Technical SEO
Security, crawlability, indexability, Search Console · verified October 3, 2026
28/100
Some basics are fine. All 88 published URLs return 200, are index, follow, and point their canonical tag at themselves. Every title is unique. http, www and http-www all redirect to https://nweautocare.com/ in one hop, and wp core verify-checksums passes on WordPress 7.0.4. Four serious problems pull the score down. A 1.8 GB full-site backup can be downloaded by anyone (C1). The page sitemap crashes with a PHP fatal error, so none of the 87 pages are in a working sitemap (C3). Wabu has no Search Console access, even though someone verified the domain (C4). And the site carries about 26 orphaned, duplicate or leftover pages that compete with the real ones (H1). We checked everything on this page live today: HTTP requests, wp-cli over SSH on the New Wabu Web Server (cPanel account nweautowabuapps), DNS and WHOIS, and Search Console in Chrome.
Public Site Backup (C1)
A complete copy of the website and its database can be downloaded by anyone
- /wp-content/ai1wm-backups/nweauto-wabuapps-com-20260223-233509-mclkgvlw4c5w.wpress returns HTTP 200 with Content-Length: 1,822,594,031 (1.8 GB), last modified February 23, 2026. The first bytes are a valid All-in-One WP Migration header, so this is a real, restorable backup.
- These exports contain the whole database (user accounts, password hashes, form data) plus every site file, including wp-config.php with the database password.
- The folder's .htaccess only turns off directory listings. It doesn't block downloads.
- We searched the access logs that are still on the server (December 2025, and May, June, September and October 2026) and found no requests for the file. Logs for January–April and July–August 2026 aren't kept, so an earlier download can't be ruled out.
Context: we found the same problem on another site on this server earlier this week. A Wabu hardening mu-plugin on this account (wabu-harden-batch.php, added September 22, 2026) notes that the WordPress REST batch endpoint "was the entry vector for the September 2026 compromise" on this server. Core files verify clean today, but that history is one more reason to rotate the credentials, and to check every site on the server for an ai1wm-backups folder.
XML Sitemap (C3)
The page sitemap crashes, so none of the real pages are in a working sitemap
robots.txt points to /sitemap_index.xml (Rank Math). The index loads and lists four child sitemaps, but only one of them actually contains the site's pages, and that one fails:
| Sitemap | What it returns |
|---|---|
| /post-sitemap.xml | One URL: /hello-world/ (the default WordPress post) |
| /page-sitemap.xml | Takes about 184 seconds, then returns HTTP 200 with a PHP fatal error instead of XML |
| /category-sitemap.xml | One URL: /category/blog/ |
| /local-sitemap.xml | /locations.kml (Rank Math Local SEO) |
Fatal error: Allowed memory size of 1073741824 bytes exhausted (tried to allocate 1970176 bytes) in /home/nweautowabuapps/public_html/wp-content/themes/Divi/includes/builder-5/server/FrontEnd/Module/Style.php on line 454
So the only URLs Google gets from the sitemap are Hello World and the blog category. The 87 real pages are missing. The error also shows the server's file path to anyone who opens it. Rank Math's sitemap settings are 200 items per page with include_images: on; building the image list makes the Divi 5 beta render every page's styles and runs out of 1 GB of memory.Fix (C3): in Rank Math → Sitemap Settings, turn off "Include Images" and lower links per sitemap (for example to 50). Update Rank Math (1.0.269 → 1.0.279) and Rank Math Pro. Then confirm /page-sitemap.xml loads in a few seconds and lists the live service pages, and not the duplicates that H1 retires.
Google Search Console & Analytics (checked directly, C4)
Someone verified this domain in Search Console, but it isn't Wabu
We checked today in Search Console, signed in as wabuwebdesign@gmail.com. Both sc-domain:nweautocare.com and https://nweautocare.com/ say "Oops, you don't have access to this property." But DNS has a google-site-verification=LM76YXgK… TXT record, which means another Google account verified the domain. We don't know whose: it could be the client, the original site builder (WordPress admin albertgalopastor1987), or Clutch Clicks, the agency behind nwautocaretx.com.A sitemap file on the server is not the same as a sitemap submitted in Search Console. Here the file is broken (C3) and we can't see what was submitted. Once access is sorted out, check the submitted-sitemaps list for anything unexpected (plugin-folder paths with random names, huge page counts, dates that don't match our work). This server had a compromise in September 2026, so treat any odd entry as a possible sign of it, not as stale data.
