WordPress speed optimization in Chicago

What WordPress cleanup and speed work covers

A WordPress site gets slower and easier to attack for a shared reason: it accumulates. Plugins that were tried and dropped, themes nobody uses, database rows from tools removed years ago, oversized uploads, a PHP version the host never moved. Cleanup and speed work is the job of finding what is dead weight, proving it is dead, removing it with a restore point in hand, and then tuning what is left. WordPress.org's housekeeping guide asks owners to review plugins and themes on a schedule, and its hardening guide says to delete any plugin you are not using.^[17],[19]

This page covers repair and tuning of a WordPress site you already have. A new site or a redesign is a different job: see web design. Search visibility work sits on the SEO, AEO and GEO page, and conventional applications and integrations on custom apps and integrations.

• Audit first

  A read-only review of plugins, themes, database, autoloaded data, PHP version, caching and security settings, before anything changes.

• Backup before change

  A database dump and an archive of every file that could be removed, with checksums, so each removal has a restore point.

• Clean

  Inactive plugins and themes, leftovers of removed plugins, old revisions and stray files go one proven item at a time.

• Speed

  Measure real-user Core Web Vitals, then fix the cause behind each slow page: caching, images, scripts, hosting.

• Secure

  File permissions, login protection, updates and monitoring, with the WordPress.org hardening guide as the checklist.

• Recover

  If the site is hacked: quarantine, restore known-clean files, close the way in and support Google's review.

You can get a free first look yourself. WordPress has a Site Health screen under Tools, then Site Health. Its Status tab sorts findings into critical issues, recommended improvements and passed tests, and it flags an outdated PHP version, plugins waiting for updates and background updates that are not working. Its Info tab lists active and inactive plugins and themes, directory sizes and the database size. WordPress.org recommends removing inactive themes you do not plan to use.^[16]

Speed starts with measurement: Core Web Vitals

Core Web Vitals are Google's three measures of real visitor experience: loading (Largest Contentful Paint, LCP), responsiveness (Interaction to Next Paint, INP) and visual stability (Cumulative Layout Shift, CLS). web.dev recommends judging each at the 75th percentile of page loads, segmented across mobile and desktop, and treats a page as passing when it meets all three targets.^{[4],[1],[2],[3]}

Sources: ^[1],[2],[3]

Field data and lab data answer different questions. Field data comes from real visitors. web.dev says only field measurement captures the complete picture, and that lab tools such as Lighthouse cannot measure INP because they have no user input. PageSpeed Insights shows both: field data from the Chrome User Experience Report over the previous 28 days, and a Lighthouse lab run that simulates a mid-tier phone on a mobile network. A page without enough real-user samples falls back to origin-level data, and a low-traffic site may have none, in which case lab data is all there is.^[4],[10]

Public data shows that many WordPress sites do not pass. The 2025 Web Almanac CMS chapter describes WordPress as among the lowest-ranked platforms for mobile Core Web Vitals, with a pass rate of 45% in its figure description. We could not confirm the data month, and your site is not an average site, so treat this as context and not as your number.^[11]

What Google says about ranking is more modest than most speed marketing. Its page experience documentation says Core Web Vitals are used by its ranking systems and recommends good scores, but also that there is no single page experience signal, that Search shows the most relevant content even when the page experience is sub-par, and that good results in a report or a third-party tool do not mean top rankings. It adds that chasing a perfect score purely for SEO reasons may not be the best use of your time. Its Core Web Vitals documentation points to the Core Web Vitals report in Search Console for how your own pages perform.^[9],[8]

Where WordPress sites lose time and what fixes it

web.dev splits LCP into four parts and gives ideal shares of the total: time to first byte about 40%, resource load delay under 10%, resource load duration about 40% and element render delay under 10%. It calls these guidelines, not strict rules. Read in plain terms: if the server is slow to answer, no image trick can rescue LCP, so hosting and caching are checked first.^[5]

Sources: ^{[5],[6],[7],[12],[13],[14],[15],[24]}

In practice we start with the cheapest, most reversible changes: update PHP where the host allows it, remove dead plugins, turn on page and browser caching, resize and convert oversized images and set image dimensions. Heavier changes such as combining or delaying JavaScript come last and one at a time, because those are the ones that break layouts.

