Hosting model:hybrid — LIVE on cPanel / LiteSpeed / CloudLinux, QA on a Kinsta clone restored from UpdraftPlus. No push path between hosts. Since 2026-10-14 the clone is refreshed from a Kinsta restore point + a fresh DB dump via the cPanel API, and Claude runs the LIVE replay through a cron-queued wp-cli runner over the cPanel API (Mitz’s decision; hybrid runbook §3.4 amended for this site).
Payment: PayPal (ppcp-gateway) + Pay by Invoice (COD). Advanced Card Processing explicitly disabled 2026-10-14 after PayPal Payments 4.1.3 newly enabled it (client may re-enable once the PayPal restriction is lifted); PayPal Standard, bank transfer, cheque and the 8 EU local methods disabled / filtered out.
Shipping: 8 zones / 12 methods — Australia, USA (5 FedEx services), Western Europe incl. UK, Southern Europe, Northern Europe, Canada, Asia, India, plus Rest of the world.
Backups: UpdraftPlus, run manually. No schedule configured for files or database.
Elementor core and Pro must be updated in the same action. A version split takes the site to HTTP 500 — proven on the clone 2026-08-05.
woocommerce-paypal-payments — the hold is LIFTED, but only via the right method.(Supersedes the previous “HELD at 3.3.2” rule, 2026-08-26.) The 4.0.4 and 4.1.1 fatals were artifacts of the update path, not the releases. A major bump on this plugin MUST be deactivate → delete → confirm the folder is gone → fresh install. Never the dashboard Update button. 4.1.2 verified clean on the clone on WP 7.1 + WC 11.0.1. Note 3.3.2 declares WC tested up to: 10.4 while LIVE runs 11.0.1.
LIVE database is 67 MyISAM tables(re-measured 2026-08-24; the earlier “133” predates the WooCommerce HPOS-era table changes), including wp_options. Never bulk-update; cap batches at 3 plugins with a log scan between each until the InnoDB conversion is done.
Do not update SeedProd while it is serving maintenance mode — it is the maintenance driver on this site. Update it after maintenance is lifted. And switch it back to inactive afterwards — it was left active after the 2026-08-26 replay and kept the store at HTTP 503 for anonymous visitors.
litespeed-cache gets its own batch, LAST. Updating the page-cache plugin alongside others while the site is in maintenance mode lets the cache capture the 503 while the tool needed to purge it is the one being replaced. Cost a production outage on 2026-08-26.
Never navigate away, close the tab, or start another admin action while a batch is installing. Wait for the completion screen. Doing so cuts off the request mid-update and strands the .maintenance file, taking the whole site — including wp-login.php — to HTTP 503. Confirmed cause of the 2026-08-26 outage.
Maintenance mode is not “off” until an anonymous request proves it. A logged-in admin sees a normal site while every visitor gets 503. Verify with curl or a private window, never from an authenticated session.
jQuery is not defined on LIVE is noise, not a fault. LiteSpeed’s Delay JS until user interaction holds ~60 scripts until a real mouse move, so any headless check reports a healthy store as broken. Count script[type="litespeed/javascript"], simulate interaction, then re-check. The clone also cannot validate add-to-cart for variable products at all, because nginx cannot serve LiteSpeed’s combined-JS bundle.
SSH to LIVE does not work — the port is 2683 (not 22/2222), firewalled from every address we hold; cPanel cannot allowlist it. Decided 2026-10-14 not to pursue. Use the cPanel API (token + login in Bitwarden) and, for wp-cli, the cron-queued job runner.
Premium plugins that refuse to update on the clone will update normally on LIVE, because the licence is bound to the live domain. Vault zips are the fallback for the clone.
Verify the schema name in any database query. Both environments hold identically-named WordPress tables; a query pointed at the wrong one produced a false “all InnoDB” result in the May 2026 report.
Known issues carried forward
PayPal PAYEE_ACCOUNT_RESTRICTED — client action required. Blocks PayPal payments and is the likely cause of 6–7 s cart load times.
