How to Fix the WordPress Too Many Redirects Error

A glowing browser window surrounded by blue and amber redirect arrows.

A website that keeps bouncing between the same pages is more than annoying. It can lock visitors out, block your WordPress login, and make your business site look broken.

The WordPress too many redirects error usually appears when parts of your setup disagree. WordPress may expect HTTPS while your server sends HTTP, or your domain may switch between www and non-www. Plugins, caching systems, .htaccess, and Cloudflare can also create conflicting rules.

We’ll start with the quickest checks, then move into server and hosting settings if the problem remains.

Key Takeaways

The WordPress too many redirects error usually comes from conflicting HTTPS, domain, plugin, server, CDN, or caching settings.
Trace the redirect chain first to identify whether the loop involves HTTP and HTTPS, or www and non-www URLs.
Make sure the WordPress Address URL and Site Address URL match exactly, and use wp-config.php if you can’t access the dashboard.
Deactivate redirect, security, SSL, and caching plugins, then purge caches across WordPress, hosting, your CDN, Cloudflare, and the browser.
Use one clear owner for HTTPS redirects and align Cloudflare, proxy, origin server, and SSL certificate settings.

What ERR_TOO_MANY_REDIRECTS Actually Means

Your browser requests a page, but the server responds with instructions to visit another URL. That URL sends the browser back again, creating a redirect loop error. Chrome, Firefox, or Safari eventually stops after detecting an infinite loop.

The most common loops look like this:

http://example.com redirects to https://example.com, then back to HTTP.
example.com redirects to www.example.com, then returns to the non-www version.
Cloudflare sends HTTP to your server while your server forces HTTPS.
A WordPress plugin adds a redirect that conflicts with a hosting rule.
Cached 301 responses keep showing an old redirect after the real issue is fixed.

The goal is simple: one preferred domain, one preferred protocol, and one clear redirect path.

Trace the redirect chain first

Don’t change five settings at once. Find the redirect that repeats.

Open your browser’s developer tools, select the Network tab, turn on Preserve log, and reload the affected page. Look for repeated 301 or 302 responses and inspect the Location header. It shows where each request is being sent.

You can also test the headers with curl -I https://example.com from a terminal. If the chain alternates between HTTP and HTTPS, the protocol is the problem. If it switches between www and non-www, your domain settings disagree.

Cloudflare lists SSL mode, Edge Certificate settings, and redirect settings among the common causes in its redirect loop troubleshooting guide.

How to clear browser cookies and cache

Before editing WordPress, try a private window. If it works there, clear browser cache and remove its cookies. Stale cookies and cached redirect responses can make the repaired site look broken.

Delete the domain’s stored data, then close and reopen the browser. A cached redirect can make a fixed website look broken on one device while it works normally elsewhere.

This check takes a minute. It’s worth doing first.

Fix the WordPress Address and Site Address

WordPress stores two important URLs in its settings:

WordPress Address URL, which points to the WordPress installation.
Site Address URL, which is the public address visitors use.

For most sites, both values should match exactly. Use the same https:// protocol, domain, www preference, and trailing-slash convention where applicable.

URL mismatches often appear after a site migration or domain change.

Match both URLs in the dashboard

If you can access the admin dashboard, go to Settings > General. Check both URL fields carefully, including the HTTPS settings.

For a standard site, the correct setup might be:

https://example.com

Both fields should use that same address. Don’t leave one set to http://example.com and the other set to https://example.com.

The same applies to www. If your preferred address is https://www.example.com, use it in both fields. A small difference can create a large problem.

WordPress provides additional guidance on changing these settings in its site URL documentation.

Save the settings once, then clear your caching layers before testing again. If WordPress immediately redirects you out of the dashboard, use the next method.

Set the URLs in `wp-config.php`

When the admin area is unavailable, you can temporarily define the correct values in the wp-config.php file.

Use your hosting file manager, cPanel, or an FTP client to open the file in your WordPress root directory. Add these lines above the /* That's all, stop editing! */ line:

define( 'WP_HOME', 'https://example.com' );

define( 'WP_SITEURL', 'https://example.com' );

Replace example.com with your real domain. Use HTTPS only if your certificate is active and your server supports HTTPS.

These constants override incorrect values stored in the WordPress database, including the relevant wp_options table. WordPress also explains the file’s role in its wp-config.php editing guide.

Create a backup before editing the file. One missing quote or semicolon can cause a different error, so slow down for this step.

If the site starts working, update the database values later or keep the definitions in place. Remember that these lines can make the URL fields in the dashboard read-only.

Disable Plugins and Purge Caches

A plugin can create a redirect loop without affecting every page. This often involves redirect, security, SSL, and caching tools.

Look closely at Redirection, Really Simple Security, WP Rocket, and WP Fastest Cache. Test the caching plugin’s layer separately from the redirect and security tools.

The issue isn’t that these tools are bad. It usually comes from two systems trying to control the same redirect.

Deactivate plugins without dashboard access

If you can still log in, deactivate plugins one at a time. Start with redirect, SSL, security, and caching tools, then test the site after each change.

If you can’t reach the admin dashboard, use FTP or your hosting file manager instead. Open wp-content/plugins and rename the suspected plugin folder, such as redirection to redirection.off.

If you can’t identify the plugin, rename the entire plugins folder to plugins.off. WordPress will deactivate all the plugins. This deactivates the tools without deleting their settings or website content.

Rename the folder back after testing, then restore plugins one at a time until the loop returns. That process takes longer, but it identifies the source while preserving your plugin settings and website content.

Purge every caching layer

Run one cache flush across your WordPress plugin, hosting account, content delivery network (CDN), and browser. Include Cloudflare if it’s active.

Some hosting security systems and Cloudflare Automatic Platform Optimization can cache redirect responses. That can preserve a bad 301 even after you fix the rule that created it.

Test in a private window after the flush. If the page works privately but not normally, the regular browser session may still hold stale data.

Reset the `.htaccess` File

Apache and LiteSpeed servers often use an htaccess file (.htaccess) for redirects and rewrites. A damaged or duplicated rewrite rule can send every request into an infinite loop.

Before changing the file, download a backup. Then rename .htaccess to .htaccess.bak. Renaming is safer than deleting because you can restore the original file if needed.

Identify all owners of HTTP-to-HTTPS redirect rules in your hosting control panel, .htaccess, WordPress plugins, and CDN settings. You usually need one clear owner for that redirect.

Try loading the site. If the redirect error disappears, .htaccess caused the problem.

Once you can access WordPress, go to Settings > Permalinks and click Save Changes. WordPress will usually generate a fresh set of basic rewrite rules.

Remove duplicate HTTPS rules

Remove duplicate redirect rules from the hosting panel, file, plugins, or CDN.

For example, an HTTPS rule in .htaccess can conflict with a hosting panel rule. A CDN may add another redirect at the edge. Multiple rules can turn one simple action into a loop.

If your site runs behind a proxy or load balancer, the server may see the connection as HTTP even when the visitor used HTTPS. In that setup, redirect logic must correctly read the X-Forwarded-Proto header. Ask your hosting provider to check this rather than adding random rewrite rules.

Nginx servers don’t use .htaccess. If renaming the file changes nothing, inspect Nginx configuration, hosting redirects, or your CDN instead.

Fix Cloudflare Flexible SSL Loops

Cloudflare Flexible SSL is a common cause of redirect loops in WordPress.

With Flexible mode, the visitor connects to Cloudflare over HTTPS, but Cloudflare connects to the origin server over HTTP. A consistent SSL configuration requires agreement between the edge mode, origin protocol, and certificate. If your WordPress host automatically redirects HTTP to HTTPS, the cycle looks like this:

The visitor requests HTTPS.
Cloudflare connects to the origin using HTTP.
The origin sends an HTTPS redirect.
Cloudflare repeats the same HTTP request.
The process starts over.

Cloudflare documents this exact problem in its explanation of ERR_TOO_MANY_REDIRECTS and SSL modes.

Use Full or Full (strict) with a valid certificate

If your hosting account has a working SSL certificate, open Cloudflare and go to SSL/TLS > Overview.

Choose:

Full (strict) when the origin has a valid certificate that matches the domain.
Full when the origin supports HTTPS but the certificate doesn’t pass Cloudflare’s full verification.

Full (strict) is the stronger option because Cloudflare encrypts the connection to your server and checks the origin certificate.

Don’t use Flexible mode while your origin server forces HTTPS. Either remove the origin redirect, which is rarely the preferred long-term choice, or move Cloudflare to Full or Full (strict).

After changing the mode, run a cache flush in Cloudflare. Check your redirect rules and Page Rules too. An edge rule can conflict with a WordPress or hosting rule even when the SSL mode is correct.

Check the certificate and origin settings

Make sure the certificate covers the exact domain you use. Check both example.com and www.example.com if your site supports both.

You can test the certificate with the Qualys SSL test. If the certificate is expired, missing a hostname, or installed on the wrong server, fix that before changing more redirects.

If you’re using ZADiC hosting, its SSL certificates and WordPress hosting options keep these settings together. Fewer separate layers can make HTTPS issues easier to troubleshoot.

Fix a Login Page That Keeps Redirecting

When only /wp-login.php or /wp-admin loops, the cause is often different from a whole-site redirect.

Start by using clear browser cookies for the domain. WordPress uses authentication cookies, and a stale cookie can send you back to the login page even after the main site works.

