Technical SEO
Security, crawlability, indexability, Search Console · verified October 3, 2026 · fixes verified October 7, 2026
65/100
Some basics are fine. All 88 published URLs return 200, are index, follow, and point their canonical tag at themselves. Every title is unique. http, www and http-www all redirect to https://nweautocare.com/ in one hop, and wp core verify-checksums passes on WordPress 7.0.4. Four serious problems pull the score down. A 1.8 GB full-site backup can be downloaded by anyone (C1). The page sitemap crashes with a PHP fatal error, so none of the 87 pages are in a working sitemap (C3). Wabu has no Search Console access, even though someone verified the domain (C4). And the site carries about 26 orphaned, duplicate or leftover pages that compete with the real ones (H1). We checked everything on this page live today: HTTP requests, wp-cli over SSH on the New Wabu Web Server (cPanel account nweautowabuapps), DNS and WHOIS, and Search Console in Chrome.
Status, October 7, 2026
Re-estimated Technical score: about 65/100 (was 28)
All four critical items on this page are fixed: the public backup (C1), the sitemap crash (C3), Search Console access (C4), and the duplicate pages (H1). Search Console then showed a problem the October 3 crawl couldn't see: 169 of the 231 indexed URLs were WordPress system folders, because folder listings were turned on. That's fixed too. What's still open is listed at the bottom of this section. The October 3 findings below are kept for the record, each with its current status.| Item | Status | What's live now |
|---|---|---|
| Public 1.8 GB backup (C1) | Fixed Oct 7 | Moved to a private folder; ai1wm-backups now returns 404; database password and security keys rotated |
| XML sitemap (C3) | Fixed Oct 7 | Loads in 0.16 s; 73 real URLs (page, post and local sitemaps); images off, 50 per page |
| Search Console (C4) | Fixed Oct 7 | wabuwebdesign@gmail.com verified as Owner (via Google Analytics); sitemap_index.xml submitted; no manual actions; no security issues; sitemaps list clean |
| Folder listings indexed by Google (new) | Fixed Oct 7 | Options -Indexes; bare theme/plugin folders return 404; PHP error display turned off (it was printing server paths) |
| Duplicate & leftover pages (H1) | Fixed Oct 7 | 17 pages drafted and redirected (301) to the matching live page; Hello World and the xyz preview page removed; archives noindexed |
| Orphaned money pages (M1) | Fixed Oct 7 | Sitewide Quick Links bar; menu items moved off retired pages |
| TTFB (H4) | Fixed Oct 7 | Page cache (WP Super Cache, static files): ~0.35 s (was 0.82 s) |
| Page size (H4) | In progress | Home HTML ~0.9 MB (was 2.28 MB). The rest is Divi 5 beta inline CSS. |
| Viewport / zoom (H7) | Fixed Oct 7 | width=device-width, initial-scale=1; pinch-zoom allowed |
| robots.txt AI crawlers (L1) | Fixed Oct 7 | Explicit Allow for GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-SearchBot, PerplexityBot, Google-Extended; llms.txt live |
| Plugins (H2) | Fixed Oct 7 | All plugins up to date (WP Mail SMTP 4.10.1 today); Better Search Replace and Duplicate Page deactivated |
| Hostinger mu-plugins, readme.html, REST user list (H2) | Fixed Oct 7 | Hostinger files moved to backup; readme.html / license.txt return 404; /wp-json/wp/v2/users hidden from the public |
| Security headers (L5) | Fixed Oct 7 | HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy all sent |
| Two unknown admins (H2) | Blocked | albertgalopastor1987 and jd are still administrators; waiting for the client to say who they are |
| Divi 5 public beta (H2/H4) | In progress | Still on 5.0.0-public-beta.9.3; update to stable on a password-protected staging copy first |
| DMARC record (L5) | Blocked | Needs IONOS DNS access for nweautocare.com |
| Bing Webmaster Tools (C4) | Blocked | Can now import from Search Console; needs a Microsoft sign-in by Marco. IndexNow already submits every URL to Bing. |
| Domain-level Search Console property | Blocked | sc-domain is still owned by an unknown account (DNS TXT); not required now that the URL-prefix property is ours |
What Search Console Showed (October 7)
- Sitemaps: only /sitemap.xml (submitted December 27, 2018; 3 pages found, because the page sitemap was crashing). No plugin-path or spam sitemaps from the September 2026 compromise. The fixed /sitemap_index.xml was submitted October 7.
