Infrastructure solid. Content needs attention.
A comprehensive audit covering security, content integrity, performance, SEO, and updates. WordPress, PHP, plugins, and the theme are all current. The newest findings are around content data drift on the Team Rosters custom post type.
Security
6 findings still open from last audit, no progress yet.
Content Integrity
113 Team Rosters unassigned to any team, 1 duplicate.
Performance
Lean DB, 98.9 KB autoload, 1 GB PHP memory.
Updates
Core, all 13 plugins, and theme fully patched.
SEO Basics
Missing site icon, empty tagline, no SEO plugin.
Content integrity, new findings
All 113 Team Roster posts have no team assigned
A check for Team Rosters with zero team-name taxonomy relationships returned 113 of 113. This is almost certainly wrong, the previous import assigned 75 players to 7 teams.
Between the last audit and now, 31 new Team Roster posts appeared. These were added by a method that bypassed taxonomy assignment. Something may also have disassociated the earlier players.
Duplicate player detected
Two Team Roster posts share the exact same title. Both were created today. Likely a double-entry during the recent addition.
5 orphaned Team Roster auto-drafts
Abandoned admin draft sessions on the Team Rosters CPT. Harmless, but they clutter the database and show up in admin listings.
Security, still open
Public user enumeration via REST API
The default REST API endpoint still exposes the administrator account without authentication, giving attackers a confirmed username.
No brute-force / login-attempt limiting
No login-limiting plugin is active. The login page will accept unlimited password guesses.
Admin username is an email address
The admin login is an email address, discoverable via multiple enumeration paths.
Hardening constants not defined
Standard defense-in-depth constants (DISALLOW_FILE_EDIT, debug display flags) still not set in wp-config.php. XML-RPC endpoint remains reachable. Destructive reset plugin still active.