Then check these settings:

The two WordPress URL values match.
The HTTPS settings match between your proxy, WordPress, and server.
Your security plugin isn’t blocking or rewriting login requests.
Cloudflare isn’t using Flexible mode with an origin that forces HTTPS.
Your domain’s www and non-www versions resolve consistently.

If you added define( 'FORCE_SSL_ADMIN', true ); to wp-config.php, the server and proxy must correctly recognize that the original request was HTTPS. Otherwise, WordPress can treat every secure login request as plain HTTP and redirect it again.

Your hosting provider can inspect the server headers and authentication cookies faster than repeated trial and error. Human support is a practical escalation when those checks are needed.

Prevent Redirect Problems on Your Hosting Account

Once the site loads, test more than the homepage. Open the login page, a post, an image, and both www and non-www versions. Test the HTTP version too, and confirm every request reaches one final HTTPS URL.

Keep a record of the canonical domain you chose. Use that same version in WordPress, your hosting panel, Cloudflare, Google Search Console, email links, and marketing materials. Test future domain or HTTPS changes on a staging site when possible, before applying them to production.

If redirect problems keep returning, a simpler hosting architecture may reduce the systems controlling redirects. Ask your hosting provider whether the setup can be simplified. ZADiC offers WordPress hosting, cPanel hosting, managed Web Hosting Plus, and VPS options, so you can choose the level of control your site needs.

Our goal is straightforward: dependable hosting, security monitoring, and 24/7 human support when something breaks. You shouldn’t need to become a server administrator to keep your website online.

Frequently Asked Questions

What causes the WordPress too many redirects error?

The error usually happens when WordPress, the server, Cloudflare, or a plugin sends conflicting redirect instructions. Common examples include HTTP-to-HTTPS loops and repeated switches between www and non-www URLs.

How can I fix the error if I can’t access WordPress?

First, define matching WP_HOME and WP_SITEURL values in wp-config.php. You can also deactivate plugins by renaming their folders through FTP or your hosting file manager, then test the site again.

Can a WordPress plugin cause a redirect loop?

Yes. Redirect, SSL, security, and caching plugins can conflict with hosting or CDN rules. Deactivate suspected plugins one at a time, or temporarily rename the entire plugins folder if you can’t reach the dashboard.

Why does Cloudflare cause too many redirects?

Cloudflare Flexible SSL can create a loop when the visitor connects over HTTPS but Cloudflare connects to an origin server that automatically redirects HTTP to HTTPS. Use Full or Full (strict) mode when the origin supports HTTPS, then purge the Cloudflare cache.

What should I check after fixing the redirect error?

Test the homepage, login page, posts, images, and both www and non-www versions of the domain. Confirm that HTTP requests and alternate domain versions reach one final canonical HTTPS URL without additional loops.

Conclusion

The WordPress too many redirects error usually comes from conflicting URL values, SSL settings, server rules, plugins, or cached responses. Compare the request path, correct mismatched settings, remove conflicts, refresh server rules, and align the proxy with the origin when HTTPS is enforced.

A working site needs one canonical domain and one clear HTTPS path. With the right hosting setup and support behind it, resolving those conflicts becomes manageable instead of a day-consuming mystery.

Submit a Comment Cancel reply

What's New?

