06Web hosting & WordPress

WordPress maintenance – updates, plugins, security, cache

Keep WordPress at Nexthosting secure and fast: updates with WP Toolkit, good plugins, protection against attacks, Redis cache, images and WP-CLI.

In short

Nexthosting keeps the server up to date, but you maintain WordPress itself: update core, plugins and themes regularly, use only maintained extensions, keep logins secure, and make a backup or test on the staging copy before big updates. WP Toolkit in the web panel takes a lot of this off your hands, and the Redis object cache and a page cache make the site fast.

The maintenance routine

Set aside ten minutes once a week. That is enough for most sites.

How often	What	Where
Weekly	Install updates for plugins, themes and translations	WP Toolkit or Dashboard → Aktualisierungen (Updates)
Weekly	Click through the site briefly: home page, contact form, shop checkout	Browser
Monthly	Delete unused plugins and themes, review the user list	Plugins, Benutzer (Users)
Monthly	Look at Werkzeuge (Tools) → Website-Zustand (Site Health)	WordPress
Before big updates	Make a backup or test on staging first	Backups, Staging
For a new PHP version	Check compatibility on staging, then switch	PHP settings

Installing updates safely

A big update without risk

BackupCreate a backup or a staging copy
Test on stagingInstall the update, click through the site
Everything fine?
Update livethe same update on the real site
Quick check

Small updates (e.g. 6.8.1 to 6.8.2, security fixes for plugins) can be installed directly. For big jumps – a new WordPress major version, a new major version of WooCommerce, Elementor or your theme – the detour via the staging copy is worth it.

With WP Toolkit in the web panel

WP Toolkit is included in every WordPress hosting plan and appears on Webspace for every WordPress site installed with one click. With it you can, without a WordPress login:

update WordPress core, plugins and themes and turn on automatic core updates,
install, activate, deactivate and delete plugins and themes (also from an address of your own),
manage WordPress users and log in as an admin with one click,
secure the admin area (admin lock),
turn on maintenance mode,
turn on debugging (WP_DEBUG, error log).

If you installed WordPress by hand or moved it here, WP Toolkit can search for existing installations and take them over.

Automatic updates

What	Recommendation
Small core updates (security)	always automatic – this is the WordPress default
Major core updates	manual after testing, or automatic for simple sites without a shop
Plugins	automatic for well-maintained, simple plugins; manual for shop, page builder, members’ area
Themes	manual if you have customized the theme; otherwise automatic

You turn on automatic updates for individual plugins in WordPress under Plugins with the link “Automatische Aktualisierungen aktivieren” (Enable auto-updates).

Choosing plugins and themes wisely

Every plugin is third-party code on your server. Less is more.

Source: Only from the official directory wordpress.org/plugins or directly from the vendor. Never “nulled” versions of paid plugins – they almost always contain malicious code.
Check before installing: last update (no older than a few months), active installations, ratings, tested up to the current WordPress version, answers in the support forum.
Only one per task: two cache plugins or two SEO plugins at the same time interfere with each other.
Deactivated is not enough: Delete unused plugins and themes. Even deactivated code can be vulnerable.
Theme customizations belong in a child theme or the Customizer, not in the theme’s files – otherwise they are gone at the next update.

Securing WordPress

Nexthosting handles the server side (firewall, operating system, DDoS protection). These points are up to you:

Install updates promptly (see above). This is the most important point.
Strong, unique passwords for all admins. No user named admin.
Two-factor authentication for all administrators, for example with the “Two Factor” plugin from the official directory.
Limit login attempts, for example with a plugin such as “Limit Login Attempts Reloaded”, or protect the admin area with the admin lock in WP Toolkit.
Assign roles sparingly (see Users and roles).
Turn off the file editor so nobody with a stolen admin login can inject PHP code via the back end. In wp-config.php, above “That’s all, stop editing!”:
```
define( 'DISALLOW_FILE_EDIT', true );
```
Force HTTPS: enter the WordPress address and site address with https://. See SSL and mixed content.
Your own backups in addition to the automatic backups, for example a monthly export to your computer.

A big security plugin is no substitute for updates. More background: Website security. If your site has already been hacked, Solving WordPress problems helps.

