Certified WordPress Developer and SEO Specialist with 10+ years of experience on Fiverr. I provide expert solutions for WordPress error fixing, debugging, speed optimization, and security hardening. Services include hacked site recovery, malware removal, on-page SEO optimization, and full customization to ensure your website runs fast, secure, and ranks higher on Google.
Do you need to regenerate or flush your WordPress permalinks?
If you are not able to view your website content, then neither can your visitors. Broken links and 404 errors can damage the user experience, and your position in SEO rankings.
In this article, we will show you how to fix these dead URLs by regenerating your permalinks in WordPress. We will also talk about what causes this error, and how to spot broken links, before your visitors do.
Why Do I Need to Regenerate Permalinks in WordPress?
Most of the time, the URLs on your WordPress site are permanent and won’t cause any problems. They just work.
However, sometimes you may click on a link and get a 404 error. You might even get a 404 when trying to access your entire WordPress website.
This sometimes happens after moving your WordPress site to a new host or server. It could also happen after you install a new plugin. This is because some plugins edit your site’s .htaccess file without your knowledge. This can affect your site in lots of different ways, including damaging your URLs.
Note: For this tutorial, you’ll need to be able to log in to the WordPress dashboard. If you can’t access your WordPress admin page, then see our step by step guide on what to do when you are locked out of WordPress admin.
Often, regenerating your permalinks can be a quick and easy fix for those issues. Let’s take a look at how to do that.
How to Regenerate Your Permalinks in WordPress
When you regenerate your links, you’re rebuilding and repairing the WordPress permalink structure. This may sound complicated, but don’t worry. You simply need to click on a button, and WordPress will handle the rest.
To get started, head over to Settings » Permalinks from your WordPress admin menu.
This will take you to the WordPress Permalinks Settings page. Here, you’ll see the permalink structure that you’re currently using.
WordPress supports several options for permalinks. You can see our guide on how to create custom permalinks in WordPress for step by step instructions on how to customize them.
To regenerate your permalinks, just scroll to the bottom of the page and click on the ‘Save Changes’ button.
After a few moments, you should see a message confirming that WordPress has updated your permalink structure.
That’s it! WordPress has now regenerated your permalinks.
To make sure it worked, head over to your site and try clicking on a few different links.
Are You Still Seeing Permalink Errors After Regenerating?
If this doesn’t fix the problem, then think about what happened right before you started seeing these 404 messages. If you’d just installed or updated a plugin, then this might have affected your links. You can try disabling this plugin, to see whether this removes the 404 error.
If this doesn’t work, then you can try deactivating all plugins to see whether this fixes your broken links.
This is a bit of a drastic step, so it’s smart to put your site into maintenance mode first. This will keep visitors informed while you test your plugins, giving a better impression than seeing a broken website.
If deactivating all of your plugins solves the problem, then you’ll know that at least one plugin is affecting your URLs. In this case, reactivate each plugin individually and then test how this impacts your links.
When the 404 error reappears, you’ve found the plugin that’s causing the issue. You can then delete this plugin from your site or ask the developer for support.
How to Track and Avoid Broken Permalinks in WordPress
Broken links are bad news for visitors, conversions, and your search engine rankings. Over time, dead URLs can impact where you appear in the search engine rankings. This means less traffic to your website.
With so much at stake, you’ll want to know about any dead links as soon as possible.
The easiest way to track and fix broken links on your WordPress website is by using the All in One SEO (AIOSEO) plugin for WordPress. Over 3 million website owners use AIOSEO including us here at WPBeginner.
AIOSEO allows you to easily find broken links and fix them with just a few clicks using their powerful redirection manager. For more details, please see our guide on how to track 404 pages and redirect them in WordPress.
Do you want to install and set up W3 Total Cache on your WordPress website?
W3 Total Cache is a popular WordPress caching plugin that helps you to improve your website speed and performance.
In this beginner’s guide, we’ll show you how to easily install and set up W3 Total Cache on your WordPress website.
Editor’s Note: We don’t use W3 Total Cache on our website anymore and have switched to WP Rocket which is a premium caching plugin. W3 Total Cache is still a fine solution that works well.
By default, WordPress uses PHP to dynamically generate each page on your website when it is requested by a user.
PHP is a server-side programming language. This means each user request increases the load on your server. This affects your website’s performance, user experience, and SEO.
WordPress caching plugins help you reduce this by skipping PHP and serving a cached copy of your webpage.
