Beginner · 12 lessons

WordPress

WordPress powers over 43% of all websites. It is a PHP-based CMS with themes for design and plugins for functionality. Understanding WordPress architecture helps you build, host, optimize, and secure WordPress sites professionally.

Key Concepts

Themes & Templates Plugins & Hooks wp-config.php Database (wp_posts) Caching Plugins Security Hardening Staging Sites Multisite

Key Takeaways

✓ WordPress = core + theme + plugins + hosting environment.
✓ Never edit core files — use child themes and custom plugins.
✓ Keep WordPress, themes, and plugins updated for security.
✓ Use caching (LiteSpeed, WP Rocket) and CDN for performance.

Lessons in This Topic

WordPress Architecture

Core, themes, plugins, and database.

WordPress core handles routing, user auth, and admin. Themes control frontend design via template hierarchy. Plugins add features via hooks (actions/filters). MySQL stores posts, users, settings in wp_* tables. wp-config.php holds database credentials and salts.

Installing & Configuring WordPress

One-click install vs manual setup.

Most hosts offer one-click WordPress via Softaculous or custom installer. Manual: upload files, create MySQL database, run 5-minute install. Set strong admin password, disable file editing (DISALLOW_FILE_EDIT), configure permalinks (/%postname%/), and set timezone.

Themes, Plugins & Updates

Choose quality extensions and stay current.

Use themes/plugins with good reviews, active development, and GPL license. Too many plugins slow the site. Update weekly — outdated plugins are the #1 hack vector. Test updates on staging first. Remove unused plugins completely, don't just deactivate.

WordPress Performance Optimization

Speed up WordPress for Core Web Vitals.

Enable object caching (Redis), page caching (LiteSpeed/WP Rocket), and CDN. Optimize images (WebP, lazy load). Minify CSS/JS. Use a lightweight theme. Limit post revisions. Database cleanup plugins remove transients and spam. Target LCP under 2.5 seconds.

WordPress Security Essentials

Protect against the most common attacks.

Change default admin username. Limit login attempts (Wordfence). Use security headers. Disable XML-RPC if unused. Regular backups with UpdraftPlus. Scan for malware. Use SFTP, not FTP. Keep wp-config.php above web root if possible.