FAQInformation Desk
WordPress FAQs, answered at the desk
We get asked a lot of questions about WordPress. These answers go in depth on what our services cover to keep your WordPress website fast, safe, and secure.
“It is such a relief to know my website maintenance and security is covered.”
“Now when something needs updating, I just send them a message and it's done.”
“...I literally got three days of my month back.”
“...Jeane's team migrated and fixed everything in a day plus set up real security.”
“She saves me countless hours, allowing me to focus on what I do best!”
01The Question Board
Find your question on the board
All 19 questions, sorted into four gates. Pick one to jump straight to its answer.
Information Desk
19 Questions
WordPress basics
5 Questions
Logins and encryption
5 Questions
Attacks and malware
6 Questions
Backups and monitoring
3 Questions
Not on the board? Bring your question to a free call with Jeane’s team.
Nothing on the board for that one. Ask us on a free call.
02WordPress Basics
How your site fits together
Core, themes, plugins, and the database: what each one is, and how we keep them in shape for you.
What are WordPress core updates?
WordPress is the content management system (CMS) behind millions of websites, and part of its appeal is how easy it is to use and maintain. The core software gets regular updates that keep things running smoothly and add new features. When a new version comes out, your WordPress dashboard shows a message asking you to update. It only takes a few minutes: click the update button and follow the prompts. Staying current matters for security, and it gets you the new features and improvements too.
When you’re a Website HQ client, we monitor your website daily and keep the WordPress core files up to date, so you can focus on your business and leave the WordPress tech to us.
What is a WordPress theme?
A theme is a pre-designed template you install to change how your WordPress site looks. Thousands of free and paid themes are out there, so you’ll find one that suits your needs. You can install a theme from the WordPress admin panel, or download it from a third-party site and upload it to your server. Once you activate it, the theme takes over the styling of your site and gives it a whole new look.
When Website HQ designs your website, we provide the theme and keep it updated too, so you don’t have to worry about the technical details.
What are WordPress plugins?
Plugins are small bundles of software that add features to your WordPress site. There’s a plugin for almost everything, from contact forms to eCommerce, plus SEO, social media, and security. Some are free and some you buy. Once you find one you want, you install it, activate it, and start using what it adds.
We monitor every Website HQ client’s site daily for plugin, theme, and WordPress updates, so you can put your time into growing your business.
Are WordPress plugins risky?
They can be. Plugins add a lot to a WordPress site, but every plugin, free or premium, is code written by a third-party developer, and any time you add code to your site you add room for vulnerabilities. A few simple habits keep the risk low. Only install plugins from trusted sources. Keep your plugins up to date. And delete the ones you aren’t using.
We only install plugins from trusted developers, so you can rest assured your website is safe.
What is WordPress database optimization?
WordPress stores your content in a database, which makes it easy to organize and manage. Over time, that database gets bloated with outdated or unused data, and your site’s performance suffers. Database optimization cleans it up by removing the data you don’t need, which helps your site’s speed and cuts the risk of errors.
You can optimize a database with a plugin or tool, by working in the database directly, or by changing your wp-config.php file. Done wrong, it can cause serious problems with your website, so always back up your database first, and if you’re not confident, leave it to a professional.
Our WordPress team keeps your site optimized for speed and performance on every care plan, so your visitors have a great experience.
03Logins and Encryption
Locks, keys, and logins
How your site proves who it is, and how it keeps the wrong people out.
What is an SSL certificate?
An SSL certificate is a digital certificate that confirms your website’s identity and encrypts the information sent to your server. When a browser connects to a site with an SSL certificate, it checks that the certificate is valid and trusted. If it is, the browser encrypts everything sent between itself and the site, which makes it much harder for hackers to intercept and read anything sensitive. Every major browser shows a padlock in the address bar when a site has a valid certificate, so visitors can see at a glance which sites are safe to use.
An SSL certificate holds two critical pieces of information: a public key and a private key. Both are generated by the Certificate Authority (CA) when the certificate is issued, and the CA runs several other checks to make sure the website is legitimate first. Once issued, the certificate has to be installed on your web server to secure communications.
