How do I keep my WordPress site fast and safe?

Give the admin account a name other than "admin", let WordPress update itself, raise PHP's limits only as far as you need, and keep only the plugins you use. Every visit already passes our web firewall.

When you add the site

1. On your project's page, in the Add a service card, choose WordPress.

2. Fill in Site title, Admin username and Admin email. Don't use admin as the username: it's the first name attackers try.

3. Leave the password to us: we make a strong one and show it once, after the install. Copy it then.

4. Choose Create site. WordPress is installed and ready in about a minute, with its own database.

Every day

• Updates. WordPress updates itself, and can update its plugins, as on any host. Remove plugins you don't use.

• WordPress admin. Open it from the site's page with WordPress admin.

• Scheduled tasks. WordPress's own tasks run from the site's Scheduled tasks card, with the output of every run.

• Files. Choose Files to edit any file in the file manager, from a laptop or a phone. A deleted file stays in the trash, so you can bring it back.

PHP settings

In the site's PHP settings card you can change Largest upload, Memory per request and Time per request, and add PHP extensions. Changing them restarts the site with no downtime.

Speed and protection

• Every visit passes our web firewall and limits at the door before it reaches WordPress.

• Keep images small. A caching plugin you trust can make pages faster too.

• If a big upload fails in WordPress, raise Largest upload in PHP settings, a little at a time. For now a site's post_max_size stays at PHP's 8 MB, so a single upload over about 8 MB still fails.

For the full guide, read WordPress.