# Werner WordPress Admin Audit — Second Pass

Date: 2026-05-29  
Scope: `berchman.com`, `bertmahoney.com`, `bert.forsale`  
Mode: **read-only REST/API audit** — no posts changed, no plugins changed, no settings changed.

---

## Access Confirmation

All three sites authenticated successfully through the WordPress REST API using the currently configured Application Password profiles.

Important distinction:

- The API credentials currently configured in Hermes are still the older publisher/admin usernames.
- Werner-named admin users are visible on all three sites.
- I did **not** see the Hermes env switched to Werner-specific app-password credentials yet.

### Current authenticated API users

| Site | Authenticated user in env | REST auth | Role | Admin capabilities |
|---|---|---:|---|---:|
| `berchman.com` | `admin-berchman` | OK | administrator | yes |
| `bertmahoney.com` | `berchman` | OK | administrator | yes |
| `bert.forsale` | `bert.mahoney@gmail.com` | OK | administrator | yes |

### Werner accounts visible

| Site | Werner user visible? | Role |
|---|---:|---|
| `berchman.com` | yes — `Werner Hermes` / slug `werner-hermes-audit` | administrator |
| `bertmahoney.com` | yes — `Werner Hermes` / slug `werner-hermes-audit` | administrator |
| `bert.forsale` | yes — `Werner Hermes` / slug `werner-hermes-audit` | administrator |

Recommended next credential cleanup:

- Generate app passwords for the Werner users.
- Replace the current env values with the Werner-specific usernames/app passwords.
- Leave Bert’s primary/admin accounts separate.

---

# Cross-site Findings

## Shared positives

- All three authenticated over REST successfully.
- All three have Administrator-level API capability available.
- All three expose the relevant REST routes for:
  - plugin inventory
  - theme inventory
  - settings readout
  - user inventory
  - Site Health test endpoints
  - app-password introspection
- HTTPS is active on all three.
- WordPress.org communication checks pass on all three.
- Loopback requests pass on all three.

## Shared issues / improvements

### Authorization-header Site Health warning

All three sites report:

> The authorization header is invalid

This appears as a Site Health **recommended** item. The REST calls are working anyway with app passwords, so this is not blocking Werner. Still, it is worth fixing because WordPress flags it as a third-party integration risk.

Suggested action:

- Flush permalinks first, as WordPress recommends.
- If it persists, check Hostinger/LiteSpeed/server config for Authorization header forwarding.

### Security headers

From the public pass, the sites are missing or not publicly exposing several baseline headers:

- `Strict-Transport-Security`
- `X-Frame-Options`
- `X-Content-Type-Options`
- `Referrer-Policy`
- `Permissions-Policy`

Recommended open-source / low-cost approach:

- Add at server level if Hostinger allows it.
- Otherwise use a lightweight headers/security plugin.
- Avoid an aggressive CSP at first; WordPress plugins/themes often break under strict CSP without careful testing.

### Admin account count

Each site has multiple admin users. This may be intentional, but it should be reviewed.

---

# Site 1 — Berchman

URL: <https://berchman.com>

## Settings

| Field | Value |
|---|---|
| Site title | `Bert.` |
| Description | `Artist, Designer & Mental Wellness Advocate` |
| Timezone | `America/Los_Angeles` |
| Posts per page | `10` |

## Users

| Name | Slug | Role |
|---|---|---|
| Berchman | `admin-berchman` | administrator |
| Bert Mahoney | `berchman` | subscriber |
| hostinger transfer | `hellobertmahoney-com` | administrator |
| Source Author | `wpra-source-author-site-1` | subscriber |
| Werner Hermes | `werner-hermes-audit` | administrator |

### User notes

- Werner account exists and is admin.
- `hostinger transfer` is also admin; review whether it is still needed.
- `Source Author` appears related to RSS/import tooling; likely tied to WP RSS Aggregator.

