What 200 emergency tickets taught us
We pulled the last 200 WordPress emergency tickets we resolved and categorized every one by root cause, time to resolution, and downtime cost to the client. The patterns are clear, the lessons are blunt, and most of these emergencies were preventable.
This article is a tour of the 12 most common emergencies in our 2026 incident data, ranked by frequency. For each, we share what causes it, how long it takes to fix, what it costs while the site is down, and what would have prevented it.
1 — Brute force followed by admin compromise (18% of incidents)
Attackers bombard /wp-login.php until they guess admin credentials. Once in, they install a backdoor and use it later to monetize (spam, redirects, malware).
- Average fix time: 4–8 hours (cleanup + hardening + Google delisting if blacklisted)
- Average downtime: 2–6 hours (cleanup window)
- Average revenue impact: $800–$5,000 depending on site type
- Prevented by: 2FA, WAF rate limiting on /wp-login.php, strong password policy, IP whitelisting
The shocking part: 95% of brute-forced accounts used a password under 12 characters. Length is a stronger defense than complexity.
2 — Plugin update broke the site (14% of incidents)
The "click update, pray" workflow biting back. A plugin update introduces a regression, fatal error, or schema migration that breaks compatibility with another plugin.
- Average fix time: 30 minutes to 2 hours (rollback or patch)
- Average downtime: 30 minutes to 4 hours
- Average revenue impact: $200–$1,500
- Prevented by: Staging environment, daily backups, plugin update testing, rollback procedures documented
The plugins that broke things most in 2025: Elementor (5 major regressions), WooCommerce (3), and several "small" page builder add-ons that depend on Elementor internals.
3 — White Screen of Death after edit (11% of incidents)
Someone edited PHP code (functions.php, a plugin file) through the WP dashboard editor or FTP without testing. Syntax error breaks the whole site.
- Average fix time: 5–30 minutes (revert via FTP)
- Average downtime: As long as it takes you to notice
- Average revenue impact: $100–$2,000 depending on detection time
- Prevented by: Disable theme editor (
DISALLOW_FILE_EDIT), require code edits in a real IDE, usephp -lto lint before deploying
We've also seen "no edit" WSODs caused by PHP version upgrades — the server moved from PHP 7.4 to 8.0 and code using deprecated features broke.
4 — Malware infection (10% of incidents)
Malicious code injected via a known vulnerable plugin, weak credentials, or a compromised plugin update. Payload varies: spam injection, SEO spam, redirects, cryptojackers.
- Average fix time: 6–24 hours (forensic cleanup, hardening, Google reconsideration)
- Average downtime: 4–12 hours (taken offline during cleanup)
- Average revenue impact: $2,000–$30,000 (depends heavily on reputation/SEO damage)
- Prevented by: WAF, file integrity monitoring, regular plugin audits, 2FA
Malware is the most expensive incident type because of cascading effects: blacklisting, customer loss of trust, SEO damage that takes months to recover.
5 — Database connection failure (8% of incidents)
The "Error establishing a database connection" message. Usually wrong credentials after migration, MySQL service crash, or max_connections saturation.
- Average fix time: 15–90 minutes
- Average downtime: As long as the issue persists
- Average revenue impact: $500–$3,000
- Prevented by: Monitoring on MySQL connection count, documented DB credentials,
systemctl enable mysql
6 — Slow site / TTFB above 5 seconds (7% of incidents)
Not a complete outage but a partial one. Customers leave, ad spend wastes, search rankings drop. Causes range from a poorly coded plugin to MySQL slow queries to under-provisioned hosting.
- Average fix time: 90 minutes to 6 hours (profiling + optimization)
- Average downtime: None directly, but bounce rate jumps 200–400%
- Average revenue impact: $1,000–$10,000 per month while it persists
- Prevented by: Performance monitoring, regular plugin audit, properly sized hosting
7 — Hosted on shared with neighbor compromise (6% of incidents)
Your site wasn't directly attacked — a sibling site on the same shared hosting got compromised and the attacker pivoted via shared filesystem access.
