WordPress still powers a large share of local business sites in Dehradun: clinics, hotels, packers, coaching institutes, and brochure sites that need an editor the owner can use. The failure mode is predictable — twenty plugins, an uncached page builder, and a host that sleeps until the next malware email.
This checklist is what ShubhKarma Tech runs before we call a WordPress site “production.” It is not a panic recovery guide (we already wrote that). It is how you avoid needing one.
1) Hosting and PHP before plugins
Use a host that supports current PHP and HTTP/2 or HTTP/3.
Enable object cache (Redis) when the site is WooCommerce or membership-heavy.
Turn on server-level page cache or a reputable cache plugin — not both fighting each other.
Put the site behind HTTPS with a valid certificate and HSTS when ready.
2) Theme and builder discipline
One page builder. Not Elementor plus WPBakery plus a theme that ships another.
Prefer block themes or a lean theme when the design allows it.
Disable unused theme demos, sliders, and icon packs.
Global styles beat per-section custom CSS pasted into widgets.
3) Plugin diet
Audit plugins quarterly. Delete what you do not open.
Security: one firewall/malware tool, not three overlapping ones.
SEO: one SEO plugin with consistent titles and sitemaps.
Forms: one form plugin with spam protection (honeypot + rate limit).
Never install “speed booster” packs that inject more JavaScript than they remove.
4) Images and media
Upload correctly sized images; do not rely on the browser to shrink 4000px photos.
Use WebP/AVIF where the host or CDN supports it.
Lazy-load below-the-fold media; keep the LCP image eager with dimensions.
Offload heavy media to object storage or a CDN when the library grows.
5) Caching and Core Web Vitals
Cache HTML for anonymous visitors; exclude cart, checkout, and account.
Defer non-critical CSS/JS carefully — broken checkout is worse than a 90 score.
Measure on mobile throttling. Desktop PageSpeed vanity scores hide builder weight.
Fix CLS from late fonts, sticky bars, and review iframes.
6) Security baseline
Unique admin usernames; strong passwords; 2FA for administrators.
Limit login attempts; disable XML-RPC if you do not need it.
Keep WordPress, theme, and plugins updated on a schedule — not only after a hack.
File permissions sane; remove unused themes; block PHP execution in uploads.
Off-site backups with a restore test every quarter.
7) SEO on WordPress without thin spam
Clean permalinks; no /?p=123 in production.
XML sitemap submitted in Search Console; noindexed thank-you and cart pages.
One H1; internal links to service and contact pages.
Local NAP in the footer matching Google Business Profile.
8) When to leave WordPress
If the site is a marketing brochure that changes monthly and must score on animation and CWV, Next.js is often cheaper long-term.
If editors need Gutenberg daily and WooCommerce already works, fix WordPress — do not rebuild for fashion.
Bottom line
Fast WordPress is a diet, not a plugin. Secure WordPress is hygiene, not a badge on the homepage.
Need a WordPress audit in Dehradun? Contact ShubhKarma Tech with your URL and host access level.