Action C4: ask the client which Google account owns Search Console and get owner access for Wabu. If nobody can be found, verify it again as Wabu (a new DNS TXT record in IONOS). Then submit /sitemap_index.xml after C3 is fixed, review Page indexing, Manual actions and Security issues, and import the property into Bing Webmaster Tools with IndexNow turned on. Bing is how ChatGPT finds sites.
Two different Google Analytics tags load on every page
Every page loads both G-HF68X7Z5KG and G-F3ZB43T30G (we don't know who owns either). That's two property owners, about 360 KB of extra script, and no single place where visits, calls and bookings are counted. No conversion events for tel: clicks or the Shopmonkey "Book Service" button were found. Keep one property, owned by the client with Wabu as admin, and add those events (M5).Duplicate, Orphaned & Leftover Pages (H1)
The site has two generations of service pages: an older set ending in -katy-tx (built around May 2026) and a newer set (July 2026) that the menu links to. The old set was never redirected, so both versions are live and indexable. 26 published pages have no internal links pointing to them at all. Several of the old pages are the ones that actually rank, so they need 301 redirects to the matching new page, not plain deletion.
| Old / duplicate URL | Live page it competes with | Ranking today (Semrush) | Action |
|---|---|---|---|
| /oil-change-service-katy-tx/ | /oil-change/ | — | 301 |
| /brake-repair-and-services/ | /brake-repair/ | — | 301 |
| /transmission-repair-katy-tx/ | /transmission-service/ | — | 301 |
| /vehicle-state-inspections-katy-tx/ | /state-inspections/ and /vehicle-inspection-2/ (three pages for one service) | — | 301 both extras to one page |
| /wheel-alignment-katy-tx/ | /alignments/ | — | 301 |
| /auto-ac-repair-katy-tx/ | /ac-heating-repair/ | — | 301 |
| /car-diagnostic-services-katy-tx/ | /diagnostic-service/ | "best car diagnostics katy tx" #24, "check engine light diagnostic katy" #46 | 301 (carry the equity) |
| /auto-fluid-flush-katy-tx/ | /fluid-flushes/ | — | 301 |
| /tire-shop-katy-tx/ | /tire-shop/ | "northwest express auto care" #34 (cannibalizing the home page) | 301 |
| /module-reprogramming-and-software-updates/ | /module-reprogramming-software-updates/ | — | Keep one, 301 the other |
| /shocks-and-struts-replacement-service-katy-tx/ | No new equivalent (closest: /steering-suspension-repair/) | "shocks and struts replacement katy" #9 (140/mo) | Keep, link from the menu, or 301 to suspension |
| /engine-cooling-system-repair-katy-tx/ | No new equivalent | "coolant flush katy" #46 | Keep and link, or fold into /fluid-flushes/ |
| /auto-repair-in-katy-tx/ | / (home) | "transmission flush katy" #1 (110/mo); brand #19 | 301 to /fluid-flushes/ or /transmission-service/ after copying its transmission-flush text |
| /home_old/, /new/ | / and /acura/ | — | 301 / delete |
| /services-2/, /service-page/ | /services/ | — | 301 to one services hub |
| /hello-world/ | Default WordPress post, sample comment, comments open | — | Delete; close comments |
| /author/albertgalopastor1987/, /category/blog/ | Archive pages | — | noindex (Rank Math) |
Separately, real money pages are orphaned too: /services/, /coupons/, /financing/, /warranty/, /vehicles/, /mobile-service/ and the new /privacy-policy/ aren't linked from the menu, the footer, or any page. The 40 car-make pages are linked only from /new/, which is itself an orphan. Linking those is M1. The /vehicle-inspection-2/ slug in the menu also reads like a leftover copy.
