WordPress Emergency Help — Triage Guide for Panicking Site Owners

"This site can't be reached" / timeout / 502 / 503

Visit your site in an incognito window. If you see a host-branded error page (SiteGround, Cloudflare, Kinsta), the issue is at the hosting or CDN layer — WordPress never got to run. If the browser times out entirely, DNS or the origin server is down.

1. Log into your hosting panel. Check if the server / container is running. Most hosts have a "Restart" or "Reboot" button.
2. Check your Cloudflare / CDN dashboard. If Cloudflare shows "host error," pause Cloudflare temporarily (DNS only) to see if the origin responds.
3. Verify DNS: dig yoursite.com or use dnschecker.org. If the A record points to the wrong IP, fix it.
4. Check disk space on the server. A full disk is a common cause of 502s: MySQL cannot write, PHP cannot write sessions.

If hosting panel is unreachable too, this is a hosting-side outage. Open a ticket with your host and ask about their status page. Nothing you can do from WordPress will help.

Completely blank page, no error message

White screen = PHP fatal error with error display disabled. The error exists — it is just hidden. Enable logging and you will see it in seconds.

Edit wp-config.php via FTP or your host's file manager. Add these four lines just above /* That's all, stop editing! */:

define( 'WP_DEBUG',         true );
define( 'WP_DEBUG_LOG',     true );    // writes to wp-content/debug.log
define( 'WP_DEBUG_DISPLAY', false );   // hide errors from visitors
@ini_set( 'display_errors', 0 );

Reload the broken page. Then read wp-content/debug.log — the exact file, line number, and PHP function that crashed will be in the last few lines.

If the log says Allowed memory size exhausted, add one more line:

define( 'WP_MEMORY_LIMIT', '512M' );

If the log points at a specific plugin, deactivate that plugin by renaming its folder over FTP (e.g., /wp-content/plugins/slug → /wp-content/plugins/slug.off). Site should come back.

If debug.log shows errors you do not understand (class not found, abstract method, type error in core files), you are probably looking at a PHP version mismatch — your host upgraded PHP and a plugin is not compatible. Ask your host to downgrade PHP temporarily, or read our detailed guide on the WordPress critical error screen.

Red / plain WordPress error page with the word "critical"

WordPress caught a PHP fatal error and replaced the white screen with a friendlier message. Check your email — WordPress sends a recovery-mode link to the admin address with the full error stack trace.

1. Open Gmail / inbox for your admin email. Search "Your Site is Experiencing a Technical Issue." The email contains a recovery-mode link.
2. Click the recovery link. WordPress loads wp-admin in a special mode where the offending plugin is auto-paused.
3. Deactivate that plugin, update it (or find a replacement), reactivate. Done.
4. If the email never arrived, enable WP_DEBUG_LOG (see Scenario 2) and read debug.log.

• Plugin auto-update installed a version incompatible with your PHP
• Theme update removed a function a child theme relied on
• WordPress core major update (like 6.9) deprecated a function — see our WP 6.9 recovery guide
• Cache plugin serialized data that can't be unserialized after a version bump

Redirects to spam, unknown admin users, strange files, Google Safe Browsing warning

Open wp-admin → Users → All Users. Any admin you do not recognize? Check /wp-content/uploads/ for random .php files (uploads should only contain images and documents). Search site root for files like wp-conflg.php, wso.php, radio.php — classic backdoors.

1. Take the site offline by putting it in maintenance mode or returning a 503 in .htaccess — stop the attack from reaching visitors.
2. Change every password in this order: hosting account, SFTP, database, then WordPress admin. Do this from a different, clean computer if possible.
3. Rotate auth salts in wp-config.php. Generate fresh ones at api.wordpress.org/secret-key/1.1/salt/ and paste over the existing define('AUTH_KEY', ...) block. This force-logs-out every attacker session instantly.
4. Install Wordfence or Sucuri and run a full scan. Follow the remediation list.
5. Delete unknown admin users from Users → All Users.
6. If you have a known-clean backup from before the compromise, restore from it. That is faster and safer than manual cleanup.

If you handle credit cards, GDPR-regulated personal data, or medical records, stop and call a professional incident response firm immediately. You may have legal notification obligations (72 hours for GDPR). Do not try to DIY a hack involving regulated data — document everything and bring in experts.

Wrong password, IP blocked, 2FA broken, redirect loop

Which lockout is it? (a) Forgot password and email reset doesn't arrive, (b) security plugin banned your IP, (c) 2FA app got wiped, (d) you log in but immediately get redirected back to login.

Forgot password, email broken: open phpMyAdmin in your hosting panel → select the WordPress database → table wp_users → edit your row → set user_pass to MD5 of your new password:

UPDATE wp_users
SET user_pass = MD5('MyNewSecurePass123!')
WHERE user_login = 'admin';

WordPress will detect the MD5 hash and upgrade it to bcrypt on your next login.

IP banned by security plugin (Wordfence, iThemes, Limit Login Attempts): connect via FTP, rename /wp-content/plugins/wordfence to /wp-content/plugins/wordfence.off. Log in, add your IP to the whitelist, rename the folder back.

2FA broken: same FTP trick — rename the 2FA plugin folder. Log in, reset your 2FA, re-enable the plugin.

Redirect loop (login succeeds, kicks you back to login): caused by cookies or URL mismatch. Clear all browser cookies for your site, or force the correct URL in wp-config.php:

define('WP_HOME','https://yoursite.com');
define('WP_SITEURL','https://yoursite.com');

If you lost access to the admin email AND cannot reach phpMyAdmin, you need your host — they can reset the WordPress password through the hosting panel.