WordPressHow to Fix the WordPress Too Many Redirects ErrorA website that keeps bouncing between the same pages is more than annoying. It can lock visitors out, block your WordPress login, and make your business site look broken. The WordPress too many redirects error usually appears when parts of your setup disagree. WordPress may expect HTTPS while your server sends HTTP, or your domain may switch between www and non-www. Plugins, caching systems, .htaccess, and Cloudflare can also create conflicting rules. We’ll start with the quickest checks, then move into server and hosting settings if the problem remains. Key Takeaways The WordPress too many redirects error usually comes from conflicting HTTPS, domain, plugin, server, CDN, or caching settings. Trace the redirect chain first to identify whether the loop involves HTTP and HTTPS, or www and non-www URLs. Make sure the WordPress Address URL and Site Address URL match exactly, and use wp-config.php if you can’t access the dashboard. Deactivate redirect, security, SSL, and caching plugins, then purge caches across WordPress, hosting, your CDN, Cloudflare, and the browser. Use one clear owner for HTTPS redirects and align Cloudflare, proxy, origin server, and SSL certificate settings. What ERR_TOO_MANY_REDIRECTS Actually Means Your browser requests a page, but the server responds with instructions to visit another URL. That URL sends the browser back again, creating a redirect loop error. Chrome, Firefox, or Safari eventually stops after detecting an infinite loop. The most common loops look like this: http://example.com redirects to https://example.com, then back to HTTP. example.com redirects to www.example.com, then returns to the non-www version. Cloudflare sends HTTP to your server while your server forces HTTPS. A WordPress plugin adds a redirect that conflicts with a hosting rule. Cached 301 responses keep showing an old redirect after the real issue is fixed. The goal is simple: one preferred domain, one preferred protocol, and one clear redirect path. Trace the redirect chain first Don’t change five settings at once. Find the redirect that repeats. Open your browser’s developer tools, select the Network tab, turn on Preserve log, and reload the affected page. Look for repeated 301 or 302 responses and inspect the Location header. It shows where each request is being sent. You can also test the headers with curl -I https://example.com from a terminal. If the chain alternates between HTTP and HTTPS, the protocol is the problem. If it switches between www and non-www, your domain settings disagree. Cloudflare lists SSL mode, Edge Certificate settings, and redirect settings among the common causes in its redirect loop troubleshooting guide. How to clear browser cookies and cache Before editing WordPress, try a private window. If it works there, clear browser cache and remove its cookies. Stale cookies and cached redirect responses can make the repaired site look broken. Delete the domain’s stored data, then close and reopen the browser. A cached redirect can make a fixed website look broken on one device while it works normally elsewhere. This check takes a minute. It’s worth doing first. Fix the WordPress Address and Site Address WordPress stores two important URLs in its settings: WordPress Address URL, which points to the WordPress installation. Site Address URL, which is the public address visitors use. For most sites, both values should match exactly. Use the same https:// protocol, domain, www preference, and trailing-slash convention where applicable. URL mismatches often appear after a site migration or domain change. Match both URLs in the dashboard If you can access the admin dashboard, go to Settings > General. Check both URL fields carefully, including the HTTPS settings. For a standard site, the correct setup might be: https://example.com Both fields should use that same address. Don’t leave one set to http://example.com and the other set to https://example.com. The same applies to www. If your preferred address is https://www.example.com, use it in both fields. A small difference can create a large problem. WordPress provides additional guidance on changing these settings in its site URL documentation. Save the settings once, then clear your caching layers before testing again. If WordPress immediately redirects you out of the dashboard, use the next method. Set the URLs in wp-config.php When the admin area is unavailable, you can temporarily define the correct values in the wp-config.php file. Use your hosting file manager, cPanel, or an FTP client to open the file in your WordPress root directory. Add these lines above the /* That's all, stop editing! */ line: define( 'WP_HOME', 'https://example.com' ); define( 'WP_SITEURL', 'https://example.com' ); Replace example.com with your real domain. Use HTTPS only if your certificate is active and your server supports HTTPS. These constants override incorrect values stored in the WordPress database, including the relevant wp_options table. WordPress also explains the file’s role in its wp-config.php editing guide. Create a backup before editing the file. One missing quote or semicolon can cause a different error, so slow down for this step. If the site starts working, update the database values later or keep the definitions in place. Remember that these lines can make the URL fields in the dashboard read-only. Disable Plugins and Purge Caches A plugin can create a redirect loop without affecting every page. This often involves redirect, security, SSL, and caching tools. Look closely at Redirection, Really Simple Security, WP Rocket, and WP Fastest Cache. Test the caching plugin’s layer separately from the redirect and security tools. The issue isn’t that these tools are bad. It usually comes from two systems trying to control the same redirect. Deactivate plugins without dashboard access If you can still log in, deactivate plugins one at a time. Start with redirect, SSL, security, and caching tools, then test the site after each change. If you can’t reach the admin dashboard, use FTP or your hosting file manager instead. Open wp-content/plugins and rename the suspected plugin folder, such as redirection to redirection.off. If you can’t identify the plugin, rename the entire plugins folder to plugins.off. WordPress will deactivate all the plugins. This deactivates the tools without deleting their settings or website content. Rename the folder back after testing, then restore plugins one at a time until the loop returns. That process takes longer, but it identifies the source while preserving your plugin settings and website content. Purge every caching layer Run one cache flush across your WordPress plugin, hosting account, content delivery network (CDN), and browser. Include Cloudflare if it’s active. Some hosting security systems and Cloudflare Automatic Platform Optimization can cache redirect responses. That can preserve a bad 301 even after you fix the rule that created it. Test in a private window after the flush. If the page works privately but not normally, the regular browser session may still hold stale data. Reset the .htaccess File Apache and LiteSpeed servers often use an htaccess file (.htaccess) for redirects and rewrites. A damaged or duplicated rewrite rule can send every request into an infinite loop. Before changing the file, download a backup. Then rename .htaccess to .htaccess.bak. Renaming is safer than deleting because you can restore the original file if needed. Identify all owners of HTTP-to-HTTPS redirect rules in your hosting control panel, .htaccess, WordPress plugins, and CDN settings. You usually need one clear owner for that redirect. Try loading the site. If the redirect error disappears, .htaccess caused the problem. Once you can access WordPress, go to Settings > Permalinks and click Save Changes. WordPress will usually generate a fresh set of basic rewrite rules. Remove duplicate HTTPS rules Remove duplicate redirect rules from the hosting panel, file, plugins, or CDN. For example, an HTTPS rule in .htaccess can conflict with a hosting panel rule. A CDN may add another redirect at the edge. Multiple rules can turn one simple action into a loop. If your site runs behind a proxy or load balancer, the server may see the connection as HTTP even when the visitor used HTTPS. In that setup, redirect logic must correctly read the X-Forwarded-Proto header. Ask your hosting provider to check this rather than adding random rewrite rules. Nginx servers don’t use .htaccess. If renaming the file changes nothing, inspect Nginx configuration, hosting redirects, or your CDN instead. Fix Cloudflare Flexible SSL Loops Cloudflare Flexible SSL is a common cause of redirect loops in WordPress. With Flexible mode, the visitor connects to Cloudflare over HTTPS, but Cloudflare connects to the origin server over HTTP. A consistent SSL configuration requires agreement between the edge mode, origin protocol, and certificate. If your WordPress host automatically redirects HTTP to HTTPS, the cycle looks like this: The visitor requests HTTPS. Cloudflare connects to the origin using HTTP. The origin sends an HTTPS redirect. Cloudflare repeats the same HTTP request. The process starts over. Cloudflare documents this exact problem in its explanation of ERR_TOO_MANY_REDIRECTS and SSL modes. Use Full or Full (strict) with a valid certificate If your hosting account has a working SSL certificate, open Cloudflare and go to SSL/TLS > Overview. Choose: Full (strict) when the origin has a valid certificate that matches the domain. Full when the origin supports HTTPS but the certificate doesn’t pass Cloudflare’s full verification. Full (strict) is the stronger option because Cloudflare encrypts the connection to your server and checks the origin certificate. Don’t use Flexible mode while your origin server forces HTTPS. Either remove the origin redirect, which is rarely the preferred long-term choice, or move Cloudflare to Full or Full (strict). After changing the mode, run a cache flush in Cloudflare. Check your redirect rules and Page Rules too. An edge rule can conflict with a WordPress or hosting rule even when the SSL mode is correct. Check the certificate and origin settings Make sure the certificate covers the exact domain you use. Check both example.com and www.example.com if your site supports both. You can test the certificate with the Qualys SSL test. If the certificate is expired, missing a hostname, or installed on the wrong server, fix that before changing more redirects. If you’re using ZADiC hosting, its SSL certificates and WordPress hosting options keep these settings together. Fewer separate layers can make HTTPS issues easier to troubleshoot. Fix a Login Page That Keeps Redirecting When only /wp-login.php or /wp-admin loops, the cause is often different from a whole-site redirect. Start by using clear browser cookies for the domain. WordPress uses authentication cookies, and a stale cookie can send you back to the login page even after the main site works. Then check these settings: The two WordPress URL values match. The HTTPS settings match between your proxy, WordPress, and server. Your security plugin isn’t blocking or rewriting login requests. Cloudflare isn’t using Flexible mode with an origin that forces HTTPS. Your domain’s www and non-www versions resolve consistently. If you added define( 'FORCE_SSL_ADMIN', true ); to wp-config.php, the server and proxy must correctly recognize that the original request was HTTPS. Otherwise, WordPress can treat every secure login request as plain HTTP and redirect it again. Your hosting provider can inspect the server headers and authentication cookies faster than repeated trial and error. Human support is a practical escalation when those checks are needed. Prevent Redirect Problems on Your Hosting Account Once the site loads, test more than the homepage. Open the login page, a post, an image, and both www and non-www versions. Test the HTTP version too, and confirm every request reaches one final HTTPS URL. Keep a record of the canonical domain you chose. Use that same version in WordPress, your hosting panel, Cloudflare, Google Search Console, email links, and marketing materials. Test future domain or HTTPS changes on a staging site when possible, before applying them to production. If redirect problems keep returning, a simpler hosting architecture may reduce the systems controlling redirects. Ask your hosting provider whether the setup can be simplified. ZADiC offers WordPress hosting, cPanel hosting, managed Web Hosting Plus, and VPS options, so you can choose the level of control your site needs. Our goal is straightforward: dependable hosting, security monitoring, and 24/7 human support when something breaks. You shouldn’t need to become a server administrator to keep your website online. Frequently Asked Questions What causes the WordPress too many redirects error? The error usually happens when WordPress, the server, Cloudflare, or a plugin sends conflicting redirect instructions. Common examples include HTTP-to-HTTPS loops and repeated switches between www and non-www URLs. How can I fix the error if I can’t access WordPress? First, define matching WP_HOME and WP_SITEURL values in wp-config.php. You can also deactivate plugins by renaming their folders through FTP or your hosting file manager, then test the site again. Can a WordPress plugin cause a redirect loop? Yes. Redirect, SSL, security, and caching plugins can conflict with hosting or CDN rules. Deactivate suspected plugins one at a time, or temporarily rename the entire plugins folder if you can’t reach the dashboard. Why does Cloudflare cause too many redirects? Cloudflare Flexible SSL can create a loop when the visitor connects over HTTPS but Cloudflare connects to an origin server that automatically redirects HTTP to HTTPS. Use Full or Full (strict) mode when the origin supports HTTPS, then purge the Cloudflare cache. What should I check after fixing the redirect error? Test the homepage, login page, posts, images, and both www and non-www versions of the domain. Confirm that HTTP requests and alternate domain versions reach one final canonical HTTPS URL without additional loops. Conclusion The WordPress too many redirects error usually comes from conflicting URL values, SSL settings, server rules, plugins, or cached responses. Compare the request path, correct mismatched settings, remove conflicts, refresh server rules, and align the proxy with the origin when HTTPS is enforced. A working site needs one canonical domain and one clear HTTPS path. With the right hosting setup and support behind it, resolving those conflicts becomes manageable instead of a day-consuming mystery. [...]