If you run a website, you need one. It keeps your customers’ data safe and their trust intact, and it helps your search ranking and conversion rates too. At Website HQ, your SSL certificate is included with your maintenance and hosting, so your visitors’ data is encrypted and safe.
What is brute force protection?
A brute force attack is trial and error: an attacker tries different username and password combinations until one works. Brute force protection for WordPress fights back by blocking IP addresses used in earlier brute force attacks, which helps keep your site from being compromised. It isn’t a silver bullet, though. Your site still needs other protection, like two-factor authentication.
Brute force protection comes with every Website HQ maintenance plan, which means more uptime and less worry about your website.
What is 2-factor authentication?
2-factor authentication, also called 2FA, is an extra layer of security for your WordPress account. With 2FA turned on, you enter your password plus a second piece of information before you can log in. That second factor might be a code from an app on your phone, or something physical like a security key. Either way, it’s one more step that makes it much harder for someone to break into your account. It isn’t foolproof, but it’s a critical security measure for your site.
What is a secure password?
A secure password is one of the main ways you protect your information online. A good one is at least eight characters long and mixes upper and lowercase letters, numbers, and special symbols. Skip easy guesses like “password” and personal details like your birthdate. Use a different password for each of your accounts, too, so if one gets hacked, the others stay safe.
What are authentication keys for a website?
When you visit a website, your browser sends a request to the site’s server, and the server sends back what you asked for. Sometimes the server needs more from your browser first. When you log in, for example, the server has to confirm who you are before it gives you access. That confirmation is usually done with authentication keys: unique strings of characters that verify a user’s identity. They generally work alongside a username and password to make sure only authorized users get in.
Not every website needs authentication keys, but sites with sensitive or confidential information often use them to keep their content limited to authorized users.
04Attacks and Malware
What we keep out of your site
The threats WordPress sites face, and what we do about each one.
What is a firewall?
A website firewall protects your site from being hacked. It blocks malicious requests before they reach your website, which helps stop WordPress hacking attempts and other unwanted activity. WordPress firewalls can also block specific IP addresses, which helps when someone keeps trying to get into your site. For WordPress, you can get a firewall as a plugin or as a service from a WordPress security company. If you’re serious about WordPress security, you need one.
Every website hosted and maintained by Website HQ gets firewall protection (a WAF) with its service, so your site stays protected and online around the clock.
What is malware?
Malware is software designed to damage or disable computers, computer systems, or websites. It can steal personal information, destroy data, or take control of a computer. It often spreads through email attachments or downloads from infected websites, and an attacker with physical access to a machine can install it directly. Once it’s in, malware can be hard to remove, and it can do serious financial damage to businesses and individuals.
What is a malware scan?
A malware scan checks a website for malicious code. It helps find and remove viruses, worms, Trojans, and other kinds of malware. Scans can be manual or automatic: security software usually runs the automatic ones, while a manual scan means someone checks the site’s code by hand. Scanning is an important part of keeping a website safe, because removing malicious code protects the site’s reputation and stops cyber criminals before they do more damage.
We scan Website HQ clients’ WordPress websites multiple times a day to protect them against malware. And if your website is ever breached, we fix it at no additional cost, so you have peace of mind that your website is safe.
What is a fake website crawler?
A fake website crawler (or spider) is a bot built to act like a real visitor: it browses websites and interacts with them realistically. People run them for different reasons, such as testing a site’s security or gathering data about its content and structure. They can be hard to detect, because they often disguise themselves well, but there are telltale signs, like unusually high traffic or unexpected links showing up on your site.
If you suspect a fake crawler is on your site, block it from your content. Left alone, it can do serious harm to your business. It also uses up your site’s allocated resources and can throw off your analytics data.
What is comment spam filtering?
Comment spam filtering protects your website from spam comments. Automated scripts usually generate them, and they can be hard to spot. They may link to shady websites, or simply try to advertise a product or service. Either way, they’re a nuisance for you and your visitors. Filtering services find and flag spam comments so they’re easier to moderate, and some stop them from being posted at all. The result is a cleaner, safer comment section.
We recommend plugins and monitoring services that reduce comment spam on all our clients’ WordPress websites, so your site isn’t littered with unwanted and unruly comments.
