This is the order these turn up in real Ohio small business sites, not a textbook ranking. Most slow sites have two or three of these at once.
Most common
Images that were never resized
How to check: Look at the largest assets in the speed test. Anything over about 300KB for a single photo is oversized. A 4MB hero image is not unusual on a site nobody has audited.
The fix: Resize each image to the size it is actually displayed at, save as WebP, set width and height attributes so the layout does not jump, and lazy-load anything below the first screen. On WordPress an image optimization plugin does most of this once and then keeps doing it.
Very common
Plugin and page builder bloat
How to check: Count the active plugins. Then look at how many CSS and JS files load on the home page. Many page builders and slider plugins load their whole library on every page, including pages that do not use them.
The fix: Deactivate anything you cannot name a use for, one at a time, checking the site after each. Replace a heavy slider with a single static image. If a plugin was installed for one page, restrict it to that page.
Very common
No caching in front of the site
How to check: If the second load of a page is no faster than the first, there is no page cache. On WordPress, check whether any caching plugin is active and whether the host does caching at the server level.
The fix: Turn on page caching, and object caching if the host supports it. This is usually the largest single improvement on a database-driven site and it costs nothing.
Common
Oversubscribed shared hosting
How to check: TTFB stays above a second even on a cached, mostly static page. The hosting control panel also feels slow. Traffic spikes make it worse in a way that looks nothing like an image problem.
The fix: Move to a plan with dedicated resources, or a different host. This is the one cause you cannot fix from inside WordPress.
Common
Third-party scripts loading on every page
How to check: Chat widgets, heat maps, two analytics tags because nobody removed the old one, ad pixels, review widgets, and fonts fetched from a third-party network. Each one is a connection to a server you do not control.
The fix: Remove duplicates, self-host fonts, and load chat widgets on click rather than on page load. Keep the tracking you actually read reports from.
Less common
Database bloat
How to check: Sites that have run for years accumulate post revisions, expired transients, and options set to autoload on every single request. The symptom is a high TTFB that gets worse over time with no obvious cause.
The fix: Clean out revisions and transients, and look at what is set to autoload. Take a backup first. This is safe work but it is work you cannot undo by hitting back.
Less common
Redirect chains
How to check: Type the bare domain with no https and no www, and watch the address bar. If it goes through three hops before it settles, every visitor pays for all three round trips.
The fix: Collapse the chain to one redirect: whatever a visitor types should land on the canonical version in a single hop.