## Plugins

### Active plugins

| Plugin | Version | Notes |
|---|---:|---|
| Advanced Custom Fields | 6.8.1 | Active; important if custom fields are used. |
| Advanced Post Block | 2.2.0 | Active block plugin. |
| Automatic YouTube Gallery | 2.7.2 | Active; visible publicly. |
| BackUpWordPress | 3.14 | Active; network-only flag reported. |
| Broken Link Checker | 2.4.8 | Active; useful but can add overhead. |
| Classic Widgets | 0.3 | Active; legacy/editor compatibility. |
| Hostinger Tools | 3.0.66 | Active host tooling. |
| Ko-fi Button | 1.4.1 | Active monetization/support widget. |
| Quick Page/Post Redirect Plugin | 5.2.4 | Active redirects. |
| Rank Math SEO | 1.0.271.1 | Active SEO. |
| Site Kit by Google | 1.179.0 | Active analytics/search/performance integration. |
| WP RSS Aggregator | 5.0.12 | Active; visible publicly. |

### Inactive plugins

| Plugin | Version | Recommendation |
|---|---:|---|
| Folders | 3.1.9 | Remove if not needed. |
| Jetpack | 15.8 | Remove if not planned; inactive large plugin. |
| WordPress to Substack publishing | 0.1.1 | Keep only if actively testing Substack flow. |

## Themes

### Active theme

| Theme | Version | Requires WP | Requires PHP |
|---|---:|---:|---:|
| Twenty Twenty-Five | 1.5 | 6.7 | 7.2 |

### Inactive themes

- Modern 2.6.6
- SimpleArtDesign 1.0
- Twenty Twenty 3.0
- Twenty Twenty-Two 2.1

Recommendation: keep one default fallback theme plus the active theme; remove old unused themes after backup.

## Site Health API checks

| Test | Status | Finding |
|---|---|---|
| Authorization header | recommended | Authorization header flagged invalid. |
| Background updates | good | Working. |
| WordPress.org communication | good | Working. |
| HTTPS | good | Active HTTPS. |
| Loopback requests | good | Working. |
| Page cache | recommended | Page cache not detected, but server response time OK. |

## Berchman priorities

1. Fix malformed public link found earlier: `http://https//bert.forsale`.
2. Review whether `hostinger transfer` admin user is still needed.
3. Remove inactive plugins if not needed.
4. Decide whether both YouTube Gallery and RSS Aggregator are still strategically useful.
5. Add security headers.
6. Resolve Authorization header Site Health warning.
7. Add/verify page cache if appropriate.

---

# Site 2 — BertMahoney.com

URL: <https://bertmahoney.com>

## Settings

| Field | Value |
|---|---|
| Site title | `Bert Mahoney` |
| Description | `AI Systems Architect & Hands-On Designer` |
| Timezone | `America/Denver` |
| Posts per page | `9` |

## Users

| Name | Slug | Role |
|---|---|---|
| berchman | `berchman` | administrator |
| hostinger transfer | `hostinger` | administrator |
| Werner Hermes | `werner-hermes-audit` | administrator |

### User notes

- Werner account exists and is admin.
- `hostinger transfer` is also admin; review whether it is still needed.

## Plugins

### Active plugins

| Plugin | Version | Notes |
|---|---:|---|
| 301 Redirects | 2.84 | Active redirects. |
| AI Provider for Google | 1.1.0 | Active; relevant to WP 7 AI/connectors direction. |
| BackUpWordPress | 3.14 | Active; network-only flag reported. |
| Broken Link Checker | 2.4.8 | Active; useful but can add overhead. |
| Duplicate Page | 4.5.9 | Active content utility. |
| Email Encoder - Protect Email Addresses | 2.5.0 | Active; visible publicly. |
| Hostinger Tools | 3.0.66 | Active host tooling. |
| LiteSpeed Cache | 7.8.1 | Active cache/performance. |
| Media Library Assistant | 3.36 | Active media utility. |
| Modern Image Formats | 2.6.1 | Active performance/image plugin. |
| Site Kit by Google | 1.179.0 | Active analytics/search/performance integration. |
| WPS Hide Login | 1.9.18 | Active login-hardening/obscurity. |
| WP SVG Images | 4.5 | Active SVG support. Review SVG upload security posture. |

