JPS Start Page

African Land
Boho Bliss
Timeless Elegance

African Land

Prepared for African Land (african-land.com) by JPS Hosting. Audit run Friday, September 18, 2026.

African Land website audit and completion plan

A full review of the live site and its WordPress back end, with a phased plan and a step-by-step checklist to bring the store to pristine shape before the holiday season.

This report contains security details about the site. Share it only with people who need it.

The store cannot take a payment right now.

Everything else in this report matters, but nothing else can earn revenue until checkout works. Phase 1 of the plan fixes it in the first week.

Payments: Square is disconnected and PayPal is off. A live cart offers zero payment methods.
Last order: April 12, 2026. A checkout started on Sept 16 never finished.
Store email: Sent from a staging address, with no DMARC record, so alerts likely never arrived.
Reviews: All 8 published reviews are spam; 68 more sit in moderation.
Timing: Thanksgiving is Nov 26 and Kwanzaa starts Dec 26.

At a glance

Updated September 19, 2026. Since the audit, four things have been done: the ATTOTE listing was taken off sale (hidden, not deleted); product reviews were switched off to stop spam; backup failure alerts were turned on; and the Hostinger Tools plugin was removed after a backup check, which completes Step 3.15 and changes the Hostinger line in Appendix E. Everything else below is unchanged. Nothing has been deleted, and no bulk edits have been made.

We found 37 issues across the store: Critical: 6 High: 13 Medium: 11 Low: 7. Some are urgent and quick; most are ordinary housekeeping that has piled up over several years of plugin and content changes. The plan turns them into 74 numbered steps across seven phases.

Area	Status	Where to read more
Payments	Broken	C1
Store email	Broken	C2, H1
Legal pages	Missing	C6
Product claims	At risk	C4, C5, H11
Customer reviews	Spam only	C3
Security	Needs work	H5, H6
Speed	Mixed	H7
Search (SEO)	Partial	H2, H3, H4
Catalog quality	Needs cleanup	M1, M2, M3
Plugins	Overlapping	H8
Database and media	Bloated	H9, M5
Customer data	Needs a policy	H10
Growth (email, reviews, local)	Not set up	H12, M8
Shipping and tax	Working	Verified with a live cart
Backups	Healthy	M6 for tuning

How to use this report

Part 1 lists every finding with its evidence, why it matters, and the step that fixes it. It also shows where the earlier public-site findings landed.
Part 2 is the plan of action: phases, timeline, effort, decisions we need, and how we will work safely.
Part 3 is the checklist: each step says who does it, how, how to verify it, and how to undo it. On the web page, ticking a box is remembered in your browser.
Part 4 turns the steps into a Trello board. Part 5 holds the evidence and reference lists.

Who does what. Claude can do most of the configuration, drafting, and cleanup through the Novamira connection, but only after James approves each change. James handles account logins (Cloudflare, Microsoft 365, Google, Brevo, hosting). Utibe supplies business facts and makes product and policy decisions. Every deletion needs a written yes.

Part 1: FindingsPublic-site findings and back-end findings are merged. Each finding says where it was found.

Critical: fix first (6)

Checkout has no payment method

CriticalFound in: back-end

Square is disconnected: there is no access token and no refresh token, and the plugin's "refresh failed" flag is set. All three Square gateways (card, Cash App Pay, gift cards) report "not available".
PayPal Payments is installed and its keys are present, but the gateway is switched off.
A live test cart (one $60 item, NC address) shows zero available payment methods. Shipping works: Shippo returned 11 live USPS and UPS rates.
Last order: Apr 12, 2026. Last completed order: Feb 20, 2026. A checkout was started on Sep 16 at 12:45 UTC and never finished.
Square's "problem with your access token" alert email is enabled for Utibe and James, but it sends from the staging address (C2), so it probably never arrived.

Why it matters. Online sales are impossible right now, weeks before the Kwanzaa and holiday season.

Fix. Reconnect Square from WooCommerce > Settings > Payments (needs the Square account owner's login), enable PayPal as a backup, and place a $1 test order. Steps: 1.1, 1.2, 1.11

The staging domain is baked into email, pages, and settings

CriticalFound in: both

WooCommerce's "From" address is [email protected], and the low-stock notification recipient uses the same domain.
Both homepage buttons ("Lets Go Shopping") link to lightpink-goldfinch-580566.hostingersite.com/shop/. The staging domain also sits in the Elementor data of 25 or more templates and pages, including the footer, plus Defender, WooCommerce helper data, and old mail-plugin options.
Separately, 67 posts and 66 meta rows still use http://african-land.com (mixed content and redirect chains).

Why it matters. Customers get order email from an unrecognizable domain that fails sender checks, homepage visitors are sent to a staging copy, and Square's alert email was likely lost.

Fix. Set a real From address, replace every staging and http:// URL in one controlled search-and-replace, regenerate Elementor CSS, and purge caches. Steps: 1.3, 1.7, 1.8

Spam "reviews" are published on product pages

CriticalFound in: back-end

All 8 approved reviews are comment spam (author "zoritoler imol", Mar to Apr 2025) on products 3282, 602, 591, 12525, 7029, 6990, 1017, and 637. The store has no genuine reviews.
68 more are waiting in moderation, 36 of them containing links, mostly Russian and Spanish spam, the newest from Sep 18.
Anyone can post: verified-owner reviews are not required, and the reCAPTCHA settings do not cover reviews.

Why it matters. Spam on product pages erodes trust and search quality, and the queue keeps growing.

Fix. Delete the 76 spam entries, switch reviews off until a real review program launches (Step 6.3), then re-enable for verified owners only. Steps: 1.9, 6.3

Medical and health claims on products, posts, and categories

CriticalFound in: both

17 of 118 products tripped a keyword scan; about 12 need rewrites (list in Appendix B).
The eczema soap (ID 530) is titled "Eczema Therapy" and says it helps "soothe and repair irritated skin," reduces itching and redness, fights acne, and reduces scarring.
Essential (Al-Riyan) soaps (591): "detoxified," "toxins," "rejuvenating." Liquid black soap (9429): "treats fungus," "helps with mild skin rashes." Essential oils (7092): "balance hormones," "boost immunity and fight infection." Living bitters (1017): "remedies," "detoxification." Whipped shea (41156): "healing cracked heels."
Three blog posts (1412, 1420, 6759) present eczema, digestive, and "therapeutic" benefits; the About page says the bitters have "detoxifying and digestive properties." The category is named "Health Care."
Product 530's image alt text says "frankincense & myrrh" while its description lists plantain skins, palm leaves, cocoa pod powder, and shea butter. The "vitamins A and E" and Halal "Islamic dietary laws" statements are unsupported.

Why it matters. Marketing a soap to treat eczema can be read as a drug claim (FDA and FTC scrutiny), and payment processors can act on it. This is not legal advice; it needs an attorney's read.

Fix. Adopt a claims policy, rewrite the flagged copy from actual labels, rename "Health Care" to "Wellness," and have an attorney review. Steps: 2.1, 2.2, 2.3, 2.6, 2.8

Male-enhancement herbal drink (ATTOTE, ID 2447)

CriticalFound in: back-end

Listed as "100% Natural Herbal Mixture for Men, Hard Rock Strength," category "Vitamins and Supplements," with dosage directions but no ingredient list, manufacturer, or supplier documentation.
The FDA has repeatedly warned about products in this category containing undeclared prescription-drug ingredients, and card processors restrict them.

