Skip to content
CH SCShop classbring safety glasses

Step-by-step, copy-paste-ready, no gatekeeping. These are the exact procedures we run on client sites — published because a person who learns to patch their own site safely is a person who calls us for the interesting problems instead.

11The fundamentals
  1. foundationbeginner · ~30 min

    How to connect to your web server with SSH

    Generate a key, make your first connection, move files both directions, and get around the command line without fear of breaking anything.

  2. foundationbeginner · ~25 min

    How to install Composer (and understand what it actually does)

    Install PHP's package manager and read a composer.json well enough to run updates on purpose instead of on faith.

  3. foundationintermediate · ~90 min

    How to run a content audit before a redesign or migration

    Inventory every page, find what's actually earning traffic, and decide what moves, what merges, and what retires — before you pay to migrate it.

  4. foundationbeginner · ~45 min

    How to set up a local development environment with DDEV

    Run a full copy of a PHP site on your own computer with DDEV and Docker, so you can test changes somewhere breaking things is free.

  5. foundationbeginner · ~20 min

    How to set up uptime monitoring for your website

    Get an alert within a minute of your site going down, with checks that watch a page that matters instead of just the server's pulse.

  6. foundationbeginner · ~40 min

    How to use Git to track your website's code

    Put your site's code under version control so every change has a history, a diff, and an undo — even if you've never typed git before.

  7. foundationbeginner · ~20 min

    Website down? The outage triage, step by step

    A calm first-fifteen-minutes triage: figure out whether it's DNS, hosting, code, or an expired card, and get the site back or know exactly who to call.

  8. builds on 1beginner · ~30 min

    How to find and read your website's error logs

    Locate the PHP, server, and CMS logs for your site and read a stack trace well enough to know what broke and where.

  9. builds on 1beginner · ~40 min

    How to take a website backup that actually restores

    Database plus files plus proof: how to capture a complete backup of any CMS site, get a copy off the server, and run the restore drill that turns hope into coverage.

  10. builds on 3advanced · ~240 min

    How to investigate a website compromise like a forensic analyst

    Beyond cleanup: preserve evidence, reconstruct the attack timeline from access logs, hunt webshells by behavior, identify the entry vector, and close the actual door the attacker used.

  11. builds on 2advanced · ~180 min

    How to profile a slow website end to end: DNS to database

    The full-stack performance investigation: decompose TTFB with curl, isolate the slow layer, read cache headers like a detective, profile queries with EXPLAIN, and prove the fix with numbers.

09Hosting & servers
  1. foundationbeginner · ~30 min

    How to read and change DNS records without breaking your site

    Understand A records, CNAMEs, MX, and TTLs well enough to change a DNS record on purpose and know how long it takes to land.

  2. builds on 1intermediate · ~45 min

    How to put your website behind Cloudflare

    Route your traffic through Cloudflare for caching, HTTPS, and a shield against ugly traffic — without cache rules that break logins or carts.

  3. builds on 1beginner · ~30 min

    How to set up cron jobs on your server

    Schedule commands to run themselves — backups, cache warming, CMS housekeeping — and prove a job actually ran instead of hoping it did.

  4. builds on 1beginner · ~40 min

    How to set up free HTTPS with Let's Encrypt

    Get a free, auto-renewing SSL certificate on your site and clean up the mixed-content warnings, so the padlock stays green on its own.

  5. builds on 1intermediate · ~45 min

    How to set up SPF, DKIM, and DMARC so your email delivers

    Add the three DNS records that prove your mail is really yours, so invoices and contact-form messages stop landing in spam.

  6. builds on 1beginner · ~45 min

    How to transfer a domain to a new registrar without breaking anything

    Move a domain between registrars with zero downtime by getting DNS, email, and expiry timing squared away before you press transfer.

  7. builds on 2intermediate · ~60 min

    How to automate offsite backups with cron and rclone

    Turn your manual backup into a nightly job that copies itself to storage outside your hosting account, with a rolling window that cleans up after itself.

  8. builds on 3advanced · ~240 min

    How to build a real deployment pipeline for a CMS site

    From cowboy FTP to git-push-to-production: atomic releases, build steps in CI, database updates in the right order, health checks, and a rollback you've actually rehearsed.

