WordPress Guides
Plain-language guides on WordPress maintenance, speed, and security, written the way we'd explain it to a client, not a search engine.
WCAG conformance: four ways it quietly lapses after an audit
For a nonprofit that receives HHS funding, the Section 504 rule sets WCAG 2.1 Level AA from May 11, 2027 at 15…
WCAG 2.1 AA standards: what the standard actually requires
WCAG 2.1 Level AA is the standard HHS's Section 504 rule names for recipients' web content, from May 11, 2027 for recipients…
Data security plan for tax preparers: the client upload path belongs in it
Every paid preparer renewing a PTIN signs Form W-12, which says preparers are required by law to keep a written information security…
When will WCAG conformance become required? What Section 504 asks now, and in 2027
HHS's Section 504 rule makes WCAG 2.1 Level AA the standard for recipients' web content, from May 11, 2027 at 15 or…
PCI DSS 6.4.3: does it apply if you use Stripe?
Your WooCommerce store takes cards through Stripe, and Stripe supplies the card fields. PCI DSS 6.4.3 covers scripts on the payment page,…
Lexcel accreditation and WordPress maintenance: who looks after the website
A practice that holds Lexcel accreditation has a written policy for each thing the standard asks for. What the policy cannot show…
SRA Digital Badge: Is Yours Still Showing Today’s Date?
An authorised body must display its SRA number and the SRA digital badge on its website, and the badge became mandatory on…
Section 508 Compliance: Who Must Comply, and What Reaches a Funded Nonprofit
HHS funding now carries a dated web accessibility requirement: May 11, 2027 for an organization with 15 or more employees, and May…
Cyber Essentials Renewal: What Changes Each Year
A supplier on a central government contract renews Cyber Essentials certification every 12 months. The requirements and the question set can change…
5 Control Points of Cyber Essentials: What Each of the Five Asks
A UK supplier holds Cyber Essentials because a central government contract asked for it and renews it every year. The scheme's five…
WCAG guidelines: standards and conformance levels
If your nonprofit receives HHS financial assistance, the Section 504 rule gives your website a date: May 11, 2027 with 15 or…
How Do You Check If Your Website Is Secure?
There is no single test that confirms a website is secure. A green padlock, a clean blacklist result and a passing Google…
Core Web Vitals for WordPress: LCP, INP and CLS
Core Web Vitals are three separate measurements, loading, interactivity and visual stability, and a WordPress site can fail any one of them…
How Do I Know If My WordPress Site Is Hacked?
Something about the site looks off: a warning in search, an email from the host, or a visitor who landed somewhere strange.…
WordPress Update Management: Core, Theme and Plugin Updates Done Safely
WordPress core, themes and plugins each update on their own schedule, and WordPress ships a built-in auto-update toggle for all three. Core…
Cyber Essentials Security Update Management: Does the 14-Day Rule Cover Your WordPress Site
Cyber Essentials requires every in-scope device to run software that is kept up to date, and it names commercial off-the-shelf applications and…
Do Websites Really Need Monthly Maintenance?
A website that launches clean does not stay in that state, because WordPress core, the theme and every active plugin are each…
How to Choose a WordPress Maintenance Company
Every established WordPress maintenance company says the same five things. This guide turns the pitch into five checkable criteria, explains the mechanism…
Cyber Essentials Malware Protection for Your Website
Cyber Essentials asks every applicant to name their in-scope devices and show a malware protection mechanism on each one. The requirements document…
WordPress Security Hardening: What It Is and What It Actually Covers
You have a security plugin installed, updates mostly happen, and the site has never been hacked. That is a reasonable place to…
WordPress PCI Compliance: What Applies to Your Payment Page
Your checkout runs on WordPress, with card fields from Stripe or WooPayments, and once a year you complete a self-assessment questionnaire rather…
How Often Should a WordPress Site Be Updated?
A WordPress site runs core, a theme, and a handful of plugins, each on its own release schedule. WordPress only auto-applies a…
How Much Does WordPress Maintenance Cost?
You are comparing WordPress maintenance quotes and the numbers run from five dollars a month to five hundred. Two plans at the…
What Are the Security Risks of WordPress?
"WordPress is insecure" gets said a lot, and it is not quite the right claim. Nearly every disclosed WordPress vulnerability lives in…
Why Is My WordPress Site So Slow?
Your WordPress site takes forever to load, and you have already tried the obvious fixes. A slow site is almost never one…
How to Speed Up a WordPress Site
A slow WordPress site turns up under a search for "how to speed up wordpress" as a dozen unrelated tactics, with no…
The WordPress Maintenance Checklist
This is the checklist for what a WordPress site actually needs on a recurring basis: core, plugin and theme updates tested before…
What Is a WordPress Care Plan?
A live WordPress site needs someone keeping it running, and "WordPress care plan" shows up in every search for that help. Providers…
Is WordPress Secure? The Honest Answer
WordPress powers a huge share of the internet. That scale is why "WordPress security" gets so much conflicting advice. Some of it…