It also allows you to easily connect your website to a CDN (content delivery network) to further improve your website performance.
Installing W3 Total Cache in WordPress
Before you install the W3 Total Cache plugin in WordPress, you’ll need to make sure that you deactivate any other caching plugin on your website. This would help you save server resources and prevent any plugin conflicts.
Upon activation, W3 Total Cache will add a new menu item labeled ‘Performance’ to your WordPress admin sidebar. Clicking on it will launch the plugin’s setup wizard.
Simply click on the Next button to continue.
First, you will be asked to turn on Page Cache. Click on the Test Page Cache button to continue.
W3 Total Cache will show you different storage engine options. You need to choose one that saves you the most time. Usually, it will be the ‘Disk: Enhanced’ option for most shared hosting platforms.
Click on the Next button to continue.
Now, you will be given the option to Test Database Cache. We recommend choosing None. For most small to medium sized websites your MySQL server will be able to fetch data more quickly than the Database cache.
Click on the Next button to move on to the next step.
This will bring you to the Object Cache section. Object Caching allows W3 Total Cache to store database queries for dynamic pages and reuse them to improve performance.
If the test result shows barely a few milliseconds difference then you can choose None.
Click on the next button to continue.
After that, click on the Test Browser Cache button and then select the ‘Enabled’ option under the test results.
This option requests user’s browsers to store a copy of the web page for a limited time. Loading a page from browser cache is much faster than loading it from your web server’s cache.
Click on the next button to move on to the next step.
Now, WordPress comes with built-in lazy loading for images. However, some older browsers may not have support for that feature.
W3 Total Cache uses JavaScript to add lazy loading for images, which can be even faster and more efficient.
After that, click on the Next button to finish the setup wizard and view W3 Total Cache dashboard.
Advanced Caching Options in W3 Total Cache
The basic settings would work for most websites. However, there are many advanced options that you can configure to further improve performance.
Let’s take a look at the most important ones.
Minifying JavaScript and CSS in W3 Total Cache
The term ‘minify’ is used to describe a method that makes your website file sizes smaller. It does this by removing white spaces, lines, and unnecessary characters from the source code.
Note: Minifiying JS and CSS files can potentially break your website. If you turn it on and your website doesn’t look right, then simply disable these options.
W3 Total Cache allows you to easily minify JavaScript, CSS, and HTML source code as well. However, we recommend only minifying JavaScript and CSS files.
Simply head over to Performance » Minify page and scroll down to the JS section.
Check the box next to ‘JS minify settings’ to enable it.
Now, scroll down to the CSS section and enable CSS minify settings the same way.
Don’t forget to click on the Save All Settings button to store your settings.
CDNs or content delivery networks help you further improve your website performance by serving static files like images, CSS, JavaScript from a global network of servers.
This reduces the load on your WordPress hosting server and improves page load speed.
W3 Total Cache comes with built-in support for various CDN platforms.
We recommend using Bunny.net which is the best CDN solution on the market. This is what we use for our OptinMonster website.
First, you need to signup for a Bunny.net account. After signup, you need to create a Pull Zone for your website.
A pull zone adds a hostname to Bunny.net CDN. This hostname is then used to serve static files for your website.
Add a name for your pull zone and then provide your website’s domain name.
After adding the pullzone, you need to visit the Performance » General Settings page and scroll down to the CDN section.
Check the Enable box next to the CDN option and choose Generic Mirror next to the CDN Type option.
Don’t forget to click on the Save All Changes button to store your settings.
Next, you need to visit the Performance » CDN page and scroll down to the Configuration: Objects section.
From here, you need to add the hostname you created earlier for your pullzone and click on the test mirror button.
W3 Total Cache will check the availability of your hostname, and will show the Test Passed message when it’s successful.
You can now click on the Save All Changes button to store your settings.
W3 Total Cache will now start serving your static resources from CDN server.
We hope this article helped you install and setup W3 Total Cache in WordPress. You may also want to see our complete WordPress security guide for beginners to strengthen your website security, or check out our comparison of the best GoDaddy alternatives that are cheaper and more reliable.
If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.
Hackers will often install a backdoor to make sure they can get back in even after you secure your website. Unless you can remove that backdoor, there’s no stopping them.
In this article, we’ll show you how to find a backdoor in a hacked WordPress site and fix it.
How to Tell if Your Website Has Been Hacked
If you are running a WordPress website, then you need to take security seriously. That’s because websites are attacked an average of 44 times every day.