### Inactive plugins

| Plugin | Version | Recommendation |
|---|---:|---|
| Contact Form 7 | 6.1.6 | Remove if no form needs it. |
| Optimization Detective | 1.0.0-beta5 | Potentially useful, but inactive beta; review before activation. |
| Performance Lab | 4.1.0 | Potentially useful, but inactive; overlaps with active perf plugins. |
| Smart Custom 404 Error Page | 11.4.8 | Remove if not needed. |

## Themes

### Active theme

| Theme | Version | Requires WP | Requires PHP |
|---|---:|---:|---:|
| Lei | 1.0.0 | 6.5 | 7.4 |

### Inactive theme inventory

There are many inactive themes, including:

- Abhavana
- Abisko
- Emoza WooCommerce
- Eryndo
- Kenta / Kenta Flow
- Michelle
- NanoSpace
- Paramatma
- Plover / Pulse Folio
- Spiekermann
- Storefront
- Twenty Twenty-Five
- Twenty Twenty-Two

Recommendation: reduce inactive themes substantially after backup. Keep active `Lei` and one known-good fallback theme.

## Site Health API checks

| Test | Status | Finding |
|---|---|---|
| Authorization header | recommended | Authorization header flagged invalid. |
| Background updates | good | Working. |
| WordPress.org communication | good | Working. |
| HTTPS | good | Active HTTPS. |
| Loopback requests | good | Working. |
| Page cache | good | Page cache detected and response time good. |

## BertMahoney priorities

1. Switch env/app-password use to Werner-specific credentials when ready.
2. Review `hostinger transfer` admin user.
3. Remove inactive plugins not needed.
4. Reduce inactive theme inventory.
5. Review SVG plugin security posture.
6. Resolve Authorization header warning.
7. Add missing baseline security headers.
8. Keep LiteSpeed Cache active/configured; page cache already looks good.

---

# Site 3 — Bert.forsale

URL: <https://bert.forsale>

## Settings

| Field | Value |
|---|---|
| Site title | `Bert.ForSale` |
| Description | `Artwork for Mental Health Awarness` |
| Timezone | `America/Denver` |
| Posts per page | `7` |
| Default post format | `video` |

Typo spotted:

- `Awarness` should likely be `Awareness`.

## Users

| Name | Slug | Role |
|---|---|---|
| Bert | `bert-mahoneygmail-com` | administrator |
| BertDot ForSale | `bertdotforsale` | administrator |
| Werner Hermes | `werner-hermes-audit` | administrator |

### User notes

- Werner account exists and is admin.
- Three admin users total; review whether all are needed.

## Plugins

### Active plugins

| Plugin | Version | Notes |
|---|---:|---|
| Akismet Anti-spam | 5.7 | Active anti-spam. |
| BackWPup | 5.6.9 | Active backup plugin. |
| Google for WooCommerce | 3.7.0 | Active commerce feed/ads integration. |
| Hostinger AI | 3.0.39 | Active host AI plugin. |
| Jetpack | 15.8 | Active large plugin; review needed modules. |
| Maintenance Redirect | 2.2.1 | Active; explains placeholder/back-shortly posture. |
| Media Library Assistant | 3.37 | Active media utility. |
| Printful Integration for WooCommerce | 2.2.12 | Active commerce/fulfillment. |
| Rank Math SEO | 1.0.270 | Active SEO. |
| Simple Social Icons | 4.0.0 | Active social icons. |
| Site Kit by Google | 1.179.0 | Active analytics/search/performance integration. |
| WooCommerce | 10.8.0 | Active commerce. |
| WooCommerce.com Update Manager | 1.0.3 | Active WooCommerce updater. |
| WooCommerce PayPal Payments | 4.0.4 | Active payment integration. |
| WordPress to Substack publishing | 0.1.1 | Active publishing bridge. |
| WP Consent API | 2.0.1 | Active consent/privacy support. |