Read more...
WordPressHow to Remove Unused WordPress Themes and Plugins SafelyYour WordPress site doesn’t need a theme museum or a collection of plugins you tested once and forgot. When we remove unused WordPress themes and plugins, we reduce security risks, save server storage, and support WordPress security. Cleaning up old autoloaded settings may also improve loading speed. A careful theme cleanup starts with a site backup and a dependency check. We then remove items through the WordPress dashboard when possible and review leftover database settings. A few careful steps now can prevent a much bigger repair later. Key Takeaways Back up the complete WordPress database and file structure before removing themes or plugins, and use staging for higher-risk cleanup. Check the active theme and child-parent relationships before deleting anything; never remove an active theme or its required parent theme. Deactivate plugins before deleting them, and use the WordPress dashboard when possible so uninstall routines can run correctly. FTP or cPanel removal is useful when the dashboard is unavailable, but manual deletion may leave database settings behind. Review leftover database entries carefully, test important site features afterward, and schedule regular cleanup to prevent future clutter. Why remove unused WordPress themes and plugins? Inactive themes and plugins may look harmless because they aren’t running. They still remain on your hosting server, inside your backups, and sometimes in your database. Inactive files can create security risks An inactive theme usually isn’t displaying your pages, but its theme files are still present. Outdated code in those files can contain security vulnerabilities or malicious code. Inactive components aren’t automatically exploitable, but attackers may still target vulnerable files. The same applies to deactivated plugins. Old code creates more files to monitor and more software to keep updated. WordPress’s hardening guidance treats deleting unused plugins as part of WordPress security and recommends getting themes and plugins only from trusted sources. Removing old files doesn’t replace updates, strong passwords, or malware scanning. It does reduce unnecessary exposure. If cleanup reveals suspicious files, redirects, or unfamiliar administrator accounts, stop deleting files and investigate the wider site. Our guide to WordPress security issue remediation covers the access, hosting, and file checks that come next. Cleanup reduces storage and database clutter Unused themes and plugins take up server storage. They also increase the size of backup files, which can make restores slower and harder to manage. There may be database leftovers too. Plugin settings can remain in the wp_options table after plugin files are gone, contributing to database bloat. Some options load on every page request, so a large collection of old entries can add unnecessary work and affect loading speed. The impact won’t be identical on every site. Still, clean hosting is easier to maintain, back up, and troubleshoot. What to check before deleting anything We treat WordPress theme cleanup like a small maintenance job, not a button-clicking spree. Take a few minutes to confirm what the site needs before removing anything permanently. Back up the full website Create a recent backup of both the database and all WordPress files. Include wp-content, the WordPress core files, wp-config.php, and .htaccess if your site uses it. The official WordPress upgrade backup instructions recommend backing up the database and every file in the WordPress directory. A backup is only useful if you can restore it, so check that the files exist and that the backup completed successfully. Before a higher-risk cleanup, we also prefer a staging environment. Remove the themes and plugins there first, check the site, then repeat the change on the live website. Check active themes and child themes Open Appearance > Themes and identify the active theme. If you see a child theme, find its parent theme before deleting anything. A child theme inherits files and functionality from its parent. It may contain only a stylesheet and a few custom templates, while the parent provides most of the site’s structure. WordPress’s child theme documentation explains how that relationship works. Never delete a parent theme while its child theme is active. Keep both themes unless you have moved the site to another theme and confirmed that the child theme is no longer needed. Also record any theme-specific widgets, menus, templates, customizer settings, or page-builder layouts before removal. These settings may remain, but the site’s appearance can change after the theme is removed. How to delete themes and plugins in the WordPress dashboard The dashboard is the safest and easiest place to remove unused items because WordPress can apply its normal deactivation and uninstall process through its admin interface. Remove an unused WordPress theme From the dashboard, delete WordPress theme files safely by following these steps: Sign in to WordPress with an administrator account. Go to Appearance > Themes. Select the theme you want to remove. Click Theme Details. Choose Delete and confirm. WordPress won’t offer the delete option for the active theme. Switch to another theme first, then check that the replacement works on desktop and mobile. Don’t delete every theme except the active one without checking your recovery needs. Keeping one clean, unused default theme can help with troubleshooting, although WordPress’s housekeeping guidance generally recommends removing themes that aren’t needed. Delete an unused plugin correctly Plugins need one extra step: Go to Plugins > Installed Plugins. Click Deactivate beside the plugin. Test the site, especially forms, checkout pages, analytics, and logged-in features. Click Delete. Confirm the removal. The official WordPress housekeeping steps use this deactivate-then-delete process. Deactivation stops the plugin from running. It doesn’t remove the plugin’s files or database settings. Deletion removes the plugin files, while a proper uninstall routine may also remove its settings and tables. That’s why clicking Delete in the dashboard is better than immediately removing the folder. Removing themes and plugins with FTP or cPanel Manual removal helps when the dashboard is unavailable, a theme causes a fatal error, or a plugin blocks access to the admin area. It also carries more risk because the usual uninstall process may not run. Delete files through an FTP client Connect to your hosting account with an FTP client that supports SFTP, such as FileZilla. Inside the FTP client, open the WordPress installation directory, then go to: wp-content/themes/ wp-content/plugins/ Use the FTP client to download a copy of the folder before removing it. Then use the FTP client to select only the folder matching the unused theme or plugin. Never delete the active theme folder. If a child theme is active, keep its parent theme folder too. If WordPress is broken after a plugin update, use the FTP client to rename the plugin folder first. Add a short suffix such as -disabled, then reload the site. If access returns, you can log in, deactivate the plugin properly, and remove it through the dashboard. Use cPanel File Manager cPanel provides the same file-level access through your browser. Open the file manager, locate the WordPress installation, and browse to wp-content. Select the unused theme or plugin folder, download a backup copy, and delete the folder. Check the folder name carefully, and ask your hosting company for help if you’re unsure before confirming. A one-letter mistake can disable the wrong component. If you want direct file access and one-click WordPress tools, cPanel hosting for WordPress keeps those controls in one hosting dashboard. We still recommend a full backup before using File Manager. Manual deletion can bypass uninstall routines. That means the website may work while old database settings remain behind. Continue with the database check instead of treating the deleted theme files as the end of cleanup. How to clean leftover database settings safely Deleting files and database maintenance are separate jobs. Treat this review as one careful step in broader theme cleanup. Don’t run broad database queries simply because an option name looks old. Let the plugin uninstall routine work first When you delete a plugin through WordPress, it may run an uninstall routine. That routine can remove plugin-specific options, settings, and database tables. The WordPress Plugin Handbook on uninstall methods explains how plugins should remove their own data. A well-made plugin may also give you a setting such as “Delete data on uninstall.” Read that option before deleting the plugin, especially if you may reinstall it later. Theme options and plugin settings can remain after either item is removed, so review them separately before deleting related data. If you removed a plugin through FTP or cPanel, check its documentation for cleanup instructions. Don’t assume every database table with a familiar-looking name belongs to that plugin. Review wp_options with care Use a staging site or a verified database backup before changing database records. The wp_options table may not be named wp_options if your installation uses a different table prefix. A safe review looks like this: Search the options table for the exact plugin slug or theme stylesheet name. Inspect the option name and value before changing anything. Check whether the option is marked autoload. Excessive or unnecessary autoloaded options can sometimes add work during requests and affect loading speed, but the impact varies by site. Confirm that the setting belongs only to the removed item. Remove one small group of confirmed leftovers. Test the site before making another change. Theme settings often use names similar to theme_mods_THEME-SLUG, but naming varies. Plugin settings may use a unique prefix, a serialized value, or several related rows. Don’t delete rows because they contain a common word such as settings, cache, or options. Don’t empty the entire options table. Serialized data can contain multiple settings in one value, and careless editing can cause errors across the site. When the ownership of a database entry isn’t clear, leave it alone or ask your hosting support team to review it. A small amount of harmless data is safer than a broken login, blank page, or missing site configuration. Verify the site and prevent future clutter Cleanup isn’t finished when the delete button disappears. Give the site a short inspection while the changes are fresh. Test the important pages Open the homepage, contact form, blog, checkout, account area, and any page using a builder or custom template. These checks help confirm website performance after cleanup. Check mobile optimization on a phone, then test the site in a desktop browser. Clear your caching layers, compare loading speed before and after, and review: Navigation menus and widgets Logo, fonts, colors, and homepage settings Forms, payments, and email notifications Search Console and analytics tracking PHP error logs and visible warnings WordPress, theme, and plugin update screens If something breaks, restore the backup or reinstall the component instead of guessing at database edits. Keep the site lean Before installing a new plugin, check whether WordPress or your current tools already provide the feature. Keep a short record of why each active plugin is installed, who manages it, and what it connects to. Set a monthly or quarterly cleanup reminder. Remove abandoned plugins, replace unsupported themes, and keep the remaining software updated. Our WordPress hosting plans include tools such as automatic setup, backups, updates, and support that can reduce the maintenance load. For sites where updates, backups, malware scans, and restores need more hands-on help, ZADiC WordPress hosting provides a simpler base for ongoing site