There is a particular silence that happens when a WordPress site that took money yesterday now shows a white screen, or the polite new message: “There has been a critical error on this website.” The instinct is to refresh, then refresh on the phone, then ask a cousin who “knows computers” to delete something in cPanel. That is how a plugin conflict becomes a missing database.
What the message actually means
PHP threw a fatal error. Something in a plugin, the theme, or a dropped-in snippet cannot run. WordPress is trying not to show strangers the file path. That is good. It is not, by itself, malware. It is also not “hosting is down” if the error page is still a WordPress error page. Hosting down looks like a browser that cannot find the server at all.
If you have a recent plugin update, a theme change, a “security hardening” tutorial, or a developer who uploaded a file by FTP at 1am, start there. The last change is guilty more often than the universe.
The calm order of operations
Do not keep refreshing. You will not randomise it back to life, and if the error is filling a log, you are helping. Do not delete wp-admin. Do not replace wp-config.php with a file you found on a forum. Do not hire the first Instagram ad that says “we hack back websites”.
If WordPress mailed you a recovery-mode link, use it. It is trying to let you in with plugins off so you can switch off the offender. If you can still reach wp-admin, disable the last plugin you touched. If you cannot, and you have hosting file access, rename the plugins folder to plugins-off. The site may come back ugly. Ugly is better than gone. Then rename folders back one at a time until it breaks again. That plugin is the conversation.
Back up before you start renaming things. A recovery that destroys the database is not a recovery.
When it is malware
Redirects to pharmacy sites, random admin users you did not create, eval(base64…) in header.php, a homepage that is fine in Nigeria and poisoned on a UK VPN — those are different from a plugin that cannot find a function after an update. Malware cleanup is not “install a scanner and tick the boxes”. It is finding the door they used, closing it, replacing modified core files, rotating passwords, and checking that the backup you restore is not the infected one from Tuesday.
If payments or customer data might have been touched, say so early. A brochure site and a store are not the same incident.
What to send a developer so they can actually help
The URL. The exact error text, screenshot included. What changed in the last day — plugin update, content edit, domain move, PHP version bump at the host. Whether you have a backup, and where. Hosting login if you trust them, or a staff account, not the nuclear option of emailing the root password in WhatsApp with no context.
If you want Tycoon Concept on it, use website rescue and the contact form. Email or WhatsApp, your choice. Send the screenshot. We would rather see the ugly truth than a rebuilt-from-memory version of it.