After each optimizer or cache change we check every page listed in the sitemap, every stylesheet and script, and what a real browser shows, not only the home page. A minify or combine setting can leave inner pages unstyled while the home page looks fine, and a cache purge that reports success can still leave old pages in the cache. We test with browser-like requests as well as plain ones.

The cleanup itself: audit, backup, then remove only what is proven dead

Cleanup is where sites get damaged, so the order matters more than the tools. This is how we work.

1. Audit, read only

   We list active and inactive plugins and themes, the largest uploads, post revisions, autoloaded options, tables that belong to no installed plugin, PHP and database versions, and the connections the site relies on: analytics, forms, Search Console, hub and API links.

2. Prove what is dead

   A leftover table or option counts as an orphan only when its plugin folder is gone, it is not in the active plugin list and no active code still reads it. A name that looks like old junk can be the live cache of a plugin you use, so we search the code before anything is marked for removal.

3. Backup and restore point

   A database dump and an archive of every file that could be removed, with checksums, copied off the server and checked. If there is no verified backup, nothing is deleted.

4. Your approval of the plan

   You see the exact counts of tables, options, revisions and files. The apply step stops by itself if the live numbers differ from the plan you approved.

5. Clean in small steps

   Inactive plugins, old revisions, leftover tables and stray files go first. Active plugins, connectors, SEO data stored in post meta, page-builder content and your media library are not touched without a separate decision.

6. Tune, verify, record

   Speed settings are staged and every page is checked after each stage. You receive the before and after numbers, what was removed and how to roll it back.

Sources: ^{[19],[16],[20],[13],[17]}

WordPress.org's backup guide says a backup has two parts, the database and the files. Back up the database first, then the files, and keep them together as one set; to restore, reverse the order, files first and then the database. It suggests weekly backups for smaller sites and daily for high-activity sites, and keeping at least 3 to 5 recent backups in different places such as your host, cloud storage and a local computer. It advises backing up before every upgrade or move.^[18]

We take a backup before any change whatever the schedule says, we copy it somewhere other than the server being cleaned, and we check that it can be read before the first deletion.

If the site is hacked: recovery in the right order

WordPress.org lists indicators of compromise: the site is blacklisted by a search engine, the host has disabled it, it is flagged for distributing malware, visitors report antivirus warnings, someone says it is attacking other sites, you see actions you did not take such as new users, or the damage is visible in the browser. Not every hack looks alike, which is why the first job is to write down the symptoms.^[26]

1. Document, then take the site offline. Write down what you see, when you noticed it (with the time zone) and what changed recently. web.dev suggests stopping the web server or pointing DNS at a static 503 page hosted elsewhere, because a robots.txt block or an error code does not stop harmful content reaching visitors. The FTC's breach guide also says to take affected equipment offline right away.^{[26],[30],[33]}
2. Call the host and scan your own computer. On shared hosting a hack can reach beyond your site, and WordPress.org notes that attacks often start on the owner's own machine, where trojans capture FTP and admin logins.^[26],[30]
3. Back up the infected state twice and find a clean one. web.dev says to make two backups even though the site is still infected, labeled as such, and to check that your backup was created before the site was hacked. WordPress.org also recommends a snapshot before cleaning, in case of catastrophic failure.^[31],[26]
4. Lock the doors. Change every access point: WordPress admin, SFTP, the hosting panel and the database. Review the user list for accounts the attacker created. WordPress.org says to replace the secret keys in wp-config.php so anyone still logged in is signed out.^[26],[30]
5. Find and remove the malicious code. WordPress.org says /wp-admin and /wp-includes can be replaced with fresh copies of the same version, and that .htaccess is one of the files attackers most often change. WP-CLI can compare core files and plugin files with the checksums published by WordPress.org and list every file that does not match. Code that does not come from WordPress.org, such as premium plugins and custom themes, has to be compared with your own known-clean copy.^{[26],[27],[28]}
6. Close the way in, then update. web.dev says to correct the vulnerability and, for a compromised server, to perform a clean installation, not just an upgrade. WordPress.org says older versions are more prone to hacks and that you should update once the site is clean.^[31],[26]
7. Change the passwords again. If you only changed them when you discovered the hack, WordPress.org says to change them again after the site is confirmed clean, and to consider a new database user and password.^[26]
8. Request Google's review if it flagged the site. Google calls the Security Issues report in Search Console the source of truth. When every listed issue is fixed on every page, select Request Review and describe what you fixed. A review can take from a few days to a few weeks, and you should not resubmit while one is pending.^[29]

