| Software | Plan | Cost | Status |
|---|---|---|---|
| Elementor Pro | Advanced Solo (1 site) | $84/yr | ✓ Purchased — BOSSTORQUE |
| Wordfence | Premium | $149/yr | ⚠ Approval Required |
| WP Staging Pro | Business (3 sites) | ~$152/yr | ⚠ Approval Required |
| Pending Approval Total | ~$301/yr | Billed annually to your card. All prices in USD. | |
sperrytreecare.com is a functioning site with a sound technical baseline — HTTPS is active, both admin accounts use 2FA, and the database is current. At time of audit, the most serious issue was a nulled (pirated) Elementor plugin operating as the site's page builder: a known malware vector with no security updates. That issue has been resolved — licensed Elementor Pro 4.0.0 is now active and the nulled plugin has been permanently deleted.
The remaining high-priority items are: PHP 8.1 is still serving the site despite PHP 8.3 being installed on the server (a configuration change, not an upgrade); Wordfence is running on the free tier with a 30-day delay on threat intelligence; and a WordPress error-disclosure flag is live on production. Three medium items — plugin bloat, a reCAPTCHA conflict, and no automated site backups — are addressed by the WS1A staging and cleanup work already underway.
Two software approvals are pending before staging work can begin: Wordfence Premium ($149/yr) and WP Staging Pro (~$152/yr). Elementor Pro ($84/yr) has already been purchased and is live. The WS1A roadmap below sequences all remaining work through April 10.
define('WP_DEBUG_DISPLAY', false); to wp-config.php. One-line fix, no compatibility risk.
define('WP_MEMORY_LIMIT', '256M'); — raises the ceiling to match the PHP limit. No compatibility risk.
| Component | Current Value |
|---|---|
| WordPress Version | 6.9.4 |
| PHP Version | 8.1.2 active / 8.3 installed FPM Config Update Needed |
| Web Server | nginx 1.18.0 |
| Database | MariaDB 10.6.23 Supported |
| Active Theme | GeneratePress 3.6.0 (3.6.1 available) |
| Active Plugins | 29 Bloated |
| Inactive Themes | 8 Remove |
| HTTPS | Yes Good |
| WP_DEBUG | Disabled Good |
| WP_DEBUG_DISPLAY | Enabled Fix Required |
| WP Memory Limit | 40MB Too Low |
| PHP Memory Limit | 256MB Good |
| Upload Max File Size | 2MB Too Low |
| WP Cache | Disabled Consider Caching |
| Admin Accounts | 2 (BT_admin + sperryadmin/Creative Pollen) |
| 2FA Status | Active on both accounts Good |
| Total Installation Size | 697 MB |
| Hosting | Self-hosted, physical server, Eugene OR |
| Server OS | Linux 5.15.0 x86_64 |
| Component | Current Setup | Cloud Migration Path |
|---|---|---|
| Web hosting | Self-managed Linux server, Eugene OR (nginx 1.18.0) | Managed cloud hosting (WP Engine, Kinsta, or equivalent) — Q3 site rebuild |
| PHP version | 8.3 installed on server (Feb 2026); PHP-FPM pool for this site still points to 8.1.2 — config update pending | Near-term: update PHP-FPM config to use 8.3 pool. Long-term: resolved automatically on cloud hosting |
| File upload limit | 2MB (server php.ini / nginx config) | Resolved automatically — standard cloud plans include configurable limits |
| DNS management | Managed at server level; registrar nameservers point to server | Transfer to Cloudflare — BOSSTORQUE manages directly (see below) |
| Email server | Self-hosted SOGO webmail + RoundCube (open source groupware); Dovecot IMAP; ActiveSync for mobile/Outlook; free Let's Encrypt SSL renewed manually every 3 months | Google Workspace — recommended Phase 2 (see below) |
| File/collaboration | Server-based (scope TBD) | Google Workspace Drive — recommended Phase 2 |
| SSL certificates | Free Let's Encrypt, manually renewed every 3 months | Auto-renewing SSL included standard with cloud hosting |
Sperry's DNS is currently managed at the server level, which means any DNS change — email authentication records (SPF/DKIM/DMARC), domain verification, URL redirects, new subdomains — requires coordinating through IT. That's a bottleneck for routine marketing and security work that should be self-service.
The standard approach for any professionally managed site is to move DNS to Cloudflare, which provides a web-based control panel where Sperry and BOSSTORQUE both have direct access — independent of any hosting arrangement. Cloudflare DNS is free, significantly faster than self-hosted DNS, and adds DDoS protection at no cost. Once nameservers are updated at the domain registrar (a one-time change), BOSSTORQUE can manage all DNS records directly going forward.
Once the website is on cloud hosting and the web server dependency is retired, the self-managed email server (SOGO/Dovecot) and file storage become the remaining items still running on the physical server. We recommend migrating to Google Workspace in Phase 2: professional email at sperrytreecare.com, shared Drive storage, Calendar, and Meet — replacing SOGO webmail, RoundCube, and server-based file storage in a single move. Typical cost is $12–18/user/month. BOSSTORQUE will prepare a full scope and cost analysis when the timing is right — no action needed now.
