Project Reports
Community Newspapers — your work progress at a glance.
Cyber Security — Incident Response
Active security incident & breach response.
Choose your level of breach-response support. T2 is our recommendation -- meets the FIPA notification floor. T3 adds full protection + monitoring ($3,610 net after credit). Prices firm 30 days.
⚠️ Already performed 2026-07-15 — awaiting your approval to bill
- Emergency closure of a public database exposure (1.09 GB dump publicly downloadable since 2022-12-01)
- 45-month forensic sweep across access logs → confirmed 24 downloads by 17 distinct IPs, ~31.6 GB exfiltrated
- Evidence preservation + hash verification + chain of custody
- Internal incident report + 6-page client-facing notice (delivery-ready)
- Targeted pre-flip backup (database + code), verified + secured
- Security lockdown Phase 1 deployed (mu-plugin allow-list, 37 sessions destroyed, function-tested)
- Admin inventory + credential remediation (15 admins audited, weak accounts flagged)
Delivered under emergency — market crisis-response for this scope typically $2,000–$3,500. Billed at flat $1,200 (with $200 goodwill credit if you approve T2 or T3 within 7 days = effective $1,000).
⚠️ Findings driving this quote
- A public database exposure — confirmed exfiltration. 1.09 GB dump publicly downloadable Dec 2022 – Jul 2026. 24 complete downloads / 17 distinct IPs / 31.6 GB exfiltrated. Exposure closed 2026-07-15; the data cannot be recalled.
- Database couriered to a third party, unencrypted. UpdraftPlus uploaded a 9 GB unencrypted copy to a third-party contractor's Dropbox account. Recurring copy STOPPED 2026-07-16. Historical copies in that account remain exposed — see Action Required below.
- Active credential-stuffing attack — ~26,000 failed logins in 14 days; 399 hits on the `aaronguerrero` admin account from 375 IPs; targets running alphabetically = attackers hold the stolen user list.
- Nothing was watching. 3.5-year exposure ran undetected. No independent monitoring on the site.
- Abandoned WordPress subsite LIVE (newsletter.communitynewspapers.com, WP 6.2.9, open login, 34 unmaintained plugins) sharing filesystem with the live papers.
- ⚠️ Below our recommendation — contains the incident but does not answer whose data was exposed
- Close 2 remaining publicly-readable files (218 MB error logs)
- Full web-root audit for other stray dumps and migration artifacts
- Forced password reset across all user accounts
- Rotate credentials for connected services (SMTP, mailing list, integrations)
- Set backup encryption passphrase (stops future cleartext copies to any destination)
- Written completion report
- Lockdown Phase 1 already delivered — counts against this tier (see prepaid credit)
- 🎯 RECOMMENDED — FIPA notification floor. This is what your attorney needs answered.
- Everything in T1, plus:
- Offline enumeration of the exfiltrated database — which tables, which users, how many individuals, categories of PII, whether live credentials were captured
- Affected-party report — a document your attorney or insurer can act on
- Post-compromise persistence check — unexpected admin accounts, unknown plugins, modified core files, evidence anyone USED the exfiltrated credentials
- Attribution pass on the 17 source IPs
- Prepaid credit applied: PM admin inventory (~$340 value) doubles as T2 persistence check
- 🎯 Upgrade — full protection + monitoring. Contains + scopes + makes the next incident detectable.
- Everything in T1 + T2, plus:
- Client-owned encrypted backup destination — account created and owned by Michael, revocable app key; migrate off third-party Dropbox
- Verified restore test (currently untested — no complete UpdraftPlus set has ever existed)
- Backup retention remediation (`/backup` volume 100% full, silently failing since Feb 2026)
- External uptime + file-integrity monitoring — catches the next stray artifact and the next silent outage
- Redirect WordPress admin notifications to Michael (currently routed to `lorenzo@`, never received)
In Progress— none right now
Work actively underway — interim status, not final.
Nothing actively in progress right now.
Completed Work
Paid & delivered — tap any project to see exactly what was done.
- • Diagnosed empty ad rails (ad-caching setting colliding with theme lazy-loading).
- • Restored each paper's OWN advertiser ads server-side across all 26 papers + homepage.
- • House 'Advertise Here' ad as clean fallback. Verified live.
- • BONUS (no charge): automatic backups restored + task scheduler fixed.
- • BONUS (no charge): browser security headers added.
- • BONUS (no charge): duplicate ad placements cleaned up.
Campaign Proposals
Ads, landing pages & marketing materials — proposed, awaiting approval. Approved items move to In Progress.
The house ad we pinned first-or-second on every page (26 papers + all articles) sends traffic to /advertise-with-us/ — and Susan (Miller-Panter Advertising) confirms the page and its form are dated and underperforming. Every impression we just won via the sidebar-ad restore lands on the weakest page in your funnel. This is a full redesign: modern layout, a rebuilt high-converting form, the red-button CTA Susan wants, and conversion tracking (GA4 + Meta Pixel) so results become measurable — not a guess. Pairs with the AI ad-sales chatbot (next).
