Methodology
Testing http://www.clivedaniel.com using a combination of automated tools (Health Check & Troubleshooting plugin, Sucuri SiteCheck, WPScan, SSL Labs Checker) and manual investigation.
Results
Hosting
It’s unclear where the site is being hosted. Some reports show GoDaddy, other indicators point to Starfield Technologies / Talbot Services Corp. The host is running outdated versions of PHP and MySQL, and does not
appear to have a CDN enabled for asset delivery.
Versions
WordPress
The site is running WordPress 4.9.10; the latest version is 5.2.2 (as of July 1, 2019). It cannot be upgraded beyond 4.9 unless PHP is on a newer version.
PHP
The server is running PHP 5.3.24, which is no longer supported by the
developers. The lowest version that WordPress can run on is PHP 5.6, and PHP 7.3 is recommended for its speed and security.
MySQL
The server is running MySQL database engine version 5.5.51. The minimum recommended version is 5.6, and the latest is 8.0.
WordPress
The site is running an old version of WordPress and is using a “kitchen sink” theme. Content is added to pages through various methods, including widgets, custom HTML, and theme settings. Some sections rely
solely on the theme’s page builder.
Upgrading to 5.0 and newer defaults to the new block editor, which changes the way content is created. If the current theme doesn’t support the editor, use the Classic Editor plugin until it does.
There are several plugins and themes that haven’t been updated. The themes should be removed since they’re not being used at all; some premium plugins that are bundled with the theme are also outdated and many versions behind the latest release. They may require an update to the theme itself, which is often an additional cost.
Theme
The theme is a site builder from Muffin Group called BeTheme. Each page is pieced together from a combination of hand-coded HTML and custom fields inside the page builder.
The theme says it supports WooCommerce, but it’s unclear to what extent.
There are several custom post types with no content or test content only (Offer, Slides, Testimonials, Layouts). I can’t be certain where they’re coming from but it appears to be the theme.
Plugins
There are 2 contact form plugins installed: Contact Form 7 and Fast Secure Contact Form.
Contact Form 7 has 3 forms which are configured incorrectly and may not work as expected.
Fast Secure Contact Form is no longer available, and may not be maintained. It was removed from the WordPress Plugin Directory for guideline violations related to malicious code, and is not available at the link provided in the plugin settings.
WPBackItUp backup plugin is installed and active, but no backups have been created.
Quick Redirects plugin is used for 4 redirects, 3 of which are supposed to go to an “Under Construction” page but don’t work.
There are 2 slider plugins installed, not including the one bundled with the theme: LayerSlider WP and Revolution Slider. Both are used in different places, the theme slider is not used.
Admin
There is only one user on the site, which means there is only one person managing the whole site, or everyone shares the same admin login. Neither of those are good options.
Mail Check test failed to send an email from WordPress admin. The server may be configured incorrectly, or an external sender may be required (like SendGrid, Mailgun, or Amazon SES).
Ecommerce
BeTheme states that it supports WooCommerce, but not to what extent. It’s unclear if there’s support for the newest version of WooCommerce and the templates it uses.
The website has a valid SSL certificate that expires July 24, 2020, but the site isn’t set up to serve SSL by default. Ecommerce requires that at a minimum the checkout page be protected with TLS/SSL, and it’s recommended that all pages on the are served securely.
Recommendations
Although WooCommerce can run on WordPress sites as old as version 4.7, there are several other issues with the site that should be addressed before attempting to add ecommerce. Beyond a complete rebuild of the site with a custom theme and plugins, these are the most immediate changes we recommend to make the site to increase security and performance – two areas that directly impact ecommerce:
- Upgrade PHP to at least version 7.2. The site should be tested in a sandbox environment before doing this. If unable to upgrade, consider switching to a host that can.
- Enable a CDN to speed up site loading. If the current host doesn’t provide a CDN, consider switching to one that does or paying for a separate CDN service.
- Upgrade WordPress to 5.2. This will enable the block editor by default, and enable us to use WooCommerce blocks for displaying products.
- Test the theme with the block editor. If it’s not compatible, install and activate the Classic Editor plugin.
- Make the site use TLS/SSL by default for all requests.
- Remove the Fast Secure Contact Form plugin and migrate any of the data to Contact Form 7.
- Remove all unused plugins and themes.
- Consolidate and remove duplicate plugins.
- Put a backup and recovery plan in place, either using the existing plugin or a backup system provided by the hosting company.
Note: All testing should be done on a test server before making changes to the live site. That can be a local development environment or a sandbox copy of the site.