Backup before anything
The broken state is backed up first. It sounds counter-intuitive when a site is down, but the alternative is losing the evidence and any chance of recovering data.
Something broke. Let us find out what, before changing anything else.
White screens, failed updates, hacked installs, forms that stopped sending, sites that died after a host migration. I diagnose the actual cause first – because the usual damage is done by the fixes attempted in a panic beforehand.
WordPress sites rarely break on their own. Something changed – an update was applied, a plugin was added, a setting was edited, the host moved a server, a certificate expired, or someone got in who should not have. The failure is nearly always downstream of a change, and identifying which change is most of the work.
The complication is that by the time someone calls, the site has usually been through several attempted fixes. Plugins deactivated and reactivated, a theme switched and switched back, files edited over FTP, a restore attempted from a backup of unknown age. Each of those is reasonable in isolation and each one obscures the original cause a little further.
That is why the first step is never a fix. It is a backup of the current broken state, then a diagnosis: reading the actual error logs rather than the white page, checking what changed and when, and establishing whether this is code, configuration, database, server or security. Fixing the wrong layer wastes a day and sometimes makes things worse.
The common emergencies fall into a handful of categories. The white screen of death, which is almost always a PHP fatal error hiding behind a blank page. A failed update leaving the site in maintenance mode or a plugin half-installed. A hacked site serving spam or redirecting visitors. Database connection errors. Forms that silently stopped delivering. And migrations that appeared to work until someone looked closely.
Nearly all of these are recoverable, and most are recoverable quickly once the cause is known. The cases that are genuinely difficult are the ones with no usable backup and a compromised database, which is exactly why the conversation afterwards is about backups and maintenance rather than about what I just charged you for.
A blank page is almost always a PHP fatal error with display turned off. I read the log, find the failing code, and fix it rather than disabling things until something works.
The site comes back, and you learn which plugin or theme caused it so it does not happen twice.
Sites stuck in maintenance mode, half-installed updates, plugin conflicts after a release, and rollbacks where a rollback is the right answer.
Recovery without losing the content or configuration added since the last backup.
Identifying the entry point, removing injected files and database content, closing the hole, rotating credentials and getting warnings lifted.
A clean site and, more importantly, an entry route that is actually closed.
Connection failures, corrupted tables, exhausted connections and the errors that follow a host migration or a disk filling up.
Data recovered rather than restored over, where recovery is possible.
Delivery traced end to end – the form, the mail configuration, the server, SPF and DKIM records, and the spam filter at the other end.
You stop losing enquiries you never knew were arriving.
Sites broken by a move: wrong URLs in the database, missing files, permission problems, PHP version mismatches, DNS half-propagated.
The move finished properly rather than abandoned halfway.
A site suddenly timing out or exhausting memory, which is usually one query, one plugin or one server limit rather than general slowness.
The specific cause found instead of a general optimisation project you did not ask for.
Payments not completing, orders stuck pending, stock not decrementing, confirmation emails not arriving.
The order path working again, with the failed transactions identified and reconciled.
The method matters most when everyone involved is under pressure.
The broken state is backed up first. It sounds counter-intuitive when a site is down, but the alternative is losing the evidence and any chance of recovering data.
Server error logs, PHP logs and debug output tell you what actually failed. Disabling plugins one at a time is what people do when nobody has looked at a log.
Where a site is compromised or serving something harmful, containment comes before repair – maintenance mode, blocked access, whatever limits the damage now.
A site that comes back and breaks again next week was not fixed. The cause gets identified even when the symptom could be cleared faster.
In plain language: what broke, why, what I changed and what it means. Not a repaired site and an invoice.
After a compromise, credentials rotated, the entry route closed, and the site checked for anything left behind. Cleaning files alone leaves the door open.
If a recovery is unlikely – no backup, corrupted database – you hear that early, while the alternatives are still cheap to consider.
What would have stopped this, and what it would cost. You are free to ignore it, but you will not be able to say nobody mentioned it.
Hosting, domain and logins remain in your name throughout, and credentials I was given can be rotated the moment the work is finished.
Sooner rather than after the fourth attempted fix, ideally.
White screen, error message, or a browser warning telling visitors the site is unsafe. Every hour it stays that way costs something.
It worked this morning, something updated, and now part or all of it does not. The most common call there is.
Spam pages, redirects to somewhere else, a Google warning, or your host has suspended the account.
The form still says thank you, and nothing reaches the inbox. Often broken for weeks before anyone notices.
Payments not completing, orders stuck, or confirmation emails not sending – which costs money by the hour.
A host move or domain change that looked fine and is not, with images missing or URLs pointing at the old server.
Nobody knows how it was built, there is no documentation, and something needs fixing now.
Works, then does not, then works again – usually a resource limit or a conflict that only fires under load.
You have read six forum threads, tried four things, and it is worse than when you started. This is very normal.
I am in Bangalore, so for clients elsewhere in India we share a working day – which matters more for an emergency than for any other kind of work. A site that breaks at ten in the morning can usually be looked at the same morning rather than the next one.
For clients in the UK, USA, Canada, the UAE and Singapore, the time difference sometimes works in your favour: a site that breaks at the end of your day is often being looked at while you sleep. What I will not do is claim a round-the-clock service I do not run. The published reply window is one working day, and faster when a site is actually down.