Why it matters. Product-safety and payment-account risk for a $39.99 item.

Fix. Set to Draft now (reversible), then request supplier documentation. Remove permanently if it cannot be produced. Steps: 1.12, 2.4

No privacy policy, no terms page, refund policy unpublished

CriticalFound in: both

WordPress's designated privacy page (ID 3) does not exist, so the "[privacy_policy]" text on checkout and registration links to nothing.
No Terms and Conditions page is set in WooCommerce. "Refund and Returns Policy" (ID 24) is still a draft. The footer has only five links, and there is no shipping information page.

Why it matters. Legal exposure, lower conversion, and trouble with payment-processor and Google Merchant Center reviews.

Fix. Draft and publish Privacy, Terms, Shipping, and Refund pages, link them in the footer, and set them in WordPress and WooCommerce. Steps: 1.10

High: fix in the first three weeks (13)

Email is not authenticated and has no proper sending service

HighFound in: back-end

No DMARC record exists. No DKIM was found for the Microsoft 365 default selector. SPF authorizes Microsoft 365 and MailerLite but probably not the server that sends store mail (the site is Cloudflare-proxied, so SPF's a mechanism points at Cloudflare).
No SMTP plugin is active (WP Mail SMTP Pro was removed; its log stops in Jan 2024). Store and contact-form mail goes out through PHP mail.
The contact form has 145 submissions since Sep 2024, the latest on Sep 18, and delivery has never been verified.

Why it matters. Order and password-reset emails land in spam or vanish, and alerts (payments, backups) do not arrive.

Fix. Send through an authenticated transactional service, add DMARC, enable Microsoft 365 DKIM, and prove delivery end to end. Steps: 1.4, 1.5, 1.6

Search engines are not being given the products

HighFound in: both

Rank Math's XML sitemap contains only posts and pages. Products and product categories are excluded, while "etheme_slides" and "staticblocks" are included.
robots.txt is User-agent: * with a blank Disallow:. There is no Sitemap line, and cart, checkout, and account pages are not disallowed.
Google Search Console is not linked in Rank Math (Bing verification is present). Rank Math's site audit scores 78. Its WooCommerce and Local SEO modules and the 404 monitor are off.

Why it matters. A store with 118 products is presenting search engines with only its 20-odd pages.

Fix. Include products and categories in the sitemap, rewrite robots.txt, link Search Console, and turn on the 404 monitor. Steps: 5.1, 5.13

Structured data and meta data are wrong or thin

HighFound in: both

Every page (Home, About, Contact) is typed as "Article" with a Person author; there is no LocalBusiness or Store entity.
Rank Math's stored opening hours say 9:00 to 17:00 seven days a week; the store is open Mon to Sat 10 to 7 and closed Sunday.
Product schema lacks brand, GTIN, shipping details, and return policy; priceValidUntil is 2027-12-31; the logo URL is http://.
The site tagline is cut off mid-sentence ("...Kente Hats,") and flows into meta descriptions and llms.txt.
No page or product has a custom meta description, and 137 items have no focus keyword.

Why it matters. Weaker search snippets and rich results, and wrong facts about the business in machine-readable form.

Fix. Correct page types, enable Local SEO with the real hours, complete product schema, and fix the tagline and meta descriptions. Steps: 5.2, 5.3, 2.7

On-page structure: headings, titles, category content, images

HighFound in: both

No H1 on the homepage, shop, category pages, or Contact. Product and blog pages have two H1s.
The homepage title is just "Home - African Land"; category titles are capitalized ("BODY CARE - African Land"). The homepage tagline "Unlock the Riches of Africa..." appears twice.
78 of 80 product categories have no description, so category pages have no meta description. The homepage, category pages, and the Kwanzaa category have no og:image.

Why it matters. Search engines and screen readers get a weak outline, and shared links look bare.

Fix. One H1 per template, keyword-aware titles, and descriptions and images for every category. Steps: 5.2, 5.4, 5.5

Security: no second factor, stalled scans, weak lockout

HighFound in: back-end

Two-factor authentication is off for all three administrators and the shop manager.
Defender's malware scan is scheduled weekly, but the last scan on record is Dec 7, 2025 (status "suspicious_check").
12,886 not-found probes and 273 failed logins in 30 days; 453 IPs currently blocked. The login lockout lasts only 5 minutes after 5 attempts. Defender's Cloudflare IP-detection notice was dismissed, so it may be seeing Cloudflare addresses instead of visitors.
Administrators: jpshost, num1jayjay (user ID 1), and Utibe; shop manager: zakia.

Why it matters. A stolen or guessed password is enough to take over the store, and a compromise could go unnoticed.

Fix. Turn on 2FA, restore scheduled scans, fix IP detection, and lengthen lockouts. Steps: 3.1, 3.2, 3.3, 3.4

Exposure: usernames, XML-RPC, stray files, missing headers

HighFound in: both

The public REST endpoint /wp-json/wp/v2/users lists an administrator's username and real name. The Rank Math author sitemap is on, and the homepage Twitter card says "Written by num1jayjay."
XML-RPC responds (not blocked). readme.html, license.txt, and wp-config-sample.php are present; wp-config.php permissions are 0644.
No HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy headers are sent.
elementor-pro-3.26.3-1.zip, a premium plugin installer, is downloadable from the public uploads folder.
Working: the login URL is masked (403), debug.log is blocked, ?author=1 is blocked, and no PHP files were found in uploads.

Why it matters. Attackers get a free list of accounts to target, and an old premium installer is publicly retrievable.

Fix. Block user enumeration, disable XML-RPC, delete stray files, tighten permissions, and add security headers at Cloudflare. Steps: 3.5, 3.6, 3.7, 3.8

Speed: fast when cached, slow when not, and heavy pages

HighFound in: both

Cached pages respond in 55 to 118 ms; uncached pages take 3.0 to 3.8 seconds (About, the Kwanzaa page, Cart).
HTML alone is 283 to 594 KB, with 73 to 80 script tags, 27 to 32 stylesheets, and 19 to 21 inline style blocks per page. Every page carries login and register forms, a mini-cart, a wishlist panel, and the full category mega-menu.
Above-the-fold images are lazy-loaded (header logo, homepage hero) without size attributes; product main images are placeholders swapped in by JavaScript. Three lazy-loaders are stacked (XStore, Smush, and the browser's own).
LiteSpeed and Hummingbird both minify. Hummingbird also delays JavaScript and loads styles on first interaction (risk of unstyled flashes and layout shift). LiteSpeed's Redis object cache is enabled in settings but not active. jQuery Migrate is still loaded.
No Lighthouse or Core Web Vitals numbers could be collected (see Appendix G).

Why it matters. Slow first paint hurts search ranking and conversion; uncached slowness hits every new visitor after a cache purge.