### Inactive plugins

| Plugin | Version | Recommendation |
|---|---:|---|
| Classic Editor | 1.6.7 | Remove if block editor is acceptable. |
| Hostinger Tools | 3.0.66 | Inactive; remove if not needed. |
| Klaviyo | 3.7.5 | Keep only if email/ecommerce flow will use it soon. |
| LiteSpeed Cache | 7.8.1 | Inactive; consider activating/configuring if compatible. |
| Pinterest for WooCommerce | 1.4.26 | Remove if not part of launch plan. |
| Quick Featured Images | 13.7.5 | Remove if not needed. |

## Themes

### Active theme

| Theme | Version | Requires WP | Requires PHP |
|---|---:|---:|---:|
| Storefront | 4.6.2 | — | 5.6.0 |

### Inactive themes

- Kiosko 1.0.0

## Site Health API checks

| Test | Status | Finding |
|---|---|---|
| Authorization header | recommended | Authorization header flagged invalid. |
| Background updates | critical | Automatic updates are disabled by filter; all automatic updates disabled. |
| WordPress.org communication | good | Working. |
| HTTPS | good | Active HTTPS. |
| Loopback requests | good | Working. |
| Page cache | recommended | Page cache not detected, but server response time OK. |

## Bert.forsale priorities

1. Fix site tagline typo: `Awarness` → `Awareness`.
2. Decide whether this is in maintenance mode intentionally until launch.
3. Review the commerce stack before launch:
   - WooCommerce
   - Printful
   - PayPal Payments
   - Google for WooCommerce
   - Pinterest/Klaviyo if reactivated
4. Resolve critical background-updates issue or document why updates are intentionally disabled.
5. Consider activating/configuring LiteSpeed Cache if compatible.
6. Remove inactive plugins not part of near-term launch plan.
7. Review admin account count.
8. Add missing baseline security headers.

---

# WordPress 7 / New API Opportunity Scan

Bert flagged the WordPress 7.0 reference page. Initial scan shows several relevant directions:

## Relevant new/updated areas

- Script module translation APIs.
- Admin view-transition helpers.
- REST/editor additions, including icon-controller related pieces.
- Connector and AI-adjacent APIs.
- Cache-switching fallback behavior.

## Site-specific relevance

### `bertmahoney.com`

Most relevant because it has:

- `AI Provider for Google`
- `Modern Image Formats`
- inactive `Performance Lab`
- inactive `Optimization Detective`

This site looks like the best candidate for experimenting with newer WordPress performance/AI APIs once stable.

### `bert.forsale`

Relevant because it has:

- WooCommerce
- Printful
- PayPal
- Google for WooCommerce
- WP Consent API
- Hostinger AI
- WordPress to Substack publishing

The priority here is commerce/security/stability before API experimentation.

### `berchman.com`

Relevant mostly for editorial/media workflows:

- RSS Aggregator
- YouTube Gallery
- Ko-fi
- Rank Math
- WordPress to Substack inactive

The priority is plugin simplification and performance/security cleanup.

---

# Recommended Next Actions

## Safe, no-content-change actions

1. Update Hermes env to use Werner-specific app-password credentials.
2. Remove inactive plugins that are clearly unused, after backup and explicit approval.
3. Remove inactive themes that are clearly unused, after backup and explicit approval.
4. Add security headers.
5. Resolve Authorization header warning.
6. Review admin users and remove old transfer/admin accounts if no longer needed.

## Needs Bert approval before changes

- Deactivating or deleting plugins/themes.
- Changing maintenance mode on `bert.forsale`.
- Changing any active theme.
- Publishing or drafting posts.
- Changing commerce/payment/fulfillment plugin settings.
- Adjusting automatic-update policies.

## Good first cleanup sequence

1. Confirm backups are working and restore-tested.
2. Switch env credentials to Werner users.
3. Fix obvious text/link issues:
   - `Awarness` typo on `bert.forsale`.
   - malformed `http://https//bert.forsale` link on `berchman.com`.
4. Remove stale inactive plugins/themes, one site at a time.
5. Add headers.
6. Re-run PageSpeed and Site Health.