Reports
Community Newspapers
mmiller657@aol.com

Project Reports

Community Newspapers — your work progress at a glance.

Cyber Security — Incident Response

Active security incident & breach response.

CN — Breach Response Service (Findings + Tiered Menu)
Pending approval

Choose your level of breach-response support. T2 is our recommendation -- meets the FIPA notification floor. T3 adds full protection + monitoring ($3,610 net after credit). Prices firm 30 days.

⚠️ Already performed 2026-07-15 — awaiting your approval to bill
  • Emergency closure of a public database exposure (1.09 GB dump publicly downloadable since 2022-12-01)
  • 45-month forensic sweep across access logs → confirmed 24 downloads by 17 distinct IPs, ~31.6 GB exfiltrated
  • Evidence preservation + hash verification + chain of custody
  • Internal incident report + 6-page client-facing notice (delivery-ready)
  • Targeted pre-flip backup (database + code), verified + secured
  • Security lockdown Phase 1 deployed (mu-plugin allow-list, 37 sessions destroyed, function-tested)
  • Admin inventory + credential remediation (15 admins audited, weak accounts flagged)

Delivered under emergency — market crisis-response for this scope typically $2,000–$3,500. Billed at flat $1,200 (with $200 goodwill credit if you approve T2 or T3 within 7 days = effective $1,000).

⚠️ Findings driving this quote
  • A public database exposure — confirmed exfiltration. 1.09 GB dump publicly downloadable Dec 2022 – Jul 2026. 24 complete downloads / 17 distinct IPs / 31.6 GB exfiltrated. Exposure closed 2026-07-15; the data cannot be recalled.
  • Database couriered to a third party, unencrypted. UpdraftPlus uploaded a 9 GB unencrypted copy to a third-party contractor's Dropbox account. Recurring copy STOPPED 2026-07-16. Historical copies in that account remain exposed — see Action Required below.
  • Active credential-stuffing attack — ~26,000 failed logins in 14 days; 399 hits on the `aaronguerrero` admin account from 375 IPs; targets running alphabetically = attackers hold the stolen user list.
  • Nothing was watching. 3.5-year exposure ran undetected. No independent monitoring on the site.
  • Abandoned WordPress subsite LIVE (newsletter.communitynewspapers.com, WP 6.2.9, open login, 34 unmaintained plugins) sharing filesystem with the live papers.
FIPA notification note
Florida's FIPA notification timeline runs from the date a breach is DETERMINED, which appears to be 2026-07-15. Tier 2 enumeration is the minimum that tells you whether and whom you must notify. Delay lands on your legal exposure.
FIPA notification deadline approaching
Deadline Aug 14, 2026
Florida FIPA 30-day notification · deadline Aug 14, 2026
20%
1/5 items delivered
Emergency incident response 2026-07-15 (delivered, awaiting approval to bill)
Includes: discovery + closure + forensics + evidence preservation + 6-page client notice + pre-flip backup + Phase 1 lockdown + admin inventory. $200 goodwill credit if T2 or T3 approved within 7 days = effective $1,000.
T1 CONTAIN
  • ⚠️ Below our recommendation — contains the incident but does not answer whose data was exposed
  • Close 2 remaining publicly-readable files (218 MB error logs)
  • Full web-root audit for other stray dumps and migration artifacts
  • Forced password reset across all user accounts
  • Rotate credentials for connected services (SMTP, mailing list, integrations)
  • Set backup encryption passphrase (stops future cleartext copies to any destination)
  • Written completion report
  • Lockdown Phase 1 already delivered — counts against this tier (see prepaid credit)
Pending approval
T3 FORTIFY
  • 🎯 Upgrade — full protection + monitoring. Contains + scopes + makes the next incident detectable.
  • Everything in T1 + T2, plus:
  • Client-owned encrypted backup destination — account created and owned by Michael, revocable app key; migrate off third-party Dropbox
  • Verified restore test (currently untested — no complete UpdraftPlus set has ever existed)
  • Backup retention remediation (`/backup` volume 100% full, silently failing since Feb 2026)
  • External uptime + file-integrity monitoring — catches the next stray artifact and the next silent outage
  • Redirect WordPress admin notifications to Michael (currently routed to `lorenzo@`, never received)
Pending approval
Review & approve →
⚠ Action Required from you — no charge
Email your former contractor to (a) delete the exposed CN backups from their Dropbox and (b) confirm deletion in writing — that written confirmation is your breach audit-trail artifact for FIPA/insurance.
In Progress— none right now

Work actively underway — interim status, not final.

