Field notes from production · est. 2009
Crime scenes, quarantined themes, and the fixes that closed the case
Case-file write-ups of real WordPress incidents — crashed queries, brute-force waves, slow checkouts — and the exact patches that shipped. Written by Jasper Frumau, founder of Imagewize, based on real experience from 100+ client projects.
File No. 57
Open case log
Latest entries
Newest first · 57 cases on file
-
Case No. 57 Devops Documented
A Standard wp-cli.yml for Bedrock, and a WP-CLI Command That Validates Block Pattern Files Against Gutenberg's Own Output
Two small pieces that I put in every Bedrock site root. The first is a wp-cli.yml that ends the --path=web/wp typing. The second is a WP-CLI command that che...
-
Case No. 56 Security Documented
Locked Out of WordPress: Create a Temporary Admin With WP-CLI Over SSH, Then Delete It
A lost admin password, a plugin that broke the login, an admin email that no longer exists: when you cannot log in but you can reach the server, WP-CLI gets ...
-
Case No. 55 Debugging Shipped
My Block Theme Template Changes Are Ignored: Find and Remove the Site Editor's Database Override With WP-CLI
I changed a pattern file in a block theme, flushed the cache, and the front end kept showing the old markup. Editing the template’s .html file did nothing ei...
-
Case No. 54 Devops Documented
Test an Unreleased Plugin in a Bedrock Site With a Composer Path Repository (and Why symlink Must Be false)
You have a plugin or theme in its own repository and a Bedrock site that installs it with Composer. Before you tag a release you want to see the branch runni...
-
Case No. 53 Security Documented
A Weekly and Monthly Security Routine for Trellis WordPress Sites: fail2ban, Scans, and Checking IPs Against AbuseIPDB Before You Block Them
Security on a Trellis site comes in layers, and each layer needs a little attention on a schedule. None of it takes long. What goes wrong is that nobody chec...
-
Case No. 52 Performance Documented
Browser Caching Headers on Trellis With One Global Nginx Include (and Why Long Expiry Needs Versioned Assets)
PageSpeed’s “serve static assets with an efficient cache policy” warning has a boring fix: tell the browser it may keep images, fonts, CSS and JS for a long ...
-
Case No. 51 Performance Documented
Serve WebP and AVIF from Nginx on Trellis Without Touching the HTML: Accept-Header Negotiation for Bedrock Uploads
There are two ways to get WebP onto a WordPress site. One rewrites the HTML, so every <img> points at a .webp. The other leaves the HTML alone and lets...
-
Case No. 50 Security Documented
A Permanent Nginx Deny List on Trellis: When It Beats fail2ban, CIDR Ranges, and How Not to Lock Yourself Out
fail2ban is the right default: it detects an attacker, bans the address for a while, and needs no upkeep. Its weakness is that a ban expires and a rotating a...
-
Case No. 49 Security Documented
Reading WordPress Malware Scan Results: Severity Levels, the False Positives You Can Ignore, and the Checks After a Compromise
A scanner that prints 86 matches is only useful if you can tell which three matter. The questions that come up every time: how urgent is a HIGH, is xmlrpc.ph...
-
Case No. 48 Security Documented
Two WordPress Malware Scanners and Checksum Verification: What Each One Catches, and How to Run Them on Any Host
A WordPress malware scan has to do two opposite things: be sensitive enough to catch an eval(base64_decode(...)) in a theme file, and quiet enough that you s...
-
Case No. 47 Devops Documented
The OOM Killer Kept Killing php on a Trellis Server, and It Was Not PHP-FPM (Cron and the Unlimited PHP CLI Memory Limit)
A 4GB WordPress and WooCommerce server on Trellis was having processes killed. The reflex is to blame PHP-FPM, because that is where the memory usually goes....
-
Case No. 46 Devops Documented
Trellis Provision Tags Cheat Sheet, and the PHP Upgrade That Breaks Deploys If You Skip the users Tag
trellis provision production runs every role on the server. It is the right command after a big change and the wrong one for a small one: it takes a long tim...
