# Werner WordPress Admin/API Audit — Second Pass
Date: 2026-05-29  
Mode: **read-only WordPress REST/API inventory**. No plugin, theme, user, post, setting, or file changes were made.
## Important access note
- The `hermie@bertmahoney.com` mailbox is configured in Himalaya, but IMAP login currently fails with `AUTHENTICATIONFAILED`.
- Keychain entries for the mailbox exist, so this looks like an invalid/outdated mailbox credential or disabled mailbox login, not a missing local config.
- I therefore could **not** read the emails sent to `hermie@bertmahoney.com`.
- Separately, existing WordPress application-password profiles in the Hermes env are working and have administrator capabilities on all three sites.
- The new **Werner Hermes** admin user exists on all three sites, but I have not confirmed a Werner-specific app password because I could not read the mailbox emails.


## 2026-05-29 access update

Bert updated the Hermes root `.env` with Werner-specific WordPress app-password credentials. Verified via the same loader path used by MyAudio/Werner helpers plus `curl` REST calls:

| Site key | Site | Auth login from env | WordPress user | Role |
|---|---|---|---|---|
| `BERTMAHONEY` | `https://bertmahoney.com` | `Werner Hermes Audit` | `Werner Hermes` | administrator |
| `BERCHMAN` | `https://berchman.com` | `Werner Hermes Audit` | `Werner Hermes` | administrator |
| `BERT_FORSALE` | `https://bert.forsale` | `Werner Hermes Audit` | `Werner Hermes` | administrator |

The helper script now resolves the refreshed root-env credentials instead of stale inherited process variables. No app-password values were printed or saved.


## 2026-05-29 Werner-authenticated inventory refresh

Saved refreshed inventory here:

```txt
/Users/bertmahoney/workspace/_agents/werner-wp-admin-inventory-werner-confirmed.json
```

Counts under Werner-specific credentials:

| Site | Plugins | Themes | Admin users |
|---|---:|---:|---:|
| `berchman.com` | 16 | 5 | 3 |
| `bertmahoney.com` | 17 | 16 | 3 |
| `bert.forsale` | 23 | 2 | 3 |

Inventory deltas from the earlier admin pass:

- `berchman.com`
  - Added: `ai-provider-for-google/plugin`
  - Updated: `advanced-custom-fields/acf` `6.8.1` → `6.8.2`
  - Updated: `wp-rss-aggregator/wp-rss-aggregator` `5.0.12` → `5.1.0`
- `bertmahoney.com`
  - Updated: `media-library-assistant/index` `3.36` → `3.37`
- `bert.forsale`
  - Added: `ai-provider-for-google/plugin`
  - Updated: `backwpup/backwpup` `5.6.9` → `5.6.10`
  - Updated: `classic-editor/classic-editor` `1.6.7` → `1.7.0`
  - Updated: `klaviyo/klaviyo` `3.7.5` → `3.8.0`
  - Updated: `seo-by-rank-math/rank-math` `1.0.270` → `1.0.271.1`
  - Updated: `woocommerce/woocommerce` `10.8.0` → `10.8.1`

## Executive summary
- All three WordPress sites are accessible through authenticated REST using existing admin credentials.
- `Werner Hermes` administrator accounts are visible on all three sites.
- `berchman.com` has moderate plugin/theme sprawl and several inactive items to prune.
- `bertmahoney.com` has the largest inactive theme footprint and several performance/security-related plugins worth rationalizing.
- `bert.forsale` has the largest active ecommerce/plugin surface and one **critical Site Health issue**: background updates are disabled.
- All three sites report the Site Health warning: **Authorization header is invalid**, even though app-password REST calls from this environment work. This should be investigated at Hostinger/server level.

---

# berchman.com
URL: <https://berchman.com>
## Auth / admin confirmation
- Current tested REST auth user: `admin-berchman`
- Tested user roles: `administrator`
- Administrator users visible: **3**
  - `admin-berchman` / Berchman
  - `hellobertmahoney-com` / hostinger transfer
  - `werner-hermes-audit` / Werner Hermes — Werner account

## PageSpeed mobile snapshot
| Category | Score |
|---|---:|
| Performance | 67 |
| Accessibility | 92 |
| Best Practices | 69 |
| SEO | 100 |