Nothing actively in progress right now.

Completed Work

Paid & delivered — tap any project to see exactly what was done.

Sidebar ad-rail restore (Job 1, delivered) — per-paper advertiser rails restored sitewide
  • • Diagnosed empty ad rails (ad-caching setting colliding with theme lazy-loading).
  • • Restored each paper's OWN advertiser ads server-side across all 26 papers + homepage.
  • • House 'Advertise Here' ad as clean fallback. Verified live.
  • • BONUS (no charge): automatic backups restored + task scheduler fixed.
  • • BONUS (no charge): browser security headers added.
  • • BONUS (no charge): duplicate ad placements cleaned up.

Campaign Proposals

Ads, landing pages & marketing materials — proposed, awaiting approval. Approved items move to In Progress.

CN — Advertise-With-Us Landing Page + Form Redesign
Pending approval

The house ad we pinned first-or-second on every page (26 papers + all articles) sends traffic to /advertise-with-us/ — and Susan (Miller-Panter Advertising) confirms the page and its form are dated and underperforming. Every impression we just won via the sidebar-ad restore lands on the weakest page in your funnel. This is a full redesign: modern layout, a rebuilt high-converting form, the red-button CTA Susan wants, and conversion tracking (GA4 + Meta Pixel) so results become measurable — not a guess. Pairs with the AI ad-sales chatbot (next).

Advertise-with-us landing page + form redesign · red-button CTA · conversion tracking (GA4 + Meta Pixel events)
  • Pairs naturally with the ad-sales chatbot (separate quote QT-NEE-2026-006).
Approve & Pay →
CN — Advertise-With-Us Form Diagnostic ('is it broken or design opinion?')
Pending approval

Susan said 'half the form is faded out' on the advertise-with-us page. That sounds like a BUG (defect), not a design opinion. Cheap look confirms which. If it turns out to be a bug already surfaced during Get Current delivery, this diagnostic bills $0 (waived, folded into paid Get Current). If it's a design/UX gap, this confirms the $950 redesign quote QT-NEE-2026-005 is the right scope. Look before quoting a full redesign.

Advertise-With-Us form diagnostic — is the 'faded form' a bug (defect) or a UX opinion? Cheap look, may be waived if bug already in Get Current scope
  • Bill triggers only if the finding is a design/UX gap requiring the QT-NEE-2026-005 redesign. If the finding is a bug already covered by Get Current, this line is voided (no charge).
Approve & Pay →
CN — AI Chatbot for Ad Sales (advertise-with-us funnel)
Pending approval

Reuse NeedAWebNow's existing Netlify Functions + Claude chatbot pattern (already live on needawebnow.com) to close ad sales on the advertise-with-us page. Not a from-scratch build — pattern is proven. Trained on CN rate cards + ad services + booking flow.

AI chatbot — ad-sales funnel · Claude-powered · books calls + captures leads · integrated into advertise-with-us page
  • $850 setup + $95/mo hosting + Claude API pass-through (separate line).
Chatbot hosting + Claude API pass-through (recurring)
  • Netlify Functions + Anthropic API. Actual API usage variable — set at $95 baseline, adjusts up if volume grows.
Approve & Pay →

Highly Suggested Maintenance

New findings & cyber security we recommend addressing.

CN — Plugin & Theme Hygiene Cleanup
Pending approval

12 inactive themes still sit on the server (per L2 scan) plus an unknown count of abandoned plugins (no updates in 12+ months). Each unused theme/plugin is a security footprint that gets scanned by every attacker — the same class of finding as the newsletter subsite. Audit + prune + document what stays and why.