  9. builds on 2intermediate · ~90 min

    How to move a website to a new host without downtime

    Migrate any CMS site to new hosting with a copy-verify-cutover sequence that keeps the old site live until the new one has proven itself.

16Drupal
  1. foundationbeginner · ~40 min

    How to manage Drupal users, roles, and permissions safely

    Build roles that give people exactly what their job needs, audit who can do what, and retire accounts without orphaning their content.

  2. builds on 1beginner · ~25 min

    How to set up Drush, Drupal's command line tool

    Install Drush in your Drupal project and learn the ten commands that make cache clears, updates, and backups a one-liner.

  3. builds on 2intermediate · ~45 min

    How to apply a Drupal security update the safe way

    The staging-tested patch process: read the advisory, back up, update on a copy, verify, then ship — the exact sequence that keeps a Wednesday advisory from becoming a Thursday outage.

  4. builds on 1beginner · ~25 min

    How to clear Drupal caches (and know which one to clear)

    Understand Drupal's cache layers well enough to clear the right one — and stop using a full rebuild as the fix for everything.

  5. builds on 2intermediate · ~60 min

    How to copy a live Drupal site to your computer with DDEV

    Pull the database, files, and code of a production Drupal site into DDEV, so every future change gets tested on a copy that costs nothing to break.

  6. builds on 2intermediate · ~45 min

    How to fix the Drupal white screen of death

    Turn a blank Drupal page back into an error message you can act on, work through the usual culprits, and get the site rendering again.

  7. builds on 2beginner · ~30 min

    How to install and remove Drupal modules with Composer

    Add, update, and cleanly remove Drupal modules the Composer way, so your site and your composer.json never disagree about what's installed.

  8. builds on 1intermediate · ~45 min

    How to make Drupal send email reliably

    Route Drupal's mail through an authenticated SMTP or API service instead of bare PHP mail, so password resets and notifications actually arrive.

  9. builds on 2intermediate · ~45 min

    How to manage Drupal configuration in Git

    Export your site's configuration to files, commit it, and import it on deploy — so settings travel like code instead of living in one database.

  10. builds on 2beginner · ~30 min

    How to set up Drupal cron the reliable way

    Move Drupal's housekeeping off the every-page-load trigger onto a real server schedule, and know how to tell when cron has quietly stopped.

  11. builds on 1intermediate · ~60 min

    How to audit and uninstall Drupal modules you don't need

    Find the modules your site isn't really using and remove them in the order Drupal expects, so every update from now on is smaller and safer.

  12. builds on 2advanced · ~150 min

    How to clean up a hacked Drupal site

    Contain the damage, find how they got in, remove what they left behind, and rebuild trust in a compromised Drupal site step by step.

  13. builds on 2advanced · ~240 min

    How to migrate a Drupal 7 site to modern Drupal

    Plan and run the D7-to-modern migration — content, users, files — with the migrate tools, and know which parts rebuild instead of migrate.

  14. builds on 1intermediate · ~90 min

    How to speed up a slow Drupal site

    Find where a Drupal site actually spends its time — cache misses, heavy views, unaggregated assets — and fix the things that move the needle.

  15. builds on 2advanced · ~180 min

    How to upgrade Drupal to the next major version

    Take a Drupal site through a major version jump — readiness scan, contrib check, the upgrade itself — without discovering the blockers mid-leap.

  16. builds on 3advanced · ~240 min

    How to write custom Drupal migration plugins for a D7 migration

    The masterclass under the migrate hood: custom source plugins, process pipelines, entity-reference webs, stubs, rollbacks, and the count reconciliation that proves nothing was lost.

13WordPress
  1. foundationbeginner · ~45 min

    How to audit and remove WordPress plugins you don't need

    Work out which plugins earn their keep, deactivate and delete the rest safely, and shrink your update burden and attack surface at once.

  2. foundationbeginner · ~25 min

    How to set up WP-CLI, the WordPress command line

    Install WP-CLI on your server or local machine and learn the handful of commands that make backups, updates, and user resets a one-liner.

