Menu

Case files

What I've fixed, and how it stays fixed.

Each case file says what you would have seen, what I found, what I did and how it stays fixed, and is tagged with whose site it was. I never name a client or their host.

My own site

Done October 2026

80 → 3 open methods

A security switch that said "on" and did nothing

What you'd have seen
My security plugin's "Disable XML-RPC" switch, showing as "on". XML-RPC is an old way for apps to log in to WordPress from outside.
What I found
The switch relied on a rule in a server file (.htaccess) that was not there after the site moved hosts in October 2026. XML-RPC still answered with 80 methods, the commands it accepts from outside, including pingbacks and system.multicall, which lets a bot try many passwords in one request.
What I did
I turned XML-RPC off with a must-use plugin, a small piece of my own code that WordPress always loads. Logins through it are refused before any password is checked, pingbacks are gone, and pages no longer advertise it. It now answers with only the 3 system methods the library always adds.
How it stays fixed
Verified live on 7 October 2026: 3 methods. The fix lives in the site's own code, not in a server file a host move can leave behind. On a plan, the number of open methods is one of the things I re-check every month.
My own site

Done October 2026

Placeholder sender → real address, tested monthly

Site mail from a real address, signed for the domain

What you'd have seen
A form that says "sent" after every enquiry. That message means the site handed the mail off. It doesn't show which address it went out from, or whether it arrived.
What I found
By default, WordPress sends site mail from a placeholder address, not a real address on the site's own domain. My site was sending from that placeholder.
What I did
My site now sends from [email protected], a real address on its own domain, through a mail service, with the mail signed for the domain (DKIM). The domain also publishes SPF and DMARC records, which tell inboxes how to check its mail. The enquiry form filters spam with a hidden field, a signed time check, a rate limit and a check for messages written mostly in non-Latin script. There is no CAPTCHA puzzle for customers to solve.
How it stays fixed
The form gets a test enquiry every month. Both plans include the same test for your own form, sent the way a customer would send it and clearly marked as a test. If it doesn't arrive, you hear it from me.
My own site

Done October 2026

Page builder → a theme with 0 outside requests

A page builder replaced with a lean theme

What you'd have seen
Pages built and edited in Divi, a page builder.
What I found
Every page's layout depended on the builder, so removing it meant building a new theme, not switching off a setting.
What I did
I replaced Divi with a lean custom theme. The theme itself loads nothing from other servers and needs no JavaScript. Its fonts and icons are stored on the site.
How it stays fixed
There is no page builder left to update, and the theme is my own code. The live site still loads Google Analytics, one outside script, by choice, and Cloudflare adds a small script of its own.

How a fix works

A price first, then the fix, then a 90-day warranty.

  1. 01

    You get a fixed price first

    I tell you what I'd fix and what it costs before I touch anything. The quote is valid for 30 days, and nothing starts until you agree to it.

    $250–$2,500

  2. 02

    I fix it where your site lives

    No move needed. I make sure there's a fresh backup first, then try the changes to your site on a copy before they go live. Once the fix is live, I check that it works, not just that a setting says it's "on".

    Your current host

  3. 03

    A 90-day workmanship warranty

    If I can't fix it, you get a full refund. If the fix fails for the same reason within 90 days, I fix it again at no charge. On a plan, I also re-check it every month.

    90 days

How I make changes

The same routine for every fix, on any host.

Every fix and every change to your site's code goes through it, whether it's a one-off fix or work on a plan.

Before

A fresh backup before I start

Before each fix or code change, I either take one or confirm one has just been taken: a snapshot from the host, or my own copy. I do that on your current host too, not only when I host your site.

During

Tried on a copy before it goes live

I try each fix and code change on a copy first: a separate test copy (a staging site) or a preview on my own computer. I never edit code in the theme and plugin editor built into WordPress, and I turn that editor off on the sites I look after.

After

Every code change I make, recorded with a way back

I keep your site's code in a private record of its own: the theme, custom plugins and any plugin I've repaired. Each change I make to it is recorded with its date. If one causes a problem, I can undo it, back to the exact version before. The record doesn't cover your content and settings (everything in the database), your photos and PDFs, or WordPress and plugin updates. If any of those need putting right, they're restored from a backup instead, either the one taken before the fix or code change, or the most recent one, to how they were when it was taken.

Yours

Your site's code, whenever you ask

You can have your site's code and its full history of changes whenever you ask, as a copy or with access of your own. If you leave, I hand it over.

Fix log

A dated log of what I've fixed.

One line per fix, newest first, tagged with whose site it was. Client sites are never named.

  1. My own site Cloudflare rules added that turn away password guessing and probes for weak spots before they reach WordPress.
  2. My own site XML-RPC turned off: 80 open methods → 3.
  3. My own site Enquiry spam filtered without a CAPTCHA, using a time check and a script check.
  4. My own site Server locked so it only accepts web traffic that comes through Cloudflare.
  5. My own site Replaced Divi with a lean theme. Site mail now comes from a real address on the domain.
  6. My own site Moved the site to Google Cloud, behind Cloudflare.

Seen something like this on your site?

Start with the free site check: at most five findings from the outside, each with a price band for the fix. If you already know what's wrong, ask for a quote instead. No obligation, no sales call.

Get a Free Site Check Or ask for a quote