Security, performance and site health

This one is not a single site. It is the security, performance and site health work I have done on client WordPress sites since 2022: Wordfence on nine rebuilds, a Content-Security-Policy at the Cloudflare edge, speed work such as taking a store’s mobile PageSpeed score from 47 into the 90s, GA4 and Tag Manager tracking, and the 404s, redirects and 500s that come with running live sites.

All projects

Where Perfect Afternoon clients, and SJD Taxi
Years 2022–2026
Platform WordPress · Cloudflare
Stack Security · Performance · Analytics · Cloudflare

A drawing of a response header check: content-security-policy, strict-transport-security, x-content-type-options, referrer-policy and x-frame-options marked set, and permissions-policy marked missing

A drawing of a header check, not a record from a particular site. The header I added myself was the Content-Security-Policy.

Security and upkeep

Keeping sites secure and working

Six jobs on client sites, in five kinds of work: security, consent, debugging, privacy and search plugins. The clients are not named for this work, because it describes their security setup. The performance and analytics work further down does name them.

01 · Security

Wordfence on nine rebuilds

From November 2022 to March 2026 I installed or configured Wordfence on nine client rebuilds, including premium licenses and firewall optimization.

02 · Security

A Content-Security-Policy at Cloudflare

For one client I wrote a Content-Security-Policy, from default-src through frame-ancestors, object-src 'none' and upgrade-insecure-requests, and deployed it as a Cloudflare response header rule on every request. The next Screaming Frog crawl no longer flagged the missing header.

03 · Consent

Cookie consent

I set up CookieYes on two client rebuilds. On one I connected the plugin to the client’s own CookieYes account instead of hard-coding the banner script, and checked the page language setting the banner reads. On a third site I styled the existing banner, adding custom CSS for hover effects on its buttons.

04 · Debugging

Console errors on seven sites

From 2025 to 2026 I traced browser console errors to their cause on seven client sites, several of which I had flagged in monthly audits. The causes ranged from prefetch requests for uncached pages and a firewall false positive on a form, to a product search still pointing at deleted categories and a bug in a form plugin’s own code.

05 · Privacy

Email addresses off a site

At a client’s request I removed every public email address and mailto link from their site, confirmed with a Screaming Frog custom search that no mailto links were left, and recommended Cloudflare’s email obfuscation.

06 · Search

Yoast SEO installs

I installed Yoast SEO, Yoast SEO Premium and Yoast WooCommerce SEO on client rebuilds as part of their plugin setup, and on one of them added the site to the client’s MyYoast account.

Debugging

What the console errors turned out to be

A run of 503 errors from speculative prefetch requests for pages that were not in Cloudflare’s cache. I went through the cache and speculation rules and the caching plugins’ preloading, and turning preloading off cleared them.
A blocked form submission, caused by a web application firewall false positive. A narrowly scoped rule exception lets the form through.
A form error when visitors used autofill, fixed by wrapping the jQuery function behind it so it skips hidden fields.
A homepage product search still referring to two categories removed in an earlier restructure. Removing those references cleared the errors.
An error that stopped a product page widget from rendering. I scoped a fix, and when the client chose to drop the widget instead, I removed its script and styles.
A form plugin error that I traced to the plugin’s own source code, after ruling out conflicts, minification and caching, and worked around so the contact form submits cleanly.
Autofill errors on a contact page, cleared by excluding that page from page caching.

Performance

Making sites faster

MJS Packaging, 2026. I wrote a site performance plan with recommendations and technical SEO notes, then did the first round of work. On production, mobile PageSpeed went from 47 to 91 and 93 (two runs) for Performance, 82 to 100 for Accessibility, 73 to 100 for Best Practices and 92 to 100 for SEO.
A stock importer, 2026. A client’s stock imports took about 2.7 seconds per product. I ruled out the usual suspects (the Action Scheduler, loopback requests, the importer’s version, fatal errors) and found that every one of 500+ rows ran a full WooCommerce product save to change two stock fields. After the fixes, the client reported that a full run of the Stock Importer I built for their admin took about a second.
A banner video, 2023. On a client’s site a banner video was rendered once for every slide. Rendering it once behind all of them was a change I estimated would cut about 28% of the page’s weight, and I recommended Cloudflare settings to go with it: Brotli, Early Hints, HTTP/2 and HTTP/3, 0-RTT and Smart Tiered Cache.
A CDN, 2024. On another client’s site I got the Easy IO CDN working properly and optimized the video and images by hand, with GTmetrix reports before and after.

Search and analytics

Tracking, crawling and status codes

GA4 and Tag Manager. PDF view tracking on one client’s site, GA4 tags through Tag Manager for two more, Cottage Inn’s contact-form submissions registering as GA4 events after I fixed the form script, and WooCommerce ecommerce events (view_item, begin_checkout and purchase) carried into another client’s rebuilt theme.
Ad click attribution. For SJD Taxi in 2024 I built attribution on the old site, so each booking recorded the ad click it came from and its referrer.
Screaming Frog and Search Console. On MJS Packaging I traced all 377 links to 115 images, fixed the alt text on every one, and the next crawl came back clean. On another client’s site a Search Console validation cleared its mobile usability issues.
Keeping staging out of Google. I built a small crawler that checks robots.txt and indexing across a list of sites, and used it to keep the agency’s staging and development sites out of search results.
Status codes. 404s and redirect chains, and 500s traced to their cause. On SJD Taxi, for example, I collapsed 24 multi-hop redirect chains so each redirect takes a single hop.