Technical deep-dives from real client work. How I diagnosed, fixed, and prevented WordPress issues.
· 18 min read
PHP2Shell (CVE-2026-109618/109619) is a pre-auth RCE in PHP itself. How to check your PHP version in Site Health, patch your server, or chase your host.
· 9 min read
How I traced intermittent WooCommerce checkout timeouts to a plugin running 12-second full table scans, using the MariaDB slow query log and pt-query-digest.
· 10 min read
How a shared PHP-FPM pool let one WooCommerce site starve five others, and the per-site pool config that prevents it.
· 11 min read
A WooCommerce store's Black Friday sale prices never activated. The root cause was a broken cron chain, a timezone trap, and a stale lookup table.
· 9 min read
Diagnosing why a WooCommerce store's product edit screen took 40 seconds to load — and the database, AJAX, and caching fixes that cut it to under 3.
· 12 min read
How I traced wrong WooCommerce prices to the new product object cache in WooCommerce 11.0 conflicting with a plugin that writes prices via raw SQL.
· 15 min read
A WooCommerce store got hit by a card testing attack overnight. Here's how I stopped it, cleaned up, and what I now configure on every store to prevent it.
· 12 min read
How switch_to_blog() silently leaks memory in WordPress Multisite loops, crashing PHP-FPM workers — and how to fix it with WP-CLI process isolation.
· 9 min read
If your WordPress 7 block editor loads the sidebar but shows a blank canvas, your Content Security Policy is blocking the blob: iframe.
· 19 min read
How I restored real visitor IPs on WordPress behind Cloudflare — fixing broken fail2ban, Wordfence lockouts, and wrong WooCommerce geolocation.
· 9 min read
How to diagnose and fix a stuck WordPress auto-update lock that leaves sites silently missing security patches.
· 9 min read
Diagnosing 403 errors on WooCommerce checkout and WordPress admin caused by ModSecurity false positives, and fixing them without disabling the WAF.
· 11 min read
A routine audit uncovered 23 PHP shells in wp-content/uploads. Here's how they got there, how I cleaned them, and the server config that prevents it.
· 18 min read
How I triaged, patched, verified and cleaned up 70+ WordPress sites after the wp2shell pre-auth core RCE (CVE-2026-63030). The full incident-response record.
· 7 min read
How a one-line change in WordPress 6.9's wp_mail() broke email delivery on servers using PHP mail(), and how I fixed it for clients.
· 14 min read
A WooCommerce store with 8,000 products had MariaDB grinding to a halt every afternoon. The root cause was WordPress's default search running full table scans.
· 12 min read
How a cloned staging site processed live Stripe payments, sent real customer emails, and ran subscription renewals — and how to prevent it.
· 10 min read
WordPress's own Performance Lab plugin quietly replaced object-cache.php, disabling Redis without any error. Here's how I found it and fixed it.
· 8 min read
How I recovered two WooCommerce stores from the 10.9 fatal error and the gated update workflow I use to stop it happening again.
· 11 min read
How I traced intermittent 502 Bad Gateway errors to OPcache JIT segfaults, and why JIT is almost never worth enabling on WordPress.
· 8 min read
After a server migration, WordPress auto-updates stopped, plugins wouldn't install, and uploads failed. All three traced to one file ownership mistake.
· 12 min read
Expired transients piled up in wp_options and added seconds to every page load. Here's how I diagnosed the bloat and automated the cleanup.
· 14 min read
How I fixed 'Illegal mix of collations' errors that broke WooCommerce search after server migrations — diagnosis SQL, bulk conversion, prevention checklist.
· 11 min read
How I checked 70+ WordPress sites for the Gravity SMTP vulnerability that exposes email API keys to unauthenticated attackers.
· 12 min read
A WordPress site had 847K revisions in wp_posts. Here's how I found the bloat, cleaned it safely with WP-CLI, and stopped it coming back.
· 14 min read
Diagnosing WooCommerce orders stuck on pending payment when Stripe webhooks silently fail — signing secret mismatches, endpoint errors, and how to recover.
· 8 min read
Three issues I hit upgrading to WordPress 7.0 Armstrong — blocked database updates, broken admin columns, and WooCommerce styling.
· 10 min read
How a forgotten debug.log exposed database credentials and session cookies on a production WooCommerce store, and how to lock it down permanently.
