An Out-of-Date Theme Isn’t a Cosmetic Problem
When people think about an out-of-date website, they picture it looking dated. That’s the smallest part of it. Website software — WordPress itself, the theme, every plugin — gets security fixes the same way your phone does. When a flaw is found, it’s fixed and then published. That publication is the point: the moment a fix is announced, the flaw becomes public knowledge, and every unpatched site running that version becomes a listed target. Automated tools scan the whole internet looking for them. It isn’t personal and nobody chose your business. You’re a version number on a list. Going through the sites we host, we found one running a commercial theme several versions behind, sitting inside published security advisories — including one that doesn’t require anyone to log in or click anything. And the theme licence had lapsed, which meant it couldn’t receive updates even if someone had tried. That’s the trap with commercial themes and plugins. The licence isn’t just support. It’s the update channel. Let it lapse and the software keeps working, looks fine, and silently stops receiving fixes. We found no sign that site had been broken into. But we did find another, years ago, where a redirect had been injected through an administrator’s own browser session and sat there for months sending visitors somewhere else. Nobody noticed, because it only fired for visitors arriving from search. What we do about it now: every site we host gets its versions checked against published advisories as a routine item, not a favour. Lapsed licences get flagged. And anything that can’t be patched gets a plan rather than a hope. If you don’t know whether your theme is current, that’s worth ten minutes of somebody’s time this week.
We Took a Website Off Its Page Builder. It Got Faster and Safer.
Most WordPress sites are built with a page builder — a drag-and-drop layer that sits on top of WordPress and makes design possible without writing code. They’re genuinely useful. We use one on plenty of sites. They have two costs that nobody mentions at the start. The first is that your content stops being yours in a practical sense. A page builder stores your text in its own format. Switch the builder off and your carefully written pages turn into a mess of unreadable codes. You’re not locked in by a contract, you’re locked in by the file format, which is harder to escape. The second is maintenance. A page builder is a large piece of third-party software with full access to your site. It needs updating like anything else. When a site stops being updated — which happens to every site somebody stopped paying attention to — the builder goes stale along with the theme, and stale software is how sites get broken into. We recently rebuilt a small site that had been sitting untouched on an old theme for years. Rather than update the builder, we moved the site onto plain WordPress — no builder at all, using the editor that comes with it. The result: nothing third-party left to keep patched, the content stored as ordinary web page code that will still make sense in ten years, and a site that loads faster because there’s simply less of it. It isn’t the right answer for every site. A complex site with a lot of design in it needs the tools. But for a small site that mostly needs to say who you are, what you do and how to reach you, a builder is a dependency you’re carrying for no return. Worth asking about yours.
Getting Your Email Into the Inbox Instead of the Spam Folder
If your emails to customers land in spam, the problem usually isn’t what you wrote. It’s that the receiving server can’t confirm the message really came from you. Three records do that job. They live in your domain’s DNS settings, not on your website, which is why most people have never seen them. SPF is a list of the servers allowed to send email using your domain name. If a message arrives claiming to be from you but came from a server that isn’t on the list, that’s a flag. DKIM is a signature. Your mail server signs every outgoing message with a key, and the receiving server checks the signature against a public one published in your DNS. If it matches, the message wasn’t tampered with in transit and it genuinely came from your system. DMARC ties the two together and tells receiving servers what to do when a message fails — ignore it, quarantine it, or reject it outright. It also lets you receive reports about who is sending mail claiming to be you. Get all three right and Gmail, Outlook and the rest have a reason to trust you. Get them wrong or leave them missing and you’re asking to be trusted on the strength of nothing. A few things worth knowing that cost people deliverability without their realising: Forwarding breaks SPF. If mail is forwarded from one address to another, it arrives at the final destination from the wrong server and fails the check — and the failure counts against whoever forwarded it. Sending from a Gmail address while your website claims to be your own domain is a mismatch, and a small one that adds up. And a sudden change in how much mail you send looks suspicious even when it’s legitimate. If your mail is landing in spam, these are the first things to check, and they’re checkable in minutes.