Speeding up with cache

A cache stores finished results so that WordPress does not have to recalculate them on every request. There are two kinds that complement each other well. Background: Understanding cache.

	Object cache (Redis)	Page cache
What is stored?	Results of database queries in memory	finished HTML pages
Helps especially with	shops, members’ areas, logged-in users, large sites	visitors who are not logged in
At Nexthosting	WordPress hosting: every plan. Webspace: from Pro	via plugin

Turning on the Redis object cache

Open the website in the web panel and choose Advanced → Developer tools.
Scroll to Redis and turn the switch on. The web panel then shows you the connection details.
In WordPress, install and activate the “Redis Object Cache” plugin.
Open Einstellungen (Settings) → Redis and click Enable Object Cache. The status should show “Verbunden” (Connected).

If the plugin shows no connection, enter the connection details from the web panel in wp-config.php, for example:

define( 'WP_REDIS_HOST', '127.0.0.1' );
define( 'WP_REDIS_PORT', 6379 );

Use the values the web panel displays.

Page cache

Install one cache plugin, for example “WP Super Cache” or “W3 Total Cache”, or use the cache function of your theme or page builder. On shops, the cart, checkout and “My account” must be excluded from the cache – good plugins recognize WooCommerce automatically. Clear the cache after design changes.

Images: the quickest win

Large photos are the most common reason for slow sites.

Shrink before uploading: for normal content, 1,600 to 2,000 pixels of width are enough. A photo straight from the camera is often 6,000 pixels wide and 8 MB.
Use WebP: WordPress can display WebP images, which are much smaller than JPG. An image plugin can convert existing images automatically.
Lazy loading (images load only when you scroll) is built into WordPress.
Tidy up the media library: unused images take up storage and backup space.

More tips in Making your website faster.

Scheduled tasks (cron)

WordPress handles scheduled tasks such as timed posts, update checks and shop emails via “WP-Cron”. This normally runs only when somebody visits the site. On sites with few visitors, tasks then arrive late.

A real cron job is more reliable. For WordPress installed with one click, the web panel usually already sets up a server cron job. If you want to control it yourself, turn off WP-Cron in wp-config.php …

define( 'DISABLE_WP_CRON', true );

… and create a cron job in the web panel under Advanced → Developer tools that runs, for example, every 15 minutes:

cd ~/public_html && wp cron event run --due-now

Cron jobs are only created in the web panel, not with crontab over SSH.

WP-CLI: WordPress on the command line

With SSH (Webspace in every plan, WordPress hosting from Basic) you can manage WordPress with WP-CLI. How to connect via SSH is explained in Uploading files. First change to the WordPress folder (cd ~/public_html) or append --path=public_html.

wp core version                 # installed version
wp core check-update            # is there an update?
wp core update                  # update WordPress
wp core update-db               # adapt the database after a big update
wp plugin list --update=available
wp plugin update --all
wp theme update --all
wp language core update

wp plugin list
wp plugin deactivate --all      # all plugins off (troubleshooting)
wp plugin activate woocommerce
wp plugin delete hello
wp user list
wp user create editorial editorial@your-domain.com --role=editor
wp user update maria --prompt=user_pass

wp db export ~/backup-$(date +%F).sql   # back up the database
wp cache flush                  # clear the object cache
wp rewrite flush                # rewrite permalinks
wp transient delete --expired   # delete expired temporary caches
wp maintenance-mode activate    # maintenance mode on
wp maintenance-mode deactivate

Do not store database exports in public_html, or anyone can download them.

Frequently asked questions

Does Nexthosting take care of my WordPress updates?

No. Nexthosting runs and secures the server. You update WordPress, plugins and themes yourself – with WP Toolkit this takes a few clicks, and can be automatic if you like.

The site is broken after an update. What should I do?

See Solving WordPress problems. In an emergency, you restore yesterday’s state from the automatic backups.

Do I need a security plugin?

Not necessarily. More important are updates, strong passwords, two-factor authentication and few, well-maintained plugins. A plugin that limits login attempts makes sense.

How much storage does my site need?

Under Werkzeuge → Website-Zustand → Bericht (Report), WordPress shows the size of the folders and the database. The limits per plan are in the overview.