Skip to content
  • Tip: keep backups off the server
  • Check: does your SSL renew automatically?
  • Rule: test updates on staging first
  • Tip: know who hosts your DNS
  • Check: can you still log in to your registrar?
  • Rule: one admin account per person

Field manual for website owners

Site down? Don’t panic.

Diagnose what broke, fix it step by step, and set things up so it doesn’t happen again. Free field guides for WordPress, hosting, DNS, SSL and email.

Start triage
Browse field guides
  • Free
  • No signup
  • Plain language
WDS / Diagnostic console Ready

Run a quick health check

Status, SSL, DNS and redirects in one pass. Nothing to install.

We check your site from the outside, the way visitors see it. We keep a simple log of sites checked to keep this tool working well. Privacy policy.

Need more than the basics? Open the full checkup for hosting, email, WordPress and more.

Example report yoursite.com
OK Website responding 200 OK
OK DNS resolving A, AAAA, MX
OK Redirect chain 1 hop
WARN SSL expires in 6 days

Section 01 / Emergency Room

What’s happening with your site?

Pick the symptom. You’ll get the first three things to try, then the full field guide.

S-01 / Symptom

My site is down

Not loading at all, or a server error like 500, 502 or 503.

Your first three moves

  1. Run the health check: it shows whether DNS, the web server (500, 502, 503) or the SSL certificate is the failure point.
  2. Check your host's status page and your hosting account for a suspension, expired plan or full disk notice.
  3. Read the newest entry in the PHP error log or wp-content/debug.log, then open the field guide that matches the error.
Open full triage
Run the health check

S-02 / Symptom

WordPress shows an error

A critical error, a white screen, a database error or a login loop.

Your first three moves

  1. Check the admin email inbox for the recovery mode email from WordPress. Its link pauses the plugin or theme that crashed.
  2. No email? Rename the suspect folder in wp-content/plugins over SFTP, or run: wp plugin deactivate --all --skip-plugins
  3. Set WP_DEBUG and WP_DEBUG_LOG to true in wp-config.php, reload once, and read the last fatal error in wp-content/debug.log.
Open full triage
Run the health check

S-03 / Symptom

I think I was hacked

Spam pages, strange admin users, redirects to other sites or files you did not add.

Your first three moves

  1. From a clean device, change hosting, SFTP or SSH, database and every WordPress admin password, and turn on 2FA.
  2. Download a full copy of the files and database before you clean anything, so you can find out how they got in.
  3. Run wp core verify-checksums and wp user list --role=administrator, then work through the hack recovery checklist.
Open full triage
Run the health check

S-04 / Symptom

SSL isn’t working

"Not secure" warnings, an expired certificate or a certificate error page.

Your first three moves

  1. Run the health check to see whether the certificate expired, is not trusted, or does not cover this exact hostname.
  2. Reissue it in your hosting panel. Let's Encrypt cannot renew if DNS points elsewhere or a CAA record blocks it.
  3. Padlock still warning? Fix mixed content: replace http:// URLs with wp search-replace, running it with --dry-run first.
Open full triage
Run the health check

S-05 / Symptom

My site is very slow

Pages take several seconds to load, or the admin area crawls.

Your first three moves

  1. Run PageSpeed Insights and note two numbers: time to first byte (the server) and the Largest Contentful Paint element (the page).
  2. A time to first byte above about 0.8 seconds points at hosting, PHP version or plugins. Test with page caching on.
  3. Resize and compress the LCP image, and remove unused fonts, sliders and third-party scripts before paying for more hosting.
Open full triage
Run the health check

S-06 / Symptom

Redirects are wrong

ERR_TOO_MANY_REDIRECTS, pages sending you to the wrong address, or a loop.

Your first three moves

  1. Trace the loop: curl -sIL https://yoursite.com lists every hop with its status code and Location header.
  2. Make siteurl and home identical, including https and www. Check them with wp option get siteurl and wp option get home.
  3. Behind Cloudflare? Flexible SSL plus a server HTTPS redirect loops forever. Switch to Full (strict) with a real certificate.
Open full triage
Run the health check

S-07 / Symptom

Email stopped working

Mail not arriving, not sending or going to spam, often after a DNS or host change.

Your first three moves

  1. Check the MX records still point at your mail provider: dig +short MX yourdomain.com
  2. Check SPF, DKIM and DMARC records exist and match what your provider asks for: dig TXT yourdomain.com and dig TXT _dmarc.yourdomain.com
  3. Send a test to an outside inbox and read the Authentication-Results header, or the bounce message if it fails.
Open full triage
Run the health check

S-08 / Symptom

My site looks broken

The layout is a mess, styles are missing or buttons and menus do not work.

Your first three moves

  1. Purge your caching plugin, the server cache and your CDN, in that order, then test in a private window.
  2. Open developer tools, Network tab, filter CSS and Font, and look for files returning 404, 403 or blocked.
  3. Regenerate your page builder's CSS files and turn off CSS combine and minify until the layout is back.
Open full triage
Run the health check

S-09 / Symptom

My traffic dropped

Search clicks fell sharply, pages left Google, or the site no longer shows up in search.