· 15 min read
How I traced three WordPress slowdowns to bots flooding /wp-json/, and the Nginx rate limiting, Fail2Ban and WordPress fixes that stopped them.
· 8 min read
Diagnosing and fixing the nginx 'upstream sent too big header' error on WooCommerce stores caused by cookie and session bloat.
· 9 min read
How to enable, read, and act on the PHP-FPM slow log to pinpoint the exact plugin or function dragging your WordPress site down.
· 12 min read
A single update_option() call invalidated the alloptions cache, triggering a thundering herd that overwhelmed MariaDB. Here's how I diagnosed and fixed it.
· 16 min read
A 128MB buffer pool crippled a 16GB VPS. A 2GB pool got MariaDB OOM-killed on a 4GB VPS. How I size the InnoDB buffer pool to the actual working set.
· 12 min read
How I diagnose and fix silent Let's Encrypt renewal failures on WordPress VPS setups, from nginx misconfigs to Cloudflare redirects.
· 11 min read
A WooCommerce store's prices were wrong on listings and sort-by-price was broken. The cause: a desynced wp_wc_product_meta_lookup table after a CSV import.
· 8 min read
Three WooCommerce stores lost SSL overnight. The cause: a certbot renewal cron that vanished during a server migration three months earlier.
· 9 min read
How I diagnosed a WooCommerce checkout slowdown caused by a bloated sessions table with 180,000 expired rows and a missing database index.
· 10 min read
A WooCommerce store's checkout kept locking up twice a day. The cause: a sessions table with 69,000 expired rows and no index on session_expiry.
· 9 min read
How WooCommerce's block checkout migration silently kills GA4, GTM, and Meta Pixel tracking — and the server-side fix that restores it.
· 10 min read
A WooCommerce flash sale caused database deadlocks during stock reduction. Here's how I diagnosed the InnoDB lock contention and stopped orders from failing.
· 8 min read
How I diagnosed a WooCommerce store where Cloudflare's Cache Everything page rule was caching cart and checkout pages, causing empty carts and stale data.
· 9 min read
A WooCommerce checkout slowed to 12 seconds. The cause: 8 million orphaned rows in wp_postmeta. Here's how I cleaned and indexed it.
· 11 min read
Fix the stuck WordPress maintenance mode error by deleting .maintenance, plus how to prevent it from happening again.
· 12 min read
How WordPress 6.8's speculative loading silently inflates your Meta Pixel, TikTok, and LinkedIn analytics — and four ways to fix it.
· 10 min read
The WordPress memory exhausted error has deeper causes than most guides cover. Here's how I diagnose and fix the real problem instead of just raising the limit.
· 11 min read
How to diagnose and fix PHP OPcache misconfigurations that cause WordPress slowdowns, stale code after updates, and random cache resets.
· 12 min read
WordPress xmlrpc.php lets attackers try thousands of passwords in one request. Here's how to detect and block XML-RPC brute force attacks at the server level.
· 12 min read
How I diagnose a slow WordPress admin using Query Monitor, WP-CLI, and slow query logs to find the actual bottleneck instead of guessing.
· 11 min read
A systematic guide to diagnosing what's eating disk space on a WordPress server, from runaway logs to forgotten backups and bloated MySQL data.
· 9 min read
The WordPress media upload 'HTTP error' has no useful detail. Here are the five server-side causes I find most often and the exact fixes for each.
· 12 min read
WooCommerce silently disables webhooks after repeated delivery failures. Here's how to diagnose and prevent silent data loss.
· 10 min read
Four ways attackers discover WordPress usernames via author archives, REST API, oEmbed, and sitemaps — and exact fixes for each one.
· 13 min read
A WooCommerce store was charging customers twice. Here's how I found three separate causes and the fixes that stopped every one of them.
· 10 min read
A systematic guide to diagnosing and fixing WordPress redirect loops, from Cloudflare SSL modes to reverse proxy headers and plugin conflicts.
· 11 min read
Step-by-step guide to diagnosing and fixing WordPress cURL error 28 connection timeouts affecting Site Health, plugin updates, and WooCommerce.
· 9 min read
How to diagnose and fix a WordPress site broken by a plugin update using Recovery Mode, WP-CLI rollback, SFTP, and safe update practices.
