by Charles Oropallo | Oct 18, 2024 | Do-It-Yourself, Security, Technical Help, The CW Corner, Web Hosting
If you secure many sites with free Let’s Encrypt SSL, you may hit a wall. Suddenly, certificate requests stop cold. One day everything works. The next, you see rate-limit errors and wonder what happened.
Here’s the thing. Let’s Encrypt secures over 350 million websites with free SSL. To keep things stable and safe, they enforce strict rate limits. These limits can surprise even seasoned developers. They bite hardest when securing many domains or subdomains at once.
Understanding these limits prevents headaches. It also keeps your sites secure and your business running. I’ll explain what the limits mean. I’ll share five practical steps to avoid SSL issues before they happen.
What Are Let’s Encrypt Rate Limits?
Think of Let’s Encrypt rate limits like a busy restaurant. It can serve only so many guests each hour. They are not there to hassle you. They ensure fair access and protect the system.
The key limit is 50 certificates per registered domain every 7 days. “Registered domain” means your eTLD+1, or main domain. If you own example.com, all subdomains share that weekly pool. That includes www, blog, and shop subdomains.
That’s not the only limit. You get 5 failed validation attempts per domain per hour. Repeated failures trigger a temporary lockout. Common causes include DNS or firewall issues. There’s also a duplicate certificate limit of 5 per week. Renewals do not count against the 50-certificate quota.
Account creation is limited too: 10 accounts per IP every 3 hours. This prevents abuse through mass accounts. It can also affect legitimate teams that need several accounts.
Step 1: Use Wildcard Certificates for Multiple Subdomains
Here’s your first defense against rate limits. Use a single wildcard certificate, not many subdomain certificates. One wildcard covers all subdomains under your domain.
A wildcard for *.example.com secures www, blog, shop, and new subdomains. You issue only one certificate. This slashes issuance volume and stays within Let’s Encrypt limits.
Even better, a single certificate can list up to 100 domains. Managing many brands? Combine domains into fewer certificates. One cert can cover yourcompany.com, .net, and .org.
Look at your setup. Are you requesting one certificate per subdomain? If so, you burn limits quickly. Switching to wildcard certificates is often the top fix.
Step 2: Test in the Staging Environment First
Before deploying live, test in Let’s Encrypt’s staging environment. It’s a safe practice kitchen. Mistakes don’t affect customers.
Staging has relaxed limits: 50 new registrations per IP per 3 hours. Production allows only 10. Use staging to test SSL, fix DNS, and refine deployment.
Many teams skip this step in a rush to go live. That’s when rate-limit problems strike. You issue, it fails, you retry, and hit five failures. Now you must wait.
Follow this rule. Do not issue a production certificate until staging succeeds. Spend 15 extra minutes. It could save days later.
Step 3: Implement Protective Safeguards
Smart hosting platforms add safeguards to prevent runaway certificate requests. You should do the same.
Many platforms lock SSL provisioning after three failures. They stop before Let’s Encrypt’s limit of five. That buffer prevents retry loops and protects weekly limits.
If you manage SSL yourself, add similar safeguards. Monitor requests per domain and per week. Create alerts near the limits. Add automatic delays between retries.
Do not rely on manual steps. SSL issues feel urgent, and pressure creates mistakes. Automation removes human error in Let’s Encrypt rate-limit management.
Step 4: Monitor and Space Out Certificate Requests
If you manage many sites or a SaaS, timing matters. Be strategic with certificate requests. Avoid securing everything at once.
Let’s Encrypt allows 10 certificates per IP every three hours. Migrating dozens at once? Pace your requests. Spread them over days, not one afternoon.
Keep detailed logs of issuance times and domains. This is essential for weekly limits. Know exact counts for each domain over seven days before requesting more.
Use a spreadsheet or database to track issuance dates, renewals, and limit usage. Seeing requests visually helps avoid accidental Let’s Encrypt limit hits.
