Security + Performance Site Audit · 2025

Security & Performance
Audit Report

Prepared For Upstate-Canna.Co

Prepared By Peter & Esteban
Report Type Security + Speed
Platform WordPress / cPanel
Priority Action Required
🔐

Malware & Security Scan

No Malicious Code Found
Current scan revealed zero active malware, injected scripts, or compromised files. The site is clean at this time.
⚠️
Residual Script Residues
Leftover scripts from deleted plugins were detected. cPanel access is required to fully clean these remnants.

The following are red-flag indicators that would signal a real infection. None were found on your site.

  • 🚨Scripts loaded from suspicious random domains — e.g., cdn-analytics.xyz, free-crypto-miner.ru
  • 🚨eval() calls scattered throughout code — a common obfuscation technique
  • 🚨Scripts injected via document.write or innerHTML manipulation
  • 🚨Unexpected network calls to unrecognized external domains
  • None of the above appear in your site's code. You are currently clear.

This code found on the page is not malware, tracking, or hacking code.

Legitimate Regulatory ID
OCM-CAURD-23-000005
OCM NY Office of
Cannabis Mgmt
CAURD Conditional Adult-Use
Retail Dispensary
23 Year
Issued
000005 License
Number

This is a CAURD dispensary license #5 issued in 2023, required by New York State regulators to be displayed on cannabis business websites. No action needed.

◆ ◆ ◆
🔍

Recommended Action — Search Console

Even though no malware was found in the code scan, verify your standing with Google directly using the steps below.

1

Log into Google Search Console

Visit search.google.com/search-console and sign in with the account linked to your site.

2

Select Your Website Property

Choose your domain from the property list in the top left dropdown.

3

Navigate to Security Issues

Go to Security & Manual ActionsSecurity Issues in the left sidebar. If Google has flagged anything, warnings will appear here.

4

Browser Test — Incognito Check

Open your site in Chrome/Firefox Incognito mode. If blacklisted, you'll see "Deceptive site ahead", "This site may harm your computer", or similar Google Safe Browsing warnings.

◆ ◆ ◆

Core Web Vitals: FAILED

Both Mobile & Desktop Failed Scanned Twice — Consistent Results

Site rendering is poor in Google's eyes. All major performance bottlenecks were identified. This directly impacts search rankings and user experience.

FAILED
LCP
Poor
Largest Contentful Paint
Main content loads too slowly
FAILED
INP
Poor
Interaction to Next Paint
Page response feels sluggish
FAILED
CLS
Poor
Cumulative Layout Shift
Elements jump during load
◆ ◆ ◆
🚀

Performance Optimization Plan

The following full optimization suite will be implemented to pass Core Web Vitals and bring the site to peak performance.

CSS Optimization
Advanced Caching
JavaScript Optimization
Adaptive Image Optimization
Lazy Loading
Turbocharged CSS + JS
Real-Time Image Optimization
Font Optimization
Ultra-Fast Global CDN
Critical CSS Optimization
Remove Unused CSS
Code Minification
Delay / Defer JavaScript
Browser Caching
Cache Preloading
Responsive Image Delivery
WebP / Next-Gen Images
Database Optimization
Remove Orphaned Data
Clean Autoloaded Options

Over time, WordPress stores massive amounts of unnecessary data — revisions, drafts, expired cache, leftover plugin tables, orphaned metadata, and ghost cron jobs. This directly slows page loading and increases server load.

  • Remove unused revisions, drafts & expired transients
  • Clean and optimize all database tables
  • Reduce heavy autoloaded options that delay page loading
  • Remove orphaned metadata and ghost cron jobs
  • Keep the database lightweight and consistently efficient
◆ ◆ ◆
🔑

Access Required — cPanel / FTP

To complete the cleanup and optimization, we need FTP access to your hosting. Here's how to create a restricted FTP account (works on cPanel, GoDaddy, SiteGround, Bluehost):

1

Log into your hosting control panel

Access cPanel or your host's dashboard (GoDaddy, SiteGround, etc.)

2

Go to FTP Accounts

Navigate to cPanel → FTP Accounts or Manage FTP on GoDaddy.

3

Create New FTP User

Username: e.g., designer01 · Set a strong, unique password · Directory: /public_html for full site or /public_html/wp-content/uploads for limited access.

4

Set Optional Storage Quota

Limit how much storage this FTP account can access, then click Create. Share the credentials with us securely.

◆ ◆ ◆
🔌

Recommended Plugins & Services

The following premium tools are needed to fully address the database bloat, speed issues, and security requirements identified in this audit.

Plugin / Service What It Does Est. Cost
Anti-Malware Pro
Scans for malware & threats, detects suspicious code, helps clean infected files $30–$40/yr
Advanced Database Cleaner Pro
Removes junk data, old revisions, drafts, transients, and orphaned tables; improves database efficiency $30–$40/yr
WP Performance & Speed Optimization
Full speed optimization: caching, CSS/JS minification, image compression, CDN setup, database optimization $150–$300 one-time
ASE Pro
Admin & Site Enhancements
Enhances WP admin dashboard, useful tools, optional security add-ons: login limiting & 2FA $39/yr
◆ ◆ ◆
💰

Investment Summary

Audit & Reporting
3 hrs
Initial audit, scan, analysis & this report
Fix & Setup Labor
3–4 hrs
Plugin configuration, cleanup & optimization
Plugin Pro Licenses — 1 Year
$200
All 4 premium plugins, annual licenses included
Labor — Fixing & Setup
$400
Plugin config, DB cleanup, speed optimization
Total Investment
$600
Plugins + Labor — all-in, first year
Plugin Pro Licenses (1 yr)
$200
Labor — Fix & Setup
$400
Total Due $600

$200 covers all 4 premium plugin Pro licenses for one full year. $400 covers hands-on labor: plugin setup, database cleanup, speed optimization, and Core Web Vitals fixes. Renewal of plugin licenses in year 2 is approximately $200.

📎 Full Reference Document
Detailed Audit Report
Complete findings, raw scan data, and extended notes
View Full Report