Fix. Make LiteSpeed the single optimizer, fix lazy-loading of the largest image, slim the page template, and re-measure against targets. Steps: 3.13, 3.14

Plugins overlap, and three caused fatal errors this month

HighFound in: both

Two SEO plugins (Rank Math, SmartCrawl), two optimizers (LiteSpeed, Hummingbird), two wishlists (XStore's own and YITH), two analytics paths (Beehive GA4 and GTM), three remote-management agents (MainWP Child, ManageWP Worker, an Installatron mu-plugin), Forminator Pro with 0 forms, and an idle PayPal plugin.
Fatal errors in the last month: YITH wishlist class missing (Sep 8), XStore Core checkout breadcrumbs on a null cart (Aug 22 and Sep 1), and Hostinger Tools MCP class missing (Aug 26).
Orphaned code: WPCode snippets (GTM) whose plugin is gone, a child-theme file named functions copy 1.php, and a custom purchase event that fires on every thank-you page load.

Why it matters. Conflicts cause slowdowns and hard-to-diagnose bugs, and every extra plugin is extra attack surface.

Fix. Keep one of each kind, remove the rest one at a time behind a fresh backup, and update the fragile ones. Steps: 3.9, 3.10, 3.11, 3.12, 3.14, 3.15, 5.12

Almost half the database is leftovers

HighFound in: back-end

The database is 265 MB. Roughly 110 MB sits in orphaned tables from about a dozen removed plugins (BlogVault about 73 MB, Wordfence about 22 MB, plus MailPoet, EDD, WPForms, Hustle, AIOSEO, Jetpack, Google Listings and Ads, WP Mail SMTP, and others). Another 45 MB is Defender lockout logs.
618 revisions, 664 transients, 3,856 orphan meta rows, about 230 KB of autoloaded Branda leftovers (ub_*), and stale auto-update entries for five uninstalled plugins.

Why it matters. Slower queries and backups, and more to restore and secure.

Fix. Back up, export the orphan tables, then drop them group by group with your approval. Steps: 4.1, 4.2, 4.3

H10

Customer data: imported accounts, weak consent, no retention rule

HighFound in: back-end

About 4,300 customer accounts were created in bulk between Jul and Oct 2025 (4,692 users in total; 8,127 Square customer mappings), yet the store has only 23 orders. Login bots can now target thousands of dormant accounts.
About 375 addresses are SMS-gateway "emails" (vtext.com, tmomail.net), not real inboxes.
There is no record of consent for site accounts or marketing. 108 old WPForms entries and 145 Elementor form submissions hold personal data with no retention rule.

Why it matters. Privacy exposure, bounced or unwanted email if these contacts are ever mailed, and a large login attack surface.

Fix. Decide how imported accounts are treated, suppress SMS-gateway addresses, export and delete stale form data, and set retention. Steps: 2.10

H11

High-value "antiquity" items are sold online without provenance

HighFound in: back-end

Two "Nigerian Antiquity" masks at $4,200 (9499, 9459) and two bronze statues at $2,200 and $2,100 (9478, 9476; both out of stock).
No provenance, authenticity, or export documentation is shown, and they use the standard card and Cash App checkout.

Why it matters. Legal (representing items as antique, cultural-property rules), fraud, and chargeback exposure.

Fix. Add provenance statements, route large orders through manual review or phone confirmation, and ask an attorney about "antique" claims. Steps: 2.5

H12

No email capture anywhere on the site

HighFound in: public crawl

No signup form appears in the header, footer, homepage, or product HTML. MailPoet and Hustle were removed; MailerLite is verified in DNS but not embedded. Only 2 unconfirmed MailPoet subscribers remain.

Why it matters. The store's largest owned-marketing opportunity is unused.

Fix. Embed a MailerLite form in the footer plus one popup, with double opt-in and a counter QR code. Steps: 6.2

H13

Kwanzaa season is close and the pieces are unfinished

HighFound in: both

A Kwanzaa principles page exists (ID 24710) but its title and slug read "Kwanzza." A Kwanzaa popup (ID 60594) is still a draft. The Kwanzaa category holds 12 products.
The menu spells "Kwanza Candle Set" and "Kwanza Cup" beside "Kwanzaa Candles," and Kwanzaa is not in the top category bar. Two candle sets share the same title at different prices ($54.99 and $59.99).
Kwanzaa runs Dec 26 to Jan 1 and Thanksgiving is Nov 26, so payments (C1) must work well before then.

Why it matters. A seasonal peak arrives with a broken checkout and an unfinished landing page.

Fix. Fix the spelling, link the hub in the menu and homepage, QA the popup, dedupe the candle sets, and go live by Nov 13. Steps: 6.1

Medium: schedule and batch (11)

Product names, slugs, and typos

MediumFound in: both

59 of 118 titles are in ALL CAPS. Slugs often do not match titles: turmeric-soap is the eczema soap, african-rosehip-halal-soap is "Essential (Al-Riyan) Soaps," kwanzaa is a kinara set, and stoles is "Belts & Cummerbunds." Seven products have numeric slugs.
Typos: "KRNTE" (64211), "NORMADS OF NIGER" (12525), cradle-of-mindkind, culturaln-atlas-of-africa, apoligically-dope-..., "FERFUME" in an image title, and the category slug kinara-candle-holerd.
Duplicates and near-duplicates are listed in Appendix B. The word "Tribal" appears in several product names (for example "Tribal Beaded Earrings").

Why it matters. Weak search relevance, confusing URLs, and a shouting tone.

Fix. Title Case, corrected typos and slugs (with 301 redirects), and merged duplicates. Steps: 5.6, 5.11, 5.13

Catalog data gaps

MediumFound in: both

43 products have no SKU; 61 of 90 simple products have no weight and 63 have no dimensions (Shippo relies on these for accurate rates); 63 have no gallery image; 38 main images have no alt text.
Five published "products" have no price and are named after categories (Appendix B). 25 variations have no price. 8 products are out of stock, including four high-ticket items.
64 products show a "sale" price with no end date, while homepage copy says the sale "won't last much longer." Only 5 products track stock, and Square inventory sync is off.
Product pages lack ingredients, usage, origin, shipping, and returns information.

Why it matters. Wrong shipping quotes, unbuyable variations, and pages that do not answer buyers' questions.

Fix. Batch-clean the catalog against a QA checklist. Steps: 5.6

Categories and tags

MediumFound in: both

80 product categories: 14 are empty, "Head Wraps" duplicates "Headwraps," "Dashiki" is top-level but also listed under Body Care in the menu, "Wax Prints" holds ties and stoles, and "ALL- NATURAL OILS" is malformed. Slugs are inconsistent (african_clothing, body, health, african-fabrics).
290 product tags: 200 are used once and 15 are empty; many are in capitals.

Why it matters. Confusing navigation and thin, duplicated archive pages.

Fix. Cut to about 45 categories with descriptions and images; prune tags. Steps: 5.5, 5.7

Duplicate and junk pages are live

MediumFound in: both

Published and indexable: "new about" (62363), "Cart 2" (64172, empty), Receipt, Order History, Transaction Failed, and Confirmation (leftovers from an old payment plugin, which redirect to nested URLs), and a second "Checkout" page.
Drafts: "test," "Coming Soon," a second "Cart," and "Refund and Returns Policy" (which is needed; see C6). Two duplicate "About" Elementor templates and an unused Loop Item template remain.

Why it matters. Duplicate content and dead ends that search engines and customers can reach.