Plugin + theme hygiene cleanup — audit all installed, remove 12 inactive themes, retire abandoned plugins, document remaining stack

Approve →
CN — Staging Site (safety net for all future work)
Pending approval

Every risky change on communitynewspapers.com right now happens directly on production, at night, with backups as the only safety net. A staging site is what makes every future upgrade cheaper, safer, and testable BEFORE it touches the live papers. Eddy called this 'the most important line' in the scope-triage notes — quote it first regardless of which build path wins later.

Staging site — full mirror of communitynewspapers.com with password-protected access + automated prod-sync + one-click deploy path

Staging site hosting (recurring)

Approve →
CN — China Block / RSS Feed Discovery (investigation only)
Pending approval

Michael mentioned a China block was added at some point to stop scrapers on the RSS feed. TWO UNRELATED SYSTEMS share the 'RSS' name: (1) WP RSS Aggregator — INBOUND, pulls other sites INTO CN, paused since 2023 (already the $300 line in paid Get Current); (2) /feed/ — OUTBOUND, CN's OWN content going out, what China would hit AND what legitimate subscribers use. The real risk: an over-broad block on /feed/ silently kills syndication Michael thinks he still has. Investigation-only quote — answers 4 questions BEFORE any change. ⚠️ HARD CONSTRAINT: DO NOT touch or remove the block as part of this discovery. Removing a block holding off a real scraper, or leaving one starving legit syndication, are both expensive mistakes. Findings drive a follow-on fix quote (B-bucket) or a geo/bot-management strategy quote (C-bucket).

China block / RSS feed discovery — investigation only (4 questions, no changes)

Approve →
CN — NWN Managed Encrypted Backup Service
Pending approval

Choose tier by your backup footprint. Medium ($65/mo) is right-sized for CN's ~200GB with headroom. If your library grows past 250GB, we bump you to Large — no re-quote, transparent add-on. If CN takes T3 Fortify on the breach quote, Medium is INCLUDED FREE for the first 90 days.

Large
  • 250GB-1TB · $295 setup + $145/mo
  • Consider if: CNEWS TV video library keeps growing (24/7 channel proposal will push footprint past 250GB)
  • Everything in Medium, plus:
  • Point-in-time snapshots (rollback to any hour in the last 30 days, not just daily)
  • 1-year retention
  • Multi-region option (US + EU dual-copy for regulatory or highest-uptime scenarios)
Pending approval
Small
  • Up to 50GB · $195 setup + $25/mo
  • Right for: small sites, testing environments — NOT enough for CN's 200+GB footprint
  • Encrypted at rest + in transit (AES-256)
  • Weekly automated backup + verified restore test
  • 30-day retention · monitored
Pending approval
Review & approve →
Small — monthly recurring
Pending approval
Approve →
Medium — monthly recurring
Pending approval
Approve →
Large — monthly recurring
Pending approval
Approve →
CN — Site Maintenance & Hardening (split from Breach Response QT-002)
Pending approval

Split out of the breach-response quote (QT-NEE-2026-002) on 2026-07-20. These three items — key rotation, abandoned subsite cleanup, and mail restoration — are ordinary operational hardening, billable independently of whichever breach-response tier is chosen.

ManageWP 7-key rotation + audit

Abandoned subsite triage (biz/advertise/LIVE newsletter subsite)

Server-mail restoration — DNS fix + relay of 2,965 frozen messages

Approve →

Feature Requests

New work orders & projects ready to greenlight.

Site Search Engine (Job 2)

Right now a search on your site takes 5–6 seconds — and it gets slower as you publish more, because WordPress is scanning decades of articles with no real search engine behind it. We fix that with our own search engine, licensed for your site — no third-party plugins to buy or renew, ever. Every tier is delivered within 1 week of your deposit. Pick your level:

FAST
  • Modern indexed search engine replaces the stock WordPress search
  • Takes searches from 5–6 seconds today down to a fraction of that
  • Smarter ranking: titles, recency and your papers weighted properly
  • Results page styled to match your site
  • 30-day warranty on everything we build
Pending approval
AI
  • Everything in SMART, plus:
  • AI-powered search suggestions and “related articles” recommendations that keep readers on the site longer
  • Smart handling of typos and natural questions
  • 30 days of hands-on tuning included after launch *(up to 6 hours; overage $75/hr)*
  • 30-day warranty on everything we build
Pending approval

Approve on the payment page.