· 9 min read
Step-by-step diagnosis and cleanup of a WordPress redirect hack using WP-CLI, grep, and SQL to find malware in .htaccess, wp_posts, and a mu-plugin.
· 13 min read
Step-by-step guide to checking if your WordPress site was compromised by the EssentialPlugin backdoor that hit 400,000+ installs in April 2026.
· 9 min read
Step-by-step guide to stopping WordPress brute force attacks at the server level using Fail2Ban jails, Nginx rate limiting, and XML-RPC lockdown.
· 11 min read
How I diagnosed and fixed a WooCommerce store's emails landing in spam using SMTP, SPF, DKIM, and DMARC. Step-by-step guide.
· 14 min read
How I traced two servers' CPU problems to admin-ajax.php — Heartbeat tuning, WooCommerce cart fragments, rogue plugins, and nginx rate limiting.
· 15 min read
A WooCommerce store hit 504 Gateway Timeouts at checkout. The cause was a blocking shipping rate API call. Here is how I found and fixed it.
· 17 min read
Two WooCommerce stores served customers each other's carts because nginx cached session cookies. The fastcgi_cache config I now use on every client site.
· 12 min read
A hosting provider used sed on a SQL dump to change domains. It corrupted every serialized value in the database. Here's how I diagnosed and repaired it.
· 13 min read
Two real MariaDB incidents behind WordPress's database connection error: connection exhaustion mid-sale, and an upgrade that took down 47 sites.
· 13 min read
How I batch-upgraded 30 WordPress sites from PHP 8.1 to 8.3, plus containing a forced PHP 8.4 upgrade that flooded 14GB of deprecation logs.
· 10 min read
How I diagnosed a WooCommerce store where Redis was 'working' but silently evicting keys, causing random slowdowns and stale data.
· 9 min read
Multiple WordPress sites sharing one Redis instance can silently leak data between each other. Here's how I diagnosed and fixed it.
· 13 min read
How I traced missing WooCommerce emails and failed renewals to broken WP-Cron, cleared 4,200 stuck scheduled actions, and replaced it with a system cron.
· 13 min read
Action Scheduler tables grew to tens of millions of rows on two WooCommerce stores. The batched cleanup and retention filters that fixed both.
· 8 min read
A WordPress site was loading 12MB of abandoned plugin data on every request. Here's how I found the bloat in wp_options and cut page load times in half.
· 17 min read
Step-by-step HPOS migration for a large WooCommerce store, plus the silent failures — broken tracking, corrupted customer lookup — I've cleaned up after.
· 6 min read
WordPress 6.9.2 security patch caused white screens across thousands of sites. Why it happened and how maintenance plans prevent the damage.
· 8 min read
A practical guide to diagnosing and fixing the WordPress white screen of death, from a developer who deals with it regularly.
· 5 min read
Investigating why 83 PayPal subscription renewals were failing in WooCommerce. The root cause: the PPCP plugin never successfully stored vault tokens for any subscription.
· 6 min read
How I diagnosed and fixed a WooCommerce database crisis where MariaDB was consuming 1479% CPU with queries running for 376 seconds. The root cause was a transient race condition.
· 5 min read
Discovering and removing a sophisticated cryptominer from a Linux server that used 14 different persistence mechanisms including systemd services, cron jobs, and immutable file attributes.
· 6 min read
How too many PHP-FPM workers caused MariaDB to be killed by the OOM killer. The math behind pm.max_children and a formula for getting it right.
· 9 min read
How I used WP-CLI to automatically generate and apply meaningful alt text to 2,846 images on a WooCommerce site, handling edge cases like size suffixes and generic filenames.
· 7 min read
Investigating a CloudPanel server compromise where an attacker created an admin user via clpctl. Tracing the attack through auth.log, checking for backdoors, and hardening the server.
· 12 min read
Solving the challenge of calculating WooCommerce shipping rates programmatically in Action Scheduler background jobs where WC()->session doesn't exist.
· 6 min read
How LiteSpeed's Guest Optimization CSS handling caused a flash of unstyled content on sites with splash screens, and the settings adjustments that fixed it.
I manage 70+ WordPress sites for agencies and businesses. Whether you need ongoing maintenance, emergency support, or a one-off performance fix — I can help.
View Maintenance Plans Get in Touch