Fix. Delete or redirect after checking nothing references them. Steps: 5.8

Media library bloat

MediumFound in: back-end

1,251 media items, 32,903 files on disk, 2.4 GB. 1,195 Smush .bak originals take 508 MB; two footer videos are about 48 MB each; 23 .mov files; large 2020 to 2023 uploads that predate the site.
426 of 1,208 images have no alt text, 87 groups of files share a filename, and 1,161 images are unattached.

Why it matters. Slow, large backups and weaker image search and accessibility.

Fix. Delete the .bak copies, compress or externalize video, add alt text, and remove unused images. Steps: 4.4, 4.5

Backups work; alerting, size, and restore testing need attention

MediumFound in: back-end

A daily WPvivid backup (files and database) runs to Google Drive. The last success was Sep 18 at about 01:09 server time; 9 of the last 10 runs succeeded (one failure on Sep 11).
No email recipients are configured for backup reports. Each run is about 2.9 GB with 30 retained (roughly 88 GB on Drive). A restore has never been tested.

Why it matters. A failed backup could go unnoticed, and an untested backup is a hope, not a plan.

Fix. Add alert recipients, test one restore, and slim the backup set. Steps: 0.2, 0.4, 4.5

Copy, voice, and content freshness

MediumFound in: public crawl

Pushy or unverifiable phrases: "Hurry to our store... won't last much longer... don't want to miss out"; "We guarantee that you'll leave feeling inspired, enlightened"; "exotic African jewelry"; and a placeholder "Buy Now !" button under "Hot Deals" that links to #.
Typos: "Lets Go Shopping," "Whishlist," "Kwanza."
The blog has three posts, the latest on Jun 20, 2024; one slug ends in -2; titles read as overwrought. The About page is 335 words, still says "new location," has empty headings, and has no owner story or photos. 174 pages have no internal links.

Why it matters. Copy that reads as pressure or filler undercuts a 30-year community reputation.

Fix. Rewrite About, add an FAQ, restart the blog, and remove pushy and off-tone lines. Steps: 5.9, 5.10, 5.11

Local search and contact details

MediumFound in: both

Phone and address are plain text (no tap-to-call or directions link). The header Facebook link points to a search-query URL while the footer links to a profile. Only one social channel is listed.
Rank Math's Local SEO module is off and its stored hours are wrong (H3). No Google Business Profile link. The Contact page's map is a strength.

Why it matters. A local store is missing its best free discovery channel.

Fix. Claim and complete the Google Business Profile, add tap-to-call and directions links, and correct the Facebook link. Steps: 5.14, 6.4

Analytics and consent

MediumFound in: both

GA4 (G-DKM5CBK6CR) and GTM (GTM-MSN9NPBM) both load through Beehive, and GTM snippets also live in WPCode records for a plugin that is gone. The noscript iframe URL has a stray space in the page output.
The custom purchase event in the child theme fires on every thank-you page load and has no null checks.
CookieAdmin has never run a scan (0 cookies classified), so the consent banner lists none.

Why it matters. Double-counted or missing data, and consent that may not match what the site actually does.

Fix. One analytics path, a safe once-per-order purchase event, and a real cookie scan. Steps: 2.9, 5.12

M10

WordPress timezone is UTC

MediumFound in: back-end

The timezone setting is empty (UTC). Order times, scheduled sales, and the 01:00 backup schedule all run on UTC rather than Eastern.

Why it matters. Sales start or end at the wrong hour, and reports and emails show confusing times.

Fix. Set America/New_York and re-time the backup. Steps: 3.16

M11

Orders and refunds: questions for Utibe

MediumFound in: back-end

23 orders since Sep 2024: 14 completed, 7 refunded, 1 failed, 1 cancelled. The five most recent orders (Mar 3 to Apr 12, 2026) were all refunded.
Square is not the system of record: inventory sync is off and stock is not tracked for 113 products.

Why it matters. May point to fraud, fulfilment, or product issues worth understanding before the season.

Fix. Ask why the recent orders were refunded; decide on inventory sync in January. Steps: 6.7

Low: tidy up along the way (7)

Footer still reads "(c) 2024 African Land"

LowFound in: public crawl

The copyright year is hard-coded.

Why it matters. Looks neglected.

Fix. Make the year automatic. Steps: 5.14

Elementor version stamps differ, and pages are served from stale caches

LowFound in: public crawl

The About page output was built by Elementor 4.2.1 while other pages show 4.2.4; Elementor Pro is 4.2.3 against Elementor 4.2.4.

Why it matters. Possible CSS mismatches after updates.

Fix. Update Pro to match, regenerate CSS, and purge caches. Steps: 3.12

Dead and script-only links

LowFound in: public crawl

The wishlist link is #, "Return to previous page" uses javascript: history.go(-1), and the "Buy Now !" button links to #.

Why it matters. Broken interaction for keyboard and assistive-technology users.

Fix. Replace with real links or remove. Steps: 5.11

Leftover files and snippets

LowFound in: back-end

functions copy 1.php in the child theme, wp-config-sample.php, draft and trashed WPCode snippet posts (including one that disables comments), and an unused Twenty Twenty-Four theme.

Why it matters. Clutter and confusion.

Fix. Remove after confirming they are unused. Steps: 3.8, 4.3

`llms.txt` is a static 56 KB file with the truncated tagline and health-claim excerpts

LowFound in: back-end

It lists the three blog posts with their health-benefit summaries and the cut-off site tagline.

Why it matters. AI assistants may quote outdated or risky claims.

Fix. Regenerate after the copy fixes. Steps: 2.3

The 404 page is 183 KB

LowFound in: back-end

The custom Elementor 404 template returns 183 KB of HTML.

Why it matters. Slow dead-end page for every bad link and bot probe.

Fix. Simplify the template. Steps: 3.13

Order emails are unbranded default templates

LowFound in: back-end

The email-customizer plugin was removed and 14 of its templates remain as orphaned records, so customers receive plain WooCommerce templates.

Why it matters. Missed branding moment on every order.

Fix. Brand the templates in WooCommerce's email settings after 1.3 to 1.6. Steps: 1.6

Checked and healthy

Canonical tags and robots meta directives are present; tag archives, empty taxonomies, date archives, and attachment pages are noindexed or redirected.
HTTPS is enforced, the site sits behind Cloudflare, and LiteSpeed page caching is serving hits.
Live shipping rates work: Shippo returned 11 USPS and UPS options for an NC address. Automated tax is on.
reCAPTCHA v3 protects login, registration, and checkout; the login URL is masked; debug.log is blocked; no PHP files were found in uploads.
WordPress (7.1.1) and PHP (8.3.33) are current; no plugin updates were pending; debug mode is off; WooCommerce uses the orders table (HPOS).
Daily backups to Google Drive succeed (Sep 18 confirmed), and the uptime monitor is enabled.
The contact form is active (145 submissions), the cookie banner has a Reject All option, and the address, phone, and hours on the pages agree with each other.
Rank Math's sitemap index works, and the Store API and custom 404 template respond correctly.

First-pass findings and where they landed

The first pass reviewed only the public pages. The back-end audit confirmed most of it, corrected a few points, and put numbers on the rest.