Step 5: Fix Root Causes Before Retrying Failed Requests
This might be the most important step. When provisioning fails, do not retry immediately. The seven-day window also tracks failed attempts per domain.
Instead, find and fix the root cause. Common causes include DNS mistakes, blocked HTTP validation, or domain verification issues. Retrying without fixes only wastes your limits.
Some common issues to check when certificates fail:
- DNS records pointing to the correct IP address
- Firewall rules allowing HTTP validation on port 80
- Web server configuration properly handling validation requests
- Domain ownership verification working correctly
Follow this rule of thumb. Wait at least an hour between failures. Do not retry until you fix the specific problem. Many providers recommend this. It prevents accidental lockouts.
What Happens When You Hit Rate Limits
Despite your best efforts, you may still hit limits. When it happens, wait for the window to reset. The main certificate limit resets after seven days.
While you wait, consider alternatives. Issue wildcard certificates where missing. Consolidate domains into fewer certificates. For critical needs, consider a commercial CA as a temporary last resort.
Most important, learn from the incident. Review what happened. Update processes to prevent repeats. Confirm your safeguards work properly.
Remember, Let’s Encrypt rate limits keep the service stable for everyone. Follow the five steps. Use wildcards. Test in staging. Add safeguards. Monitor usage. Fix root causes early.
The key is proactive planning, not reactive troubleshooting. With preparation, you can keep sites secure without hitting these limits.
by Charles Oropallo | Sep 27, 2024 | Do-It-Yourself, Technical Help, The CW Corner, Web Hosting, WordPress
You updated PHP on your hosting account and suddenly your WordPress site displays a white screen or error messages. Sound familiar? You’re not alone. PHP updates break WordPress sites more often than you’d think, but the good news is that most issues have straightforward fixes.
The problem usually stems from outdated plugins, themes, or even WordPress core files that aren’t compatible with newer PHP versions. Think of it like trying to run old software on a brand-new computer – sometimes it just doesn’t work without updates.
Don’t panic. Here’s your step-by-step recovery plan to get your site back online and properly updated.
Step 1: Revert PHP Version Immediately
Your first priority is getting your site back online. Log into your hosting control panel (like cPanel) and find the PHP settings. This might be called “MultiPHP Manager,” “PHP Version,” or “Select PHP Version.”
Switch back to your previous PHP version – usually PHP 7.4 or 8.0. Your site should come back online within minutes. This buys you time to properly diagnose and fix the underlying compatibility issues.
Remember, this is a temporary fix. Running outdated PHP versions leaves your site vulnerable to security threats. PHP 7.4 stopped receiving security updates in November 2022, and even PHP 8.0 support ended in November 2023.
Step 2: Create a Full Site Backup
Before making any changes, backup everything. Use a plugin like UpdraftPlus or your hosting provider’s backup tool. You need both your website files and database.
Think of this as insurance. If something goes wrong during the update process, you can restore your site to its current working state. Many hosting providers offer one-click backups through their control panels.
Don’t skip this step. I’ve seen too many sites get worse instead of better because someone tried to fix things without a safety net.
Step 3: Update WordPress Core, Themes, and Plugins
Head to your WordPress dashboard and navigate to Updates. Install all pending updates for WordPress core, your active theme, and plugins. Newer versions often include compatibility patches for recent PHP versions.
Pay special attention to plugins you haven’t updated in months or years. Abandoned plugins are the biggest culprits in PHP compatibility issues. If you see plugins that haven’t been updated in over two years, consider finding alternatives.
Update your active theme too. Custom themes from developers who no longer provide support can be particularly problematic. If your theme hasn’t been updated recently, contact the developer or consider switching to a well-maintained alternative.
Step 4: Run a PHP Compatibility Check
Install the PHP Compatibility Checker plugin by WP Engine. This free tool scans your entire site and generates a report showing which themes and plugins won’t work with newer PHP versions.