- Manual actions: none. Security issues: none.
- Page indexing: 231 indexed, 1.06K not indexed (778 crawled but not indexed, 168 soft 404, 64 duplicate without canonical, 22 not found, 18 redirects, 5 noindex). Of the 231 indexed URLs, only 62 are real pages; 77 are /wp-content/themes/ folders and 92 are /wp-includes/ folders. They were indexable because the server showed public "Index of" folder lists.
- Fixed October 7: folder listings off, bare theme/plugin folders return 404, PHP errors hidden. Google will drop these URLs over the next few weeks. Re-check Page indexing in 2–4 weeks.
Public Site Backup (C1)
A complete copy of the website and its database can be downloaded by anyone Fixed Oct 7
- /wp-content/ai1wm-backups/nweauto-wabuapps-com-20260223-233509-mclkgvlw4c5w.wpress returns HTTP 200 with Content-Length: 1,822,594,031 (1.8 GB), last modified February 23, 2026. The first bytes are a valid All-in-One WP Migration header, so this is a real, restorable backup.
- These exports contain the whole database (user accounts, password hashes, form data) plus every site file, including wp-config.php with the database password.
- The folder's .htaccess only turns off directory listings. It doesn't block downloads.
- We searched the access logs that are still on the server (December 2025, and May, June, September and October 2026) and found no requests for the file. Logs for January–April and July–August 2026 aren't kept, so an earlier download can't be ruled out.
Context: we found the same problem on another site on this server earlier this week. A Wabu hardening mu-plugin on this account (wabu-harden-batch.php, added September 22, 2026) notes that the WordPress REST batch endpoint "was the entry vector for the September 2026 compromise" on this server. Core files verify clean today, but that history is one more reason to rotate the credentials, and to check every site on the server for an ai1wm-backups folder.
Status, October 7: The backup is moved to /home/nweautowabuapps/private-backups/ (outside public_html), and the folder denies all requests (404). Database password and WordPress security keys rotated. The older February file was deleted with approval. Left: the owner should reset admin passwords.
XML Sitemap (C3)
The page sitemap crashes, so none of the real pages are in a working sitemap Fixed Oct 7
robots.txt points to /sitemap_index.xml (Rank Math). The index loads and lists four child sitemaps, but only one of them actually contains the site's pages, and that one fails:
| Sitemap | What it returns |
|---|---|
| /post-sitemap.xml | One URL: /hello-world/ (the default WordPress post) |
| /page-sitemap.xml | Takes about 184 seconds, then returns HTTP 200 with a PHP fatal error instead of XML |
| /category-sitemap.xml | One URL: /category/blog/ |
| /local-sitemap.xml | /locations.kml (Rank Math Local SEO) |
Fatal error: Allowed memory size of 1073741824 bytes exhausted (tried to allocate 1970176 bytes) in /home/nweautowabuapps/public_html/wp-content/themes/Divi/includes/builder-5/server/FrontEnd/Module/Style.php on line 454
So the only URLs Google gets from the sitemap are Hello World and the blog category. The 87 real pages are missing. The error also shows the server's file path to anyone who opens it. Rank Math's sitemap settings are 200 items per page with include_images: on; building the image list makes the Divi 5 beta render every page's styles and runs out of 1 GB of memory.Fix (C3): in Rank Math → Sitemap Settings, turn off "Include Images" and lower links per sitemap (for example to 50). Update Rank Math (1.0.269 → 1.0.279) and Rank Math Pro. Then confirm /page-sitemap.xml loads in a few seconds and lists the live service pages, and not the duplicates that H1 retires.