management. Frequently Asked Questions Is it safe to delete unused WordPress themes? Yes, deleting unused themes is generally safe after confirming that the theme is not active and is not the parent of an active child theme. Keep a recent backup and consider retaining one clean default theme for troubleshooting. Should I deactivate a plugin before deleting it? Yes, deactivate the plugin first and test important site features such as forms, checkout, analytics, and logged-in areas. Then use the Delete option in the WordPress dashboard so the plugin’s uninstall routine has a chance to remove its settings. Can I remove a WordPress theme or plugin with FTP or cPanel? Yes, manual removal through FTP or cPanel can help when the dashboard is unavailable or a component causes a fatal error. Download a backup copy, select the exact folder, and remember that manual deletion may leave database settings behind. Do deleted plugins leave data in the WordPress database? They can, especially when a plugin is removed manually or does not include a complete uninstall routine. Review the options table carefully on a staging site or after confirming a database backup, and remove only entries that clearly belong to the deleted plugin. How often should I clean up unused WordPress themes and plugins? A monthly or quarterly review is a practical schedule for most sites. During each review, remove abandoned components, replace unsupported software, check backups, and keep the remaining themes and plugins updated. Conclusion To remove unused WordPress themes safely, back up the complete site, check for child-parent dependencies, and use the dashboard whenever possible. Deactivate plugins before deleting them, protect the active theme, and treat database cleanup as a separate job. A clean WordPress installation has fewer files to monitor, smaller backups, and less clutter, making theme cleanup easier when something goes wrong. With dependable hosting and a regular maintenance habit, your site can stay secure, manageable, and ready for its next stage of growth. [...]
Read more...
WordPressHow to Rotate WordPress Security Salts After a BreachA suspected WordPress breach changes the priority list fast. You need to limit access, protect your files, and stop stolen login sessions before you start digging into every detail. Rotating WordPress security salts is one of the quickest steps you can take. It invalidates existing authentication cookies, which logs users out and forces fresh sign-ins. That can cut off an attacker who still has an active session. The process is manageable, but the order matters. We recommend protecting the site first, replacing the full salt block, then reviewing every account and access point. How WordPress security salts protect your site WordPress security salts are secret random values stored in wp-config.php. They work with security keys to help protect authentication cookies, logged-in sessions, and nonces. Think of them as part of the lock system for your website. Changing one doesn’t repair a hacked site, but replacing the full set makes old session data unusable. The standard WordPress configuration includes eight values: AUTH_KEY helps protect authentication cookies. SECURE_AUTH_KEY supports secure authentication. LOGGED_IN_KEY protects logged-in user cookies. NONCE_KEY supports nonce creation. AUTH_SALT adds another secret value to authentication data. SECURE_AUTH_SALT adds protection to secure authentication data. LOGGED_IN_SALT supports logged-in cookie security. NONCE_SALT adds protection to WordPress nonces. The official wp-config.php documentation explains how these values fit into WordPress configuration. The wp_salt() reference also shows how WordPress uses secret keys and salts when generating protected values. Why changing salts logs users out When WordPress creates an authentication cookie, it uses the security keys and salts in the process. After you replace those values, old cookies no longer match. The result is immediate: Existing WordPress sessions stop working. Administrators and editors must sign in again. Stolen login cookies lose their value. Existing nonces may stop working and need to be regenerated. That forced logout is the main reason to rotate salts after a suspected breach. It doesn’t remove malware or repair unauthorized changes, but it closes one access route quickly. Rotating salts is an access-control step, not a complete malware cleanup. Prepare the site before rotating salts Don’t edit wp-config.php while an attacker may still be changing files or accounts. Take a few minutes to contain the situation first. Start by putting the site into maintenance mode if you can do so without hiding important evidence. If the site is actively being abused, ask your host to isolate it or suspend public access temporarily. Next, create a backup of the current site and database. Keep the backup in a safe location, and label it with the time and date. Preserve at least one copy for investigation, but don’t treat an old backup as clean automatically. Before changing anything, record useful details: The time you noticed unusual activity. Unknown administrator accounts or recent users. Suspicious plugins, themes, files, or scheduled tasks. Recent password-reset emails. Unexpected redirects, pop-ups, or new content. Security alerts and hosting access logs. Make a second backup of wp-config.php before editing it. The file contains database connection details and other sensitive settings. Store it outside the public website directory, protect its permissions, and don’t send it through an unsecured email thread. If you use cPanel or another hosting panel, open the file through the file manager or connect with SFTP. If you have shell access, WP-CLI is usually the cleaner option. Either way, edit the correct WordPress installation. Our WordPress hardening guidance should sit alongside this response, not replace it. Salt rotation helps end sessions, while hardening addresses wider risks such as weak accounts, outdated software, and unsafe configuration. How to rotate WordPress security salts safely There are two practical methods. Use WP-CLI if your hosting plan provides shell access. Use the WordPress salt generator when you need to edit wp-config.php manually. Option 1: Replace the block in wp-config.php Open the wp-config.php file in the root directory of the affected WordPress installation. Find the existing block containing the key and salt definitions. Replace the entire block with newly generated values. Don’t change one line and leave the other seven untouched. A partial replacement gives you less certainty during an incident. WordPress provides a generator that returns fresh random values for all eight constants. Copy the complete result, then paste it over the existing key and salt block. The new entries should look like this structure, but every value must be newly generated: define('AUTH_KEY', 'new-random-value'); define('SECURE_AUTH_KEY', 'new-random-value'); define('LOGGED_IN_KEY', 'new-random-value'); define('NONCE_KEY', 'new-random-value'); define('AUTH_SALT', 'new-random-value'); define('SECURE_AUTH_SALT', 'new-random-value'); define('LOGGED_IN_SALT', 'new-random-value'); define('NONCE_SALT', 'new-random-value'); Don’t invent values, shorten them, or reuse keys from another website. Save the file, upload it if you used SFTP, and visit the site in a private browser window. If the site shows a PHP error or stops loading, restore the backup copy immediately. A missing quote, extra character, or damaged PHP line can prevent WordPress from loading. Option 2: Use WP-CLI WP-CLI can update the file without requiring you to copy and paste long values manually. From the WordPress installation directory, run wp config shuffle-salts. The command changes the salt values in wp-config.php in place. Check your hosting account’s PHP and WP-CLI setup before running it on a live site. The official WordPress configuration command documentation covers the file and its placement. Keep a backup before using any command that modifies configuration files. After the command completes, open a new private browser session and test the login page. Existing browser sessions should no longer work. If another administrator remains logged in, ask them to close the session and sign in again. Complete the breach response after rotation Rotating WordPress security salts is an important first move, but it isn’t the finish line. If an attacker accessed the site, assume other credentials or files may be exposed. Change passwords for every WordPress administrator, hosting-panel user, SFTP account, database user, and email account connected to the website. Use separate, strong passwords for each service. Don’t keep an old password because it seems unrelated. Review the Users screen carefully. Remove unknown accounts, delete unused administrator profiles, and reduce trusted users to the permissions they need. WordPress recommends avoiding the username admin and reviewing old accounts in its brute-force protection guidance. Update WordPress core, plugins, and themes. Remove anything you don’t need, including inactive plugins. An inactive plugin can still become a problem if its files remain outdated or vulnerable. Then inspect the site for changes: Compare plugin and theme files with trusted original copies. Check for unfamiliar PHP files in wp-content. Review recently modified files. Search posts and pages for injected links or scripts. Check cron jobs and scheduled tasks for unknown entries. Review redirects, DNS records, and administrator email addresses. Scan the website with a reputable security service. If wp-config.php may have been exposed, rotate the database password too. The file stores database credentials, so changing salts alone doesn’t protect a database account that an attacker may already know. Application passwords need separate attention. The official salt guidance clearly covers cookies and nonces, but it doesn’t state that salt rotation resets every application password. Review and revoke application passwords individually where your site uses them. Don’t restore an old backup without checking it. A backup made after the intrusion can put the same malicious file right back on the server. When hosting support should take over Manual salt rotation works well for a small, isolated incident. A larger breach needs a wider response, especially when you can’t identify what changed. This is where dependable hosting support earns its place. With ZADiC, you can choose WordPress hosting, managed Web Hosting Plus, or VPS hosting based on how much control and support your site needs. Security monitoring, SSL, backups, and human support reduce the number of moving parts you need to manage alone. We recommend managed hosting when you don’t want to spend your day checking logs, patching software, and wondering whether a strange file belongs on the server. You still control your website, but you have a team and a stronger hosting setup behind it. For a small business, that matters. The goal isn’t to become a full-time security administrator. The goal is to keep your site available, your customers confident, and your business moving. Conclusion Changing WordPress security salts can end active login sessions within minutes. Replace all eight values, test the site, then reset passwords and inspect the wider hosting environment. Don’t mistake a forced logout for a full cleanup. Check users, plugins, themes, database credentials, backups, and hosting access before you call the incident closed. When the technical work becomes too much, managed WordPress hosting gives you reliable infrastructure and support without making security your full-time job. [...]
Read more...