Run a scan targeting your desired PHP version (usually PHP 8.1 or 8.2). The report will flag specific files and functions that need attention. This gives you a roadmap for what needs fixing before you can safely update PHP.
The scan might take several minutes depending on your site size. Don’t close your browser tab while it’s running. The detailed report will show you exactly which plugins or themes are causing problems.
Step 5: Test in a Staging Environment
If your hosting provider offers staging sites, use one. Create a copy of your live site where you can safely test the PHP update without affecting visitors.
Apply the PHP update to your staging site first. If everything works correctly there, you can confidently update your live site. If problems occur, you can troubleshoot without any downtime.
Many hosts include staging tools in their control panels. WordPress.com, WP Engine, and SiteGround all offer easy staging environments. Some plugins like WP Staging can create staging sites on any host.
Step 6: Isolate Problematic Components
If your site still breaks after updating everything, you need to identify the specific culprit. Start by deactivating all plugins and switching to a default WordPress theme like Twenty Twenty-Four.
Try the PHP update again. If your site works with all plugins disabled and the default theme active, you know the problem is with a plugin or your theme.
Reactivate plugins one by one, testing your site after each activation. When your site breaks, you’ve found the problematic plugin. Do the same process with your theme by switching back to it after testing all plugins.
Step 7: Handle Incompatible Extensions
Found the troublemaker? You have several options. First, check if there’s a newer version available. Plugin developers often release compatibility updates shortly after new PHP versions.
If no update exists, look for alternative plugins that provide the same functionality. The WordPress plugin directory has thousands of options, and newer plugins typically support current PHP versions.
For premium plugins or themes, contact the developer directly. Many offer compatibility updates for paying customers even if they haven’t released public updates.
Sometimes you might need to hire a developer to update custom code or modify a theme. This is especially common with heavily customized sites or older premium themes.
Step 8: Reapply the PHP Update
Once you’ve resolved all compatibility issues, it’s time to update PHP again. Go back to your hosting control panel and select your target PHP version.
Most sites work well with PHP 8.1 or 8.2. These versions offer significant performance improvements over older versions. WordPress officially supports PHP 8.0 and higher, with PHP 8.1 being the recommended version.
Apply the change and test your site thoroughly. Check your homepage, admin area, contact forms, and any special functionality like e-commerce checkout processes.
Step 9: Post-Update Monitoring
After updating PHP, monitor your site closely for the first few days. Clear all caches – server-level caches, plugin caches, and your browser cache.
Check your hosting control panel’s error logs for any PHP errors or warnings. Look for the “Error Logs” section in cPanel or similar tools in other hosting panels. WordPress also creates debug logs if you enable debugging in wp-config.php.
Set up website monitoring tools to alert you if your site goes down. Services like UptimeRobot or Pingdom can send email alerts when problems occur.
Prevention Tips for Future Updates
Stay proactive with updates. Install WordPress, theme, and plugin updates regularly instead of letting them accumulate. Regular small updates are much safer than jumping multiple versions at once.
Remove unused plugins and themes. Every piece of code on your site is a potential compatibility problem. If you’re not actively using a plugin, delete it completely.
Consider managed WordPress hosting. Companies like WP Engine, Kinsta, and Pressable handle PHP updates more carefully, often testing compatibility before applying updates to your site.
When to Get Professional Help
Some situations require expert assistance. If you’re running a mission-critical e-commerce site, have heavily customized code, or feel overwhelmed by the technical steps, consider hiring a WordPress professional.
Custom-built themes and plugins often need developer attention for PHP compatibility. The cost of professional help is usually much less than the revenue lost from extended downtime.
Don’t let pride keep your site broken. Sometimes the smartest move is admitting you need help and getting your site fixed quickly and correctly.
Your WordPress site doesn’t have to break every time PHP updates. With proper preparation and systematic troubleshooting, you can keep your site running smoothly on current, secure PHP versions. The key is taking it step by step and not rushing the process.
European Union General Data Protection Regulation Compliant