Some signs your WordPress site has been hacked include a drop in website traffic or performance, added bad links or unknown files, a defaced home page, an inability to log in, suspicious new user accounts, and more.
Cleaning up a hacked website can be incredibly painful and difficult. We take you through the process step by step in our beginner’s guide to fixing your hacked WordPress site. You should also make sure you scan your site for any malware that the hackers left.
And don’t forget to close the backdoor.
A smart hacker knows that you’ll eventually clean up your website. The first thing they might do is install a backdoor, so they can sneak back in after you secure the front door to your WordPress website.
What Is a Backdoor?
A backdoor is code added to a website that allows a hacker to access the server while remaining undetected, and bypassing the normal login. It allows a hacker to regain access even after you find and remove the exploited plugin or vulnerability to your website.
Backdoors often survive WordPress upgrades. That means your site will remain vulnerable until you find and fix every backdoor.
How Do Backdoors Work?
Some backdoors are simply hidden admin usernames. They let the hacker log in as normal by typing a username and password. Because the username is hidden, you’re not even aware that someone else has access to your website.
More complex backdoors can allow the hacker to execute PHP code. They manually send the code to your website using their web browser.
Others have a full fledged user interface that allows them to send emails as your WordPress hosting server, execute SQL database queries, and much more.
Some hackers will leave more than one backdoor file. After they upload one, they will add another to ensure their access.
Where Are Backdoors Hidden?
In every case we’ve found, the backdoor was disguised to look like a WordPress file. The code for backdoors on a WordPress site are most commonly stored in the following locations:
A WordPress theme, but probably not the the one you’re currently using. Code in a theme is not overwritten when you update WordPress, so it’s a good place to put a backdoor. That’s why we recommend deleting all inactive themes.
WordPress plugins are another good place to hide a backdoor. Like themes, they’re not overwritten by WordPress updates, and many users are reluctant to upgrade plugins.
The uploads folder may contain hundreds or thousands of media files, so it’s another good place to hide a backdoor. Bloggers almost never check its contents because they just upload an image and then use it in a post.
The wp-config.php file contains sensitive information used to configure WordPress. It’s one of the most highly targeted files by hackers.
The wp-includes folder contains PHP files required for WordPress to run properly. It’s another place that we find backdoors because most website owners don’t check to see what the folder contains.
Examples of Backdoors We’ve Found
Here are some examples of where hackers have uploaded backdoors. In one site we cleaned up, the backdoor was in the wp-includes folder. The file was called wp-user.php, which looks innocent enough, but that file doesn’t actually exist in a normal WordPress installation.
In another instance, we found a PHP file named hello.php in the uploads folder. It was disguised as the Hello Dolly plugin. What’s strange is that the hacker put it in the uploads folder instead of the plugins folder.
We’ve also found backdoors that don’t use the .php file extension. One example was a file named wp-content.old.tmp, and we’ve also found backdoors in files with a .zip extension.
As you can see, hackers can take very creative approaches when hiding a backdoor.
In most cases, the files were encoded with Base64 code that can perform all sorts of operations. For example, they can add spam links, add additional pages, redirect the main site to spammy pages, and more.
With that being said, let’s take a look at how to find a backdoor in a hacked WordPress site and fix it.
How to Find a Backdoor in a Hacked WordPress Site and Fix It
Now you know what a backdoor is and where it might be hidden. The difficult part is finding it! After that, cleaning it up is as easy as deleting the file or code.
They offer a free Sucuri Security plugin for WordPress that lets you scan your website for common threats and harden your WordPress security. The paid version includes a server side scanner that runs once each day and looks for backdoors and other security issues.
Searching through your plugin folders looking for suspicious files and code is time consuming. And because hackers are so sneaky, there’s no guarantee you will find a backdoor.
The best thing you can do is delete your plugins directory, and then reinstall your plugins from scratch. This is the only way to know for sure that there are no backdoors in your plugins.
You will need to use the software to navigate to your website’s wp-content folder. Once there, you should right click on the plugins folder and select ‘Delete’.
3. Delete Your Themes Folder
In the same way, instead of spending time searching for a backdoor among your theme files, it’s better just to delete them.
After you delete your plugin folder, simply highlight the themes folder and delete it in the same way.
You don’t know whether there was a backdoor in that folder, but if there was, it’s gone now. You just saved time and you eliminated an extra point of attack.
Now you can reinstall any themes that you need.