Six Months of Email Nobody Was Scanning
Here’s a failure mode worth understanding, because it applies to more than email. The mail server we run scans every message for viruses before delivering it. Standard stuff. Earlier this year we went looking through the logs for an unrelated reason and found the same line repeating on every message, going back six months: the scanner had failed, and the message had been passed through unchecked. Every single message. For half a year. No alert, no bounce, no error anyone would see. Mail arrived normally. The dashboard looked fine. The cause was mundane — a software update had recreated a system account without the permissions the scanner needed to talk to the mail system. Each piece was running. They just couldn’t reach each other any more, and the failure had been designed to fail open so that mail kept flowing. That design decision is defensible. Blocking everyone’s email because a scanner is down would have been worse. But it means the failure is silent, and silent failures last exactly as long as nobody goes looking. Two things came out of it. We fixed the scanner, and we now monitor for the failure message itself rather than for the scanner being “up” — because it was up the whole time. Up and useless. And it changed what we look at during maintenance. A service that’s running tells you nothing. A service that’s producing the result it’s supposed to produce is the only thing worth checking. Anything that logs a failure on every single transaction should be screaming, and if it isn’t, that’s the real problem. Most of what we found across our systems this month was some version of this: something running, logging success, and producing nothing.
Two Locations, One Website, Without Confusing Google
A business opens a second location. The website gets a line added to the contact page: “now also in West Point”. Perfectly clear to a human being. To a search engine it’s a contradiction. The site says the business is at one address. Now it also says another. Which one is real? Which one shows when someone searches from ten miles away? We hit this with a client who runs two branches, and the correct answer is more specific than “put both addresses on the page”. Each location needs to be published as its own entry in the site’s structured data, with its own address, its own phone number and its own hours — and then explicitly linked to the main business as a branch of it. That last part is what stops the two reading as a contradiction. It says: same company, different building, both real. Done properly, a search for the service near the second location can surface the second location. Done as two addresses in a paragraph, you’re relying on the search engine to work it out, and it often doesn’t. A few things we learned putting it in: Give each branch its own phone number if one exists. Two locations sharing one number is a weaker signal than two numbers, and it makes them harder to tell apart. If the hours are the same at both, say so at both. Don’t leave the second one silent. And name the branch in a way a customer would recognise — “the West Point store”, not “Location 2”. We built the ability to do this into the plugin we run on every site we host, so it’s now a setting rather than a project.
What We Rebuilt So 33 Websites Could Talk to AI Search
We spent last week doing something unglamorous across every website we host, and the result is worth explaining because most business sites have the same problem. Search engines and AI assistants build a picture of your business from structured data on your site — a code block stating your name, address, phone, hours and services. Get it right and you’re quotable. Get it wrong and you’re a guess. Here’s what we actually found when we looked. Twenty sites were publishing two competing business listings. Four were publishing three or more. This happens because SEO plugins each add their own, and a site that has picked up two or three plugins over the years ends up describing itself two or three times, often with different details. On two sites the competing listings carried different business names. A search engine reading that has to choose which version of you to believe. It usually chooses badly. So we went through all thirty-three. One listing per site. Real street address or, for the businesses that work from a van rather than a shopfront, a proper list of the towns they serve. Phone numbers, opening hours, services in the words a customer would actually use. For a client with two branches, both locations published properly and linked, so nobody thinks one building moved. We finished with every site publishing exactly one clear listing — and a dated record of every check on every site, so the work is provable rather than claimed. If you don’t know whether your site does this correctly, that’s normal, and it’s not something you can see by looking at the page. We’re happy to check.
Your Opening Hours Belong in Your Website’s Code
Your hours are on your contact page. A human reads them fine. That isn’t the problem. The problem is what happens when someone asks their phone “is it open right now?” The answer doesn’t come from reading your page. It comes from a database, and that database only knows what your website has stated in a machine-readable form. If your site has your hours as ordinary text in a nice font, you’ve told people. You haven’t told the machines. So the assistant says it doesn’t know, or worse, it guesses from something stale it found on a directory site. The fix is structured data — a small block of code that sits in your page and says, in a standard format every search engine understands: this is the business name, this is the street address, this is the phone number, these are the hours, this is what we sell. We went through every site we host and added it properly. Along the way we learned something worth passing on: stating that you’re closed on Sunday is more useful than saying nothing about Sunday. Silence gets interpreted. “Closed” gets repeated accurately. There’s a second benefit that matters more every month. The same structured data is what AI assistants read when someone asks them for a recommendation. A business that states its address, phone, hours and services in that format is quotable. A business that doesn’t is a guess. None of this changes how your site looks to a visitor. It changes whether a machine can answer a question about you correctly — which is increasingly how people decide where to go.
