helpful if you have a plugin that has caused an issue with your website and yet you cannot log in at the dashboard with a browser, in order to deactivate it. In such cases, you would still be able to log into your account via SSH and deactivate the problematic plugin from the command line using WP-CLI.  Managing WordPress themes Here are the most common commands for managing the WordPress themes: wp theme list wp theme activate theme_name wp theme delete theme_name wp theme install theme_name wp theme update theme_name The first command shows you a list of the themes currently installed, and here is the output when executed in our sample installation: wp theme list +-----------------+----------+-----------+---------+| name | status | update | version |+-----------------+----------+-----------+---------+| twentyfifteen | inactive | available | 1.8 || twentyseventeen | inactive | available | 1.3 || twentysixteen | inactive | available | 1.3 |+-----------------+----------+-----------+---------+ This table shows there are three themes installed with updates available for all of them. Here is how a theme can be updated via the command line: wp theme update twentyseventeenDownloading update from https://downloads.wordpress.org/theme/twentyseventeen.1.7.zip...Unpacking the update...Installing the latest version...Removing the old version of the theme...Theme updated successfully.+-----------------+-------------+-------------+---------+| name | old_version | new_version | status |+-----------------+-------------+-------------+---------+| twentyseventeen | 1.3 | 1.7 | Updated |+-----------------+-------------+-------------+---------+Success: Updated 1 of 1 themes. Managing WordPress users You can obtain a list of the existing users with the following command: wp user list The following command can be used to change the password of a given user: wp user update USERNAME --user_pass="PASSWORD" This command is helpful if you have forgotten the password for a given user and do not have access to the email account associated with it. Here is how you can create a new dashboard user directly from the command line: wp user create USERNAME EMAIL --role=administrator You should replace the USERNAME string with the desired username and the EMAIL with his/her actual email address. The "role" field sets the role of the user to create; the possible values are: ‘administrator’, ‘editor’, ‘author’, ‘contributor’, ‘subscriber’. Here is an example: wp user create example [email protected] --role=administrator Changing the WordPress URL CMS applications like WordPress are configured to work and accept requests over a specific URL. This URL is set during the installation process. However, it's often required to change it for a number of different reasons. For example, you might have to move your WordPress installation from one subdomain or subfolder to another, or may wish to change your domain name. Another fairly common situation is whenever you wish to force HTTPS connections to your website after installing an SSL certificate. This is a fairly complex task as it requires an update of all the database entries containing the old URL to the new one. The process is much easier with the use of WP-CLI, as you just need to run the following command: wp search-replace 'http://your-old-URL.com' 'http://your-new-URL.com' --skip-columns=guid Your site should now be configured to work over the new URL. Don't hesitate to open a support ticket in case you detect any issues. Note: There may be hard-coded links to resources in your files that contain the old URL. If you notice missing images, CSS files, or any other discrepancies, you may want to check the browser's error console for specific errors. You can open the error console by clicking F12. It will help you locate files that may contain links to missing resources. You may also open a support ticket for help.