- Pairs naturally with the ad-sales chatbot (separate quote QT-NEE-2026-006).
Susan said 'half the form is faded out' on the advertise-with-us page. That sounds like a BUG (defect), not a design opinion. Cheap look confirms which. If it turns out to be a bug already surfaced during Get Current delivery, this diagnostic bills $0 (waived, folded into paid Get Current). If it's a design/UX gap, this confirms the $950 redesign quote QT-NEE-2026-005 is the right scope. Look before quoting a full redesign.
- Bill triggers only if the finding is a design/UX gap requiring the QT-NEE-2026-005 redesign. If the finding is a bug already covered by Get Current, this line is voided (no charge).
Reuse NeedAWebNow's existing Netlify Functions + Claude chatbot pattern (already live on needawebnow.com) to close ad sales on the advertise-with-us page. Not a from-scratch build — pattern is proven. Trained on CN rate cards + ad services + booking flow.
- $850 setup + $95/mo hosting + Claude API pass-through (separate line).
- Netlify Functions + Anthropic API. Actual API usage variable — set at $95 baseline, adjusts up if volume grows.
Highly Suggested Maintenance
New findings & cyber security we recommend addressing.
12 inactive themes still sit on the server (per L2 scan) plus an unknown count of abandoned plugins (no updates in 12+ months). Each unused theme/plugin is a security footprint that gets scanned by every attacker — the same class of finding as the newsletter subsite. Audit + prune + document what stays and why.
Plugin + theme hygiene cleanup — audit all installed, remove 12 inactive themes, retire abandoned plugins, document remaining stack
Every risky change on communitynewspapers.com right now happens directly on production, at night, with backups as the only safety net. A staging site is what makes every future upgrade cheaper, safer, and testable BEFORE it touches the live papers. Eddy called this 'the most important line' in the scope-triage notes — quote it first regardless of which build path wins later.
Staging site — full mirror of communitynewspapers.com with password-protected access + automated prod-sync + one-click deploy path
Staging site hosting (recurring)
Michael mentioned a China block was added at some point to stop scrapers on the RSS feed. TWO UNRELATED SYSTEMS share the 'RSS' name: (1) WP RSS Aggregator — INBOUND, pulls other sites INTO CN, paused since 2023 (already the $300 line in paid Get Current); (2) /feed/ — OUTBOUND, CN's OWN content going out, what China would hit AND what legitimate subscribers use. The real risk: an over-broad block on /feed/ silently kills syndication Michael thinks he still has. Investigation-only quote — answers 4 questions BEFORE any change. ⚠️ HARD CONSTRAINT: DO NOT touch or remove the block as part of this discovery. Removing a block holding off a real scraper, or leaving one starving legit syndication, are both expensive mistakes. Findings drive a follow-on fix quote (B-bucket) or a geo/bot-management strategy quote (C-bucket).
China block / RSS feed discovery — investigation only (4 questions, no changes)
Choose tier by your backup footprint. Medium ($65/mo) is right-sized for CN's ~200GB with headroom. If your library grows past 250GB, we bump you to Large — no re-quote, transparent add-on. If CN takes T3 Fortify on the breach quote, Medium is INCLUDED FREE for the first 90 days.
- 250GB-1TB · $295 setup + $145/mo
- Consider if: CNEWS TV video library keeps growing (24/7 channel proposal will push footprint past 250GB)
- Everything in Medium, plus:
- Point-in-time snapshots (rollback to any hour in the last 30 days, not just daily)
- 1-year retention
- Multi-region option (US + EU dual-copy for regulatory or highest-uptime scenarios)
- Up to 50GB · $195 setup + $25/mo
- Right for: small sites, testing environments — NOT enough for CN's 200+GB footprint
- Encrypted at rest + in transit (AES-256)
- Weekly automated backup + verified restore test
- 30-day retention · monitored
- 🎯 RECOMMENDED for CN — 50-250GB · $195 setup + $65/mo
- Right-sized for your 200+GB footprint with headroom to grow
- Everything in Small, plus:
- Daily rotation (not just weekly) — you never lose more than 24hrs of new content
- 90-day retention (a 3-month backup window in case a bad change goes undiscovered)
- Quarterly disaster-recovery drill: we actually restore + verify the site works from cold backup
- INCLUDED FREE for 90 days if you take T3 Fortify on the CN-2026-07-B breach quote — then converts to $65/mo recurring, or optional client-managed handoff
Split out of the breach-response quote (QT-NEE-2026-002) on 2026-07-20. These three items — key rotation, abandoned subsite cleanup, and mail restoration — are ordinary operational hardening, billable independently of whichever breach-response tier is chosen.