Sperry's website currently runs on a self-managed physical server in Eugene, OR. When the server was recently rebuilt, PHP was not updated — it remains at version 8.1.2, which reached full end-of-life on December 31, 2025 (active support had ended November 25, 2023). This means no security patches are available for any PHP vulnerability discovered after that date. On a managed cloud hosting platform, PHP version management is handled by the provider automatically — this gap simply doesn't exist.
Server-level backups (full machine images) are currently the only backup in place. These are valuable for physical server recovery, but they are not WordPress site backups — they don't allow rolling back to a specific version of the site without taking the entire server offline. WP Staging Pro bridges that gap now. On cloud hosting, automated site-level backups are a standard included feature.
In the Q2 strategy meeting on March 25, 2026, Rob stated directly: "The servers are going to be gone. It's not a matter of if, it's a matter of when. The website's going to be on the cloud — that's not a big deal." That alignment is already in place. The WS1A work protects the site through this transition and positions the Q3 rebuild to land cleanly on cloud infrastructure when the time comes.
Scope clarification: moving sperrytreecare.com to cloud hosting does not require changing the physical server, office file storage, or the existing IT relationship. The server continues handling everything it handles today. The website is simply removed from that responsibility — it gets its own dedicated, professionally managed web infrastructure. The PHP issue and the backup gap are both solved at the hosting layer without touching anything else on the server.
Most of the WS1A work is done entirely through WordPress admin — no server access needed. Two items are different: they require changes to server configuration files. These can't be made through WordPress and will need to be coordinated with whoever manages the server.
/etc/php/8.3/fpm/pool.d/sperrytreecare.conf) followed by an nginx reload. No PHP installation needed — it's already there.php.ini has upload_max_filesize = 2M and post_max_size = 8M. Recommend increasing both to 32M and 64M respectively. Two line changes + PHP-FPM restart. Note: this resolves automatically when the site moves to cloud hosting in Q3.| # | Action | Where | Risk | Owner |
|---|---|---|---|---|
| 1 ✓ | DONE (Apr 1) — Activated licensed Elementor Pro Advanced Solo ($84/yr) on the live site — replaced PRO Elements cleanly with no page disruption | Live site | None | BOSSTORQUE |
| 2 | Manual UpdraftPlus backup → save to Google Drive | Live site | None | BOSSTORQUE |
| 3 | Install WP Staging Pro, create full staging clone at password-protected subdirectory | Live site (plugin) | Very low | BOSSTORQUE |
| 4 ✓ | DONE (Apr 1) — Deactivated and deleted PRO Elements on live site; confirmed Elementor Pro (licensed) renders all pages correctly | Live site | None | BOSSTORQUE |
| 5 | On staging: Audit which Elementor addons are in active use; remove unused plugins | Staging only | None | BOSSTORQUE |
| 6 | On staging: Fix wp-config.php — WP_DEBUG_DISPLAY off, WP_MEMORY_LIMIT 256M | Staging only | None | BOSSTORQUE |
| 7 | On staging: Upgrade Wordfence to Premium, run full malware scan, configure firewall + login hardening | Staging only | None | BOSSTORQUE |
| 8 | On staging: Test Elementor 4.0.0 update with surviving addons — verify all pages render correctly | Staging only | Low (staging) | BOSSTORQUE |
| 9 | Full staging QA — all pages, forms, and Elementor-built layouts | Staging only | None | BOSSTORQUE |
| 10 | Push confirmed staging changes to live site | Live site | Low — backup exists | BOSSTORQUE |
| 11 | Post-push UpdraftPlus backup → Google Drive | Live site | None | BOSSTORQUE |
| 12 | Review sperryadmin (Creative Pollen) account with Rob & Michele — revoke or downgrade | WP Admin | None | Rob / Michele |
| 13 | Configure automated weekly backup schedule in UpdraftPlus | Live site | None | BOSSTORQUE |
| 14 | Verify GA4 tracking and install Meta Pixel + estimate request conversion events | Live site | Low | BOSSTORQUE |
| 15 | Initiate DNS transfer to Cloudflare — set up Cloudflare account, document and import all existing DNS records, coordinate nameserver cutover for zero-downtime transition; configure SPF/DKIM/DMARC email authentication records | Cloudflare / Registrar | Low — fully reversible | BOSSTORQUE |
| 16 | Switch PHP-FPM pool for sperrytreecare.com to PHP 8.3 interpreter — PHP 8.3 already installed on server; requires updating pool config file + nginx reload. BOSSTORQUE will provide exact file path and config values. | Server config | Very low | Contract IT |
| 17 | Increase upload file size limit — update upload_max_filesize to 32M and post_max_size to 64M in server php.ini. Two line changes + PHP-FPM restart. Resolves automatically at Q3 cloud migration. | Server config | Very low | Contract IT |
| Item | Status |
|---|---|
| GA4 tracking tag | Not yet verified. Will check WPCode snippets and page source. |
| Meta Pixel | Not yet installed per audit. WS1A deliverable. |
| Estimate request conversion events | Pending GA4 and Pixel being live. |
| Security response headers | External check completed. Full HSTS/CSP review pending Wordfence Premium config. |
| Creative Pollen relationship status | Needs confirmation from Rob or Michele before action on sperryadmin account. |
| Elementor Pro features in use | Resolved Apr 1, 2026 — Clean swap completed on live site. PRO Elements deleted, Elementor Pro 4.0.0 licensed and active. All pages confirmed rendering correctly. |