- Average fix time: 4–12 hours (clean up + migrate to better isolation)
- Average downtime: 2–8 hours
- Average revenue impact: $1,000–$5,000
- Prevented by: Don't use shared hosting for serious sites; use VPS or managed WordPress with proper isolation
8 — Stuck in maintenance mode (5% of incidents)
A failed update left .maintenance in the root directory. Site is showing "Briefly unavailable for scheduled maintenance" to all visitors.
- Average fix time: 5 minutes (delete the file) to 2 hours (if updates also need re-running)
- Average downtime: As long as you don't know to delete the file
- Average revenue impact: $200–$1,000 per hour
- Prevented by: Higher PHP
max_execution_time, smaller update batches, monitoring that catches maintenance state
9 — DNS / SSL certificate issue (5% of incidents)
The site itself is fine but DNS isn't pointing right or the SSL certificate expired. Browser shows a warning, traffic plummets.
- Average fix time: 15 minutes to 4 hours (depends on DNS propagation)
- Average downtime: 2–24 hours
- Average revenue impact: $500–$5,000
- Prevented by: SSL auto-renewal monitored, DNS records documented, certificate expiry alerts at 14 days
10 — Cloudflare misconfiguration (4% of incidents)
A Cloudflare setting change cascaded into site issues. Common culprits: SSL mode change causing redirect loops, page rules conflicting, firewall rule too aggressive.
- Average fix time: 15 minutes to 2 hours
- Average downtime: As long as the misconfiguration persists
- Average revenue impact: $500–$3,000
- Prevented by: Test Cloudflare changes in development, document existing rules, use Cloudflare's preview/staging features
11 — WooCommerce checkout broken (4% of incidents)
A specific subset of plugin conflicts: an update or change broke checkout while the rest of the site works. Customers can browse, add to cart, but checkout fails.
- Average fix time: 1–4 hours
- Average downtime: None visible, but conversions go to zero
- Average revenue impact: $1,000–$10,000 per day until fixed
- Prevented by: Automated checkout test (Cypress or similar), staging testing, payment gateway version pinning
12 — Hacked redirect (4% of incidents)
Visitors to your site get redirected to spam sites. Often invisible to admins (cloaking by referrer) until Google flags the site.
- Average fix time: 4–8 hours
- Average downtime: 1–4 hours during cleanup
- Average revenue impact: $1,000–$8,000 (mostly SEO damage)
- Prevented by: WAF, file integrity monitoring, regular SEO audit
What this data tells us
Three patterns emerge clearly from the data:
Most emergencies are preventable. 9 of the 12 categories above have known, well-documented prevention strategies. The reason they still happen is operational, not technical — owners don't implement the prevention until after the first incident.
Detection time dominates damage. A 2-hour incident detected within 15 minutes costs roughly 10% of what the same incident detected 12 hours later costs. Monitoring is the highest-ROI investment for any site that matters.
Brute force is still #1. In 2026, with AI-augmented credential stuffing and bots, brute force remains the most common attack vector. 2FA solves this. Every site we manage has 2FA mandatory for administrator role.
The prevention investment that pays off
For business-critical WordPress sites, we recommend this annual budget allocation:
- WAF ($240/year for Cloudflare Pro): prevents ~30% of incidents
- Monitoring ($120/year for UptimeRobot Pro + Patchstack): cuts detection time
- Backups ($60/year for Backblaze or S3): enables fast recovery
- Staging hosting ($240/year): prevents update-induced incidents
- Total: $660/year
Average cost of a single major incident: $3,000–$10,000. The math is overwhelming.
When to call a specialist
Reading this article and feeling overwhelmed by the prevention checklist is the right reaction. Most owners don't have the operational capacity to maintain all of this themselves — that's why specialized WordPress maintenance services exist.
Ongoing emergency support keeps a specialist on call for your incidents. Hacked website repair covers post-breach recovery. WordPress speed recovery addresses chronic slowness before it becomes an emergency.