Ask ten site owners what SEO is and eight of them will say keywords. Keywords still matter, but Google stopped ranking pages on words alone a long time ago. Today the ranking systems look at the whole picture: whether the content actually answers the question, whether the page loads fast enough for a person on a phone in a train, whether the site is safe to visit, and whether the links pointing at it still lead somewhere. A site can have excellent content and still lose positions because one of the other pieces quietly broke.
This post walks through the factors that decide rankings for a typical WordPress site, from the obvious to the ones people only discover after the traffic has dropped. Three of them are areas where we build plugins, and we say so where it is relevant.
1. Content that answers the question
Everything else on this list is a multiplier on content. Google’s own guidance on helpful content comes down to a simple test: was this written for a person with a real question, or for a crawler? Pages that cover a topic properly, show first-hand experience and are kept up to date hold their positions. Pages built by stitching together what already ranks tend to sink as soon as the next core update rolls out.
Practical points: one clear topic per page, a title that says what the page is about, headings that follow the reader’s questions, and an update when the facts change. That is the whole trick, and it is the part no plugin can do for you.
2. Crawlability and indexing
Google cannot rank what it cannot reach. A page that is blocked in robots.txt, set to noindex by an old plugin setting, or only reachable through a form will never appear, however good it is. Check that the XML sitemap lists the pages you care about and nothing else, that every important page has a canonical URL so filters and tracking parameters do not create duplicates, and that structured data is present where it earns a richer result: products, articles, FAQs, events.
Search Console tells you most of this for free. The Pages report shows what is indexed and why the rest is not, and it is the first place to look when traffic changes.
3. Speed and Core Web Vitals
Speed is a ranking factor, and it is also the factor most people measure wrong. Google’s page experience guidance says its ranking systems reward pages that offer a good experience, and the measurable part of that is Core Web Vitals: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, and Cumulative Layout Shift under 0.1. What counts is field data, meaning what real visitors experienced over the last 28 days, not the lab score you get by running a test once from a fast office connection. We wrote about the difference in why the Core Web Vitals assessment fails even when PageSpeed Insights looks fine.
The reason speed carries so much weight is that it is a proxy for user experience. A slow page gets abandoned before it renders, and a visitor who bounces back to the results tells Google something about the page. So the goal is not a green number in a test tool. It is a page that is visibly fast on a mid-range phone: the main image appears immediately, nothing jumps around while it loads, and tapping a menu responds at once.
On WordPress this is mostly a caching, CSS and JavaScript problem, and it is what Swift Performance AI is built for. It caches full pages, generates per-page critical CSS so nothing blocks rendering, defers and trims JavaScript, converts images to WebP and serves them at the right size, and detects the LCP image so it is preloaded rather than lazy-loaded. It also optimises the pages a cache cannot help with: logged-in users, cart and checkout, dynamic requests. The difference shows up where it matters for rankings, in the field data in Search Console, not only in the lab score.
4. Mobile first
Google indexes the mobile version of your site, full stop. If the mobile layout hides content that the desktop version shows, the hidden content does not count. If the mobile page is slow because it loads the same 3 MB hero image as the desktop page, the Core Web Vitals above are measured on that. Test with a real phone, not by narrowing a desktop browser window.
5. Security: a hacked site loses its rankings
This is the factor nobody plans for, and it is the one that can undo years of work in a week. HTTPS has been a ranking signal since 2014, so an expired certificate or mixed content is the easy part. The hard part is what happens when a site is compromised.
Most WordPress hacks today are not about defacing your homepage. They are about borrowing your reputation. The attacker injects thousands of spam pages for pharmaceuticals, casinos or replica goods under your domain, plants hidden blocks of links in your existing posts, or sets up cloaking: Googlebot is served the spam, while you and your visitors see the normal page, so you do not notice for months. Sometimes the payload is a redirect that only fires for visitors arriving from a search result, so the site looks perfectly healthy when you type the address in yourself.
Google’s spam policies treat hacked content and cloaking as violations regardless of who put them there. The consequences stack up quickly: a “This site may be hacked” label in the results, a Safe Browsing warning that makes Chrome show a red interstitial before your page, a manual action in Search Console, and, underneath all of that, an algorithmic drop because your domain is now associated with spam. Recovery means cleaning every trace, requesting a review, and then waiting weeks for trust to come back. Sites that were number one for their brand name have watched competitors take that spot in the meantime.
Prevention is far cheaper than recovery, and this is where Must-Have Security takes a different approach from the usual firewall. Instead of trying to recognise attacks by their pattern, it makes the attacker’s goal impossible: no executable file can be written to your site without a trusted administrator confirming it with a second factor, and no PHP file that is not a WordPress entry point can be requested by name. A vulnerability in some plugin can still be exploited, but it cannot turn into a backdoor, a spam generator or a cloaking script, because none of those can be written to disk. For what is already there, the scanner reads every file as code, with an AI reading the ones the classifier cannot decide, and its database pass looks specifically for the SEO-spam shapes: hidden link blocks in posts, scripts parked in settings, redirects that only fire for search visitors, administrator accounts you never created.
6. Broken links, 404 pages and redirects
Every site accumulates dead URLs. Products go out of stock and get deleted, a category is renamed, a permalink structure changes, an editor fixes a typo in a slug, someone links to you with a stray character at the end. Each of those turns into a 404, and a 404 is where two things get lost at once: the visitor, who leaves, and the ranking value of every link that pointed at the old address, which Google eventually drops from the index.
The fix is a 301 redirect to the page that best replaces the old one. Google treats a permanent redirect as a strong signal that the new URL is the canonical one, and passes the links along with it. The two ways to get this wrong are redirecting everything to the homepage, which Google treats as a soft 404, and letting redirects chain (old URL to newer URL to newest URL), which wastes crawl budget and slows the page for visitors.
Doing this by hand means checking the Search Console 404 report every week and writing rules. Must-Have Redirect does the routine part automatically: when a visitor lands on a URL that does not exist, it finds the closest matching content and redirects there, so a typo in the address is corrected on the fly and a deleted product sends the visitor to a similar one rather than a dead end. Manual rules, wildcards and a custom 404 page cover the cases where you want to decide yourself, and it sits alongside the redirect module of your SEO plugin rather than fighting it. The result is a site where visitors and crawlers stop hitting walls, which is exactly what the 404 report is asking you to achieve.
7. Internal linking and structure
Google discovers and weighs pages partly through your own links. A page that nothing links to is an orphan, and orphans rank badly even when they are indexed. Group related posts into hubs, link from the hub to the posts and from the posts back to the hub and to each other, and use link text that says what the target is about. Menus and footers count, but links inside the body of a relevant article count more.
Putting it together
Rankings are a sum: good content, reachable by the crawler, fast for real visitors, safe to visit, with links that still lead somewhere. Most sites that lose positions did not lose them on content. They lost them on the technical side, quietly, through a slow mobile page, an injected spam directory or a few hundred broken URLs after a redesign. The good news is that those three are the ones you can fix once and keep fixed with the right tools: Swift Performance AI for speed and Core Web Vitals, Must-Have Security to keep the site out of the spam policies, and Must-Have Redirect so that no link to your site ever ends at a 404.
If you want to start with the piece that is easiest to measure, read how Core Web Vitals became ranking signals and why WordPress sites run slow in the first place, then check your own field data in Search Console.