Crawl & Index Checks
| Check | Result | Status |
|---|---|---|
| http://, http://www, https://www → https apex | 301 to https://nweautocare.com/, 1 hop each | Pass |
| Search engine visibility | blog_public = 1; all 88 URLs index, follow, max-image-preview:large; all canonicals self-referencing | Pass |
| Titles / meta descriptions | 88 unique titles; 2 pages with no meta description | OK |
| robots.txt | Disallow: /wp-admin/, Allow: /wp-admin/admin-ajax.php, sitemap line. AI crawlers are allowed by default, not named explicitly (L1). | OK |
| XML sitemap | Page sitemap fatal error; only Hello World + blog category listed | Fix (C3) |
| Search Console / Bing Webmaster Tools | Verified by an unknown account; no Wabu access; no Bing access known | Fix (C4) |
| Duplicate / orphan pages | ~10 duplicate service pairs, 4 homepage/services variants, 26 orphans | Fix (H1) |
| Server response (TTFB) | 0.82 / 0.83 / 0.87 s on three tries; Lighthouse "root document took 790–820 ms" | Slow (H4) |
| Page size | Average HTML 2.9 MB per page; home 2.28 MB, of which about 2.1 MB is inline CSS | Fix (H4) |
| Rendering | Content is in the raw HTML (Divi renders on the server), so non-JavaScript crawlers can read it | Pass |
| Viewport | user-scalable=no blocks pinch-zoom on phones | Fix (H7) |
| WordPress core | 7.0.4, checksums verify | Pass |
Admin Accounts & Server Hygiene (H2)
Four administrators, two of them unknown to us
| ID | Username | Registered | Note | |
|---|---|---|---|---|
| 1 | albertgalopastor1987 | albertgalopastor1987@gmail.com | 2025-11-14 | The original installer. Named as "author" in the schema on 86 pages, and has a public author archive. |
| 2 | jd | josephdavidfabiana@gmail.com | 2025-12-24 | Unknown |
| 3 | marco | marco@wabuweb.com | 2025-12-31 | Wabu |
| 4 | info@wabuweb.com | info@wabuweb.com | 2026-05-07 | Wabu |
- 8 of 9 plugins have updates waiting, all with auto-updates off: Rank Math 1.0.269 → 1.0.279, Rank Math Pro 3.0.112 → 3.0.122, WP Reviews Plugin for Google 13.2.9 → 14.2, Ollie Menu Designer 0.3.1 → 0.3.4, plus Better Search Replace, Duplicate Page, Header Footer Code Manager and Responsive Menu.
- The theme is Divi 5.0.0-public-beta.9.3, a public beta, running a live business site. It's the source of the sitemap crash (C3) and the 2.1 MB of inline CSS (H4). An inactive copy of an older beta (new/Divi51) is also installed.
- Two mu-plugins left over from a previous host: hostinger-preview-domain.php and hostinger-auto-updates.php. They don't belong on this server; remove them.
- readme.html returns 200 and reveals the WordPress install. xmlrpc.php returns 405 (fine). Better Search Replace and Duplicate Page are admin tools best deactivated when not in use.
- A draft page (xyz-ics-preview-page) and a placeholder cPanel account on the server (nweautocare / nweautocare1.com) are leftovers to confirm and clean up.
- Wabu's wabu-harden-batch.php is in place and blocks the REST batch endpoint used in the September 2026 compromise.
Security Headers & Email (L5)
| Item | Today | Status |
|---|---|---|
| Strict-Transport-Security (HSTS) | Not sent | Add |
| Content-Security-Policy | Not sent | Optional |
| X-Frame-Options / X-Content-Type-Options / Referrer-Policy | None sent | Add |
| SPF | v=spf1 include:_spf.google.com include:_spf-us.ionos.com ~all | OK |
| DMARC | No record at _dmarc.nweautocare.com | Add p=none to start |
| Mail (MX) | Google Workspace | OK |
| Domain | IONOS, registered 2017-02-03, expires 2027-02-03 | OK |
The Other Domains
nwautocaretx.com and nwmobileautocare.com
nwautocaretx.com is the duplicate GoHighLevel site built by "Clutch Clicks" that we audited on August 4. It's still live, and today Google, Bing and Brave all use it as this business's website (C2). Semrush shows it at 142 keywords and about 27 visits a month, up from 23 keywords and 0 visits in August. nwmobileautocare.com ("NW Mobile Auto Care", registered June 6, 2026) is linked from the homepage. It's a JavaScript-only Base44 app, so its raw HTML has no readable content for search or AI crawlers (L3). Both are covered on Local & Maps and AI / GEO.