ManageWP 7-key rotation + audit
Abandoned subsite triage (biz/advertise/LIVE newsletter subsite)
Server-mail restoration — DNS fix + relay of 2,965 frozen messages
Feature Requests
New work orders & projects ready to greenlight.
Site Search Engine (Job 2)
Right now a search on your site takes 5–6 seconds — and it gets slower as you publish more, because WordPress is scanning decades of articles with no real search engine behind it. We fix that with our own search engine, licensed for your site — no third-party plugins to buy or renew, ever. Every tier is delivered within 1 week of your deposit. Pick your level:
- Modern indexed search engine replaces the stock WordPress search
- Takes searches from 5–6 seconds today down to a fraction of that
- Smarter ranking: titles, recency and your papers weighted properly
- Results page styled to match your site
- 30-day warranty on everything we build
- Everything in FAST, plus:
- Search-as-you-type suggestions (autocomplete)
- Filter search by publication — readers search their paper
- Monthly readers-search report — see exactly what your audience is looking for; your ad team can sell against it
- 30-day warranty on everything we build
- Everything in SMART, plus:
- AI-powered search suggestions and “related articles” recommendations that keep readers on the site longer
- Smart handling of typos and natural questions
- 30 days of hands-on tuning included after launch *(up to 6 hours; overage $75/hr)*
- 30-day warranty on everything we build
Approve on the payment page.
Susan raised concern the LiquidWeb server may be undersized. Eddy's sequencing is right: measure AFTER upgrades so the baseline reflects PHP 8.1 + Redis + purged 23GB error logs. Any pre-2026-07-15 reading is obsolete and understates the improvement — the box may well be fine now. Do NOT let anyone buy a bigger server before re-measuring.
- Post-upgrade server capacity assessment
- CPU/RAM/IO steady-state + peak
- TTFB under load
- newsletter send window overlay
2,849 CNEWSTV posts are organized BY HOST (Michael Miller, Fara Sax, Gloria Burns, etc.) — but programs have their own shows. Farasax and fara-sax exist as duplicate categories (same person, split). Reorganize into show-based taxonomy. This is the PREREQUISITE for the 24/7 broadcast channel (separate quote QT-NEE-2026-008) — you can't program a channel whose library is filed by host.
- CNEWS TV taxonomy overhaul
- reorganize 2,849 posts from host-first to show-first
- deduplicate host categories
- migrate existing tags
Michael reports the server 'gets slow' during newsletter sends. SendLayer already handles transactional WordPress mail — but the newsletter system is unknown (Mailchimp? Sendy? cPanel mail? plugin?). Also: revenue-facing infrastructure ('Reach Over 60,000 Inboxes' house ad = CN sells newsletter reach). Before proposing a migration to Resend/Postmark/Mailgun, discover what actually sends, list size, and bounce hygiene. Discovery-only quote — migration quote follows.
- Newsletter Sending Discovery — We audited your mail setup: your newsletters go out through EmailOctopus — a third-party email-marketing platform that is connected and active on your site and sends from its own cloud, not from your web server.
- Your staff email runs on Google Workspace, and your site transactional mail goes through an SMTP plugin.
- So the sending is not actually happening on your own server — EmailOctopus does the heavy lifting.
- This discovery confirms the specifics before we recommend anything: your EmailOctopus plan and list size, send volume and bounce/list hygiene, deliverability (your domain has SPF and DKIM but no DMARC, worth adding regardless), and whether the server slows during sends is actually EmailOctopus-related or a separate load issue to pinpoint.
- A migration or optimization proposal follows from the findings.
Eddy's own note: 'cnewstv should have its own channel and broadcast live 24/7 365 looping the pre-recorded videos and transmitting their own scheduled livestreams.' This is a PRODUCT, not a fix — a linear 24/7 channel with scheduled livestreams. Reframes CNEWS TV from 'a bunch of videos on a site' to 'a channel with programming.' Requires QT-NEE-2026-007 (taxonomy overhaul) as prerequisite.
- CNEWS TV 24/7 broadcast channel
- playlist scheduler
- live-stream ingest
- public-facing player
- scheduled programming
CNEWS TV streaming infrastructure (recurring)
One live login-scoped dashboard where Michael sees his whole publishing business in one place — powered by MC20 (already renders your reports.needawebnow.com/cn view). Three tiers, custom integration allowance included at each. Featured tier NETWORK flips the dashboard from your expense line to your OWN revenue product (advertisers pay YOU for the portal).
Essentials — Audience + Search Visibility + Site Health
Essentials — monthly hosting + data refresh
Publisher — Essentials + Advertising performance + On-site-search intelligence
Publisher — monthly hosting + data refresh
Network — Publisher + Newsletter + CNEWS TV metrics + advertiser sub-logins (FEATURED)
Network — monthly hosting + data refresh