First-pass finding	Now	Status	Note
Homepage buttons send shoppers to a staging site	C2	Confirmed	Both buttons are in Elementor page 25; the domain also appears in 25+ templates.
Health claims on the eczema soap, bitters, and About page	C4, C5	Confirmed and expanded	17 products, 3 posts, plus the ATTOTE listing.
Ingredient data contradicts itself (alt text vs. description)	C4	Confirmed	Needs the real label; Step 2.6.
Privacy link empty; no terms, shipping, or returns pages	C6	Confirmed	The privacy page (ID 3) no longer exists; refund policy is a draft.
GTM noscript URL has a stray space; cookie banner lists no cookies	M9	Refined	GTM does load. The noscript comes from a WPCode snippet, and the cookie scanner has never run.
WordPress username exposed in the homepage Twitter card	H6	Confirmed	Also exposed by the REST users endpoint and the author sitemap.
No email capture visible	H12	Confirmed	No form in header, footer, homepage, or product HTML.
Speed suspicions (lazy placeholders, duplicate hero, heavy header)	H7	Confirmed and measured	Cached 55 to 118 ms, uncached 3.0 to 3.8 s, HTML up to 594 KB.
Kwanzaa readiness (no landing page? nav spelling)	H13	Corrected	A Kwanzaa page exists (with a "Kwanzza" typo); the nav spelling problem is confirmed.
Homepage SEO basics (title, no H1, no og:image, repeated tagline)	H4	Confirmed	The site tagline is also cut off mid-sentence.
Blog is stale	M7	Confirmed	Three posts; newest Jun 20, 2024.
Pushy or off-tone copy ("exotic," "Hurry," "guarantee," "Buy Now !")	M7	Confirmed	Plus typos and a placeholder button.
Category and menu taxonomy problems	M3	Confirmed and quantified	80 categories, 14 empty, 78 without descriptions.
Product-page hygiene (slugs, caps, alt text, reviews, missing info)	M1, M2, C3	Confirmed and quantified	The "reviews" turned out to be spam.
About page is thin	M7, M4	Confirmed	335 words; a duplicate "new about" page is also live.
Local search (tap-to-call, map, schema, Facebook link)	M8, H3	Confirmed	Stored business hours are also wrong.
Footer year, Elementor version stamps, dead links	L1, L2, L3	Confirmed	Stamps reflect stale caches.

Part 2: Plan of actionSeven phases, ordered by risk and revenue. Estimated total: about 108 working hours over roughly ten weeks.

Timeline

Phase

Sep 21

Sep 28

Oct 5

Oct 12

Oct 19

Oct 26

Nov 2

Nov 9

Nov 16

Nov 23

0. Safety net

1. Restore revenue and stop the leaks

2. Claims, compliance, and trust

3. Security and a leaner plugin stack

4. Database and media cleanup

5. Search, catalog, and content

6. Season and growth

then ongoing

Key dates: Thanksgiving is Thu Nov 26; Kwanzaa runs Dec 26 to Jan 1. Change freeze Nov 20 to Jan 4: content edits only, no plugin, code, or settings changes.

Phases at a glance

Phase	When	Effort	Goal
0. Safety net	Fri Sep 18 to Mon Sep 21	about 3 hours	Nothing we do next is irreversible, and alerts reach a human.
1. Restore revenue and stop the leaks	Mon Sep 21 to Fri Sep 25	about 10 hours	A customer can pay, receives a correct email, and never sees a staging address.
2. Claims, compliance, and trust	Mon Sep 28 to Fri Oct 9	about 14 hours	No page makes a medical claim, risky products are resolved, and there is a written data policy.
3. Security and a leaner plugin stack	Mon Sep 28 to Fri Oct 16	about 14 hours	Hard to attack, quick to load, and one plugin for each job.
4. Database and media cleanup	Mon Oct 12 to Fri Oct 23	about 7 hours	A small, fast, quick-to-restore site. Every deletion needs an explicit yes on its card.
5. Search, catalog, and content	Mon Oct 5 to Fri Nov 6	about 40 hours	Search engines see the whole store, every product is complete and clearly named, and the content sounds like the shop.
6. Season and growth	Mon Oct 19 to Fri Nov 27, then ongoing	about 20 hours	Be ready for Kwanzaa and the holidays, and start building an audience you own.

How we work safely

Backup first. Before each phase, Claude verifies a backup under 24 hours old and takes a locked manual one before any risky change.
One change at a time. After each change, load the home page, shop, a product, the cart, and the contact page. Update plugins one at a time.
Report before acting. Findings and proposed changes are posted on the Trello card first. Claude changes nothing until James says yes.
No deletions without a written yes. Each deletion step lists exactly what will be removed. Appendix I is a printable approval sheet.
No email is sent on anyone's behalf without showing the draft first.
Everything is reversible or logged. The old value of every changed setting is recorded on its card.

Who is needed, and when

Utibe: the Square login (Step 1.1), return and shipping policy facts (1.10), product and policy decisions (2.1 to 2.6, 5.5), supplier documents (2.4), and about 20 minutes a week to approve copy.
James: Cloudflare, Microsoft 365, Brevo, Google, and hosting-panel steps; approvals for each Claude change.
An attorney (optional but recommended): a one-time review of the claims policy and the four legal pages (2.8).

Decisions to confirm

Recommended defaults are shown so each can be approved in one word.

ID	Decision	Recommended	Steps
D1	Reconnect Square and add PayPal as a backup	Yes	1.1, 1.2
D2	Transactional email through Brevo (with FluentSMTP)	Yes	1.4
D3	Reviews off until the review program starts	Yes	1.9, 6.3
D4	Claims policy: no disease names, no treat/cure/heal/detox language	Yes	2.1
D5	ATTOTE: remove unless full documentation arrives	Remove	2.4
D6	Items over $1,000: provenance statement plus phone or in-store purchase	Yes	2.5
D7	One SEO plugin: Rank Math (retire SmartCrawl)	Yes	3.10
D8	One optimizer: LiteSpeed (Hummingbird for uptime only)	Yes	3.13
D9	One analytics container: GTM	Yes	5.12
D10	Catalog style: Title Case, about 45 categories	Yes	5.5, 5.6
D11	Attorney review of claims and policies	Yes	2.8
D12	Square inventory sync	January	6.7

Exit criteria by phase

Phase 0: done when

Backup verified within 24 hours and one labeled, locked pre-change backup exists.
Backup alerts reach James and Utibe.
Trello board exists and every step in this plan has a card.

Phase 1: done when

A $1 test order succeeds through Square (and PayPal if enabled) and refunds cleanly.
Order email arrives from [email protected] and passes SPF, DKIM, and DMARC.
Zero staging references on the site; zero spam reviews; reviews switched off.
Privacy, Terms, Shipping, and Refund pages are live and linked in the footer and at checkout.

Phase 2: done when

The keyword scan finds no medical claims on live pages (books excluded).
ATTOTE is resolved with documentation or permanently removed.
Every item over $1,000 carries a provenance statement or is by phone or in store.
Consent banner behavior is verified; a customer-data policy is written.

Phase 3: done when

Two-factor authentication is on for every privileged account.
A Defender scan has completed in the last 7 days.
One SEO plugin, one optimizer, one remote-management agent, one wishlist.
Mobile LCP at or under 2.5 s, CLS at or under 0.1, uncached page time at or under 1 s.
No new fatal errors for 14 days; security-headers grade A.

