The WordPress care glossary

WordPress Core

The base WordPress software that powers your site, separate from your theme and plugins.

Minor Update

A small WordPress release with security and bug fixes, applied automatically by default.

Major Update

A larger WordPress release with new features that should be tested in staging before going live.

Staging Environment

A private copy of your live site used to test updates and changes safely.

Rollback

Reverting your site to a previous working state after a failed update or bad deploy.

Backup

A saved copy of your WordPress files and database used to restore the site after damage.

Incremental Backup

A backup that only saves what changed since the last backup, making frequent backups practical.

Off Site Backup

A backup stored on different infrastructure from your live site, so a server failure cannot destroy both.

Uptime Monitoring

Automated checks that ping your site every few minutes and alert on downtime.

Downtime

Any period when your site is unreachable, slow beyond a threshold, or returning errors to visitors.

MTTR (Mean Time To Recovery)

The average time from the moment a site breaks to the moment it is fully restored.

SLA (Service Level Agreement)

A written promise of response time, resolution time, and what happens if we miss either.

Malware

Malicious code injected into your WordPress files or database, usually for spam, redirects, or data theft.

Backdoor

Hidden code left by an attacker so they can return to your site after a cleanup.

Hardening

A set of changes that make a WordPress site harder to attack: file permissions, login limits, security headers, and more.

Two Factor Authentication (2FA)

A login method that requires both a password and a one time code, blocking 99% of stolen password attacks.

Brute Force Attack

An attacker trying thousands of password guesses against your WordPress login page.

Japanese SEO Hack

A common WordPress hack that injects thousands of Japanese spam pages to rank in Google for unrelated terms.

File Integrity Monitoring

Automated checks that flag any change to core WordPress files outside of a planned update.

Core Web Vitals

Three Google performance scores: LCP (load), INP (interactivity), and CLS (layout shift).

LCP (Largest Contentful Paint)

How fast the biggest visible element on a page renders. Pass under 2.5 seconds.

INP (Interaction to Next Paint)

How responsive your page feels when a user clicks, taps, or types. Pass under 200ms.

CLS (Cumulative Layout Shift)

How much the page jumps around as it loads. Pass under 0.1. Often caused by ads, web fonts, or images without dimensions. Fixed by reserving space.

CDN (Content Delivery Network)

A global network of edge servers that serves your static files from the location closest to each visitor.

Caching

Saving the result of expensive work so the next request can return it instantly.

Page Cache

A saved HTML snapshot of each page so PHP and the database do not run on every visit.

Object Cache

A memory store like Redis or Memcached that holds frequently used database query results.

Database Optimization

Cleaning, indexing, and tuning your wp_posts and wp_options tables to keep queries fast.

wp_options Table

The settings table WordPress loads on every page request. Bloated options tables slow down the whole site.

Autoloaded Data

Rows in wp_options that load on every single page request. More than 1 MB total is a red flag.

Performance Optimization

The end to end process of making your WordPress site fast: caching, images, code, hosting, and database.

JavaScript Bloat

Too much JavaScript loaded on the page, slowing down INP and total blocking time.

White Screen Of Death (WSOD)

A blank white page where your WordPress site used to be, usually caused by a PHP fatal error.

PHP Fatal Error

A PHP error severe enough to stop your site from rendering. Always logged.

Debug Mode (WP_DEBUG)

A WordPress setting that logs PHP warnings and errors to /wp-content/debug.log for diagnosis.

Recovery Mode

A safe login link WordPress emails when a fatal error blocks the admin, letting you disable the broken plugin.

Redirect Loop

Your browser bouncing between two URLs without ever loading the page. ERR_TOO_MANY_REDIRECTS.

Mixed Content

An HTTPS page that loads images, scripts, or styles over HTTP, breaking the lock icon.

HTTPS

Encrypted HTTP traffic. Required for SEO, modern browsers, and any login or payment flow.

SSL Certificate

A digital certificate that enables HTTPS and proves your domain identity to browsers.

DNS (Domain Name System)

The system that translates your domain name into the IP address of your hosting server.

wp-config.php

The core WordPress config file holding database credentials, security keys, and tuning constants.

.htaccess

An Apache configuration file at the WordPress root that controls URL rewrites and many request rules.

robots.txt

A file at /robots.txt that tells search engines and AI crawlers which paths to crawl and which to skip.

XML Sitemap

A list of every canonical URL on your site, submitted to Google Search Console for indexing.

Canonical URL

The single preferred URL for a piece of content when multiple URLs could serve it.

Google Search Console

Google's free tool that shows which keywords drive clicks to your site, plus indexing and Core Web Vitals data.

Schema Markup

Structured data added to pages so Google and AI engines understand what the content represents.

AEO (Answer Engine Optimization)

Optimizing pages so AI engines like ChatGPT, Perplexity, and Google AI Overviews cite you in answers.

GEO (Generative Engine Optimization)

The broader practice of being visible across all generative AI surfaces: chat, search, voice, and agents.

wp-adminerlzp Hidden Admin User

A persistence backdoor that re-creates a rogue WordPress administrator with a wp-adminerlzp-style username after every cleanup.

mu-plugin Malware

Malicious code dropped into wp-content/mu-plugins/ so WordPress auto-loads it on every request without showing it in the plugins screen.

Trojanized Core File

A WordPress core file (like wp-blog-header.php or wp-load.php) modified to load attacker code on every request.

410 Gone

An HTTP status code that tells Google a URL is permanently removed and should be dropped from the index faster than a 404.

302 Redirect Hack

A compromise where injected code 302-redirects search traffic to affiliate or scam URLs while showing the real site to direct visitors.

robots.txt Hijack

A compromise that rewrites robots.txt to block legitimate crawlers or allow attacker paths Google should never see.

C2 Server (Command and Control)

An external server that compromised WordPress sites beacon to for instructions, payloads, or stolen data.

Knowledge Panel

The Google sidebar card that appears for a recognized entity (person, brand, place) and acts as the canonical identity record.