Troubleshooting is entirely remote work – it needs access to the hosting and the site, not to the room they are in. I have worked with most Indian hosting providers and the major managed WordPress hosts abroad, which saves time when the problem turns out to live at server level rather than in WordPress.
Same time zone as clients across India, for same-day response.
A break at the end of your day is often looked at before your next one.
Indian providers and the major managed WordPress hosts.
Credentials in your name, rotatable the moment work ends.
Serving Chennai, Bangalore, India, Canada, UK, USA, Dubai, Singapore.
Urgency is not the same in every sector, and neither is the right first move.
Typically needs: Downtime is revenue, and a broken checkout is worse than a broken homepage.
How I help: Containment first, order path restored before anything cosmetic, and failed transactions identified and reconciled.
Typically needs: Appointment enquiries and patient information that people need today.
How I help: Contact and appointment paths restored first, with any exposure of submitted data assessed honestly.
Typically needs: Admissions windows where a week of downtime is a year of intake.
How I help: Priority on admissions and enquiry paths, and capacity checked before the next traffic spike.
Typically needs: Breaks at weekends, when bookings are made and offices are closed.
How I help: Booking and contact paths restored first, with a plan for who handles the next weekend.
Typically needs: Reputation damage from a hacked site can outlast the outage itself.
How I help: Fast containment of anything visible to visitors, warnings lifted, and a written account you can share with clients.
Typically needs: Traffic-heavy sites where an outage is measurable in a day.
How I help: Serving restored quickly, then the resource or query limit that actually caused it addressed.
Typically needs: Enquiry routing that fails silently while listings keep attracting interest.
How I help: End-to-end delivery testing on every enquiry path, not just the main contact form.
Typically needs: Donation flows breaking during a campaign, with no budget for an emergency.
How I help: The donation path first, diagnosis scoped to what the budget allows, and the rest prioritised honestly.
Typically needs: A client site down and a relationship under strain.
How I help: White-label response, a written account you can pass on, and no contact with your client unless you want it.
Six steps, and the first two are not fixing anything.
I establish what is actually happening – the exact error, what changed most recently, who has access, what has already been tried – and take a backup of the current broken state before touching anything.
You get: A snapshot of the site as it is, and a clear account of the symptoms.
Why it matters: Fixing before backing up is how a recoverable problem becomes an unrecoverable one.
Diagnosis from the logs: server errors, PHP errors, database status, recent file changes, plugin and core versions, and whether the cause is code, configuration, database, server or a compromise.
You get: A named cause, or a short list of candidates with how to distinguish them.
Why it matters: Every hour spent here saves several spent fixing the wrong layer.
If the site is compromised or serving something harmful, containment comes first: maintenance mode, restricted access, credentials rotated, and the host informed where they need to be.
You get: The damage stopped spreading, and visitors no longer at risk.
Why it matters: A compromised site left serving to the public gets blacklisted, and that takes far longer to undo.
The repair itself – correcting the code, restoring from a clean backup, rebuilding the affected data, or reconfiguring the server, depending on what the diagnosis found.
You get: A working site, with content and configuration preserved where preservation was possible.
Why it matters: The right repair depends entirely on the cause, which is why it is step four rather than step one.
Verification across the whole site, not just the page that was broken: forms, checkout, logins, search, admin functions and anything custom, plus a check for anything the compromise left behind.
You get: A tested site, and confirmation that nothing else broke while this was fixed.
Why it matters: Emergency fixes are exactly where collateral damage hides, because everyone stops looking once the homepage loads.
A written account: what broke, why, what I changed, and what would prevent it. Plus what it would cost to put that prevention in place.
You get: A plain-English record, and a recommendation you are free to decline.
Why it matters: A site that is fixed but unchanged will usually break the same way again.
Mostly logs and access. The tooling is unglamorous and that is fine.
If yours is on this list, it is almost certainly fixable.
A broken site has search consequences that outlast the outage. Pages returning errors for days get dropped from the index. A hacked site can pick up a manual action or a browser warning that keeps costing traffic long after the malware is gone. Injected spam pages can get indexed in hours and take considerably longer to clear.
Nobody can guarantee a recovery timeline, because reindexing is Google’s schedule rather than mine. What is within reach is cleaning the site properly, removing what was injected, and requesting review promptly.
A compromise can put content on your site that you never wrote, and anything crawling during that window may have recorded it. Cached copies, scraped versions and automated summaries can carry that content well after the site itself is clean, which is a reason to fix things thoroughly rather than quickly.
No one controls what an AI system retains or repeats. What you can control is removing the injected content properly and making sure what remains is accurate.
The practical reasons, rather than the adjectives.
The backup comes first, then the logs, then the fix. Most of the damage in a WordPress emergency is done by well-intentioned changes made before anyone established what was actually wrong.
White screens, hacked installs, failed migrations, database corruption. Most emergencies are a pattern I have seen before, and recognising the pattern is usually the difference between an afternoon and a week.
Knowing how WordPress is put together is what lets you read an error and know which layer it came from. Diagnosis is much faster when the platform is not itself a mystery.
A written account of what broke and why, in plain language. A site that comes back without anyone knowing why it went down will go down again.
No backup and a corrupted database is sometimes genuinely unrecoverable. You will hear that early, while rebuilding is still a cheaper option than a long shot.
The rate is the rate. An emergency is not a reason to charge more for the same hours, and a site being down is not a negotiating position I intend to use.
Tell me what you need. I reply within one working day, and the first conversation costs nothing.