-
Case No. 45 Devops Documented
Updating Trellis Without Losing Your Vault, Site Config and Custom Roles: A Backup, Diff and rsync-with-Excludes Routine
Trellis lives inside your project, not as a dependency, so there is no composer update for it. The trellis/ directory is a copy of the upstream repository th...
-
Case No. 44 Devops Documented
Cloning an Existing Trellis and Bedrock Project and Getting It Running Locally: Vault Password, VM, Provision, Pull from Production
You have a Trellis and Bedrock project in a Git repository and a Mac that is ready for Trellis. The steps between git clone and a working site at https://you...
-
Case No. 43 Devops Documented
Setting Up a New Mac for Trellis Development: What Runs on the Host, What Runs in the Lima VM
The question I get most about a Trellis setup is whether you need PHP, Composer, Node and MySQL on your Mac if WordPress runs in a virtual machine anyway. Th...
-
Case No. 42 Development Documented
Block Pattern Layout Rules That Prevent Gaps and Validation Errors: alignfull Groups, Grids, Spacing Variables and Margin Resets
Layout bugs in block patterns have a recognisable look: a thin gap between two coloured sections, a hero that overflows sideways, a three-column grid that ju...
-
Case No. 41 Development Documented
Writing Block Patterns as PHP Files: Headers, Escaping, Image Paths and What You Cannot Call on init
A block pattern in a theme is a PHP file in patterns/. WordPress reads a comment block at the top for the pattern’s identity, runs the file to produce block ...
-
Case No. 40 Development Documented
Creating WordPress Pages from Block Markup with WP-CLI on Trellis: VM First, Production Second, and the .test URLs That Follow You
Building a page in the block editor and building it from a file are different workflows, and the second is better when you want the page in version control, ...
-
Case No. 39 Development Documented
Changing a WordPress Domain, HTTPS or Bedrock Paths with wp search-replace, and the Other Ways to Fix Site URLs
After a migration the site loads and every link goes to the old domain, or the images 404 because the database still says /wp-content/uploads/. WordPress sto...
-
Case No. 38 Devops Documented
Migrating Several WordPress Sites onto One Trellis Server: Configure Everything First, and the Pitfalls That Bite
Trellis can host many WordPress sites on one server, and moving three sites over is not three times the work of moving one. Most of the first migration is le...
-
Case No. 37 Devops Documented
Testing a Trellis Migration Before DNS: /etc/hosts, a Self-Signed Certificate, and the Let's Encrypt Cutover
The site is deployed on the new Trellis server, the database and uploads are in. You still cannot look at it with the real domain, because DNS points at the ...
-
Case No. 36 Devops Documented
Migrating a WordPress Site from Shared Hosting to Trellis and Bedrock: The Order That Works
Moving a site from shared hosting, Plesk or cPanel onto a Trellis server running Bedrock is mostly a question of order. Each step is small. Doing them out of...
-
Case No. 35 Development Documented
Noindex WordPress Posts After an Expiry Date: Yoast's wpseo_robots Filter and the Site Timezone
Some posts have a shelf life. A race tip, an event preview or a limited offer is useful until the event happens, and then it is a stale page that still ranks...
-
Case No. 34 Development Documented
WooCommerce Product Attributes and Variations with WP-CLI on Trellis: Why Your Terms Land on the Wrong Site
Setting up a WooCommerce catalogue by hand means clicking through Products, Attributes, Configure terms, once per value. With WP-CLI you can create the attri...
-
Case No. 33 Development Documented
A Cookie-Based Age Gate for WordPress: jQuery Modal, ACF Fields, and One Class to Hide Content
Some WordPress sites show promotional blocks for gambling operators, and those blocks must not be shown to younger visitors. The requirement was a modal on t...
-
Case No. 32 Devops Documented
Which Analytics Is This WordPress Site Running? Detect Site Kit, GA4, GTM and Matomo With curl
When you take over a WordPress site, one of the first questions is what tracking it already has. The answer is rarely in the handover notes, and the admin sc...
-
Case No. 31 Performance Documented
Measuring WordPress TTFB From the Command Line: curl, wget, and Why to Test as Googlebot Too
Time to First Byte is the number I check first when a WordPress site feels slow. It needs no browser, no Lighthouse run and no account, only curl and a URL. ...