Status, October 7: Rank Math "Include Images" off, 50 links per sitemap, Rank Math updated to 1.0.280. The sitemap index lists page-sitemap1, page-sitemap2, post-sitemap and local-sitemap; 73 real URLs; loads in seconds; retired duplicates are absent. Submitted in Search Console.
Google Search Console & Analytics (checked directly, C4)
Someone verified this domain in Search Console, but it isn't Wabu Fixed Oct 7
We checked today in Search Console, signed in as wabuwebdesign@gmail.com. Both sc-domain:nweautocare.com and https://nweautocare.com/ say "Oops, you don't have access to this property." But DNS has a google-site-verification=LM76YXgK… TXT record, which means another Google account verified the domain. We don't know whose: it could be the client, the original site builder (WordPress admin albertgalopastor1987), or Clutch Clicks, the agency behind nwautocaretx.com.A sitemap file on the server is not the same as a sitemap submitted in Search Console. Here the file is broken (C3) and we can't see what was submitted. Once access is sorted out, check the submitted-sitemaps list for anything unexpected (plugin-folder paths with random names, huge page counts, dates that don't match our work). This server had a compromise in September 2026, so treat any odd entry as a possible sign of it, not as stale data.
Action C4: ask the client which Google account owns Search Console and get owner access for Wabu. If nobody can be found, verify it again as Wabu (a new DNS TXT record in IONOS). Then submit /sitemap_index.xml after C3 is fixed, review Page indexing, Manual actions and Security issues, and import the property into Bing Webmaster Tools with IndexNow turned on. Bing is how ChatGPT finds sites.
Status, October 7: Verified as Owner of https://nweautocare.com/ with wabuwebdesign@gmail.com (auto-verified through Google Analytics). Sitemaps list checked (clean), sitemap_index.xml submitted, manual actions and security issues are clear. See "What Search Console Showed" above.
Two different Google Analytics tags load on every page In progress
Every page loads both G-HF68X7Z5KG and G-F3ZB43T30G (we don't know who owns either). That's two property owners, about 360 KB of extra script, and no single place where visits, calls and bookings are counted. No conversion events for tel: clicks or the Shopmonkey "Book Service" button were found. Keep one property, owned by the client with Wabu as admin, and add those events (M5).Status, October 7: Both IDs now load from one gtag.js (about 180 KB less script). Events are live for calls, texts, booking clicks, financing clicks and form leads. Search Console verified through Analytics, so wabuwebdesign@gmail.com has access to at least one of the two properties. Next: confirm which one, make it the only one, and mark the events as conversions.
Duplicate, Orphaned & Leftover Pages (H1)
The site has two generations of service pages: an older set ending in -katy-tx (built around May 2026) and a newer set (July 2026) that the menu links to. The old set was never redirected, so both versions are live and indexable. 26 published pages have no internal links pointing to them at all. Several of the old pages are the ones that actually rank, so they need 301 redirects to the matching new page, not plain deletion.
