# Werner WordPress Public Audit — Initial Report

Date: 2026-05-28  
Scope: `berchman.com`, `bertmahoney.com`, `bert.forsale`  
Mode: **public/read-only audit only** — no admin dashboard access used, no site changes made.

---

## Executive Summary

All three sites are reachable over HTTPS and appear hosted through Hostinger/hPanel. The public-facing audit found:

- `berchman.com` has the most visible WordPress/plugin surface and the most immediate cleanup opportunities.
- `bertmahoney.com` is cleaner and currently stronger on Best Practices, but still lacks several common security headers.
- `bert.forsale` is currently a lightweight static-looking placeholder page with the smallest public attack surface.

A full WordPress **Site Health**, exact plugin inventory, theme inventory, update status, and admin-side security posture still require dashboard/API access via dedicated Werner accounts.

---

## Access Recommendation

For each WordPress site, create a dedicated account with Werner in the username, for example:

- `werner-berchman`
- `werner-bertmahoney`
- `werner-berforsale`

Recommended setup:

1. Create a dedicated WordPress user per site.
2. Use the minimum role that permits the needed audit.
   - For full plugin/theme/site-health audit: likely **Administrator**.
   - For content-only validation: **Editor** is enough.
3. Generate a WordPress **Application Password** for that Werner account.
4. Store the values in the Hermes root env using the existing site-key pattern:
   - `BERCHMAN_WP_URL`
   - `BERCHMAN_WP_USER`
   - `BERCHMAN_WP_APP_PASSWORD`
   - `BERTMAHONEY_WP_URL`
   - `BERTMAHONEY_WP_USER`
   - `BERTMAHONEY_WP_APP_PASSWORD`
   - `BERT_FORSALE_WP_URL`
   - `BERT_FORSALE_WP_USER`
   - `BERT_FORSALE_WP_APP_PASSWORD`

Do **not** share or reuse your primary admin password for agent access.

---

# Site 1: Berchman

URL: <https://berchman.com>

## Public status

- HTTP status: `200`
- Platform headers indicate: Hostinger / hPanel
- Public WordPress REST endpoint available: `/wp-json/`
- SEO markup visible from Rank Math

## Public title / positioning

Detected homepage title:

> Bert Mahoney. Artist, Designer + Mental Health Advocate — Blog — Bert.

Detected description:

> Artist + Mental Health Advocate using visual expression. Sharing my life journey of depression—in hopes it may be someone else's survival guide.

## Publicly visible plugin clues

Visible from homepage asset URLs:

- `automatic-youtube-gallery`
- `wp-rss-aggregator`
- Rank Math SEO is visible in markup, though not through a `wp-content/plugins/` asset URL in the sampled homepage assets.

## Public theme clues

No definitive theme slug was visible from homepage `wp-content/themes/...` asset URLs in the public sample.

## PageSpeed Insights — mobile

Captured through PageSpeed web UI.

| Category | Score |
|---|---:|
| Performance | 67 |
| Accessibility | 92 |
| Best Practices | 69 |
| SEO | 100 |

Visible mobile metrics included:

- First Contentful Paint: `1.5s`
- Largest Contentful Paint: `3.8s`
- Total Blocking Time: `940ms`
- Cumulative Layout Shift: `0.004`
- Speed Index: `2.3s`

## Public security posture

Visible issues / opportunities:

- Missing or not publicly visible:
  - `Strict-Transport-Security`
  - `X-Frame-Options`
  - `X-Content-Type-Options`
  - `Referrer-Policy`
  - `Permissions-Policy`
- One malformed/insecure homepage link found:
  - `http://https//bert.forsale`
- Homepage structured data appears to expose contact-style data. This may be intentional, but should be reviewed.
- Public plugin surface is larger than the other two sites.

## Recommended next actions

1. Fix malformed `bert.forsale` link.
2. Review whether both `automatic-youtube-gallery` and `wp-rss-aggregator` are still needed.
3. Add baseline security headers via server config or a lightweight security/header plugin.
4. Review structured data for any contact info that should not be public.
5. Investigate render-blocking requests and front-end plugin weight.
6. After Werner admin access is available, check:
   - exact plugin list and versions
   - inactive plugins
   - theme and child-theme status
   - WordPress core version
   - update status
   - Site Health screen
   - user accounts and admin count

---

# Site 2: Bert Mahoney

URL: <https://bertmahoney.com>

## Public status

- HTTP status: `200`
- Platform headers indicate: Hostinger / hPanel
- Server header observed on one pass: LiteSpeed
- Public WordPress REST endpoint available: `/wp-json/`

## Public title / positioning

Detected homepage title:

> Bert Mahoney – AI Systems Architect & Hands-On Designer

No homepage meta description was detected in the sampled public markup.

## Publicly visible plugin clues

Visible from homepage asset URLs:

- `email-encoder-bundle`

## Public theme clues

Visible theme slug:

- `lei`

## PageSpeed Insights — mobile

Captured through PageSpeed web UI.

| Category | Score |
|---|---:|
| Performance | 73 |
| Accessibility | 90 |
| Best Practices | 100 |
| SEO | 92 |

## Public security posture

Visible issues / opportunities:

- Missing or not publicly visible:
  - `Strict-Transport-Security`
  - `X-Frame-Options`
  - `X-Content-Type-Options`
  - `Referrer-Policy`
  - `Permissions-Policy`
- `Content-Security-Policy: upgrade-insecure-requests` was visible.
- `X-Powered-By: PHP/8.3.30` was visible on one header pass. Consider hiding this header if possible.
- Homepage meta description appears absent or empty.