-
Case No. 30 Debugging Shipped
My Trellis Nginx Redirect Did Nothing: The Wrong Provision Tag, and a 301 That Drops the Query String
I moved a blog post to another domain and added a 301 for the old URL to the site’s Nginx redirect file in Trellis. I committed it, ran a provision, and the ...
-
Case No. 29 Performance Shipped
WordPress WebP Featured Images Without Breaking og:image: Convert Resized Copies, Keep the Original JPG
My blog posts had featured images, but the theme never showed them. I had uploaded them as JPG because the social share card (og:image) is built from that fi...
-
Case No. 28 Devops Documented
Scheduled Posts Go Live Up to 15 Minutes Late on Trellis: WP-Cron Is Off, and the Interval Is a Site Setting
On a Trellis site, a post scheduled for 09:00 can appear at 09:12. Nothing is broken. Trellis turns WP-Cron off and runs the due events from system cron inst...
-
Case No. 27 Debugging Documented
Trellis Provision Fails at "Set root user password": The Password Is Fine, MariaDB Isn't Running (provider_bzip2.so)
A Trellis provision stopped in the MariaDB role with this:
-
Case No. 26 Debugging Documented
WordPress Mail Not Arriving on Trellis: Two Different Failures That Look the Same (Config Reset vs Bounces)
“WordPress emails aren’t arriving” has at least two unrelated causes on a Trellis server, and they need opposite fixes. In one the mail never leaves the serv...
-
Case No. 25 Security Shipped
fail2ban for wp-login.php on Trellis: Turn the Jail On, Anchor the Filter, Keep an Nginx Deny List for the Rest
One IP address tried to log in to /wp-login.php 1,420 times in two months on a production Trellis server. Two more tried 860 and 742 times, and over 40 other...
-
Case No. 24 Debugging Documented
Renamed a WordPress Multisite Subsite and WP-CLI Still Shows the Old Slug: A Site Path Is Cached Infrastructure
I renamed a subdirectory subsite on a Multisite network from /fintech/ to /kafe/. I changed the path in the database and expected that to be the end of it. I...
-
Case No. 23 Debugging Documented
Child Theme Activated but the Style Variation Is Gone: Global Styles Are Per Theme (and wp_insert_post Needs a User in WP-CLI)
I activated a block child theme on a multisite subsite and rebuilt its pages from the child’s patterns. The layout was right, but the colours and fonts were ...
-
Case No. 22 Performance Documented
Site Health Says Too Many Autoloaded Options: Find the Culprits with WP-CLI Before You Touch Anything
A client’s Site Health screen showed this warning:
-
Case No. 21 Devops Shipped
Shipping a Git-Hosted Plugin to WordPress.org SVN: A Staging Script and One Case-Sensitive Gotcha
Aludra, my block library plugin, lives on GitHub. Pull requests, tags and the release zip all happen there. WordPress.org only understands Subversion, though...
-
Case No. 20 Devops Documented
Safe Plugin Updates on a Plesk Site: WP Toolkit's WP-CLI, an FTP Download and Batches
A client site had 20 pending updates. I had WordPress admin, a Plesk login and FTP, but no SSH. The site ran a custom theme that leans on ACF Pro and Gravity...
-
Case No. 19 Devops Shipped
Refreshing Three Local WordPress Sites From Production Without Leaving .com URLs Behind
Every few weeks my local copies drift from production far enough that I stop trusting them: stale content, missing uploads, a plugin version that no longer m...
-
Case No. 18 Devops Shipped
WordPress Mobile Menu Overlay Styling and the Headless Chrome Trap
If you’ve ever styled a WordPress block theme’s mobile navigation overlay and wondered why your 375px-wide screenshot shows a hamburger clipped off-screen wh...
-
Case No. 17 Devops Documented
WordPress Database Backup When You Only Have FTP (No SSH, No CPanel, No Plesk)
You have FTP access to a WordPress site, a password for wp-config.php, and nothing else — no SSH, no CPanel, no Plesk, no phpMyAdmin. The database needs a ba...