Google's Security Issues report names these kinds of hacked content, among others: code injection (malicious code such as redirects or cryptocurrency mining scripts), content injection (spammy links or text added to existing pages) and URL injection (new spam pages created on your site). Many hackers show their changes only to Google's crawler, so use the URL Inspection tool to see a page as Google sees it, and use cURL or Wget with different user agents and referrers instead of a browser to look at infected pages, since malware can exploit browser flaws.^[29]

Google's spam policies define hacked content as any content placed on a site without permission due to vulnerabilities in the site's security, and list code injection, page injection, content injection and redirects as examples. The policies also say that sites that violate them may rank lower or not appear in results at all.^[32]

• Who is covered (Illinois Personal Information Protection Act, 815 ILCS 530). A data collector includes privately and publicly held corporations and any other entity that, for any purpose, handles, collects, disseminates or otherwise deals with nonpublic personal information. A breach is unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of personal information the collector maintains.^[34]
• What counts as personal information. A first name or initial and last name combined with a Social Security number, driver's license or state ID number, account or card number, medical information, health insurance information or unique biometric data, or an email address or user name combined with a password or security question and answer that would permit access to an online account.^[34]
• Notice. After a breach the data collector must notify the affected Illinois resident at no charge, in the most expedient time possible and without unreasonable delay, consistent with measures needed to find the scope and restore the system. A collector that must notify more than 500 Illinois residents because of a single breach must also notify the Attorney General, no later than when it notifies consumers.^[35]
• Security duty. A data collector that holds personal information about an Illinois resident must implement and maintain reasonable security measures, and a contract for disclosing that information must require the recipient to do the same. Ask your host and your plugin vendors what they commit to.^[36]
• Practical steps (FTC). The FTC's guide for businesses says to secure operations, reset credentials, remove personal information posted on your website, preserve evidence, bring in forensic experts to find the source and scope, and check state and federal breach notification laws.^[33]

For a hacked site we use the same written scope, with a different order: quarantine and backup first, then cleanup, then a review of how the attacker got in. We do not delete anything we cannot restore, and we say so plainly when a site should be restored from a clean backup instead of cleaned in place.

Hardening, updates and a maintenance rhythm

The WordPress.org hardening guide is the checklist we start from. These are the items we check on almost every site:^[19]

• File permissions. Directories 755 and files 644, with core files writable only by your user account. wp-config.php readable only by you and the web server, which generally means 400 or 440, and it can live one directory above the install.^[19]
• Turn off the dashboard file editor. Define DISALLOW_FILE_EDIT as true in wp-config.php. WordPress.org notes this does not stop an attacker from uploading malicious files, so it is one layer, not the fix.^[19],[20]
• Delete what you do not use. Keep plugins updated and delete any plugin you are not using.^[19]
• Strong login. Long, unique passwords, two-step authentication and no admin or webmaster user name.^[19]
• Encrypted connections. SFTP instead of FTP, and HTTPS for administration; the FORCE_SSL_ADMIN constant secures logins and the admin area so passwords and cookies are not sent unencrypted.^[19],[20]
• Database. A separate database and user for each site, and a table prefix other than the default. Changing the prefix on a live site is risky, so we only do it with a tested backup.^[19]
• Backups and monitoring. Dated snapshots of the whole install and the database, and a way to notice changed files.^[19]