MyISAM to InnoDB conversion on LIVE — root cause of the February 2026 ten-day outage. Scheduled as a separate task.
Rogue administrator accountsenphysical (547) and siapyearyt (542) — identified 2026-08-05, confirmed still present 2026-08-24, still not removed after three runs.
Mass spam registration(new 2026-08-24) — users_can_register=1 and 5,955 users on a B2B chemical supplier: 2,138 in June, 1,108 in July. Almost none have ordered. Needs registration hardening plus a purge of orderless accounts.
boron-theme/functions.php:156 — add_category_name() reads $category[0]->slug with no guard, so every product-page view emits a warning. One-line fix prepared 2026-08-24, awaiting client approval.
Disk: 5.1 GB of UpdraftPlus archives, up from 3.5 GB, now ~60% of an 8.5 GB site. Consent-gated.
Order cancellation rate 26% over 90 days (5 of the last 12 orders). Likely payment friction alongside the PayPal restriction; recommended as a separate billable investigation.
Wordfence scan outstanding since May; malware status is “removed, not yet cleared”.
Toolset types 3.5.2 — 3.6.3 available; the licence updater gives wp-cli no package on LIVE (2026-10-14). Update from wp-admin → Updates.
blaze-ai-discovery-for-woocommerce 1.1.3(found 2026-10-14) — logs a missing wp_blazeaid_endpoint_log table ~500×/day since 2026-10-01. Blaze plugin; installer fix needed (Jayr).
Mailchimp for WooCommerce sync failing on LIVE(found 2026-10-14) — RateLimited + api.list errors; wp_mailchimp_jobs 479k rows / 287 MB.
LiteSpeed inline minify mangles the wc_variation_gallery_defaults snippet on product pages (isolated syntax error; excluded from combine 2026-10-14, still minified). Exclude from minify or report upstream.
Web-root quarantine 2026-10-14 (/home/boronmol/quarantine-2026-10-14/, 15 MB) and the 4.33 GB API backup archive in the home directory — delete after client confirmation.
Updates
2026-10-14 — 25 plugins + Astra on both environments; first LIVE replay run by Claude (cron-queued wp-cli over the cPanel API), 15 batches in an 84-minute coming-soon window, 0 fatals. WooCommerce 11.0.1 → 11.2.1, Elementor pair → 4.3.5/4.3.2, Astra → 4.14.0, Gravity Forms 2.9.26 → 3.1.3.2, PayPal Payments 3.3.2 → 4.1.3 (card gateway kept off), GTM4WP → 2.0.6. Fixed the dead header search on the optimised LiteSpeed path; quarantined the web-root strays. Toolset types pending.
2026-08-26 — 19 plugins + Astra + WordPress core 7.0.4 → 7.1 (major). WooCommerce 11.0.0 → 11.0.1, Elementor pair → 4.2.3/4.2.2, Astra → 4.13.10. Ghost Inspector SUCCESS 15/15; no gateway or shipping drift. Broke the three-month PayPal Payments hold — 4.1.2 installs cleanly via delete-then-fresh-install, though it was deferred on LIVE and is now PRIORITY for next run. Took a production 503 outage during batch 5, cause confirmed as navigating away mid-update. Solved the slug on null carry-forward. New finding: ~5,955 users from open registration.
2026-08-05 — 27 plugins + 1 theme on both environments. WooCommerce 10.7.0 → 11.0.0, Elementor pair → 4.2.1, Astra → 4.13.8. Ghost Inspector 16/16 pass. PayPal Payments held. Found two rogue administrator accounts and two recording errors in the previous report; raised the PHP memory limit to 512M.
2026-05-27 — first hybrid run. WP 6.9.4 → 7.0, WooCommerce 10.4.3 → 10.8.0, Elementor 3.35 → 4.1.1, LIVE PHP 7.4.33 → 8.3. Removed the udujevaz malware dropper from LIVE. (No vault post — predates this documentation hub.)