| Old / duplicate URL | Live page it competes with | Ranking today (Semrush) | Action |
|---|---|---|---|
| /oil-change-service-katy-tx/ | /oil-change/ | — | 301 |
| /brake-repair-and-services/ | /brake-repair/ | — | 301 |
| /transmission-repair-katy-tx/ | /transmission-service/ | — | 301 |
| /vehicle-state-inspections-katy-tx/ | /state-inspections/ and /vehicle-inspection-2/ (three pages for one service) | — | 301 both extras to one page |
| /wheel-alignment-katy-tx/ | /alignments/ | — | 301 |
| /auto-ac-repair-katy-tx/ | /ac-heating-repair/ | — | 301 |
| /car-diagnostic-services-katy-tx/ | /diagnostic-service/ | "best car diagnostics katy tx" #24, "check engine light diagnostic katy" #46 | 301 (carry the equity) |
| /auto-fluid-flush-katy-tx/ | /fluid-flushes/ | — | 301 |
| /tire-shop-katy-tx/ | /tire-shop/ | "northwest express auto care" #34 (cannibalizing the home page) | 301 |
| /module-reprogramming-and-software-updates/ | /module-reprogramming-software-updates/ | — | Keep one, 301 the other |
| /shocks-and-struts-replacement-service-katy-tx/ | No new equivalent (closest: /steering-suspension-repair/) | "shocks and struts replacement katy" #9 (140/mo) | Keep, link from the menu, or 301 to suspension |
| /engine-cooling-system-repair-katy-tx/ | No new equivalent | "coolant flush katy" #46 | Keep and link, or fold into /fluid-flushes/ |
| /auto-repair-in-katy-tx/ | / (home) | "transmission flush katy" #1 (110/mo); brand #19 | 301 to /fluid-flushes/ or /transmission-service/ after copying its transmission-flush text |
| /home_old/, /new/ | / and /acura/ | — | 301 / delete |
| /services-2/, /service-page/ | /services/ | — | 301 to one services hub |
| /hello-world/ | Default WordPress post, sample comment, comments open | — | Delete; close comments |
| /author/albertgalopastor1987/, /category/blog/ | Archive pages | — | noindex (Rank Math) |
Status, October 7 Fixed Oct 7
All 17 duplicate and leftover URLs in this table now 301 to the live page (the transmission-flush text was moved to /transmission-service/ first, and /shocks-and-struts… goes to /steering-suspension-repair/). Hello World is deleted and archives are noindexed. The money pages are linked from a sitewide Quick Links bar, and /vehicles/ links the make pages.Separately, real money pages are orphaned too: /services/, /coupons/, /financing/, /warranty/, /vehicles/, /mobile-service/ and the new /privacy-policy/ aren't linked from the menu, the footer, or any page. The 40 car-make pages are linked only from /new/, which is itself an orphan. Linking those is M1. The /vehicle-inspection-2/ slug in the menu also reads like a leftover copy.
Crawl & Index Checks
| Check | Result | Status |
|---|---|---|
| http://, http://www, https://www → https apex | 301 to https://nweautocare.com/, 1 hop each | Pass |
| Search engine visibility | blog_public = 1; all 88 URLs index, follow, max-image-preview:large; all canonicals self-referencing | Pass |
| Titles / meta descriptions | 88 unique titles; 2 pages with no meta description. Oct 7: all 73 sitemap URLs have a meta description. | OK |
| robots.txt | Disallow: /wp-admin/, Allow: /wp-admin/admin-ajax.php, sitemap line. AI crawlers are allowed by default, not named explicitly (L1). Oct 7: explicit Allow lines added. | Fixed Oct 7 |
| XML sitemap | Page sitemap fatal error; only Hello World + blog category listed | Fixed Oct 7 |
| Search Console / Bing Webmaster Tools | Verified by an unknown account; no Wabu access; no Bing access known | Fixed Oct 7 (GSC); Bing pending |
| Duplicate / orphan pages | ~10 duplicate service pairs, 4 homepage/services variants, 26 orphans | Fixed Oct 7 |
| Server response (TTFB) | 0.82 / 0.83 / 0.87 s on three tries; Lighthouse "root document took 790–820 ms" | ~0.35 s Oct 7 |
| Page size | Average HTML 2.9 MB per page; home 2.28 MB, of which about 2.1 MB is inline CSS | ~0.9 MB Oct 7 |
| Rendering | Content is in the raw HTML (Divi renders on the server), so non-JavaScript crawlers can read it | Pass |
| Viewport | user-scalable=no blocks pinch-zoom on phones | Fixed Oct 7 |
| WordPress core | 7.0.4, checksums verify | Pass |
Admin Accounts & Server Hygiene (H2)
Four administrators, two of them unknown to us Blocked
| ID | Username | Registered | Note | |
|---|---|---|---|---|
| 1 | albertgalopastor1987 | albertgalopastor1987@gmail.com | 2025-11-14 | The original installer. Named as "author" in the schema on 86 pages, and has a public author archive. |
| 2 | jd | josephdavidfabiana@gmail.com | 2025-12-24 | Unknown |
| 3 | marco | marco@wabuweb.com | 2025-12-31 | Wabu |
| 4 | info@wabuweb.com | info@wabuweb.com | 2026-05-07 | Wabu |
Status, October 7: Waiting for the client (open question 2). The public user list at /wp-json/wp/v2/users is hidden, and all pages are reassigned to the "Northwest Express Auto Care" author, so the schema no longer names albertgalopastor1987.