## Plugins
- Total plugins visible: **15**
- Active: **12**
- Inactive: **3**

| Status | Plugin | Version | Author |
|---|---|---:|---|
| active | `advanced-custom-fields/acf` — Advanced Custom Fields | 6.8.1 | WP Engine |
| active | `advanced-post-block/plugin` — Advanced Post Block | 2.2.0 | bPlugins |
| active | `automatic-youtube-gallery/automatic-youtube-gallery` — Automatic YouTube Gallery | 2.7.2 | Team Plugins360 |
| active | `backupwordpress/backupwordpress` — BackUpWordPress | 3.14 | XIBO Ltd |
| active | `broken-link-checker/broken-link-checker` — Broken Link Checker | 2.4.8 | WPMU DEV |
| active | `classic-widgets/classic-widgets` — Classic Widgets | 0.3 | WordPress Contributors |
| inactive | `folders/folders` — Folders | 3.1.9 | Premio |
| active | `hostinger/hostinger` — Hostinger Tools | 3.0.66 | Hostinger |
| inactive | `jetpack/jetpack` — Jetpack | 15.8 | Automattic |
| active | `ko-fi-button/Ko_fi` — Ko-fi Button | 1.4.1 | Ko-fi Team |
| active | `quick-pagepost-redirect-plugin/page_post_redirect_plugin` — Quick Page/Post Redirect Plugin | 5.2.4 | anadnet |
| active | `seo-by-rank-math/rank-math` — Rank Math SEO | 1.0.271.1 | Rank Math SEO |
| active | `google-site-kit/google-site-kit` — Site Kit by Google | 1.179.0 | Google |
| inactive | `wp-substack-trunk/wp-substack` — WordPress to Substack publishing | 0.1.1 | WordPress.com Special Projects Team |
| active | `wp-rss-aggregator/wp-rss-aggregator` — WP RSS Aggregator | 5.0.12 | RebelCode |

## Themes
- Total themes visible: **5**
- Active: **1**
- Inactive: **4**

| Status | Stylesheet | Template | Version | Author |
|---|---|---|---:|---|
| inactive | `modern` — Modern | `modern` | 2.6.6 | WebMan Design |
| inactive | `third-try` — SimpleArtDesign | `third-try` | 1.0 | Bert |
| inactive | `twentytwenty` — Twenty Twenty | `twentytwenty` | 3.0 | the WordPress team |
| active | `twentytwentyfive` — Twenty Twenty-Five | `twentytwentyfive` | 1.5 | the WordPress team |
| inactive | `twentytwentytwo` — Twenty Twenty-Two | `twentytwentytwo` | 2.1 | the WordPress team |

## Site Health API checks
| Test | Status | Label |
|---|---|---|
| `background-updates` | good | Background updates are working |
| `loopback-requests` | good | Your site can perform loopback requests |
| `https-status` | good | Your website is using an active HTTPS connection |
| `dotorg-communication` | good | Can communicate with WordPress.org |
| `authorization-header` | recommended | The authorization header is invalid |

## Immediate recommendations
- Review/remove inactive Jetpack, Folders, and WordPress-to-Substack if not needed.
- Investigate whether BackUpWordPress is still the best maintained backup path.
- Fix malformed public link `http://https//bert.forsale`.
- Add baseline security headers.
- Investigate Authorization header Site Health warning.

---

# bertmahoney.com
URL: <https://bertmahoney.com>
## Auth / admin confirmation
- Current tested REST auth user: `berchman`
- Tested user roles: `administrator`
- Administrator users visible: **3**
  - `berchman` / berchman
  - `hostinger` / hostinger transfer
  - `werner-hermes-audit` / Werner Hermes — Werner account

## PageSpeed mobile snapshot
| Category | Score |
|---|---:|
| Performance | 73 |
| Accessibility | 90 |
| Best Practices | 100 |
| SEO | 92 |