-
Case No. 16 Devops Documented
WP-CLI One-Liner: Generate and Set a Secure Password Without the Shell History Risk
The command reads like a haiku, but it solves a problem that bites everybody at least once:
-
Case No. 15 Security Shipped
wp-ops malware-scan: Checking a Remote WordPress Site Without Leaving Anything Behind
Malware scanning a WordPress site you can only reach over SSH used to mean a small ritual: scp the scanner script up to /tmp, run it, and remember to delete ...
-
Case No. 14 Ai Shipped
Mistral Vibe Upwork MCP Server Setup with OAuth — Why the Docs Are Wrong and How to Fix It
If you’ve tried to connect Mistral Vibe to the Upwork MCP server and hit a wall, you’ve probably read the official documentation on MCP servers and come away...
-
Case No. 13 Devops Documented
The Administration Email Field Doesn't Change the Administration Email
I opened Settings → General on a client site this week and found this sitting above the email field:
-
Case No. 12 Devops Shipped
The Seven Commands I Actually Run Every Day (And Why I Stopped Memorizing Them)
For a long time, my daily WordPress ops routine lived in shell history. Pull a database, sync some uploads, eyeball a security log, glance at a client site’s...
-
Case No. 11 Devops Shipped
Splitting a Sage Theme From Its Trellis Deploy: Nynaeve as a Composer Package
Our Sage 11 theme, Nynaeve, used to live two places at once: as its own standalone repo, and as a plain git-tracked copy pasted into the main site repo’s web...
-
Case No. 10 Frontend Documented
Two Colors, One Gutenberg Block, No InnerBlocks in Sight
While adding color controls to a small Gutenberg block — a single “stat” tile, a big number sitting over a caption, the sort of thing you’d repeat three or f...
-
Case No. 9 Debugging Resolved
I Shipped a Gutenberg Block Update, Clicked Save, and Nothing Changed
I added a new section to a custom Gutenberg block, deployed the plugin update, opened the page that uses the block, and clicked Save. The front end kept show...
-
Case No. 8 Devops Documented
Catching WordPress Emails Locally with MailHog (No More Test Mail Hitting Real Inboxes)
Every WordPress site sends more mail than people think: password resets, contact form notifications, WooCommerce order confirmations, plugin alerts. That’s f...
-
Case No. 7 Security Hardened
WP 2FA on Roots Bedrock/Trellis: Per-Environment Encryption Keys and a Composer Patch for a Fatal Bug
We added WP 2FA (two-factor authentication) to a client site this week to help lock down /wp-login.php after a brute-force wave that hit us — 20 IPs, 176 to ...
-
Case No. 6 Devops Patched
How Trellis's database-pull Playbook Works (And What We Fixed)
One of the most useful Trellis commands in day-to-day WordPress development is trellis db pull. It syncs your production (or staging) database down to local ...
-
Case No. 5 Ecommerce Documented
WooCommerce vs Shopify 2025: Which E-Commerce Platform is Right for Your Business?
Choosing between WooCommerce and Shopify? This comprehensive comparison covers costs, features, flexibility, and real-world use cases to help SMEs make the r...
-
Case No. 4 Performance Documented
WordPress Speed Optimization Guide 2025: Proven Techniques to Achieve Sub-1 Second Load Times
Learn battle-tested WordPress speed optimization techniques that have helped us achieve sub-1 second load times for SME websites. Based on real implementatio...
-
Case No. 3 Debugging Resolved
The WordPress Query Filter Trap: How I Caused Infinite Recursion and Crashed Production
I wrote some code a month ago that finally crashed a production WordPress site today. The bug sat dormant for 4 weeks before exploding. This post documents t...
-
Case No. 2 Debugging Resolved
Debugging PHP-FPM Memory Exhaustion on WordPress with WooCommerce and Trellis
Over the past weekend, I spent considerable time debugging persistent memory exhaustion errors on a WordPress site running WooCommerce and the Roots stack (T...
-
Case No. 1 Frontend Shipped
Building a Custom WordPress Walker for Multilingual Mobile Navigation with Secondary Menus
When building modern WordPress themes, mobile navigation often requires more sophisticated functionality than the standard WordPress menu system provides out...