Phase 4: done when

Database at or under 120 MB.
Uploads at or under 1.2 GB.
Backup size at or under 1.5 GB.
Alt text on every image still in use.

Phase 5: done when

The sitemap lists all 118 products and Search Console reports it as Success.
Exactly one H1 per page template; about 45 categories, each with a description and image.
Every product has a Title Case name, SKU, weight, alt text, and description.
No junk pages remain; every changed URL redirects.

Phase 6: done when

Email capture is live by Oct 30; the Kwanzaa hub is live and linked by Nov 13.
At least 20 genuine verified reviews by Dec 31.
Weekly monitoring is running and someone reads the alerts.
A January re-audit is scheduled.

Risks

Square reconnect fails or needs a new Square application. Mitigation: enable PayPal (1.2) so the store can take payments while Square is repaired.
A cleanup step breaks something. Mitigation: locked backups, SQL exports before table drops, and one-at-a-time changes with checks.
Utibe is unavailable for decisions. Mitigation: Phase 1 needs one login and four business facts; everything else has a recommended default.
The holiday freeze arrives before the work is done. Mitigation: Phases 1 to 4 finish by Oct 23, leaving three weeks for content and the Kwanzaa hub.

Part 4: Trello boardOne card for each of the 74 steps, so the report and the board always agree.

Board name: African Land: Site Recovery and Polish. Cards use the step ID as a prefix (for example "1.1 Reconnect Square"), and each card's checklist is that step's bullet list. A ready-to-import file, african-land-trello-cards.csv, is included with this report. When the Trello connector is added to Claude, Claude can create the board, lists, labels, cards, and checklists directly, and move cards as steps complete.

Needs a decision

2.1 Claims policy

2.4 Resolve ATTOTE

Ready this week

1.1 Reconnect Square

1.3 Fix email From

1.9 Remove spam reviews

Up next

3.1 Turn on 2FA

5.1 Fix sitemap

In progress

1.7 Replace staging URLs

Waiting on Utibe

1.10 Legal pages (facts)

Verify

0.3 Pre-phase-1 backup

Done

0.5 Board created

Sample layout only. On day one every card sits in "Needs a decision", "Ready this week", or "Up next", and moves right as work is done.

Lists

List	Use
Needs a decision	Steps marked Decision or Needs approval wait here until a person says yes.
Ready this week	Steps due within the current week with no open questions.
Up next	Everything scheduled but not yet this week.
In progress	One or two cards at a time.
Waiting on Utibe or a vendor	Blocked on a login, a document, or an outside answer.
Verify	Work is done; the Verify line still has to pass.
Done	Verified. Add the date and the result in a comment.

Labels

Group	Labels
Severity	Critical (red), High (orange), Medium (blue), Low (grey)
Owner	James (green), Utibe (yellow), Claude (purple)
Phase	Phase 0 to Phase 6 (one colour each)
Flags	Needs approval (pink), Touches money (black)

Card format

Title: step ID and name, for example "1.7 Replace every staging and http URL".
Description: why it matters (finding IDs), the Verify line, the Undo line, and a link to the step in the report.
Checklist: the step's sub-steps, plus a final "Verified and logged" item.
Due date: from Part 3. Members: the owners shown on the step.
Custom fields (optional Power-Up): Effort (hours), Risk (Low, Medium, High), Approved by, Approved on.

Suggested automation (Butler)

When the label "Needs approval" is added to a card, move it to "Needs a decision" and mention James.
When a card is moved to "Done", mark the due date complete and add a comment with today's date.
When a card is added to "Verify", add a checklist "Verification" with two items: "Verify line passed" and "Before-value recorded".
Every Friday at 9:00, create a card "Weekly health check" (payments, email, backup, fatal errors) in "Ready this week".
One day before a due date, comment on the card and mention its owner.

The board is only useful if it is small on any given day. Keep at most three cards in "In progress", and never start a Phase 4 or Phase 5 card while a Phase 1 card is still open.

Part 5: Appendices

Appendix A: Site snapshot

Item	Value
Platform	WordPress 7.1.1, PHP 8.3.33, MariaDB 11.8.9; XStore 9.7.8 with child theme; Elementor 4.2.4 and Pro 4.2.3; WooCommerce 11.1.0.
Hosting	Hostinger (LiteSpeed server), behind Cloudflare; Microsoft 365 mailboxes.
Content	118 products (90 simple, 28 variable) with 579 variations, plus 1 draft; 17 published and 4 draft pages; 3 posts; 80 product categories; 290 product tags.
People	4,692 users: 4,387 customers, 3 administrators, 1 shop manager.
Orders	23 since Sep 2024 (14 completed, 7 refunded, 1 failed, 1 cancelled); last on Apr 12, 2026.
Data	Database 265.5 MB; uploads 2.4 GB in 32,903 files; 1,251 media items.
Plugins	30 active plugins and 5 mu-plugins; no updates pending.
Payments and shipping	Square (card, Cash App Pay, gift cards) enabled but disconnected; PayPal disabled; Shippo live rates working; automated tax on.
Backups	WPvivid Pro daily to Google Drive; last success Sep 18; about 2.9 GB per run; 30 retained.

Appendix B: Catalog work lists

B1. Health-language triage (17 keyword hits, plus ATTOTE)

ID	Product	Terms found	Action
530	African Black Soap: Eczema Therapy Halal	eczema, therapy, healing, scarring, acne	Rewrite; rename; new slug with 301
591	Essential (Al-Riyan) Soaps	detoxified, toxins, rejuvenating, wrinkles	Rewrite
1017	African Living Bitters	remedy, healing, detoxification, rejuvenate	Rewrite; supplement labeling review
7092	Essential Oils (Aromatherapy)	hormones, immunity, infection, anxiety, relieves	Rewrite
9429	Pure Liquid Black Soap	treats, wrinkles	Rewrite
41156	Luxurious Whipped Shea Butter	healing, treating, scars	Rewrite
3577	African Raw Shea Butter	healing	Rewrite
53155	Foil Wrapped Incense Sticks Bundle	depression, relieve, antimicrobial, purify	Rewrite (copy is repeated on 19508)
19508	Three Kings Charcoal	depression, relieve, antimicrobial, purify	Rewrite (pasted from incense)
50979	All-Natural Oils	therapeutic	Rewrite
865	HEM Incense	purifying	Review
637	Incense Resin/Rocks	rejuvenation	Review
4170	African Cowrie Shell Ring (Silver)	fertility, healing, medicine	Review
4181	Black Antique Ring	healing	Review
4124	Egyptian Bronze Bangle (Horus & Isis)	healing	Review
12157	Cultural Atlas of Africa	healing	Likely fine (book)
11755	African Ceremonies (two volumes)	healing	Likely fine (book)
2447	ATTOTE Herbal Mixture for Men	not keyword-flagged	See C5; draft now, Step 2.4

B2. Product problem lists (IDs)

