WordPress

Use "Lost your password?" on the login page, or in the control panel open WordPress Users, then Manage > Change Password. Without the control panel: in phpMyAdmin open the table wp_users, edit your user, and in user_pass choose the function MD5 and enter the new password.

Yes: the control panel's Plugins and Themes pages list versions and updates, and activate, deactivate or update them. Several WordPress sites can be updated together where the control panel shows that option.

It compares the WordPress core files with the official ones and puts back missing or changed ones, without touching your content, plugins, themes or wp-config.php. Changed core files usually mean malware: run the Malware Scan too.

Only for a fresh start: it deletes the site's files and database and installs a new, empty WordPress. It does not repair a site.

They cannot find a working site. Usual causes: WordPress is not directly in public_html, or there are two installs; the database details in wp-config.php are wrong; the site shows a 500 error; a must-use plugin from the old host (the mu-plugins folder) interferes; the PHP version is too old; or the security keys are in a separate wp-salt.php instead of wp-config.php.

WordPress Staging, Create Staging Site copies the live site to staging.yourdomain.lk within a few minutes, with its own files (in staging_html) and its own database. Changes there do not touch the live site.

Clone into live (tick the confirmation) replaces the live site with the staging site, files and database. Orders, comments or sign-ups made on the live site since the copy are lost, so for a shop take a backup first and do it at a quiet time.

Control panel, WordPress Settings: set Site URL and Home to the real address (https:// once SSL works), Save. In WordPress it is Settings > General, both addresses. Then replace the old address in your content with Search/Replace in the control panel: run it as a Dry Run first, then for real. Take a backup first.

By SSH the same is:

wp search-replace old-address new-address --dry-run
wp search-replace old-address new-address

Set it back in the control panel's WordPress Settings, or add these lines to wp-config.php with your real address:

define('WP_HOME', 'https://yourdomain.lk');
define('WP_SITEURL', 'https://yourdomain.lk');

To see the cause, set define('WP_DEBUG', true); in wp-config.php (and back to false afterwards), or read the error log. Usual causes: a plugin or theme (deactivate it in the control panel's Plugins page, or rename its folder in wp-content/plugins), damaged core files (Checksum Report), or too little memory (PHP settings; 1024M is plenty, 2048M the most).

DB_NAME, DB_USER, DB_PASSWORD and DB_HOST in wp-config.php must match the database on the control panel's MySQL Databases page; DB_HOST is the server name shown there, not "localhost". If they match, repair the database: by SSH in public_html, wp db repair.

In WordPress, Settings > Permalinks, press Save Changes without changing anything; that rebuilds the rules. If the whole site shows 404, the document root points to the wrong folder.

The .user.ini file in public_html still has the old host's path to wordfence-waf.php. Replace it with your home path (control panel, Account Information) followed by /public_html/wordfence-waf.php. The error log shows the old path.

Set the permissions of index.php to 640 in the File Manager. If that does not help, keep a copy of .htaccess and replace it with the standard WordPress rules.

In Elementor, Tools, switch Safe Mode on. If it loads then, another plugin or the theme conflicts. If not, switch off the JavaScript optimisations (especially Defer JavaScript) in the control panel's Web Optimisation.

That is on purpose: the firewall filters it against password guessing. The WordPress apps, Jetpack, Zapier and IFTTT still work. If another service needs it, write to us.

An object cache (Redis) is not available on our hosting, which is not a fault. The page cache is there but uses header names Site Health does not look for. If wp-config.php sets WP_CACHE to false on the live site, remove that line.

Run the scheduled task with the PHP command instead of wget (see scheduled tasks), and not in the same minute as the processing task.

Set both addresses in Settings > General to https://. Then change the old http:// links in your content with Search/Replace (http://yourdomain.lk to https://yourdomain.lk), or use the plugin "SSL Insecure Content Fixer". Clear the cache and check in a private window. More in SSL and HTTPS.

None. Remove W3 Total Cache, WP Super Cache, WP Rocket, Hummingbird and the like: our CDN and caching do this, and those plugins cause cache misses. If our caching plugin is installed on your site, its settings are in the WordPress admin menu: purge, cache times, and exclusions for pages that must stay fresh (account, login, register and thank-you pages, membership plugins).

By itself: for the whole site when you switch the theme, save Customizer settings or (de)activate a plugin; for one page when a post, page or product is edited, deleted, restored or commented. If a change still does not show, purge in the plugin or in Edge Caching, then check in a private window.

BackupWordPress, VersionPress and Broken Link Checker overload the server; please do not use them. Backups are part of your hosting (Backups). Every plugin adds work to each page load, so fewer plugins make a faster site.

Keep WordPress, plugins and themes updated: outdated plugins are the usual way sites get hacked. Automatic core updates are set in wp-config.php, above the line "That's all, stop editing!":

define('WP_AUTO_UPDATE_CORE', 'minor');

'minor' installs security updates only, true all updates, false none.

Yes, in the control panel (Change PHP Version). Modern plugins work on PHP 8; if something breaks, switch back at once. From very old versions such as 5.6, check with the plugin authors first. In WordPress, Tools > Site Health shows the version in use.

The From address of the form must be an address at your site's own domain; To can be any address. Best is to send through a mailbox: create one (how) and set up an SMTP plugin such as WP Mail SMTP with smtp.yourdomain.lk, port 465, SSL, the full address and its password.

If forms stopped sending entirely, check the Malware Scan: a site with red findings has PHP mail switched off.

Add reCAPTCHA (keys from Google reCAPTCHA, entered in the form plugin's settings) or a honeypot field.

Yes. Add all domains of the network to the hosting with the same document root (public_html). Subdomains work without adding them, but to get SSL they have to be added under Subdomains.

WP-CLI is installed; run it by SSH in public_html. For example:

wp plugin list
wp plugin update --all
wp plugin install name --activate
wp plugin deactivate name
wp user create name name@yourdomain.lk --role=administrator
wp core verify-checksums
wp core download --force
wp option get siteurl
wp db repair

wp core download --force puts back the WordPress core files only; your content stays.