14 faults found, fixed and proven on the Hollis Creek site

Exhibit A-1 The booking button was off the screen on phones

On a 390px phone the page scrolled sideways and “Request an appointment” sat past the right edge, so a patient had to know to swipe to find it.

Root cause A 2019 child-theme rule fixed the header at 1180px, stopped the menu from wrapping and hid the small-screen menu toggle.

The fix Removed the override; the parent theme’s fluid header collapses the menu under 900px and gives the button its own row.

Exhibit A-2 Phones downloaded full-size camera images

The home page sent the original uploads to every phone (a 3600px hero, a 3000px waiting room, 1600px portraits) without sizes to choose from or lazy loading.

* Lighthouse: median of 3 runs

Root cause The child theme’s home template and the team loop printed bare <img src> tags pointing at the originals: no srcset, sizes, width/height or loading="lazy".

The fix Back to wp_get_attachment_image() at the size of each slot; the hero loads first with fetchpriority="high", everything else lazily.

Exhibit A-3 Scripts and styles held back the first paint

Before anything appeared, the browser had to fetch a chain of stylesheets and run jQuery, four jQuery UI widgets and a slider for markup that no longer exists.

* Lighthouse: median of 3 runs

Root cause The child stylesheet @imported the parent (a serial download), all six font weights loaded without font-display, and the slider and its dependencies were enqueued in the head.

The fix Child stylesheet enqueued with the parent as a dependency, three font weights with swap, slider and jQuery UI deleted; the menu script is deferred.

Exhibit A-4 Zoom, focus, contrast and labels were broken

Patients could not pinch to zoom, keyboard users could not see where they were, the menu was pale grey on white and the form fields had no labels.

* Lighthouse: median of 3 runs

Root cause An old copy of header.php disabled zoom and dropped the skip link; child CSS removed focus outlines and greyed the menu; the form printed placeholders instead of labels.

The fix Deleted the stale header copy, the contrast and outline overrides, and gave every field its label back. Checked against WCAG 2.2 AA with axe-core.

Exhibit B-1 PHP notices printed above every page

Every page opened with lines of “Deprecated:” text showing server paths, and the same lines were written to a log anyone could download at /wp-content/debug.log.

Root cause PHP 7 code in the child theme that PHP 8 deprecates (optional-before-required parameters, ${} strings, a dynamic property, null passed to trim and strlen), with error display left on after the host move.

The fix Removed the dead code, turned display off, log to /var/www/logs outside the web root, and a migration deletes the old public log.

Exhibit B-2 The team page raised a PHP warning per person

Each visit to “Our team” logged one “Trying to access array offset on false” warning for every team member.

Root cause The loop read a long-deleted option as an array. PHP 7 stayed silent; PHP 8 warns.

The fix Treat the missing option as empty settings; the home page also only shows the next slot when one exists.

Exhibit B-3 The Insurance page was a white screen

Opening “Insurance and payment” showed only “There has been a critical error on this website.” with HTTP 500.

Root cause The insurance plugin sorted plans with create_function(), removed in PHP 8.0, before the page rendered.

The fix Sort with a closure, and drop the pre-render hook.

Exhibit C-1 The team list ran a query per person, per detail

Rendering “Our team” cost a database query for every member’s row, role, photo, languages and each service, and grew with every hire.

Root cause A 2016 loop with raw SQL per member (N+1), bypassing WordPress’s caches.

The fix One WP_Query with meta and term caches primed, all photos in one call, all services in one query.

Exhibit C-2 Every request loaded megabytes of dead cache

Before WordPress could start on any page, it read and unserialized the cached responses of a social feed that closed in 2023.

Root cause The feed plugin saved each response as a new option with autoload “yes” and never cleaned up.

The fix Removed the dead plugin; a repair migration deletes its options (wp hollis migrate, run by deploy.sh).

Exhibit C-3 The next free slot was found by reading every slot since 2019

The “Next open appointment” line on the home page scanned and sorted tens of thousands of old slot rows on every view.

Root cause Slots were stored as post meta and matched on meta_value, which has no usable index.

The fix A slots table indexed on (status, slot_at); a migration moves the rows. The lookup now reads one index entry.

Exhibit D-1 No security headers

Any site could frame the clinic’s pages, browsers could guess content types, and nothing limited where scripts could load from.

Root cause Nothing on the site sent them; WordPress does not by default.

The fix A hardening mu-plugin sends CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, HSTS over HTTPS, and drops X-Powered-By.

Exhibit D-2 Anyone could list the login names

/?author=1 redirected to the owner’s login name, and /wp-json/wp/v2/users listed every author, which leaves only the passwords to guess.

Root cause WordPress defaults: author archives, the public REST users route, the users sitemap.

The fix Author queries are a 404 for visitors, the users routes exist only for logged-in users, no users sitemap, no author in oEmbed.

Exhibit D-3 XML-RPC was open

xmlrpc.php answered with its full method list, including system.multicall, which tries hundreds of passwords in one request.

Root cause A WordPress default; nothing on the site uses XML-RPC.

The fix Requests to xmlrpc.php get a 403 before any method runs; no pingback header or RSD link.

Exhibit D-4 The form said thank you and sent nothing

A patient who asked for an appointment was thanked, and the front desk never received the request.

Root cause The SMTP plugin still pointed at the previous host’s relay, and the form ignored the failed send and stopped logging failures.

The fix The relay reads its host from the site configuration (Mailpit in this demo) and logs failures; the form only says thank you when the email was handed over.