4. Search the Uploads Folder for PHP Files
Next, you should take a look through the uploads folder and make sure that there are no PHP files inside.
There is no good reason for a PHP file to be in this folder because it’s designed to store media files such as images. If you find a PHP file there, then it should be deleted.
Like the plugins and themes folders, you’ll find the uploads folder in the wp-content folder. Inside the folder you will find multiple folders for each year and month you have uploaded files. You will need to check each folder for PHP files.
Some FTP clients offer tools that will search the folder recursively. For example, if you use FileZilla, then you can right click the folder and select ‘Add files to queue’. Any files found in any subdirectories of the folder will be added to the queue in the bottom pane.
You can now scroll through the list looking for files with the .php extension.
Alternatively, advanced users who are familiar with SSH can write the following command:
find uploads -name "*.php" -print
5. Delete the .htaccess File
Some hackers may add redirect codes to your .htaccess file that will send your visitors to a different website.
Using an FTP client or file manager, simply delete the file from your website’s root directory, and it will be recreated automatically.
If for some reason it isn’t recreated, then you should go to Settings » Permalinks in your WordPress admin panel. Clicking the ‘Save Changes’ button will save a new .htaccess file.
6. Check the wp-config.php File
The wp-config.php file is a core WordPress file that contains information that allows WordPress to communicate with the database, the security keys for your WordPress installation, and developer options.
The file is found in your website’s root folder. You can view the file’s contents by selecting the Open or Edit options in your FTP client.
Now you should look at the contents of the file carefully to see if there is anything that looks out of place. It might be helpful to compare the file with the default wp-config-sample.php file which is located in the same folder.
You should delete any code that you’re certain doesn’t belong.
7. Restore a Website Backup
If you have been making regular backups of your website and are still concerned that your website isn’t completely clean, then restoring a backup is a good solution.
You will need to completely delete your website and then restore a backup that was taken before your website was hacked. This isn’t an option for everyone, but it will leave you 100% confident that your site is safe.
Now that you’ve cleaned up your website, it’s time to improve your site’s security to prevent hacks in the future. It doesn’t pay to be cheap or apathetic when it comes to website security.
1. Regularly Backup Your Website
If you don’t already make regular backups of your website, then today is the day to start.
WordPress does not come with a built-in backup solution. However, there are several great WordPress backup plugins which allow you to automatically backup and restore your WordPress website.
UpdraftPlus is one of the best WordPress backup plugins. It allows you to setup automatic backup schedules and will help you restore your WordPress site if something bad happens.
You can’t possibly monitor everything that goes on your website when you’re busy working on your business. That’s why we recommend you use a security plugin like Sucuri.
We recommend Sucuri because they’re good at what they do. Major publications like CNN, USA Today, PC World, TechCrunch, The Next Web, and others agree. Plus, we rely on it ourselves to keep WPBeginner secure.
The next thing you should do is add two-factor authentication. This will protect your website against stolen passwords and brute force attacks. It means that even if a hacker knows your username and password, they still won’t be able to log in to your website.
Finally, you should limit login attempts in WordPress. WordPress allows users to enter passwords as many times as they want. Locking a user out after five failed login attempts will significantly reduce a hacker’s chance of working out your login details.
4. Protect Your WordPress Admin Area
Protecting the admin area from unauthorized access allows you to block many common security threats. We have a long list of tips on how you can keep WordPress admin safe.
Did you know that WordPress comes with a built-in theme and plugin editor? This plain text editor allows you to edit your theme and plugin files directly from the WordPress dashboard.
While this is helpful, it can lead potential security issues. For example, if a hacker breaks into your WordPress admin area, then they can use the built-in editor to gain access to all your WordPress data.
After that, they will be able to distribute malware or launch DDoS attacks from your WordPress website.
6. Disable PHP Execution in Certain WordPress Folders
By default, PHP scripts can be run in any folder on your website. You can make your website more secure by disabling PHP execution in folders that don’t need it.
For example, WordPress never needs to run code stored in your uploads folder. If you disable PHP execution for that folder, then a hacker won’t be able to run a backdoor even if they successfully uploaded one there.
7. Keep Your Website Up to Date
Every new version of WordPress is safer than the previous one. Whenever a security vulnerability is reported, the core WordPress team works diligently to release an update that fixes the issue.
This means that if you are not keeping WordPress up to date, then you are using software with known security vulnerabilities. Hackers can search for websites running the older version and use the vulnerabilty to gain access.