## Plugins
- Total plugins visible: **17**
- Active: **13**
- Inactive: **4**

| Status | Plugin | Version | Author |
|---|---|---:|---|
| active | `eps-301-redirects/eps-301-redirects` — 301 Redirects | 2.84 | WebFactory Ltd |
| active | `ai-provider-for-google/plugin` — AI Provider for Google | 1.1.0 | WordPress AI Team |
| active | `backupwordpress/backupwordpress` — BackUpWordPress | 3.14 | XIBO Ltd |
| active | `broken-link-checker/broken-link-checker` — Broken Link Checker | 2.4.8 | WPMU DEV |
| inactive | `contact-form-7/wp-contact-form-7` — Contact Form 7 | 6.1.6 | Rock Lobster Inc. |
| active | `duplicate-page/duplicatepage` — Duplicate Page | 4.5.9 | mndpsingh287 |
| active | `email-encoder-bundle/email-encoder-bundle` — Email Encoder - Protect Email Addresses | 2.5.0 | Online Optimisation |
| active | `hostinger/hostinger` — Hostinger Tools | 3.0.66 | Hostinger |
| active | `litespeed-cache/litespeed-cache` — LiteSpeed Cache | 7.8.1 | LiteSpeed Technologies |
| active | `media-library-assistant/index` — Media Library Assistant | 3.36 | David Lingren |
| active | `webp-uploads/load` — Modern Image Formats | 2.6.1 | WordPress Performance Team |
| inactive | `optimization-detective/load` — Optimization Detective | 1.0.0-beta5 | WordPress Performance Team |
| inactive | `performance-lab/load` — Performance Lab | 4.1.0 | WordPress Performance Team |
| active | `google-site-kit/google-site-kit` — Site Kit by Google | 1.179.0 | Google |
| inactive | `404page/404page` — Smart Custom 404 Error Page | 11.4.8 | NerdPress |
| active | `wps-hide-login/wps-hide-login` — WPS Hide Login | 1.9.18 | WPServeur, NicolasKulka, wpformation |
| active | `wp-svg-images/wp-svg-images` — WP SVG Images | 4.5 | ShortPixel |

## Themes
- Total themes visible: **16**
- Active: **1**
- Inactive: **15**

| Status | Stylesheet | Template | Version | Author |
|---|---|---|---:|---|
| inactive | `abhavana` — Abhavana | `abhavana` | 1.0.0 | wpkoithemes |
| inactive | `abisko` — Abisko | `abisko` | 1.0.6 | Anders Norén |
| inactive | `emoza-woocommerce` — Emoza WooCommerce | `emoza-woocommerce` | 1.1.4 | emoza |
| inactive | `eryndo` — Eryndo | `eryndo` | 1.1.4 | bdthemes |
| inactive | `kenta-flow` — Kenta Flow | `kenta` | 1.0.2 | WP Moose |
| inactive | `kenta` — Kenta | `kenta` | 1.4.11 | WP Moose |
| active | `lei` — Lei | `lei` | 1.0.0 | Roman Fink |
| inactive | `michelle` — Michelle | `michelle` | 1.5.12 | WebMan Design |
| inactive | `nanospace` — NanoSpace | `nanospace` | 1.2.7 | Labinator |
| inactive | `paramatma` — Paramatma | `paramatma` | 1.0.0 | wpkoithemes |
| inactive | `plover` — Plover | `plover` | 1.4.4 | WP Plover |
| inactive | `pulse-folio` — Pulse Folio | `plover` | 1.0.3 | WP Plover |
| inactive | `spiekermann` — Spiekermann | `spiekermann` | 1.0.0 | Anders Norén |
| inactive | `storefront` — Storefront | `storefront` | 4.6.2 | Automattic |
| inactive | `twentytwentyfive` — Twenty Twenty-Five | `twentytwentyfive` | 1.5 | the WordPress team |
| inactive | `twentytwentytwo` — Twenty Twenty-Two | `twentytwentytwo` | 2.1 | the WordPress team |

## Site Health API checks
| Test | Status | Label |
|---|---|---|
| `background-updates` | good | Background updates are working |
| `loopback-requests` | good | Your site can perform loopback requests |
| `https-status` | good | Your website is using an active HTTPS connection |
| `dotorg-communication` | good | Can communicate with WordPress.org |
| `authorization-header` | recommended | The authorization header is invalid |

## Immediate recommendations
- Prune inactive themes aggressively; 15 inactive themes is unnecessary surface area.
- Review inactive performance plugins before deleting: Optimization Detective and Performance Lab may be useful, but inactive plugins should not linger.
- Review Contact Form 7 / 404page if inactive and no longer needed.
- Add baseline security headers and hide PHP powered-by header if possible.
- Investigate Authorization header Site Health warning.