WordPressBlock PHP Uploads in WordPress Before They RunOne vulnerable upload can give an attacker a quiet way into your website. A single disguised script may expose passwords, alter pages, or create a backdoor that keeps returning after cleanup. The safest way to block PHP uploads WordPress sites receive is to stop uploaded scripts from executing. We also need strong file rules, updated plugins, sensible permissions, and hosting that watches for trouble. Let’s start with the risk inside the uploads folder. Why the WordPress uploads folder needs protection WordPress normally stores images, PDFs, videos, and other media in wp-content/uploads. Those files need to be publicly available so visitors can view them. That public access creates a target. An attacker doesn’t need to upload a file named malware.php. They may use a double extension, a less common PHP extension, or a vulnerable plugin that handles uploads poorly. If the server treats that file as executable code, the attacker may run commands through its URL. The result can be serious: Malicious code may create administrator accounts. Attackers may inject spam links into posts and pages. Website files may be changed or deleted. Database credentials may be exposed. A backdoor may remain after the original file disappears. A media upload folder should store content, not run code. That distinction gives us a practical security rule: PHP execution has no place inside a normal WordPress uploads directory. WordPress itself checks many common upload types, but those checks aren’t a complete security boundary. A plugin can introduce a file-handling flaw. A compromised administrator account can also bypass normal expectations. That’s why server-level protection matters. Even if a harmful script reaches wp-content/uploads, the web server should refuse to execute it. Block PHP uploads WordPress sites cannot safely execute The exact fix depends on your hosting stack. Apache servers usually use .htaccess. Nginx servers ignore .htaccess, so the rule belongs in the server configuration. Before changing anything, create a backup of the current file and confirm whether your website uses Apache, LiteSpeed, or Nginx. If you’re unsure, ask your hosting provider. A wrong server rule can produce errors or fail without giving you any warning. Apache and LiteSpeed: add an uploads rule On Apache or LiteSpeed, create a file named .htaccess inside: wp-content/uploads/ Do not place this rule in the website’s root .htaccess unless your hosting support team tells you to. The uploads folder is the narrowest location, so the protection affects media files without interfering with WordPress core. For Apache 2.4 and newer, use: <FilesMatch "\.(php|phtml|php?|phar)$"> Require all denied </FilesMatch> This blocks common PHP variations, including .php, .phtml, .php5, and .phar files. The server returns a forbidden response instead of handing the file to PHP. Some older Apache setups use this syntax instead: <FilesMatch "\.(php|phtml|php?|phar)$"> Order Allow,Deny Deny from all </FilesMatch> Use one version, not both. If your host uses cPanel, you can create the file through File Manager. For a step-by-step file-manager example, see one.com’s guide to disabling file execution. The same approach is commonly recommended in the WordPress.org support discussion about disabling PHP execution. The rule is small, but its location matters. It must sit directly inside the uploads directory. Nginx: add a server-level location rule Nginx doesn’t read .htaccess. Adding that file to wp-content/uploads won’t protect the directory on an Nginx server. Your host needs to add a rule to the Nginx server block: location ~* ^/wp-content/uploads/.*\.(php|phtml|php?|phar)$ { deny all; return 403; } The rule matches PHP-related extensions below wp-content/uploads and returns HTTP status 403. That means the file can exist, but the web server won’t allow it to run. Nginx rules can interact with other location blocks, especially a general PHP handler. The order and pattern need to match your server’s existing configuration. This is one reason we don’t recommend editing production Nginx settings without a backup and a way to restore the previous version. If your website uses managed hosting, send the rule to support rather than guessing. A hosting technician can check the active web server, place the rule correctly, and reload the configuration safely. Test the protection before trusting it A rule that looks correct isn’t enough. Test the result. Upload a harmless file named test.php containing plain text, or ask your host to test the path without placing a real script there. Then request its URL, such as: https://example.com/wp-content/uploads/test.php A working block should return 403 Forbidden or another non-executable response. You should not see PHP output, a blank page generated by PHP, or a download that exposes source code. Delete the test file after checking it. If the request returns a normal page or executes code, contact your host immediately. The protection isn’t active yet. Strong upload security needs more than one rule Blocking execution closes one dangerous door. It doesn’t replace the rest of your WordPress security work. Start with the upload process itself. Only allow the file types your website needs. A photography site may need JPEG, PNG, WebP, and PDF files. It probably doesn’t need PHP, JavaScript, shell scripts, or server-side templates. Use trusted plugins that receive regular updates. Pay attention to plugins that accept profile pictures, contact form attachments, ZIP files, or document submissions. Upload features deserve extra scrutiny because they move files from a visitor’s browser onto your server. Keep WordPress core, themes, and plugins updated. Security fixes only help when they reach your site. Remove plugins and themes you no longer use instead of leaving inactive software in place. File permissions matter too. WordPress needs enough access to manage media, but every account and process shouldn’t have unrestricted control over every file. Your hosting provider can recommend the right ownership and permission setup for its server. A practical baseline includes: Blocking PHP execution in wp-content/uploads. Disabling unused plugins, themes, and server features. Using separate administrator accounts instead of sharing one login. Requiring strong passwords and two-factor authentication where available. Keeping off-site backups that you can restore. Reviewing security alerts, login activity, and unexpected file changes. Don’t overlook older files. If an attacker already placed a backdoor in the uploads folder, adding .htaccess won’t remove it. Review recently modified files, scan the website, check administrator accounts, and restore from a clean backup when needed. A security plugin can help with scanning and alerts, but it shouldn’t be your only control. Application tools, server rules, account security, and reliable backups work better together. How hosting makes WordPress upload protection easier Website owners often know they need protection but don’t want to edit server files every week. That’s reasonable. Your time belongs on customers, orders, and growth, not on hunting through configuration menus. The right hosting plan reduces that burden. ZADiC provides WordPress hosting and cPanel hosting for site owners who want simple setup without giving up dependable infrastructure. With cPanel access, you can manage files, domains, SSL, backups, and email in one familiar place. When you need more help, our managed Web Hosting Plus options add hands-on support and room to grow. We can help confirm whether your site runs Apache, LiteSpeed, or Nginx, then point you toward the correct protection for that environment. Our VPS options fit websites that need more control over server settings. That flexibility is useful when you manage Nginx rules, custom applications, or several WordPress installations. It also means you need a clear maintenance plan, so managed support can be a better fit if you don’t want server administration on your plate. Security monitoring and 24/7 human support give you another practical advantage. When a file behaves strangely or a website suddenly shows a forbidden error, you have someone to contact instead of relying on trial and error. Free SSL on many plans protects data moving between your visitors and website. One-click WordPress setup gets the site online quickly. The goal is straightforward: secure hosting that lets you focus on the business using the website. Check your WordPress uploads protection today If you want to block PHP uploads WordPress sites should never execute, begin with the server rule in wp-content/uploads. Apache and LiteSpeed need a local .htaccess file. Nginx needs a server-block rule. Then test the result with a harmless file request, remove the test file, and review the rest of your security setup. Update software, restrict upload types, protect administrator accounts, maintain clean backups, and monitor unexpected changes. A malicious PHP file is dangerous because it can look like an ordinary upload until the server runs it. Stop that execution path first. With the right hosting setup and a few focused controls, your uploads folder can stay useful without becoming an open door. [...]
Read more...
WordPressHow to disable WordPress file editor accessA hacked WordPress admin account can turn a tiny edit into a full website problem. The built-in file editor gives privileged users a direct path to your theme and plugin code. If you want to disable WordPress file editor, you don’t need another plugin. One line in wp-config.php removes the Theme File Editor and Plugin File Editor from wp-admin. Code changes then happen through a controlled server tool instead. We recommend this setting for business sites, especially when several people manage content or plugins. The change takes minutes, but the code must sit in the right place. Why disable the WordPress theme and plugin editors? WordPress includes browser-based editors under Appearance > Theme File Editor and Plugins > Plugin File Editor. They can be useful for quick changes, but they also put sensitive files close to the login screen. If someone gains administrator access, they may use the editor to add malicious code, create a backdoor, or break a plugin. A small account security issue can become a site recovery job. The editor also makes accidental damage easier. One missing character in a PHP file can trigger a critical error and take your site offline. Editing files through cPanel, SFTP, or SSH creates a more deliberate process. We don’t treat this setting as a complete security solution. We treat it as one sensible lock on an unnecessary door. DISALLOW_FILE_EDIT removes the dashboard editors, but it doesn’t stop file changes through SFTP, SSH, or a hosting file manager. How to disable WordPress file editor in wp-config.php Before editing a configuration file, create a current backup of your WordPress files and database. If something goes wrong, a backup gives you a clear way back. You’ll need access to the WordPress root directory. Most hosting accounts provide this through cPanel File Manager. You can also use SFTP or SSH if those tools are part of your hosting plan. Follow these steps: Open the WordPress root folder, often named public_html, and locate wp-config.php. Download a backup copy before making any changes. Open the file in the hosting editor or a plain-text code editor. Add the following line above the comment that says /* That's all, stop editing! Happy publishing. */. Save the file and return to your WordPress dashboard. define( 'DISALLOW_FILE_EDIT', true ); The spelling, capital letters, brackets, and semicolon all matter. Add the line only once. Avoid placing it inside another setting or PHP statement. You won’t need to restart the web server. Reload the dashboard, then check the Appearance and Plugins menus. The file editor options should no longer appear. one.com’s file-editing guide also recommends adding this constant in wp-config.php. When to use DISALLOW_FILE_MODS instead Sometimes you want to block more than code editing. WordPress also supports the DISALLOW_FILE_MODS constant: define( 'DISALLOW_FILE_MODS', true ); This setting disables the Theme and Plugin File Editors, along with dashboard actions that modify plugin and theme files. That includes installing, updating, and deleting plugins or themes through wp-admin. Use it on tightly controlled sites where updates happen through a maintenance process, staging site, or hosting team. It can be too restrictive for a small business owner who handles regular updates from the dashboard. For most sites, DISALLOW_FILE_EDIT is the better starting point. It removes the risky browser editor while leaving normal plugin and theme management available. Don’t add both settings unless you have a clear reason. DISALLOW_FILE_MODS already disables the editors, so the narrower setting adds little in that situation. Check the change and recover safely After saving wp-config.php, sign in again and look for the editor links. Administrators should no longer see Theme File Editor under Appearance or Plugin File Editor under Plugins. Try opening the old editor address directly if you want an extra check. WordPress should block access or show a permissions message instead of loading the editing screen. Need to restore editor access temporarily? Remove the line, or change true to false, then save the file again. We recommend turning the editor off once the emergency change is complete. If the site shows a critical error after saving, don’t keep editing randomly. Replace the file with your backup, or remove the new line through cPanel File Manager or SFTP. Your hosting provider’s support team can often help restore access without changing the rest of the site. Know what this setting doesn’t protect Disabling the editor only blocks changes made through the WordPress dashboard. It doesn’t prevent someone with hosting credentials from changing files through cPanel, SSH, SFTP, or another file manager. It also doesn’t fix vulnerable plugins, weak passwords, stolen login cookies, or an outdated WordPress installation. Keep WordPress, themes, and plugins updated. Use strong, unique passwords and enable two-factor authentication where available. Regular backups matter too. A security feature can reduce risk, but a clean backup is what helps you recover when prevention fails. For another layer, add malware scanning, login protection, and monitoring through reliable website security features. Jetpack’s security guidance also treats file editor restrictions as one part of broader WordPress protection. Make WordPress administration easier with ZADiC Safe maintenance shouldn’t require you to become a server administrator. Your hosting should give you a clear way to manage files, restore backups, and get help when a configuration change causes trouble. Our ZADiC WordPress hosting plans provide WordPress hosting with cPanel access, one-click setup, free SSL on many plans, and 24/7 human support. That gives you a practical alternative to making sensitive edits inside the WordPress dashboard. You can disable the editor in wp-config.php, handle approved changes through cPanel, and add security monitoring as your site grows. Fewer risky shortcuts. More control when you need it. Conclusion A single DISALLOW_FILE_EDIT line can remove the WordPress theme and plugin editors from wp-admin. Back up your site first, place the code above the WordPress stop-editing comment, and check both dashboard menus afterward. The setting won’t replace updates, strong login protection, or backups. It closes one unnecessary access point, giving your site a safer and more controlled maintenance routine. [...]