Issue	Product IDs
No price or placeholder listing	19485, 19466, 19464, 19460, 47666 (also 19458 Boy's Clothing, out of stock)
Duplicates and near-duplicates	Earrings 47666 / 47663 / 47658; Maasai books 12575 / 12162; wooden mask plaques 9466 / 9464; Kwanzaa candle sets 60497 / 60492 (same title, $54.99 vs $59.99), 60503, 60482; kente stoles 64193 / 64234, 64205 / 64211, 64221 / 64226; six twisted cuff bracelets 47651, 47646, 47638, 47634, 47627, 47611
Numeric slugs	64226, 64211, 60647, 12162, 7083, 3072, 3007
Slug does not match title	530 turmeric-soap; 591 african-rosehip-halal-soap; 19466 stoles; 60482 kwanzaa; 50979 african-natural-oil; 976 satya-sai-babaagarbatti; 9396 tribal-necklace-with-matching-earrings; 19591 african-bowtie-set-bowtie-kufi-hat-to-match
Typos	64211 "KRNTE"; 12525 "NORMADS"; slugs of 12491, 12157, 47594; category 477 slug; page 24710 "Kwanzza"
Variations with no price	47594 (6), 46869 (6), 47460 (6), 47575 (3), 787 (2), 50979 (1), 3625 (1)
Out of stock	62421, 19458, 9478, 9476, 9464, 7083, 11755; 3577 has 4 of 6 variations out
High value	9499 and 9459 ($4,200 each), 9478 ($2,200), 9476 ($2,100), 11755 ($250), 9466 and 9464 ($230)

B3. Category cleanup

Issue	Details
Empty (14)	Candles (467), Canes (28), Children's Clothing (44), Deodorants (49), Fans (36), Four Piece Ensembles (26), Fragrance Oils (57), Handbag (29), Head Wraps (31, duplicate of Headwraps 357), Men's Jewelry (48), Musical Instruments (40), Shoes (32), Unisex Clothing (45), Uncategorized (15)
Misplaced	Dashiki (350) is top-level; ties, bow ties, and stoles are in Wax Prints; "Belts & Cummerbunds" is filed under Women's Jewelry; a senator suit sits in Dashiki
Spelling	Kwanza Candle Set (469), Kwanza Cup (474); slug `kinara-candle-holerd` (477)
Slugs to normalize	`african_clothing` (22), `body` (55), `health` (38)

Appendix C: Pages and templates to remove or keep

ID	Title	Status	Action
62363	new about	Published	Delete; 301 to /about-us/
64172	Cart 2	Published, empty	Delete
64166	Cart	Draft	Delete
60623	test	Draft	Delete
142	Coming Soon	Draft	Delete
4491	Receipt	Published	Delete after checking no plugin uses it
4493	Order History	Published	Delete after check
4492	Transaction Failed	Published	Delete after check
4494	Confirmation	Published	Delete after check
4490	Checkout (child of Cart)	Published	Delete after check
24	Refund and Returns Policy	Draft	Keep; publish in Step 1.10
283	Wishlist	Published	Keep (theme uses it)
61	AL Blog	Published	Keep (posts page)
7529, 7615	"About" Elementor templates	Published	Keep one; delete the other
64115, 5936	Single Product #64115 and Loop Item #5936	Published	Review; delete if unused

Appendix D: Orphaned database tables (candidates)

Sizes are as measured on Sep 18, 2026. The exact table list is regenerated and shown for approval at Step 4.2.

Source plugin (removed)	Tables	Approx. size
BlogVault and MalCare	`bv_fw_requests` (69.6 MB), `bv_ip_store`, `bv_lp_requests`, `bv_activities_store`, `mclean_*`	about 73 MB
Wordfence	`wffilemods` (11.5 MB), `wfknownfilelist` (8.5 MB), and about 20 other `wf*` tables	about 22 MB
MailPoet	about 45 `mailpoet_*` tables (2 unconfirmed subscribers; newsletter templates 2.5 MB)	about 3 MB
Easy Digital Downloads	about 25 `edd_*` tables (0 customers, 0 orders)	under 1 MB
WPForms	`wpforms_*` (108 entries; export first)	small
Hustle	`hustle_*` (0 modules, 0 entries)	small
All in One SEO	`aioseo_*`	small
Jetpack	`jetpack_sync_queue`	small
Google Listings and Ads	`gla_*`	small
WP Mail SMTP	`wpmailsmtp_*` (email log 5.5 MB, ends Jan 2024)	about 6 MB
Elementor Site Mailer	`site_mail_*` (2.5 MB)	about 3 MB
Snapshot, File Manager, email customizer, login tracker	`snapshot_action_logs`, `wpfm_backup`, `viwec_clicked`, `nxtext_login_failed`	small
Retire with their plugins (Steps 3.10, 3.11)	`smartcrawl_redirects`, `yith_wcwl`, `frmt_`	small
Keep (active)	`wc_`, `woocommerce_`, `actionscheduler_`, `litespeed_`, `defender_` (purge rows only), `mainwp_`, `wpvivid`, `rank_math_`, `novamira_`, `smush_`, `cookieadmin_`, `e_`, `hostinger_reach_*`	-

Appendix E: Plugin inventory and decisions

Plugin	Role	Decision	Notes and step
Beehive Pro 3.5.2	Analytics	Keep	Choose GA4 or GTM as the single path (5.12)
CookieAdmin 1.2.3	Consent banner	Keep	Run the cookie scan (2.9)
Defender Pro 6.2.4	Security	Keep	Fix scans, 2FA, IP detection (3.1 to 3.4)
Elementor 4.2.4 / Pro 4.2.3	Page builder	Keep	Update Pro to match (3.12)
Flexible Editor Panel 2.6.1	Editor interface	Keep	Low risk
Forminator Pro 1.57.3	Forms	Remove	0 forms, 0 entries (3.11)
HappyFiles Pro 1.8.2	Media folders	Keep	-
Hostinger Tools 3.0.77	Host integration	Keep	Update; fatal on Aug 26 (3.15)
Hummingbird Pro 3.21.2	Optimization	Keep, reduced	Uptime monitor only; turn off minify and delay JS (3.13)
LiteSpeed Cache 7.9.1	Caching	Keep	The single optimizer (3.13)
MainWP Child 6.2	Fleet management	Keep	Your MainWP hub
ManageWP Worker 4.9.38	Fleet management	Remove	Duplicate of MainWP (3.9)
Multi-Carrier Shippo 1.5.18	Live shipping rates	Keep	Verified working
Novamira 1.12.4	AI admin connection	Keep for now	Needed for this project; review afterward
Rank Math SEO 1.0.278	SEO	Keep	The single SEO plugin
SmartCrawl Pro 3.16.4	SEO	Remove	Duplicate of Rank Math (3.10)
Smush Pro 4.3.3	Images and CDN	Keep, adjusted	Turn off lazy-load and backup originals (3.13)
WooCommerce 11.1.0	Commerce	Keep	-
WooCommerce.com Update Manager 1.0.3	Updates	Keep	-
WooCommerce PayPal Payments 4.1.3	Gateway	Keep or remove	Enable as backup (1.2) or remove (3.11)
WooCommerce Shipping 2.4.0	Labels	Verify	Remove if unused; Shippo handles rates (3.11)
WooCommerce Square 5.5.0	Gateway	Keep	Reconnect (1.1)
WooCommerce Tax 3.6.16	Automated tax	Keep	-
WPMU DEV Dashboard 5.0.2	Suite manager	Keep	Needed for Pro plugin updates
WPvivid Backup Plugin, Pro, and MainWP	Backups	Keep	Slim the backup set (4.5)
XStore Core 5.7.8	Theme companion	Keep	Update; fatal errors (3.12, 3.14)
YITH WooCommerce Wishlist 4.18.1	Wishlist	Remove	Theme has its own; fatal on Sep 8 (3.11)
mu-plugins	hosting.php, hostinger-preview-domain.php, hostinger-auto-updates.php, 0-worker.php, automation-by-installatron.php	Keep host files	Remove 0-worker.php with ManageWP; review Installatron (3.9)