CN — Server Load / LiquidWeb Capacity Assessment (post-upgrade baseline)
Pending approval

Susan raised concern the LiquidWeb server may be undersized. Eddy's sequencing is right: measure AFTER upgrades so the baseline reflects PHP 8.1 + Redis + purged 23GB error logs. Any pre-2026-07-15 reading is obsolete and understates the improvement — the box may well be fine now. Do NOT let anyone buy a bigger server before re-measuring.

  • Post-upgrade server capacity assessment
  • CPU/RAM/IO steady-state + peak
  • TTFB under load
  • newsletter send window overlay
Approve →
CN — CNEWS TV Categorization Overhaul
Pending approval

2,849 CNEWSTV posts are organized BY HOST (Michael Miller, Fara Sax, Gloria Burns, etc.) — but programs have their own shows. Farasax and fara-sax exist as duplicate categories (same person, split). Reorganize into show-based taxonomy. This is the PREREQUISITE for the 24/7 broadcast channel (separate quote QT-NEE-2026-008) — you can't program a channel whose library is filed by host.

  • CNEWS TV taxonomy overhaul
  • reorganize 2,849 posts from host-first to show-first
  • deduplicate host categories
  • migrate existing tags
Approve →
CN — Newsletter Sending Discovery (before migration proposal)
Pending approval

Michael reports the server 'gets slow' during newsletter sends. SendLayer already handles transactional WordPress mail — but the newsletter system is unknown (Mailchimp? Sendy? cPanel mail? plugin?). Also: revenue-facing infrastructure ('Reach Over 60,000 Inboxes' house ad = CN sells newsletter reach). Before proposing a migration to Resend/Postmark/Mailgun, discover what actually sends, list size, and bounce hygiene. Discovery-only quote — migration quote follows.

  • Newsletter Sending Discovery — We audited your mail setup: your newsletters go out through EmailOctopus — a third-party email-marketing platform that is connected and active on your site and sends from its own cloud, not from your web server.
  • Your staff email runs on Google Workspace, and your site transactional mail goes through an SMTP plugin.
  • So the sending is not actually happening on your own server — EmailOctopus does the heavy lifting.
  • This discovery confirms the specifics before we recommend anything: your EmailOctopus plan and list size, send volume and bounce/list hygiene, deliverability (your domain has SPF and DKIM but no DMARC, worth adding regardless), and whether the server slows during sends is actually EmailOctopus-related or a separate load issue to pinpoint.
  • A migration or optimization proposal follows from the findings.
Approve →
CN — CNEWS TV 24/7 Channel (FLAGSHIP)
Pending approval

Eddy's own note: 'cnewstv should have its own channel and broadcast live 24/7 365 looping the pre-recorded videos and transmitting their own scheduled livestreams.' This is a PRODUCT, not a fix — a linear 24/7 channel with scheduled livestreams. Reframes CNEWS TV from 'a bunch of videos on a site' to 'a channel with programming.' Requires QT-NEE-2026-007 (taxonomy overhaul) as prerequisite.

  • CNEWS TV 24/7 broadcast channel
  • playlist scheduler
  • live-stream ingest
  • public-facing player
  • scheduled programming

CNEWS TV streaming infrastructure (recurring)

Approve →
CN — CNEWS Command Center (Publisher KPI Dashboard)
Pending approval

One live login-scoped dashboard where Michael sees his whole publishing business in one place — powered by MC20 (already renders your reports.needawebnow.com/cn view). Three tiers, custom integration allowance included at each. Featured tier NETWORK flips the dashboard from your expense line to your OWN revenue product (advertisers pay YOU for the portal).

Essentials — Audience + Search Visibility + Site Health

Essentials — monthly hosting + data refresh

Publisher — Essentials + Advertising performance + On-site-search intelligence

Publisher — monthly hosting + data refresh

Network — Publisher + Newsletter + CNEWS TV metrics + advertiser sub-logins (FEATURED)

Network — monthly hosting + data refresh

Approve →
Publisher Care
Upgrade
Available as an upgrade to keep your project supported and current.
Upgrade →

View proposals & quotes → · View invoices & payments →