WordPress security guide: the measures that matter and what to do if you have been hacked
Updates, passwords, 2FA, backups, permissions and firewalls: practical protection and the steps to take if your site is hacked.
LCP, INP and CLS explained simply: how to measure website speed, what slows it down and the order in which to fix it.
Core Web Vitals are three measurements Google uses to describe website speed as a visitor feels it: LCP (how quickly the main content appears, aim for under 2.5 seconds), INP (how quickly the page reacts to a click or tap, under 200 milliseconds) and CLS (how stable the layout stays, under 0.1). Measure them with PageSpeed Insights and Search Console, and fix images, hosting and third-party scripts first.
A visitor does not think about your server. They think about three things: “Is anything appearing on the screen?”, “Can I press that button?” and “Why did the page jump just as I was about to tap?” Core Web Vitals are Google’s way of turning those three questions into numbers that you can track, compare and improve.
They matter to a business owner for two reasons. The first is commercial: a slow page loses people before they read your offer, and the visitors you pay for with advertising are the most expensive ones to lose. The second is visibility: Google uses page experience as one of its quality signals, alongside content relevance, links and much else. It is not a magic switch that takes you to the top of the results, but between two equally relevant pages it can tip the balance.
The good news is that you do not need to read code to manage the process. You need to know what is being measured, where the numbers come from and which questions to ask whoever looks after your site.
The thresholds below are the ones Google publishes and uses in its reports. They are usually assessed at the 75th percentile of real visits, which means that three visits in four must fall within the “good” range.
| Metric | What it tracks | “Good” threshold | “Poor” threshold |
|---|---|---|---|
| LCP (Largest Contentful Paint) | When the largest visible element appears: the hero image or the top block of text | up to 2.5 seconds | over 4 seconds |
| INP (Interaction to Next Paint) | How long the page takes to respond visibly after a click, tap or key press | up to 200 ms | over 500 ms |
| CLS (Cumulative Layout Shift) | How much the content moves around while the page loads | up to 0.1 | over 0.25 |
INP replaced the older FID metric in 2024. The difference is real: FID only looked at the first interaction, while INP considers how the page responds across the whole visit. If you have read older articles that talk about FID, that advice is out of date.
This is where most people get confused. There are two kinds of data, and they should not be mixed up.
Lab data comes from a test run now, in a simulated environment such as Lighthouse. It is useful for finding causes and checking that a fix worked, but it depends on the simulation you choose: connection speed, phone type, even the time of day.
Real-user (field) data comes from actual visitors, collected through Chrome and aggregated in the Chrome UX Report. This is what Google uses, and it tells the truth about your customers on their own phones and networks.
A small site with little traffic may not have enough real-user data. In that case you rely on lab results and common sense, accepting that they are an estimate. A sensible start is to run PageSpeed Insights on your home page and on the page that receives the most visits or enquiries.
LCP is often the easiest metric to improve, and the improvement is usually clearly visible. The causes repeat from one site to the next.
A 3 MB photograph used as the cover image is the classic culprit. The fix is sizes that suit the screen, modern formats such as WebP or AVIF, and sensible compression. One detail that is often missed: the main image should not be lazy-loaded. That technique is meant for images further down the page, not the one at the very top.
If the server responds slowly, everything else waits. An overloaded hosting plan, a busy database or the lack of a caching layer all delay the first byte (the measurement is called TTFB). Better hosting, page caching and, for audiences in several countries, a CDN will help. The reasoning behind the choice is covered in our guide to choosing web hosting.
Large CSS and JavaScript files loaded at the top of the page keep the screen blank while the browser downloads them. The remedy is to defer whatever is not needed for the first view and keep only the critical styles up front.
INP gets worse when the browser’s main thread is busy with too much JavaScript. Typical sources are a pile of plugins, a heavy page builder, chat widgets, tracking pixels, maps and social buttons added over the years without anyone clearing them out. Each looks harmless; together they make the page freeze for a few hundred milliseconds after a tap.
