What you can ask your AI

Read-only, it found a card skimmer, a backdoor with remote execution, tampered core jQuery and 3 rogue admins — and handed you the exact cleanup plan.

It cross-checks the evidence: a «suspicious» 0-byte PHP file was a false positive, and gambling spam marked «fixed» was still injected, cloaked, in 3 spots.

It confirmed the false positive (bot score 0, legitimate admin URLs) and staged the whitelist for their IP.

It rebuilds the timeline from users and logs — and when the host already rotated the logs, it tells you instead of inventing an entry vector.

It reads them one by one: benign leftovers (a plugin's, core modules) apart from the genuinely dangerous ones, with proof for each.

It got 100+ submissions a month but had no webhook, the license lacked the add-on and 2 snippets sat in draft — no rebuild needed, just the bridge.

It finds every page, shortcode and Elementor template it appears on — no manual hunting.

It inventories everything: which form is active, its recipients and webhooks (one to Salesforce, another to a CRM) — untangling the setup.

It reads the entries and gives you the real ratio (active vs Akismet spam) and which pages each comes from.

Root cause: a cache-TTL change (28 days → 10 min) doubled the PHP renders and saturated the workers — not an attack, config.

It measured real coverage (12% of CSS used, YouTube up front) and, being Agency, wrote the fix mu-plugin and left it one-click activatable.

A surge of scrapers hitting uncacheable paths, no Redis, plus an old credential hammering the site — with the exact mitigation.

The auto-investigation gathers the fatals, 5xx, brute-force and recent changes on its own and infers the likely cause — before you ask.

It found 587 MB of duplicate staging tables, a thousand+ revisions and a plugin's orphan tables — weighing on every request.

It found three cache layers serving the old version (host edge, an eternal 304 and the TTL) and built purge-on-publish.

It re-traced 130 live redirects, split yours from an external layer and got yours 25/25 to a single hop.

It verified: production was clean (139/139 pages), the claim was the staging URL — it didn't accept the claim blindly.

It sets up a genuine 410 Gone and removes it from the sitemap, no noindex or robots block — verified on staging.

Cause: a Stripe plugin 10.9.0 regression that hung the payment sheet — the fix was updating to 10.9.1, verified.

No — ruled out with evidence: only Stripe renders the button, the WooPayments wrappers were empty.

An expiry/Stripe-sync bug (not the membership plugin) — 238 subscribers resynced, the flapping stopped, 0 errors.

It reconciled account by account: 458 with an active sub, 38 to triage — with the exact list to review.

Not a bug: the store shipped US-only; an out-of-country address failed, a US one got «Free shipping» fine.

A script erased utm_source on load — ~$2,500/week in ads losing attribution. Located, with the fix.

It installed the A/B testing via GTM (survives staging→prod pushes) with the goal tied to the form submit, verified.

A level-routing defect — corrected so free goes to the free list, verified in the config.

It re-enabled the LLM-crawler logger (it was off in prod) and verified it records — so you can see who scrapes.

The email service had no valid API key — thousands of sends failing since an exact date; new key, verified with zero failures.

It checks SPF / DKIM / DMARC alignment and the sending service, and tells you what's missing to reach the inbox.

It reads the form notification config: which email it goes to, the confirmation, and whether a CRM webhook is missing.

It measured a CLS of 1.95 — the logo with no dimensions and late-loading fonts. Being Agency, it wrote the mu-plugin with the preloads and aspect-ratio and left it one-click activatable → CLS 0.07.

The mobile hero image was a 337 KB JPG and the CDN was serving the desktop copy to phones. Lightweight WebP + per-device preload, one-click activatable.

The tablet version was a 252 KB JPG while the others were already WebP. It swapped it to WebP and purged the cache — one-click activatable.

It measures them one by one — GTM 515 KB / 920 ms, Facebook, the CDN challenge — and tells you how much you gain by removing or deferring each.

It inventoried the plugins, the theme and even the code snippets stored in the database, and tells you what is and isn't compatible before you touch anything.

It opened it up: all it left was a dead Analytics tag in the HTML — zero risk, but ready to remove.

It read every active snippet straight from the database and confirmed the code is modern and compatible.

It found WP_DEBUG and WP_DEBUG_LOG set to true in wp-config — leaking errors and a growing log. It staged the change to false with a backup of the file.

A plugin was writing «Migrating…» on every request. It unhooked it and truncated the log in a one-time mu-plugin — one-click activatable.

No: they were managed-host platform files (an auto_prepend and a checksum compared against the wrong version). Two false positives, with proof.

It saw the wp_head hooks that run on the front end (the ones an external scanner can't see) and determined it was a third-party runtime integration, not something planted in the database.

Not a theme bug: it was the browser focus ring on each card's link. It handed you the exact CSS to soften it without losing accessibility.

A third-party script loaded late and blocked rendering on iOS; moving it early into the <head> fixed it — verified on a real iPhone.

It caught 2 hops to the sitemap and staged the line fixed to 0 hops — and it warns you when the old view is just CDN cache, not the real file.