On updates, the hardening guide says older versions of WordPress are not maintained with security updates, and that once a fix ships the information needed to exploit the flaw is almost certainly public, which is a main reason to stay current. WordPress.org's security page says only the latest version is officially supported, with fixes backported to older versions as a courtesy.^[19],[23]

Since version 3.7, minor and security updates for core apply automatically in the background on most sites, while major releases need a click; the WP_AUTO_UPDATE_CORE setting defaults to minor releases only. Plugin and theme auto-updates arrived in version 5.5, are opt-in for each plugin and theme, and run twice a day by default. They rely on WordPress cron, Site Health can show whether it works, and WordPress.org advises making sure you can roll back before turning them on.^{[21],[20],[22],[16]}

On versions, the WordPress.org requirements page recommends PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, and HTTPS support. It says WordPress still works with PHP 7.4 and MySQL 5.5.5, but those versions have reached end of life and may expose a site to security vulnerabilities. The PHP project's supported-versions table, read on October 13, 2026, lists 8.2 with security fixes only until December 31, 2026, 8.3 with security support until December 31, 2027, and 8.4 and 8.5 in active support.^[24],[25]

Sources: ^{[21],[20],[22],[17],[18],[16],[24],[25]}

A maintenance plan is the same list with a named owner and a written change log. We agree the list and how often each item runs in the written scope, and we report what was updated, what failed and what was rolled back.

Repair or rebuild, and where AI helps

Repair is cheaper in the short run and a rebuild is cleaner in the long run. The right answer depends on evidence, so we write the recommendation down with the reasons.

Sources: ^{[26],[31],[24]}

For a site that rarely changes, rebuilding as hand-edited static pages in CMS MESH 5.1 (Media Express Static Hub), our own new-generation manual CMS, is one option: ultra-fast static HTML pages, no database, no plugins to update, an AI-ready structure (schema, llms.txt, sitemap) and hand-verified QC. It is not the right choice for sites that need plugin ecosystems, shops or user accounts; those stay on WordPress. The CMS MESH page explains the trade-offs honestly.

AI-assisted editing. AI is how we work faster: drafting page copy, writing tests, summarizing audit output and checking changes. A person approves what goes live, and nothing an AI drafts is applied to a production site without that approval.

WordPress itself now has a built-in AI Client. According to the core developer note of March 24, 2026, WordPress 7.0 includes a provider-agnostic PHP API that lets plugins send prompts to AI models, site administrators configure providers on the Settings, Connectors screen, and core does not bundle any AI providers directly. The post notes that not every site will have a provider configured. It describes no site-wide switch to disable the AI Client and no usage or cost limits for site owners; developers can block specific prompts with a filter.^[37]

That is why we treat any AI plugin like any other plugin that sends data to a third party: we check what it sends, who can use it and what it can change before it is switched on.

How an engagement works, what you receive and what to prepare

1. Request

   You send the site address and what you see: slow pages, a warning, strange users, a failed update, or a plugin you want gone.

2. Short call

   We ask what the site is for, who has access, what changed recently and what must not break, and we tell you honestly if a cleanup is not what you need.

3. Written scope

   Goal, tools and accounts involved, approvals and the success measure, written down before we touch the site.

4. Audit and backup

   A read-only audit, then a verified backup. You see the plan and the exact counts before anything is removed.

5. Clean, tune, verify

   Changes are made in stages, with an approval point before risky ones. Every step is logged and has a way back.

6. Report and maintain

   You receive before and after measurements and a change list, and a recurring maintenance scope if you want one.