What is DDoS mitigation?
A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic to a server, service, or network by flooding it, or the infrastructure around it, with internet traffic. It works by using many compromised computer systems as the sources of that traffic.
An attacker usually targets a single system connected to the internet and sends it a flood of traffic that looks legitimate, until the system or the infrastructure around it is overloaded and real requests struggle to get through. The common signs are slow performance, outages that come and go, and complete shutdowns.
For all their sophistication, DDoS attacks are fairly easy to carry out. Attackers can rent or buy botnets (networks of hijacked computers) and use them to flood a target with illegitimate traffic until its applications and services go offline. Some also go after infrastructure like DNS servers to make a website unreachable.
DDoS and DoS attacks are not the same. A DDoS attack attacks a single system, while a DoS attack targets multiple systems. DDoS attacks are also harder to stop and do more damage, so they’re usually considered more severe.
DDoS mitigation protects a network or system from these attacks, and the right strategy depends on what that network or system needs. One common approach uses a series of DHCP servers to distribute IP addresses to clients, which makes it harder for attackers to target a single IP address. Another uses rate-limiting rules to cap the traffic aimed at any one IP address. Whatever the approach, the goal is to make a DDoS attack harder to pull off.
Every Website HQ client gets DDoS mitigation to keep their website up and available around the clock.
05Backups and Monitoring
Watching your site so you don’t have to
If something goes wrong, this is how we spot it and bring your site back.
What are cloud backups?
A cloud backup keeps your website’s data safe by storing it in the cloud, so it’s there when you need it, no matter what happens to your computer or servers. If you ever need to restore your website from a backup, we can do it in a few clicks with our cloud backup service. No lost data, and no starting your website over from scratch.
Every Website HQ maintenance client gets daily onsite and offsite cloud backups, so you’re protected if something unexpected happens.
What is real-time monitoring?
Real-time monitoring means continuously checking a website’s uptime, performance, and features, so the site runs smoothly and visitors can always reach the information they need. The tools run from simple ping tests to systems that track every part of a site’s performance. Most of the time, dedicated website monitoring services handle it: they ping the site regularly, check server logs, and track user activity. Watching a website continuously is how a business knows its site is up and running.
At Website HQ, we monitor our clients’ websites daily to keep the software up to date, prevent security breaches, and scan for malware, so you never have to become a WordPress expert.
What is a DNS change alert?
DNS stands for Domain Name System. It translates domain names (like www.example.com) into IP addresses (like 192.0.2.1). Devices connect to the internet using IP addresses, but people remember domain names much more easily. So when you type a domain name into your browser, your computer asks a DNS server for the matching IP address, and once it has it, your browser connects to the website. DNS servers are run by internet service providers and other companies around the world, and they usually keep a cache of commonly requested IP addresses to speed things up.
A DNS change alert is a notification sent whenever someone changes a domain’s DNS records. It helps you keep track of changes and keep an eye on security risks. If someone changed your DNS records maliciously, for example, your domain could stop working or redirect to a malicious website. With an alert in place, you hear about every change to your DNS records and can act if you need to.
Website HQ protects our clients’ websites with change alert monitoring, which means your domain can’t be stolen and moved.
06Boarding Pass
What our care plans include
Most of the answers above end with what we do about it. Here is that work, all on one pass.
Passenger
Your WordPress Website
Class
Covered, Managed or Mission-Critical
- Optimized speed and performance
- Free CDN
- Free SSL certificates
- Domain management help
- 3x daily site backups
- 2x daily malware scans
- Website firewall
- Malware removal and cleanup
- DDoS mitigation
Fare
From $125 a Month
Guarantee
30 Days Risk-Free
Billing
Month to Month
“The Website HQ team keeps our website up-to-date with the latest compliance in our industry. I don’t need to worry about the back-end tech, they have it covered.”
“The team at Website HQ has done a tremendous job keeping our website safe and secure. They implemented improvements that turned our site profitable, and they are responsive to requests.”
Still have questions?
Jump on a free call to find out how we can help with your website.
Book a free, no-pressure call with Jeane's team. Plans start at $125 a month, and every one comes with a 30-day risk-free guarantee.