Appendix F: Method and footprint

Public review: the homepage, About, Blog, and one product page, plus live HTTP checks on 13 URLs and 17 endpoints.
Back-end review through the Novamira connector (WordPress user 53, read-only): environment, plugins and themes, database and orphan tables, users, all pages, posts, 118 products and 579 variations, categories and tags, media, WooCommerce settings, gateways, shipping, tax, orders, mail configuration, DNS lookups (SPF, DMARC, DKIM), Rank Math audit and settings, SmartCrawl, Defender, WPvivid, cron, logs, and an uploads filesystem scan.
Live tests: page-head parsing for titles, schema, headings, and images; timing of cached and uncached pages; and a guest-cart simulation through WooCommerce's Store API (created and removed).
Nothing on the site was changed. The only footprint is a throwaway guest cart session and read requests.
Corrections made during the audit: shipping works even though the shipping-zone table is empty (Shippo supplies rates); backups are healthy (the Pro schedule is stored under a different option); a Kwanzaa page does exist; category totals are 80 categories, 14 empty, 78 without descriptions.

Appendix G: Not verified

Real-user Core Web Vitals and a Lighthouse run: Google's PageSpeed API quota was exhausted, and browser-based measurement was declined.
Mobile rendering and visual quality; accessibility testing with a tool such as axe.
Cloudflare (WAF, cache, DNS), Square, PayPal, Google (Search Console, GA4, GTM, Business Profile), Microsoft 365, and Brevo dashboards.
External broken links (needs Rank Math Pro) and the 404 log (the monitor is off).
Legal sufficiency of any claim or policy; supplier documentation for ATTOTE and the antiquities.

Appendix H: Access checklist

Account or system	Needed for	Steps
Square account owner	Reconnect payments	1.1
PayPal business account	Backup gateway	1.2
Cloudflare	DNS, security headers, bot rules	1.4, 1.5, 3.7
Microsoft 365 admin	Mailbox, DKIM	1.3, 1.5
Brevo	Transactional email	1.4
Hostinger hPanel	Cron, backups, Redis	3.2, 3.13
WPMU DEV and MainWP hub	Plugin licenses and fleet view	3.9, 3.12
Google (Search Console, Tag Manager, Analytics, Business Profile, Drive)	SEO, tracking, local, backups	5.1, 5.12, 6.4, 0.1
MailerLite	Email capture	6.2
Trello	Board	0.5

Appendix I: Deletion approval sheet

Print this page, and initial each row before Claude deletes anything in that row. Where a row lists a count, Claude shows the exact items first.

What will be deleted	Amount	Step	Approved
Spam reviews (8 published, 68 pending)	76	1.9	[ ] Yes Initials ______
URL search-and-replace across posts, Elementor data, options	bulk edit	1.7	[ ] Yes Initials ______
Old WPForms entries (after export)	108	2.10	[ ] Yes Initials ______
readme.html, license.txt, wp-config-sample.php	3 files	3.6	[ ] Yes Initials ______
elementor-pro-3.26.3-1.zip; `functions copy 1.php`; empty upload folders	2 files + 4 folders	3.8	[ ] Yes Initials ______
ManageWP Worker, mu-plugin 0-worker.php, Installatron mu-plugin	3 items	3.9	[ ] Yes Initials ______
SmartCrawl Pro plugin and its options/table	1 plugin	3.10	[ ] Yes Initials ______
YITH Wishlist, Forminator Pro (and PayPal or WooCommerce Shipping if unused)	2 to 4 plugins	3.11	[ ] Yes Initials ______
Orphaned database tables (by group)	about 200 tables	4.2	[ ] Yes Initials ______
Log rows, revisions, transients, orphan meta and options	thousands of rows	4.3	[ ] Yes Initials ______
Smush .bak originals; .mov files; duplicate and unused images	1,195 + 23 + TBD	4.4	[ ] Yes Initials ______
Junk and duplicate pages	10 pages	5.8	[ ] Yes Initials ______
Empty and duplicate categories	14 + 1 merge	5.5	[ ] Yes Initials ______
Duplicate and placeholder products	about 12	5.6	[ ] Yes Initials ______
Empty and single-use tags	215	5.7	[ ] Yes Initials ______

Boho Bliss

Select Template

Please select a template to display its content.

Timeless Elegance

Select Template

Please select a template to display its content.

JPS Start Page

Manual Docs

JPS Photographs

JPS Hosting

Training

At a glance

How to use this report

Part 1: FindingsPublic-site findings and back-end findings are merged. Each finding says where it was found.

Critical: fix first (6)

High: fix in the first three weeks (13)

Medium: schedule and batch (11)

Low: tidy up along the way (7)

Checked and healthy

First-pass findings and where they landed

Part 2: Plan of actionSeven phases, ordered by risk and revenue. Estimated total: about 108 working hours over roughly ten weeks.

Timeline

Phases at a glance

How we work safely

Who is needed, and when

Decisions to confirm

Exit criteria by phase

Phase 0: done when

Phase 1: done when

Phase 2: done when

Phase 3: done when

Phase 4: done when

Phase 5: done when

Phase 6: done when

Risks

Part 3: Step-by-step completion planWork top to bottom. Tick each box when its "Verify" line passes. Steps marked "Needs your OK" involve deletions or bulk edits.

Phase 0: Safety net

Confirm the latest backup before every phase

Add backup alert recipients

Take a labeled, locked manual backup

Test one restore on a scratch site

Create the Trello board and load the cards

Agree the working rules

Record before-values for every setting we change

Phase 1: Restore revenue and stop the leaks

Reconnect Square

Enable PayPal as a second gateway

Fix the store email identity

Set up a transactional email service (Brevo)

Add DMARC and enable Microsoft 365 DKIM

Prove delivery end to end

Replace every staging and http URL

Fix the homepage buttons

Remove the spam reviews and close the door

Publish the legal pages

Place a $1 test order

Take the riskiest listing off the store

Make failures loud

Phase 2: Claims, compliance, and trust

Adopt a claims policy

Rewrite the flagged products

Rewrite the blog posts and About copy

Resolve ATTOTE

Handle antiquities and other high-value items

Verify what is really in the soaps

Add return and shipping data to product schema

Optional: attorney review

Fix consent and tracking

Set a customer-data policy

Phase 3: Security and a leaner plugin stack

Turn on two-factor authentication

Make Defender scans run

Give Defender real visitor IPs

Tighten login rules

Stop leaking usernames

Close the small doors

Harden at Cloudflare

Remove the plugin zip and stray files

Keep one remote-management agent

Retire SmartCrawl

Retire YITH Wishlist and other idle plugins

Update fragile plugins, one at a time

Speed pass, one change at a time

Fix the checkout-breadcrumb fatal error

Fix the Hostinger Tools fatal error

Set the timezone