Read more...
WordPressHow to Configure WordPress Security Headers SafelyA missing header can leave a WordPress site open to avoidable browser-based attacks. But a badly configured one can block payments, forms, fonts, analytics, or even the WordPress editor. WordPress security headers need a careful rollout, not a pile of settings switched on at once. We recommend starting with low-risk headers, checking every site feature, and treating Content Security Policy as the final step. The right hosting setup also matters, because your headers may be controlled by WordPress, the web server, a CDN, or more than one of them. What WordPress security headers actually do Security headers are instructions sent with a web page response. The browser reads them before displaying the page and decides what the page can load, where it can connect, and whether other sites can embed it. Think of them as rules for a building. Your website is open to visitors, but the browser still checks which doors, windows, and delivery routes are allowed. A header doesn’t replace strong passwords, updates, backups, or malware monitoring. It adds another layer around the site. The most useful headers for many WordPress sites include: X-Content-Type-Options, which helps stop browsers from guessing a file’s content type. Referrer-Policy, which limits how much page information is shared when someone follows a link. X-Frame-Options, which helps prevent clickjacking by controlling iframe use. Strict-Transport-Security, also called HSTS, which tells browsers to use HTTPS. Content-Security-Policy, usually called CSP, which controls approved scripts, styles, images, fonts, frames, and connections. Permissions-Policy, which limits access to browser features such as the camera, microphone, and location. These settings are not equally risky. nosniff is usually simple to add. CSP can require several rounds of testing. HSTS is powerful, but a browser can remember it for months or years. The WordPress security header guide from Patchstack provides useful background on the common headers and the risks they address. We still recommend checking your own site’s features before copying any policy. Prepare the site before changing headers A header change is a live configuration change. Treat it with the same care as a plugin update. Start by making a current backup of the database and website files. A backup gives you a clear way back if a configuration change affects the front end or the WordPress dashboard. If your host provides staging, test there first. A staging copy should match production closely enough to reveal problems with plugins, themes, forms, and checkout tools. Next, list the services your site uses. Look beyond the homepage. Include: Contact forms and newsletter signups WooCommerce cart, checkout, and payment pages WordPress login, admin screens, and the block editor Google Analytics, Tag Manager, Meta Pixel, or other tracking tools Video players, maps, chat widgets, and booking systems External fonts, image CDNs, payment scripts, and marketing tools Pop-ups, cookie consent tools, and embedded content This list gives you something practical to test later. It also makes CSP reports easier to understand. A blocked domain is less mysterious when you know the site uses a payment provider or a video service. Find the layer that controls your headers Before adding anything, inspect the current response headers. Use your browser’s Network panel, your hosting control panel, or a header testing service. The MDN HTTP Observatory can check headers such as CSP and HSTS and point out missing settings. Look for duplicate headers. You might already have security settings from: Your web server configuration A caching or optimization plugin A WordPress security plugin Cloudflare or another CDN Your hosting provider Choose one main control point whenever possible. Adding X-Frame-Options in three places creates confusion. Adding CSP in two places can create multiple policies, and browsers apply all of them. The strictest combined result wins, which can make a page stop working without an obvious WordPress error. For many sites, the best order is the web server or CDN first, followed by WordPress only when you don’t have access to the hosting layer. A plugin is useful when it gives you a clear dashboard, report-only CSP support, and an easy rollback option. Configure WordPress security headers in a safe order Don’t start with the strictest policy. Add the lower-risk headers first, test them, then move toward HSTS and CSP. HeaderSensible starting valueCheck before enforcingX-Content-Type-OptionsnosniffScripts and styles use correct MIME typesReferrer-Policystrict-origin-when-cross-originAnalytics and referral tracking still provide what you needX-Frame-OptionsSAMEORIGINNo trusted service needs to frame your pagesPermissions-PolicyDisable unused features, such as camera and microphoneMaps, video, calls, and location tools still workStrict-Transport-SecurityStart with a short max-ageEvery required page and subdomain works over HTTPSCSPReport-Only firstReports have been reviewed and legitimate domains are allowed The table is a starting point, not a universal policy. Your plugins and third-party services decide what needs to be allowed. Start with low-risk headers Set X-Content-Type-Options to nosniff. This tells the browser to respect the declared MIME type instead of trying to guess what a file contains. If this breaks a script or stylesheet, the file or server configuration may be sending the wrong content type. Set Referrer-Policy to strict-origin-when-cross-origin. This usually keeps the full URL for same-site navigation while sharing only the origin with another site. If your business depends on detailed referral data, review your analytics reports after the change. For framing protection, X-Frame-Options: SAMEORIGIN is a practical choice for many WordPress sites. It allows your own pages to frame content from the same origin while stopping other sites from embedding your pages. Use DENY when your site never needs to appear in a frame. Be careful with membership platforms, page builders, support tools, and embedded checkout flows. A setting that blocks every frame may stop a trusted service from displaying part of your site. Permissions-Policy is another useful starting point. If your site doesn’t need browser access to the camera, microphone, or location, you can disable those features. A policy such as geolocation=(), camera=(), microphone=() is restrictive, so don’t use it if your site needs maps, video calls, location services, or camera-based uploads. Add HSTS only after HTTPS is stable HSTS tells a browser to use HTTPS for future visits. This protects visitors from being sent to an insecure HTTP version of your site, but it also creates a rollback problem. If you publish a long HSTS period and later discover that a subdomain doesn’t support HTTPS, browsers may refuse to visit that subdomain over HTTP. Turning the header off on the server won’t immediately erase the browser’s stored rule. Start with a short max-age, such as 300 seconds, while you test. If the main domain and required subdomains continue working, increase the period gradually. A long-term policy may eventually use max-age=31536000, with includeSubDomains only when every relevant subdomain is ready. Don’t add preload casually. HSTS preload lists are designed for long-term HTTPS-only use, and removing a domain later can take time. Confirm that old subdomains, development addresses, email links, APIs, and third-party integrations won’t need HTTP before considering it. Leave CSP until the site has a map CSP is the header most likely to break a WordPress site. It can block inline scripts, external JavaScript, stylesheets, fonts, images, frames, AJAX requests, and form submissions. That doesn’t make CSP a bad idea. It means you need to build it from evidence instead of guessing. Build a CSP that protects the site without blocking it Begin with Content-Security-Policy-Report-Only. In this mode, the browser reports violations but doesn’t block the resource. You can see what the site wants to load before enforcing the policy. CSP is built from directives. Common ones include: default-src, the fallback rule for resource types without their own directive script-src, which controls JavaScript style-src, which controls stylesheets and style sources img-src, which controls images font-src, which controls web fonts connect-src, which controls fetch requests, AJAX, and other connections frame-src, which controls content embedded inside your pages form-action, which limits where forms can submit A conservative policy may begin with default-src 'self', but that alone is rarely enough for a working WordPress site. Your theme and plugins may load resources from a CDN, font provider, payment domain, analytics service, or video platform. Review the browser console and your CSP reports. Add only the domains connected to real site features. If a payment script appears in a report, confirm that the checkout needs it before adding the payment provider. If a font domain appears, check that the theme or design system uses it. This process creates a policy that matches your site instead of a copied string that nobody can maintain. A CSP report is not automatically a security problem. It may identify a legitimate font, payment script, or analytics request that your policy hasn’t approved yet. Watch for WordPress-specific breakage WordPress sites often use inline scripts. Plugins may print JavaScript directly into the page, and the block editor uses several requests that aren’t visible on a simple landing page. A strict script-src rule can therefore break: The mobile menu Form validation WooCommerce cart updates Product filters Cookie consent controls The block editor Search suggestions Login and password reset screens Avoid adding 'unsafe-inline' or 'unsafe-eval' without understanding why they are needed. They can make a policy work faster, but they weaken the protection CSP is meant to provide. If a plugin requires inline code, check whether it supports nonces or hashes, or decide whether that plugin belongs on the site. Test the public site and /wp-admin/ separately. A policy that works on the homepage may fail when you edit a page, upload media, open the customizer, or manage an order. You may need different handling for admin requests, but don’t create complex exceptions until the simpler policy has been tested. Don’t chase a perfect score by adding every available header. Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy can affect payment pages, embedded tools, pop-ups, and cross-origin resources. Add them only when you understand the site’s relationships with other origins. Test every feature after the header change A green homepage isn’t proof that the site works. Headers often affect actions that happen after a click. Open the site in a private browser window and test the main customer path. Visit a product page, add an item to the cart, complete the form, and check the confirmation message. Test the mobile menu, search, account login, password reset, cookie banner, and any appointment or quote tool. Then test the business side. Log into WordPress and edit a page with the block editor. Upload an image, preview the page, update a plugin if a staging site is available, and check that media libraries load. If your site uses WooCommerce, test a payment flow with the payment provider’s approved test method. Check the browser console for blocked resources. A CSP violation often identifies the directive and domain that needs attention. A generic “site is broken” report isn’t enough. Look for the exact page, action, request, and response header. Test at more than one level: Check the response headers on the homepage and important internal pages. Test logged-out and logged-in sessions. Check desktop and mobile layouts. Test in the browsers your customers use. Clear or purge page caches before checking again. Caching can make a header change appear inconsistent. Purge the WordPress cache first, then any CDN cache, and recheck the response. If one page has the new header and another doesn’t, inspect the cache rules and server configuration before changing the policy again. Use a header scanner after functional testing. A scanner can find missing or duplicated headers, but it can’t tell you whether your checkout or editor works. You need both checks. Choose a hosting setup that makes security easier Security headers are easier to manage when the hosting environment is clear and well supported. If you have to edit server