Work runs through accounts you own. The AI agents we use on a site ask for approval on risky steps, log every action, use least-privilege access with their own service account, and can be switched off. We never ask for passwords or API keys in a contact form. See how we run AI agents for the detail.

Who you work with: Media Express LLC in Mount Prospect, Illinois, opened on April 1, 1995, and has delivered 2,500+ digital projects. Our own team of AI agents (Claude, ChatGPT, Gemini and open-source runtimes) keeps 100+ web properties running and monitored. Google Inc. was incorporated in August 1998, so we built websites in the dial-up era.^[38]

• A written audit with findings sorted by risk.
• A verified backup and rollback instructions.
• A list of everything removed, changed or updated.
• Before and after Core Web Vitals measurements from the same tools.
• A hardening checklist: what was done and what remains.
• For a hacked site: what was found, what was restored, how the attacker most likely got in if the evidence allows, and what you must change.
• A maintenance scope, if you want one.

To prepare: the site address; who has the hosting, domain and WordPress admin access and who owns each account; what the site must keep doing (forms, shop, bookings, logins); anything that changed before the problem started, such as a new plugin, a theme edit or a host change; the last backup you know about and where it is; and any warnings from Google, your host or customers. Not the passwords: we set up access with you.

We do not publish prices. The estimate is free, we work with every budget, and scope and cost come in writing after a short call. Call 773-800-1520, Monday to Friday 9 to 5 and Saturday 10 to 2 Central. We work remotely across the United States and on site in the Chicago area, in English and in Polish.

When this is NOT a good fit

• You need a new website, not a repair. A redesign or a new build is a different job; see our web design page.
• You want a perfect score for its own sake. Google says trying for a perfect score just for SEO reasons may not be the best use of your time, and that Search shows relevant content even when page experience is sub-par.^[9]
• You want ranking promises. Google says there is no single page experience signal. Speed is one input among many, and we do not promise rankings or a score. If you need search work, start with the SEO, AEO and GEO page.^[9]
• Your host is the limit. If the plan cannot run a current PHP version, offer a cache server or give access to logs, tuning inside WordPress only goes so far. The fix may be a host change, and we will say so.
• You need a legal or forensic investigation. Cleanup restores the site. It is not a legal opinion, a forensic report for a court or a regulator notice. For a breach of personal information your attorney should lead; the FTC guide says to bring in forensic experts to determine the source and scope.^[33]
• Nobody can say who owns the hosting, the domain or the admin accounts. We work through accounts you own, so sort out ownership first.

If one of these fits, we will say so on the first call.