## Recommended next actions

1. Add/confirm a focused homepage meta description.
2. Add baseline security headers.
3. Consider hiding `X-Powered-By`.
4. Verify `email-encoder-bundle` is current and still needed.
5. After Werner admin access is available, check:
   - exact plugin list and versions
   - inactive plugins
   - `lei` theme status and update path
   - WordPress core version
   - Site Health screen
   - admin user list

---

# Site 3: Bert.forsale

URL: <https://bert.forsale>

## Public status

- HTTP status: `200`
- Platform headers indicate: Hostinger / hPanel
- Homepage appears to be a static “Back Shortly” page.
- Public WordPress REST endpoint responded at `/wp-json/`, so WordPress appears present behind the site even though the homepage itself exposes no normal WP theme/plugin assets.

## Public title / positioning

Detected homepage title:

> bert.forsale — Back Shortly

No homepage meta description was detected in the sampled public markup.

## Publicly visible plugin clues

None found from homepage asset URLs.

## Public theme clues

None found from homepage asset URLs.

## PageSpeed Insights — mobile

Captured through PageSpeed web UI.

| Category | Score |
|---|---:|
| Performance | 93 |
| Accessibility | 85 |
| Best Practices | 100 |
| SEO | 82 |

## Public security posture

Visible issues / opportunities:

- Smallest public attack surface of the three sites.
- Missing or not publicly visible:
  - `Strict-Transport-Security`
  - `X-Frame-Options`
  - `X-Content-Type-Options`
  - `Referrer-Policy`
  - `Permissions-Policy`
- Placeholder page has limited SEO metadata.
- If this is intentionally temporary, that is acceptable. If it becomes a real public site, it needs a second full pass after launch.

## Recommended next actions

1. Add baseline security headers.
2. If the placeholder will remain public for a while, add a minimal meta description.
3. After Werner admin access is available, confirm why `/wp-json/` exposes WordPress while the homepage appears static.
4. Check full plugin/theme inventory inside admin.

---

# Cross-Site Security Recommendations

These are low-drama, mostly open-source / standard WordPress hardening steps:

## Headers

Add or verify these headers where compatible:

```txt
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
```

Be careful with a full Content Security Policy on WordPress sites because plugins/themes often load scripts/styles dynamically. Start with reporting or conservative directives.

## Accounts

- Use dedicated Werner accounts.
- Keep Bert’s primary admin account separate.
- Remove unused admin users.
- Ensure all admin users have 2FA where possible.

## Plugins

- Remove inactive plugins.
- Remove duplicate functionality.
- Keep only plugins with active maintenance.
- Prefer fewer, well-maintained plugins over stacked utility plugins.

## Backups

- Confirm automated backups exist.
- Confirm restore has been tested, not just backup creation.

## Updates

- Confirm WordPress core update status.
- Confirm theme and plugin update status.
- Note any plugins blocking core update compatibility.

## Monitoring

Open-source/self-hostable options Werner can consider:

- **WP-CLI** for plugin/theme/core inventory and update checks.
- **Lighthouse CLI** for repeatable PageSpeed-style local performance runs.
- **Security Headers** checks or equivalent curl-based header scanner.
- **Wazuh / Uptime Kuma / Healthchecks** for broader monitoring if desired.
- **Wordfence / Solid Security / NinjaFirewall** if a WordPress-native security plugin is preferred. These are not all purely open-source in every tier, so Werner should distinguish free/open-source vs paid features.

---

# WordPress 7 Opportunity Scan

Bert noted that WordPress 7 has several pages of new API functions/methods. Initial review of the WordPress 7.0.0 reference page shows potentially relevant areas:

## Areas to watch

- Script modules and script-module translations.
- View transition CSS for admin.
- REST/editor additions such as icon endpoints.
- Connector and AI-adjacent APIs.
- Cache switching fallback behavior for multisite/object-cache cases.

## How this could help these sites

### Publishing automation

The script-module and REST changes may help future admin/editor tooling, especially if Werner or MyAudio eventually adds richer WordPress-side helpers.

### Plugin/theme compatibility

Werner should check whether installed plugins/themes are compatible with WP 7 and whether any are lagging on newer APIs.

### AI / connector possibilities

The connector-related APIs may matter if WordPress begins exposing more native AI or external-service configuration surfaces. Werner should review this cautiously before building against it, because it may be evolving.

### Admin UX

View transitions and admin-side script improvements could eventually help custom admin tools, but they are not urgent for the immediate audit.

---

# What Requires Werner Admin Access Next

Once the dedicated Werner users are created, run a second-pass admin/API audit for each site:

## Inventory

- WordPress core version
- PHP version
- Active theme
- Parent/child theme relationship
- Active plugins
- Inactive plugins
- Must-use plugins
- Drop-ins
- Available updates

## Health

- Site Health status
- Critical issues
- Recommended improvements
- REST API status
- loopback request status
- scheduled events / cron status

## Security

- Admin user count
- Old/unused accounts
- 2FA status if available
- application password inventory
- file editing enabled/disabled
- XML-RPC exposure
- REST exposure
- public author enumeration
- backup status

## Publishing readiness

- Confirm app-password publishing works for draft posts only.
- Confirm `MyAudio-2-RawTxt` can create a private or draft test post on the correct site.
- Confirm no accidental public publishing.

---

# Immediate Open Items

1. Bert to create dedicated Werner users for each site.
2. Bert to generate app passwords for those users.
3. Store/update site credentials in the Hermes env using the existing site-key variables.
4. Werner to run admin/API inventory after credentials are available.
5. Werner to prepare site-specific remediation tickets once admin data confirms the public findings.