- Oct 7: all plugins updated (Rank Math 1.0.280, Rank Math Pro 3.0.123, Reviews 14.2, Ollie 0.3.4, WP Mail SMTP 4.10.1); admin tools deactivated. Oct 3: 8 of 9 plugins have updates waiting, all with auto-updates off: Rank Math 1.0.269 → 1.0.279, Rank Math Pro 3.0.112 → 3.0.122, WP Reviews Plugin for Google 13.2.9 → 14.2, Ollie Menu Designer 0.3.1 → 0.3.4, plus Better Search Replace, Duplicate Page, Header Footer Code Manager and Responsive Menu.
- Oct 7: still open. The inactive Divi51 copy was moved to backup; the stable update should be tested on staging first. Oct 3: The theme is Divi 5.0.0-public-beta.9.3, a public beta, running a live business site. It's the source of the sitemap crash (C3) and the 2.1 MB of inline CSS (H4). An inactive copy of an older beta (new/Divi51) is also installed.
- Oct 7: removed (moved to private-backups). Oct 3: Two mu-plugins left over from a previous host: hostinger-preview-domain.php and hostinger-auto-updates.php. They don't belong on this server; remove them.
- Oct 7: readme.html and license.txt return 404; admin tools deactivated. Oct 3: readme.html returns 200 and reveals the WordPress install. xmlrpc.php returns 405 (fine). Better Search Replace and Duplicate Page are admin tools best deactivated when not in use.
- Oct 7: the xyz preview page is in the trash; the placeholder cPanel account is left alone (other account). Oct 3: A draft page (xyz-ics-preview-page) and a placeholder cPanel account on the server (nweautocare / nweautocare1.com) are leftovers to confirm and clean up.
- Wabu's wabu-harden-batch.php is in place and blocks the REST batch endpoint used in the September 2026 compromise.
Security Headers & Email (L5)
| Item | Today | Status |
|---|---|---|
| Strict-Transport-Security (HSTS) | Oct 7: max-age=31536000 | Fixed Oct 7 |
| Content-Security-Policy | Not sent | Optional |
| X-Frame-Options / X-Content-Type-Options / Referrer-Policy | Oct 7: SAMEORIGIN / nosniff / strict-origin-when-cross-origin, plus Permissions-Policy | Fixed Oct 7 |
| SPF | v=spf1 include:_spf.google.com include:_spf-us.ionos.com ~all | OK |
| DMARC | No record at _dmarc.nweautocare.com | Blocked: IONOS DNS access |
| Mail (MX) | Google Workspace | OK |
| Domain | IONOS, registered 2017-02-03, expires 2027-02-03 | OK |
The Other Domains
nwautocaretx.com and nwmobileautocare.com
nwautocaretx.com is the duplicate GoHighLevel site built by "Clutch Clicks" that we audited on August 4. It's still live, and today Google, Bing and Brave all use it as this business's website (C2). Semrush shows it at 142 keywords and about 27 visits a month, up from 23 keywords and 0 visits in August. nwmobileautocare.com ("NW Mobile Auto Care", registered June 6, 2026) is linked from the homepage. It's a JavaScript-only Base44 app, so its raw HTML has no readable content for search or AI crawlers (L3). Both are covered on Local & Maps and AI / GEO.