files, configure a CDN, maintain WordPress plugins, and troubleshoot cache layers alone, a small header change can become an afternoon project. That isn’t the best use of your time when you’re running a business. At ZADiC, our hosting options are built for site owners who want dependable infrastructure without constant technical work. You can choose WordPress hosting for a straightforward setup, managed Web Hosting Plus for additional support and room to grow, or a managed VPS when the site needs more control and resources. Many plans include free SSL, and our services include security monitoring and 24/7 human support. That gives you a practical place to ask questions before enabling HSTS or CSP, especially when you aren’t sure whether a setting belongs in WordPress, the server, or the CDN. Hosting doesn’t make an unsafe configuration safe by itself. You still need updated software, strong admin access, backups, and sensible permissions. The difference is that a supported hosting layer gives you fewer moving parts to investigate when something changes. The simplest header setup is the one with one clear owner, one known-good configuration, and a tested rollback path. Keep the configuration working after updates Headers aren’t a set-and-forget task. WordPress plugins change their scripts. Themes add fonts or tracking tools. Payment providers update domains. CDN settings drift. A policy that worked last month can fail after an ordinary update. Keep a copy of the known-good header configuration. Record why each external domain is allowed and which feature depends on it. When a new domain appears in a CSP report, you can decide whether it belongs there instead of approving every request. Review reports regularly if you use a reporting endpoint. Collect enough data to include normal customer activity, not only your own visits. Two weeks can reveal a useful range of forms, devices, checkout paths, and logged-in actions. After plugin, theme, hosting, or CDN changes, run a short regression test. Check the homepage, contact form, checkout, login, editor, and any page with embedded content. This takes less time than tracking down a broken conversion path later. The security header rollout guide on GitHub also recommends conservative testing, report review, versioned configurations, and documented exceptions. Those habits matter more than adding a long list of headers once. If a feature breaks, roll back the most recent header change first. Don’t immediately weaken the entire policy. Remove one directive or one newly added domain, test again, and identify the smallest change that restores the feature. A practical rollout plan for WordPress sites Use this sequence when you want a clear path forward: Back up the site and create a staging copy. Identify where current headers are set. Remove duplicate or conflicting header rules. Confirm that every required domain and subdomain works over HTTPS. Add nosniff, a sensible referrer policy, and framing protection. Test the public site, dashboard, forms, checkout, and embedded features. Add HSTS with a short period before increasing it. Put CSP into report-only mode. Review reports and browser console messages for legitimate resources. Enforce CSP gradually, then keep testing after updates. This order keeps the blast radius small. If something stops working, you know which change to inspect. Conclusion WordPress security headers work best as a controlled layer, not a one-click score improvement. Start with simple protections, confirm HTTPS before HSTS, and build CSP from the resources your site genuinely uses. We recommend keeping the configuration in one place, testing customer and admin features, and saving a known-good version before every major change. With supported hosting, clear monitoring, and a staged rollout, better security doesn’t have to come at the cost of a working website. [...]
Read more...
WordPressWordPress Scheduled Posts: Fix Missed PublishingNothing is more frustrating than preparing content ahead of time, only to find that it never went live. Your WordPress scheduled posts can remain stuck in “Scheduled” or change to “Missed schedule” without any clear explanation. The cause is usually practical, not mysterious. WordPress depends on cron tasks, site settings, plugins, and hosting services working together. We can narrow down the problem quickly, fix the missed posts, and prevent the same issue from returning. Why WordPress scheduled posts miss their publishing time WordPress doesn’t use a traditional alarm clock for scheduled content. It uses a system called WP-Cron to check whether tasks are due. WP-Cron is a trigger, not a clock WP-Cron runs when someone visits your website or when WordPress receives another request. It checks the site’s scheduled tasks and runs anything that is due. That setup works well for busy websites. A site with regular visitors keeps triggering the process throughout the day. A newer business website with little traffic may not trigger it at the right time. Caching can add another obstacle. A visitor may receive a cached page without reaching WordPress’s PHP system. Security tools can also block the loopback request WordPress uses to run scheduled tasks. A scheduled post doesn’t publish because the date arrived. It publishes when WordPress gets a chance to process its scheduled event. The usual blockers Several issues can stop future posts from publishing: The site’s timezone doesn’t match the timezone you expect. WP-Cron is disabled in the wp-config.php file. A caching, security, or optimization plugin blocks cron requests. A plugin or theme creates a conflict with WordPress publishing tasks. The website is stuck in maintenance mode. Your hosting account has resource limits, failed loopback requests, or server-level cron problems. A recent migration changed the domain, server settings, or PHP configuration. WordPress may show the post as “Missed schedule” when its publishing event was due but never completed. The WordPress missed schedule error guide also points to timezone settings, maintenance mode, traffic, and cache as common areas to check. How to fix WordPress scheduled posts that never publish Start with the simple checks. There is no reason to change server settings if the post is set for the wrong time. 1. Check the post status and scheduled date Open Posts > All Posts in your WordPress dashboard. Find the post that failed and check its status. A post marked “Scheduled” may still be waiting for its event to run. A post marked “Missed schedule” was due to publish but wasn’t processed. Open the post and verify the date, time, and publishing timezone. If the post is already overdue, you can publish it manually or choose a new future date. Liquid Web’s manual rescheduling steps cover the same basic recovery process. Don’t create a second copy before checking the original. Duplicate posts can lead to repeated content, confusing URLs, and accidental double publishing. 2. Confirm the WordPress timezone Go to Settings > General and find the Timezone setting. WordPress schedules posts according to this site timezone, not necessarily the timezone configured on your hosting server or personal computer. Choose a city-based timezone when possible, such as New York, London, or Sydney. City-based settings handle daylight saving changes more reliably than a fixed UTC offset. Save the setting, then reschedule one test post for a few minutes in the future. This gives you a quick way to confirm whether the time mismatch caused the problem. 3. Clear server, plugin, and CDN caches Clear your caching plugin first. Then clear any cache provided by your hosting account or content delivery network. A browser refresh won’t fix a cron task, so clearing browser cache alone isn’t enough. The important step is making sure WordPress can receive a fresh request and execute PHP instead of returning a stored page. If you use Cloudflare or another security service, review its firewall events. Look for blocked requests to wp-cron.php, the WordPress login area, or your site’s loopback requests. 4. Check plugins and maintenance mode Caching, security, backup, performance, and automation plugins can affect scheduled publishing. A new plugin update may also introduce a conflict. Use a staging site if your host provides one. Otherwise, create a current backup before testing. Temporarily deactivate plugins that affect caching, security, redirects, or scheduled tasks. Then schedule a short test post. If the test works, reactivate plugins one at a time. Test after each change until the conflict appears. The WordPress support discussion about scheduled posts shows why testing the wider plugin and hosting setup matters. Also check whether the site is stuck in maintenance mode after an update. A failed update can leave WordPress unable to complete normal requests. 5. Inspect scheduled events The WP Crontrol plugin can show scheduled events inside the WordPress dashboard. It helps you see whether WordPress has created the publishing event and whether that event is overdue. Look for events related to future post publishing. You can also check whether other scheduled tasks are failing at the same time. Use care here. Deleting cron events without understanding them can remove tasks that plugins need. If you see repeated errors, a blank event list, or a large backlog, save the details and ask your hosting provider or developer to review them. 6. Check whether WP-Cron is disabled Some site owners disable built-in WP-Cron because they plan to use a real server cron job instead. That can improve control on a busy site, but only when the replacement task is configured correctly. Check your wp-config.php file for DISABLE_WP_CRON. If it is set to true, WordPress’s normal cron trigger is turned off. Don’t edit this file casually on a live site. A missing semicolon or incorrect setting can take the website offline. If a real cron job is already configured, your host can confirm whether it runs wp-cron.php at a useful interval. When the problem starts with hosting Sometimes the dashboard is fine, but the server can’t complete the task. That happens when loopback requests fail, PHP workers are exhausted, security rules block cron, or the account reaches its resource limits. Open Tools > Site Health and look for warnings about loopback requests, REST API access, or scheduled events. These warnings can connect a missed post to a wider hosting issue. Server logs can provide more detail. Look for PHP fatal errors, timeout messages, blocked requests, or memory-limit notices around the time the post should have published. A host can usually check these records faster than you can search through every plugin. This is where dependable WordPress hosting matters. Your content schedule shouldn’t depend on a fragile server setup that nobody is watching. With managed WordPress hosting, ZADiC gives you a practical place to get help with WordPress, hosting settings, security monitoring, and site performance. Our plans are built for small businesses and growing site owners who want reliable infrastructure without managing every server detail themselves. If missed posts happen repeatedly, ask support these questions: Is WP-Cron enabled, or is a server cron job replacing it? Are loopback requests reaching WordPress? Is a firewall blocking wp-cron.php? Has the account reached CPU, memory, or process limits? Do the PHP and server error logs show a publishing failure? Clear answers point to the real fix. Guessing usually creates more problems. Keep future posts publishing reliably Once the issue is fixed, test it before trusting your next content campaign to the schedule. Create a private test post for five or ten minutes in the future. Watch whether it publishes, then remove it. Keep WordPress, your theme, and your plugins updated. Apply updates carefully, especially when a plugin controls caching, security, automation, or content workflows. A staging environment makes this much safer. Review these settings whenever you move hosts, change domains, or rebuild the website: WordPress timezone and date format WP-Cron or server cron configuration Cache and CDN rules Security plugin settings PHP version and memory limit Site Health warnings Scheduled events in WP Crontrol High-traffic sites may benefit from a real server cron job that runs on a fixed schedule. Low-traffic sites can often use WP-Cron successfully when the host allows loopback requests and doesn’t interfere with WordPress’s requests. A reliable backup also matters. If a plugin update breaks publishing, you need a safe way to restore the site before the next post goes live. Hosting with backups, security monitoring, and human support gives you more room to fix problems without losing momentum. Conclusion Missed publishing usually comes down to one failed connection between WordPress, WP-Cron, your plugins, and your hosting server. Check the post time and timezone first, then clear caches, test conflicts, inspect scheduled events, and review cron settings. If the same WordPress scheduled posts keep failing, the server deserves attention. Reliable hosting and responsive support can turn a recurring publishing headache into a quick settings check, so your content keeps moving while you focus on the business behind it. [...]
Read more...

How to Fix the WordPress Too Many Redirects Error

Key Takeaways