CMS
WordPress audit: cache, builders, and headers nginx actually sets
· Configuration notes, not a newsroom.
How SiteRune fingerprints WordPress, what the WordPress bootcamp playbook contains, and why page builders show up as CMS health — not as a moral failing.
Fingerprint, then dialect
We detect WordPress from wp-content, generator tags, and common plugin fingerprints. WooCommerce is a separate slug when the shop stack is visible. The playbook is written like a senior WP engineer: staging, updates, full-page cache (LiteSpeed or Cloudflare APO), kill unused builders, security headers at nginx, Yoast/Rank Math sitemap + schema, publish llms.txt.
What we ship for WordPress
A mu-plugin snippet for headers when you do not control nginx. We do not ship a replacement llms.txt or robots.txt if the origin file is already stronger. We do not recommend 'install another security plugin' as the first move — headers and cache usually pay faster.
- Update debt and builder CSS as CMS-health findings, not malware.
- XML sitemap and schema via the SEO plugin you already run.
- AI-bot robots policy that does not fight Wordfence's block-AI preset blindly — we report the file.
Run it on a live URL
The brief will name your CMS and attach the files. Three guest scans, no card.