The Contact Form That Quietly Threw Every Message Away
A contact form that fails doesn’t announce it. The visitor fills it in, hits send, gets a thank-you message, and goes away satisfied. You get nothing. Neither of you knows. We audited thirty-four contact forms across the sites we host. Thirty-three were fine. One had no recipient address configured at all — so every message sent through it had been accepted, processed, and discarded. Nobody had complained, because nobody knew. The people sending those messages assumed they’d been ignored. That’s the part that costs money. It isn’t the lost message, it’s the customer who thinks you couldn’t be bothered to reply. Forms break quietly for boring reasons. Somebody changes the email address the form sends to. A plugin updates and resets a setting. The mail server starts rejecting messages from the website because the sending address doesn’t match the domain. An email host starts filing your own website’s notifications as spam. Any of those can happen months after the site was built and working. Test yours properly, at least twice a year. Not by looking at the settings — by filling the form in yourself, from your phone, on mobile data rather than your office wifi, using an email address that isn’t your business one. Then check whether it arrived, and check the spam folder too. If it doesn’t arrive, that’s the answer. If it arrives in spam, that’s a different problem and a fixable one. We now test every form on every site we host as part of routine maintenance, because “it worked when we built it” is not the same as “it works”.
We Found a Fake Phone Number on a Live Business Website
Most website themes ship with fake content so the demo looks full. A stock photo, a paragraph of lorem ipsum, an address in New York City, a phone number in the 555 range that doesn’t exist anywhere. You’re meant to replace all of it. Almost nobody replaces all of it. Going through the sites we host, we found a business publishing a phone number with an area code from a state it has never operated in. It had been there since the site was built. Anyone who dialled it got somebody else entirely. On another, the footer still carried the theme’s demo contact block — a street address in New York, a 1-800 number that belonged to the theme company, and an email address at a domain the business doesn’t own. That business is in Mississippi. Elsewhere we found published product pages full of lorem ipsum, testimonials from invented customers, and the “Hello world!” post WordPress creates on day one still sitting there years later. None of this is dramatic. All of it is the kind of thing a customer notices, and a competitor points at. Here’s how to check yours. Use your site’s search box, or Google with site:yourbusiness.com, and look for: example.com, lorem ipsum, Insert Tagline Here, Your Company, 555, North Main Street, Sample Page, Hello world. Then actually read your own footer, which is the part of a website nobody ever re-reads after launch. If you find something, it’s usually a five-minute fix. The hard part is knowing to look — which is why we now check for it on every site we host, as a standing item rather than a favour.
Is Your Website Invisible to ChatGPT and AI Search?
More and more people are asking an assistant instead of typing into a search box. “Who does vehicle wraps near Tupelo?” “Is there a place in Iuka open late that sells wine?” Whatever answer comes back was read off somebody’s website. If the crawlers those assistants use can’t read yours, you’re not in the running. Not ranked low — absent. We went through every site we host last week looking for exactly this, and we found sites quietly refusing the crawlers that feed ChatGPT, Claude, Perplexity and Google’s AI answers. Nobody chose that. It came in with a theme, or a plugin, or a file somebody pasted in years ago and forgot. Here’s how to check your own. Type your domain into a browser followed by /robots.txt — so yourbusiness.com/robots.txt. You’ll get a plain text file. Look for any line that says Disallow: / underneath a name like GPTBot, ClaudeBot, PerplexityBot, Google-Extended or CCBot. If you see one, that crawler has been told to go away. Two things worth knowing. A file that doesn’t exist at all is usually fine — it means nothing is being blocked. And a file that’s there but blocking ad networks and scrapers is often deliberate and harmless. It’s the AI and search crawlers you care about. The other trap is harder to spot: a physical robots.txt file sitting on the server overrides whatever your SEO plugin thinks it’s publishing. Your plugin shows one thing in the dashboard, visitors get another. We found that on twenty-six sites. If you’re not sure what you’re looking at, send us the address and we’ll look for free. It takes a minute and it’s the kind of thing that costs you customers silently for years.