SECURITY FINDING

WordPress scheduled tasks (WP-Cron) stalled

What it is

WordPress's scheduled tasks (WP-Cron) are stuck and haven't fired recently, so automatic updates, backups and scheduled scans may not be running on time — the same risk as having them disabled outright.

How to fix it

Set up a real system cron job (through your host) to trigger wp-cron.php on a fixed schedule — more reliable than WordPress's default, page-visit-triggered cron.

In depth

Your WordPress site has a scheduling system called WP-Cron that's supposed to handle automatic tasks like updates, backups, and security scans, but it's currently broken and not running these jobs. Think of it like an alarm clock that's supposed to go off at certain times to trigger important maintenance, except your alarm has stopped working. When WP-Cron fails, your site doesn't automatically update its software, run backups, or scan for security problems, which leaves your website vulnerable to hackers and data loss. The fix involves contacting your web hosting company and asking them to set up a "real cron job" that pings your WordPress site on a regular schedule to force these tasks to run, rather than relying on WordPress's built-in method which doesn't always work reliably. Your hosting company will give you a simple command to add to their control panel, and once it's set up, your backups and security checks will run automatically again without you having to do anything. This is a straightforward technical request that any hosting support team should be able to handle in minutes, and it ensures your site stays protected and up to date with minimal effort on your part.

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.