Questions answered

Sources

1. Largest Contentful Paint (LCP) (web.dev (Google)), accessed 2026-10-13. LCP thresholds (2.5 and 4.0 seconds), 75th percentile, what counts as the LCP element.https://web.dev/articles/lcp
2. Interaction to Next Paint (INP) (web.dev (Google)), accessed 2026-10-13. INP thresholds (200 and 500 milliseconds) and what INP measures.https://web.dev/articles/inp
3. Cumulative Layout Shift (CLS) (web.dev (Google)), accessed 2026-10-13. CLS thresholds (0.1 and 0.25) and the 75th percentile.https://web.dev/articles/cls
4. Web Vitals (web.dev (Google)), accessed 2026-10-13. The three Core Web Vitals, the 75th percentile rule, field versus lab data and Lighthouse not measuring INP.https://web.dev/articles/vitals
5. Optimize Largest Contentful Paint (web.dev (Google)), accessed 2026-10-13. The four LCP sub-parts with ideal shares, fetchpriority, never lazy-load the LCP image, CDN and redirects.https://web.dev/articles/optimize-lcp
6. Optimize Cumulative Layout Shift (web.dev (Google)), accessed 2026-10-13. Image dimensions, reserved space for embeds, font-display optional.https://web.dev/articles/optimize-cls
7. Optimize Interaction to Next Paint (web.dev (Google)), accessed 2026-10-13. Long tasks, yielding to the main thread and DOM size.https://web.dev/articles/optimize-inp
8. Understanding Core Web Vitals and Google Search results (Google Search Central), accessed 2026-10-13. Core Web Vitals report in Search Console and the three suggested thresholds.https://developers.google.com/search/docs/appearance/core-web-vitals
9. Understanding page experience in Google Search results (Google Search Central), accessed 2026-10-13. No single page experience signal, Core Web Vitals used by ranking systems, relevance over page experience, good scores do not mean top rankings, perfect score not worth chasing for SEO alone.https://developers.google.com/search/docs/appearance/page-experience
10. About PageSpeed Insights (Google), accessed 2026-10-13. Field data from the Chrome User Experience Report over 28 days, Lighthouse lab data, fallback to origin-level data.https://developers.google.com/speed/docs/insights/v5/about
11. Web Almanac 2025: CMS (HTTP Archive), accessed 2026-10-13. Mobile Core Web Vitals pass rate for WordPress in the chapter's figure description.https://almanac.httparchive.org/en/2025/cms
12. Image performance enhancements in WordPress 6.3 (WordPress Core team (make.wordpress.org)), accessed 2026-10-13. Automatic fetchpriority high on the likely LCP image and fixes to lazy-loading in WordPress 6.3.https://make.wordpress.org/core/2023/07/13/image-performance-enhancements-in-wordpress-6-3/
13. Optimization (WordPress Advanced Administration Handbook) (WordPress.org), accessed 2026-10-13. Caching plugins, persistent object cache needs a host cache server, delete unnecessary plugins, InnoDB, revisions, autoload under 800kb, WebP.https://developer.wordpress.org/advanced-administration/performance/optimization/
14. WP_Object_Cache class reference (WordPress.org), accessed 2026-10-13. The object cache saves trips to the database and is non-persistent by default.https://developer.wordpress.org/reference/classes/wp_object_cache/
15. LiteSpeed Cache plugin (WordPress.org Plugin Directory), accessed 2026-10-13. Server-level page cache needs a LiteSpeed-based host; Redis and Memcached object cache support.https://wordpress.org/plugins/litespeed-cache/
16. Site Health screen (WordPress.org), accessed 2026-10-13. Status and Info tabs, critical issues, outdated PHP, background updates, inactive themes.https://wordpress.org/documentation/article/site-health-screen/
17. WordPress Housekeeping (WordPress.org), accessed 2026-10-13. Review plugins and themes regularly, delete unwanted ones, unused images, database overhead, update check every three to six months.https://wordpress.org/documentation/article/wordpress-housekeeping/
18. WordPress Backups (WordPress.org), accessed 2026-10-13. Database and files, backup and restore order, weekly or daily frequency, 3 to 5 recent copies in different places.https://developer.wordpress.org/advanced-administration/security/backup/
19. Hardening WordPress (WordPress.org), accessed 2026-10-13. Permissions 755 and 644, wp-config settings, DISALLOW_FILE_EDIT, delete unused plugins, SFTP, two-step authentication, backups, old versions not maintained.https://developer.wordpress.org/advanced-administration/security/hardening/
20. Editing wp-config.php (WordPress.org), accessed 2026-10-13. WP_POST_REVISIONS, DISALLOW_FILE_EDIT, FORCE_SSL_ADMIN and the WP_AUTO_UPDATE_CORE default.https://developer.wordpress.org/advanced-administration/wordpress/wp-config/