---

# bert.forsale
URL: <https://bert.forsale>
## Auth / admin confirmation
- Current tested REST auth user: `bert.mahoney@gmail.com`
- Tested user roles: `administrator`
- Administrator users visible: **3**
  - `bert-mahoneygmail-com` / Bert
  - `bertdotforsale` / BertDot ForSale
  - `werner-hermes-audit` / Werner Hermes — Werner account

## PageSpeed mobile snapshot
| Category | Score |
|---|---:|
| Performance | 93 |
| Accessibility | 85 |
| Best Practices | 100 |
| SEO | 82 |

## Plugins
- Total plugins visible: **22**
- Active: **16**
- Inactive: **6**

| Status | Plugin | Version | Author |
|---|---|---:|---|
| active | `akismet/akismet` — Akismet Anti-spam: Spam Protection | 5.7 | Automattic - Anti-spam Team |
| active | `backwpup/backwpup` — BackWPup | 5.6.9 | BackWPup – WordPress Backup & Restore Plugin |
| inactive | `classic-editor/classic-editor` — Classic Editor | 1.6.7 | WordPress Contributors |
| active | `google-listings-and-ads/google-listings-and-ads` — Google for WooCommerce | 3.7.0 | WooCommerce |
| active | `hostinger-ai-assistant/hostinger-ai-assistant` — Hostinger AI | 3.0.39 | Hostinger |
| inactive | `hostinger/hostinger` — Hostinger Tools | 3.0.66 | Hostinger |
| active | `jetpack/jetpack` — Jetpack | 15.8 | Automattic |
| inactive | `klaviyo/klaviyo` — Klaviyo | 3.7.5 | Klaviyo, Inc. |
| inactive | `litespeed-cache/litespeed-cache` — LiteSpeed Cache | 7.8.1 | LiteSpeed Technologies |
| active | `jf3-maintenance-mode/wpjf3_maintenance_redirect` — Maintenance Redirect | 2.2.1 | Peter Hardy-vanDoorn |
| active | `media-library-assistant/index` — Media Library Assistant | 3.37 | David Lingren |
| inactive | `pinterest-for-woocommerce/pinterest-for-woocommerce` — Pinterest for WooCommerce | 1.4.26 | WooCommerce |
| active | `printful-shipping-for-woocommerce/printful-shipping` — Printful Integration for WooCommerce | 2.2.12 | Printful |
| inactive | `quick-featured-images/quick-featured-images` — Quick Featured Images | 13.7.5 | Kybernetik Services |
| active | `seo-by-rank-math/rank-math` — Rank Math SEO | 1.0.270 | Rank Math SEO |
| active | `simple-social-icons/simple-social-icons` — Simple Social Icons | 4.0.0 | OsomPress |
| active | `google-site-kit/google-site-kit` — Site Kit by Google | 1.179.0 | Google |
| active | `woocommerce/woocommerce` — WooCommerce | 10.8.0 | Automattic |
| active | `woo-update-manager/woo-update-manager` — WooCommerce.com Update Manager | 1.0.3 | Automattic |
| active | `woocommerce-paypal-payments/woocommerce-paypal-payments` — WooCommerce PayPal Payments | 4.0.4 | PayPal |
| active | `wp-substack-trunk/wp-substack` — WordPress to Substack publishing | 0.1.1 | WordPress.com Special Projects Team |
| active | `wp-consent-api/wp-consent-api` — WP Consent API | 2.0.1 | WordPress Contributors |

## Themes
- Total themes visible: **2**
- Active: **1**
- Inactive: **1**

| Status | Stylesheet | Template | Version | Author |
|---|---|---|---:|---|
| inactive | `kiosko-theme` — Kiosko | `kiosko-theme` | 1.0.0 | Automattic |
| active | `storefront` — Storefront | `storefront` | 4.6.2 | Automattic |

## Site Health API checks
| Test | Status | Label |
|---|---|---|
| `background-updates` | critical | Background updates are not working as expected |
| `loopback-requests` | good | Your site can perform loopback requests |
| `https-status` | good | Your website is using an active HTTPS connection |
| `dotorg-communication` | good | Can communicate with WordPress.org |
| `authorization-header` | recommended | The authorization header is invalid |

## Immediate recommendations
- Fix critical background-updates issue: automatic updates are disabled.
- Review ecommerce plugin stack before launch: WooCommerce, PayPal, Google, Pinterest, Printful, Jetpack, Klaviyo, Consent API.
- Prune inactive plugins: Classic Editor, Hostinger Tools, Klaviyo if unused, LiteSpeed Cache if not used, Pinterest if not used, Quick Featured Images if not used.
- Confirm maintenance mode/redirect behavior before public launch.
- Investigate Authorization header Site Health warning.

---

# Next steps

1. Fix `hermie@bertmahoney.com` IMAP auth if you want Hermes to read WordPress account emails directly.
2. Generate or provide Werner-specific app passwords for the visible `Werner Hermes` admin users if you want the env switched away from the older admin profiles.
3. Decide whether Werner should create remediation tickets/files for each site before any changes are made.
4. Prioritize `bert.forsale` background updates and plugin-stack review before a public ecommerce launch.