CLS appears when something takes up space after the rest of the page has settled. Common causes:
The fix for CLS is usually the same: reserve the space in advance. For INP, remove what adds no value and defer the rest.
A common reflex is to add yet another optimisation plugin on top of the existing ones. Without measurement you can end up with the opposite result: more scripts, not fewer. Change one thing at a time and measure again.
The order matters more than the number of fixes. Start with whatever delivers the most for the least effort.
For a quick first impression of a landing page, you can use the landing page audit in our Lab. It does not replace a full technical test, but it shows what to check next.
There is no simple rule such as “one second faster means X% more sales”. The figures that circulate online come from different contexts and do not apply automatically to your business. What can be said with confidence is the direction: a page that loads quickly and stays stable causes less frustration, and a less frustrated visitor is more likely to read, call or buy.
On the search side, Core Web Vitals belong to page experience, a group of signals Google uses. Content relevance remains far more important. A site with excellent text and average speed can outrank a fast but thin one. That is why speed should be treated as a baseline condition, not as a strategy in itself.
For paid ads the effect is more direct: you pay for every click, and if the page loads slowly, some of the people you paid for leave before seeing the offer. A fast site makes the same ad budget go further.
TTFB (Time to First Byte) is the time until the server starts sending its response. Cache is a store holding a ready-made copy of the page, so it does not have to be built from scratch on every visit. CDN is a network of servers that delivers static files from a point close to the visitor. Lazy loading means loading images only when they get near the screen. 75th percentile is the value below which 75% of visits fall; this is why a few very slow visits do not ruin the result, while consistently slow traffic does.
We begin by measuring the pages that bring in revenue or enquiries, not by optimising at random. We record the real-user values, find the two or three causes that weigh most and fix them in order, checking after each change. Where a problem cannot be solved without better hosting or replacing a heavy plugin, we say so plainly, with the alternatives and their approximate cost.
On a WordPress site, speed erodes slowly, through accumulation. That is why part of our WordPress maintenance is regular housekeeping: updates, unnecessary scripts, new images that were never resized, the database. If a site is being built from scratch, these rules go in from the design stage of a new WordPress website.
They are three measurements that describe how a website feels to a visitor: how quickly the main content appears (LCP), how quickly it responds to a click (INP) and how steady the layout stays (CLS). Google uses them as part of its page experience assessment, and you can track them for free in Search Console.
There is no single number that fits every case, but Google’s target for the main content (LCP) is no more than 2.5 seconds, measured across most real visits. If you go beyond 4 seconds on mobile, the page counts as poor and deserves to be your first repair job.
Yes, but usually only modestly. They belong to the page experience signals, while relevance and content quality remain far more important. Think of speed as a condition that lets you compete, not as a trick that lifts you to the top on its own.
The mobile test simulates a slower phone and a weaker network, so heavy scripts and images show up. Because many visitors use phones, mobile is the one that counts first. Fix the images and scripts, then test again.
The report relies on real-user data collected over roughly 28 days, so changes appear with a delay. After a fix, PageSpeed Insights shows the lab effect quickly, while the field data updates gradually over the following weeks.
The simple parts, such as smaller images, unused plugins removed and a well-configured cache, you can do yourself if you are careful and take a backup first. Problems with the server, the database or the theme code call for a specialist, so you do not break the live site.
Laborator
Lab tools that help you put this guide into practice.
Blog
Updates, passwords, 2FA, backups, permissions and firewalls: practical protection and the steps to take if your site is hacked.
Shared, VPS, cloud or managed WordPress: the criteria that matter, the questions to ask a provider and the traps in offers.
A pre-launch checklist: content, technical SEO, speed, forms, tracking and legal basics.
Tell us where you are now and what you want to achieve — you will get a concrete proposal with services, timeline and a transparent budget.