21. Updating WordPress (WordPress.org), accessed 2026-10-13. Back up before updating; automatic background updates for minor and security releases since 3.7.https://wordpress.org/documentation/article/updating-wordpress/
22. Plugin and themes auto-updates (WordPress.org), accessed 2026-10-13. Auto-updates since 5.5, opt-in, twice a day, rely on WordPress cron, backup advice.https://wordpress.org/documentation/article/plugins-themes-auto-updates/
23. WordPress Security (WordPress.org), accessed 2026-10-13. Only the latest version is officially supported; older versions get fixes as a courtesy.https://wordpress.org/about/security/
24. WordPress requirements (WordPress.org), accessed 2026-10-13. Recommended PHP 8.3 or greater, MariaDB 10.11 or MySQL 8.0, HTTPS; PHP 7.4 and MySQL 5.5.5 work but are end of life.https://wordpress.org/about/requirements/
25. Supported Versions (PHP) (The PHP Group), accessed 2026-10-13. Active and security support dates for PHP 8.2, 8.3, 8.4 and 8.5.https://www.php.net/supported-versions.php
26. FAQ: My site was hacked (WordPress.org), accessed 2026-10-13. Indicators of compromise, document, scan, reset access and secret keys, backups, replace core folders, .htaccess, update, change passwords again.https://wordpress.org/documentation/article/faq-my-site-was-hacked/
27. wp core verify-checksums (WP-CLI) (WordPress.org (WP-CLI handbook)), accessed 2026-10-13. Verifies core files against WordPress.org checksums and lists mismatches.https://developer.wordpress.org/cli/commands/core/verify-checksums/
28. wp plugin verify-checksums (WP-CLI) (WordPress.org (WP-CLI handbook)), accessed 2026-10-13. Verifies plugin files against WordPress.org checksums.https://developer.wordpress.org/cli/commands/plugin/verify-checksums/
29. Security Issues report (Search Console Help) (Google Search Console Help), accessed 2026-10-13. Source of truth, code, content and URL injection, URL Inspection and cURL advice, Request Review, a few days to a few weeks, no resubmitting.https://support.google.com/webmasters/answer/9044101?hl=en
30. Quarantine your site (web.dev (Google)), accessed 2026-10-13. Take the site offline with a 503 page from outside, contact the host, review accounts and change all passwords. Page last updated 2015.https://web.dev/quarantine-your-site/
31. Clean and maintain your site (web.dev (Google)), accessed 2026-10-13. Two backups of the infected site, check the backup predates the hack, correct the vulnerability, clean installation for a compromised server. Page last updated 2015.https://web.dev/clean-and-maintain-your-site/
32. Spam policies for Google web search (Google Search Central), accessed 2026-10-13. Definition and examples of hacked content; violating sites may rank lower or not appear.https://developers.google.com/search/docs/essentials/spam-policies
33. Data Breach Response: A Guide for Business (U.S. Federal Trade Commission), accessed 2026-10-13. Take affected equipment offline, reset credentials, remove posted personal information, forensics, check state and federal notification laws.https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business
34. 815 ILCS 530/5: Personal Information Protection Act, definitions (Illinois General Assembly), accessed 2026-10-13. Definitions of data collector, breach of the security of the system data and personal information.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K5.htm
35. 815 ILCS 530/10: Notice of breach; notice to Attorney General (Illinois General Assembly), accessed 2026-10-13. Notice to residents without unreasonable delay; notice to the Attorney General for more than 500 residents.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm
36. 815 ILCS 530/45: Data security (Illinois General Assembly), accessed 2026-10-13. Reasonable security measures and the contract requirement.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K45.htm
37. Introducing the AI Client in WordPress 7.0 (WordPress Core team (make.wordpress.org)), accessed 2026-10-13. What the AI Client is, who configures providers, no bundled providers, no site-wide off switch or cost limits described.https://make.wordpress.org/core/2026/03/24/introducing-the-ai-client-in-wordpress-7-0/
38. How we started and where we are today (Google), accessed 2026-10-13. Google Inc. was incorporated in August 1998.https://about.google/company-info/our-story/

How we checked this page

Last verified 2026-10-13 · Media Express LLC

General information, not legal, financial or security advice. Rules and vendor terms change; check the cited source before you rely on a figure.

Related

• Custom web design in ChicagoWeb design
• A static website CMS, explained honestlyStatic website CMS
• Custom software development in ChicagoCustom apps and integrations
• SEO, AEO, GEO and AI SEO in ChicagoSEO, AEO and GEO