  3. foundationintermediate · ~90 min

    How to speed up a slow WordPress site

    Measure where a WordPress page's time really goes, add page caching, shrink the images, and retire the plugins doing the damage.

  4. builds on 2intermediate · ~60 min

    How to copy a live WordPress site to your computer with DDEV

    Pull a production WordPress site's database, uploads, and code into DDEV — with the URL rewrites done right — so you can test changes locally.

  5. builds on 1intermediate · ~50 min

    How to put a WordPress site under version control

    Track the parts of WordPress that belong in Git — themes, custom code, config — while keeping uploads and secrets out, and deploy by push.

  6. builds on 1beginner · ~30 min

    How to update WordPress plugins without breaking the site

    The five-step update routine for WordPress: backup, staging, update in the right order, click the money paths, then ship — instead of the update-and-pray button.

  7. builds on 2intermediate · ~45 min

    How to clean up a bloated WordPress database

    Clear out the revisions, transients, and orphaned tables that make a WordPress database ten times bigger than it needs to be — safely, with a backup.

  8. builds on 2advanced · ~150 min

    How to clean up a hacked WordPress site

    Contain a compromised WordPress site, find and remove the malware and its backdoors, close the hole, and get off the blocklists.

  9. builds on 1beginner · ~40 min

    How to fix the WordPress white screen of death

    Turn on debug output, read the fatal, and use the halving method on plugins and theme to get a blank WordPress site rendering again.

  10. builds on 1intermediate · ~60 min

    How to harden WordPress against the attacks that actually happen

    Close the doors real WordPress attacks use — stale plugins, weak logins, writable files, XML-RPC — without buying a security suite you don't need.

  11. builds on 1beginner · ~40 min

    How to make WordPress send email reliably

    Route WordPress mail through an authenticated SMTP service so form submissions, receipts, and password resets stop vanishing into spam.

  12. builds on 2intermediate · ~60 min

    How to move a WordPress site to a new domain

    Change a WordPress site's domain with a serialized-safe search-replace, permanent redirects from the old name, and none of the half-moved weirdness.

  13. builds on 1intermediate · ~60 min

    How to set up a WordPress staging site

    Build a place to test updates that isn't your live site — the host's one-click version if you have it, a subdomain copy if you don't.

08Commerce
  1. foundationbeginner · ~30 min

    How to run a test order through your checkout

    Place a real-conditions test order with your gateway's test cards — through cart, payment, confirmation email, and refund — and make it a monthly habit.

  2. builds on 1intermediate · ~45 min

    How to back up a commerce site without losing orders

    Back up a store where orders never stop arriving — timing, freeze windows, and the staging-push rule that keeps you from overwriting last night's sales.

  3. builds on 2intermediate · ~60 min

    How to diagnose a checkout that stopped working

    Work out where in the funnel orders are dying — cart, payment, confirmation — and whether the culprit is a gateway, a plugin update, or a cache.

  4. builds on 2advanced · ~90 min

    How to prepare your store for a traffic spike

    Get a commerce site ready for the sale-day rush: cache everything cacheable, keep carts out of the cache, and know your host's and gateway's limits before the crowd arrives.

  5. builds on 2intermediate · ~60 min

    How to update WooCommerce without breaking checkout

    Run WooCommerce updates in the order that respects its database migrations and extension version matrix, and prove checkout works before anyone notices.

  6. builds on 1intermediate · ~60 min

    How to fix outdated WooCommerce template warnings

    Find the template overrides your theme is carrying, diff them against current WooCommerce, and bring them up to date without losing the customizations.

  7. builds on 2intermediate · ~60 min

    How to update a Drupal Commerce store safely

    Apply Drupal Commerce and payment-module updates with order data protected and the gateway proven, on a store where downtime is measured in dollars.

  8. builds on 3advanced · ~150 min

    How to debug Drupal Commerce price and promotion problems

    The order refresh pipeline, adjustments, promotion evaluation order, and compatibility — how to find out exactly why a total is wrong instead of guessing at configuration.

The shelf grows — new lessons land as we write them, and the feed carries them alongside the Field Notes. Stuck partway through one of these on your own site? Send up a flare — honest advice first, always.