Your first three moves

  1. Compare Search Console clicks with analytics sessions for the same dates. Steady clicks mean tracking broke, not traffic.
  2. Run curl -sI https://YOURSITE.com/ and look for X-Robots-Tag: noindex. Then check wp option get blog_public prints 1.
  3. Run a lost page through URL Inspection, then check Manual actions, Removals and the Search Status Dashboard for that date.
Open full triage
Run the health check

S-10 / Symptom

My store or checkout is broken

Checkout errors, payments failing, orders stuck in pending or carts that empty.

Your first three moves

  1. Open WooCommerce, Status, Logs and read the fatal-errors and payment gateway logs at the time a checkout failed.
  2. Check your payment gateway's status page, then its dashboard for failed payments and undelivered webhook events.
  3. Run curl -sI https://YOURSITE.com/checkout/ and make sure no header says HIT. A cached checkout breaks carts and tokens.
Open full triage
Run the health check

S-11 / Symptom

Forms are broken or spammed

Messages not arriving, entries missing, or a flood of spam sign-ups and comments.

Your first three moves

  1. Submit the form in a private window with developer tools open. Note the console error and the status code of the POST.
  2. CAPTCHA error after a domain change? Add the new hostname to the site key's domain list in reCAPTCHA or Turnstile.
  3. Spam flood? Run wp option get users_can_register (should be 0) and add a honeypot or Turnstile before a harsher CAPTCHA.
Open full triage
Run the health check

  1. Diagnose

    Find the real problem, not just the symptom.

  2. Fix

    Follow clear steps written for people in a hurry.

  3. Prevent

    Set things up so it never happens again.

Section 02 / Field guides

Featured field guides

Step-by-step fixes for the errors people search for most, written in plain language.

FG-04 SSL

How to Fix ERR_CERT_DATE_INVALID (Expired SSL Certificate)

Your SSL certificate expired, or the visitor’s clock is wrong. Confirm which with one command, renew the certificate, and fix the DNS, CAA or blocked-challenge problem that stopped it renewing.

Read the guide
9 min read
FG-05 Security

WordPress Site Hacked? What to Do in the First Hour

Contain it, preserve evidence, find how they got in, then rebuild from clean sources and rotate every credential. The order matters, and skipping a step is how sites get reinfected.

Read the guide
11 min read

Fourteen topics, from WordPress, security, SSL and DNS to email, WooCommerce, SEO, accessibility and design.

Browse all field guides

Section 03 / Bug-Out Bag

Pack it before you need it.

Free one-page checklists. Printable on any black and white printer. No signup required.

KIT-01
PDF, 1 page, 7 KB

Backup plan

What a full WordPress backup contains, how often to run it, where to keep it, how to test it.

Download PDF
KIT-02
PDF, 1 page, 7 KB

Hack recovery

After a WordPress hack: contain it, keep evidence, find the way in, clean, harden, recover.

Download PDF
KIT-03
PDF, 1 page, 7 KB

Pre-launch

Check DNS, SSL, WordPress settings, security, speed, SEO, forms and backups before a new or redesigned site goes live.

Download PDF
KIT-04
PDF, 1 page, 7 KB

Switching hosts

Move a WordPress site to a new host without losing email, SSL, data or rankings: inventory, rehearse, cut over, then wait.

Download PDF

Optional / Field notes

Stay ready between emergencies.

One short email per new guide. No spam, unsubscribe in one click.

Section 04 / Toolkit

Check it, then look it up.

Free tools that test any site from the outside, and cheat sheets for the commands and codes you need while you fix it.

  • WCU / Checkup

    Website checkup

    One domain, one click: the whole public side of a site checked and explained.

    • Who hosts it, runs its DNS and holds the domain
    • Email authentication: SPF, DKIM and DMARC
    • SSL chain, security headers and redirects
    Run the checkup
  • 18 free tools

    Eighteen focused tools

    Go deeper on one thing, with the raw data your host will ask for.

    • DNS inspector with a propagation view
    • SSL/TLS inspector and open port check
    • Domain expiry, subdomains and IP lookup
    Pick a tool
  • 19 cheat sheets

    Cheat sheets

    Commands, codes and settings at a glance, every placeholder explained.

    • WP-CLI, curl, dig and OpenSSL commands
    • HTTP status and SMTP bounce codes
    • Where things live in your hosting panel
    Open the cheat sheets

Section 05 / For designers

Built for the people who build sites.

Templates, small tools and builder fixes for designers and freelancers who keep their clients' sites alive.

  • CSK / Templates

    Client Survival Kit

    Free templates and playbooks for the client side of the job.

    • "Your site is down" client emails
    • Scope creep script and change request
    • Handoff document and launch day runbook
    Open the kit
  • DFK / Tools

    Design Field Kit

    Six small tools that keep client sites accessible, documented and profitable.

    • Contrast checker and fluid type generator
    • Care plan calculator and project estimator
    • Owner’s manual generator for clients
    Use the tools
  • Topic / Guides

    Design and builder fixes

    Field guides for the problems designers get called about first.

    • Page builder broke after an update
    • Fonts showing as Times New Roman
    • Mobile layout broken
    Read the guides

Section 06 / Prevention

Be prepared, not panicked.

  • Keep backups somewhere else

    A backup stored on the same server as your site can disappear with it.

  • Test updates before they go live

    A staging copy turns a broken update into a non-event.

  • Know before your visitors do

    Uptime and certificate monitoring warn you while there’s still time to act.

Read the prevention guide

Search the field manual

What is going wrong?

Or jump straight to a symptom

Press / to search from any page, Esc to close