Project Dashboard

Status

Live Site Security Assessment

Passive reconnaissance of sarahcann.com — 9 April 2026. No exploitation attempted. Full details in the recon and recommendations documents.

Critical — Fix Before Engagement

• WP REST API user enumeration — Admin username lcmosley (ID 1) exposed at /wp-json/wp/v2/users. First step in credential brute-force. Fix: block the endpoint or disable REST API.
• Zero security headers — No HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy. The hub already has all of these. Fix: add Cloudflare Transform Rules mirroring the hub's _headers file.
• Directory listing enabled — wp-content/uploads/, /plugins/, /themes/, /backup/, /backups/ all browseable. Fix: Options -Indexes in .htaccess.
• WordPress version disclosure — WP 6.9.4 leaked via ?ver=6.9.4 on dashicons CSS. Fix: remove_action('wp_head', 'wp_generator') and dequeue version strings.
• Dual DMARC record — Conflicting DMARC policies can cause delivery failures. Fix: remove duplicate, set p=reject with rua reporting.

High Priority — During Engagement

• SimpleBot vs "AI Bots" service — The live site lists "AI Bots" as a service, but the deployed chatbot (SimpleBot botId 55113) is a mid-tier system with curated knowledge base and guardrails. Opportunity: replace with a proper LLM-powered assistant that understands Sarah's methodology.
• CTA fragmentation — Some links go to Kartra, some to Typeform quiz, some to internal pages. No single primary action. Fix: consolidate all CTAs to one primary action (free strategy session or diagnostic).
• Inconsistent messaging — Homepage says "local market" and "community-centric" but about page positions Sarah as a premium B2B consultancy with institutional clients. Two conflicting narratives.
• BREACH vulnerability — Content-Encoding set to deflate on responses with user data. Fix: add Content-Encoding: identity or random padding.
• CORS wildcard on favicon — Access-Control-Allow-Origin: * on favicon.ico. Fix: remove the wildcard header.
• .htpasswd accessible — Available at web root. Fix: remove from web root, add to deny list.

Strategic — Migration Sprint

• Divi bloat & accessibility — The Boardroom Journal static site (this hub) eliminates page builder overhead, WordPress attack surface, and accessibility gaps. Est. 3–5× LCP improvement.
• Missing case studies — Tourism Tasmania, Tennis Australia, and QUT deserve quantified results pages. The hub already has the content; migration makes this natural.
• No content strategy — The live site has no blog or insights section. The migration is the opportunity to build one with SEO-optimised thought leadership.

Hub vs Live Site

Next Steps

1. Harden the live site Block WP REST API user enumeration, add security headers via Cloudflare, disable directory listing, remove WordPress version disclosure, fix DMARC. All under 30 minutes total.
2. Review the prepared materials Profile, service architecture, methodology, and brand voice guide — tell me what's right and what needs correction
3. Provide brand assets Professional photography, logo files, and any existing brand guidelines
4. Decide on public site scope Which pages, what photography, how it should feel. Nothing is decided without you.
5. Migrate to Boardroom Journal The static architecture eliminates most security concerns by design. When you're ready, we replace Divi with what's already built here.