Review report survivalism.pl

Site

survivalism.pl, a blog about survival, preparedness and the outdoors, in Polish with some posts in English

Platform

WordPress 7.1.2 (7.0.6 before the round), PHP 8.3

Theme

Iconic One 3.4 with its own child theme

Plugins

27, all active

Server

shared hosting, LiteSpeed server

Round

23 September 2026 on the working copy, deployed to production on 24 September 2026

A sample report from a care round. The site belongs to the person who ran the round. Chapter 6 describes the issues found: each one ends with a box saying what was done in the round or, where the recommendation stays open, a recommended fix.

1. Summary

• Round of 23 September 2026, deployed on 24 September 2026: the WordPress core was updated (from 7.0.6 to 7.1.2), along with three plugins, the site theme, four inactive default themes and the translations. Everything was done on a working copy first; production stayed unchanged until the deployment.
• One update carries security fixes: Copy & Delete Posts 1.5.6 (two fixes, section 4). Automatic updates for this plugin were switched off on production, so the fix released on 18 August 2026 was waiting for the round.
• The core needed no patching. WordPress released the security fixes of 7.1.1 and 7.1.2 on the same day for the 7.0 branch as well, and the site installed them by itself; the fix for a critical flaw reachable without logging in went in 16 minutes after the release was announced.
• A visual comparison of 12 pages on a phone and a computer found one regression: the new theme version turned the link under post teasers into English text, also on Polish pages. Fixed before the deployment. After the fix, 22 of 24 screenshots are identical to the pixel; the login screen differs because of the new look in WordPress 7.1.
• Browser console and PHP error log: no new errors.
• After the deployment, recommendations 6.2-6.5 were carried out: automatic updates for two plugins, removal of inactive plugins and themes, a clean-up of the code repository and removal of a backup folder with no access block. The recommendation on remote database backups (6.7) was deferred by the owner's decision.
• The deployment fixed a fault that predated the round: the open menu on a phone showed one of its five items (6.6).
• Round time up to the end of tests on the copy: 40 minutes; deployment to production with checks: 7 minutes (section 7), without errors (section 8).

2. Backup and working copy

• Database backup before any change: 23 September 2026, 16:04, 136 tables, stored off the site's server.
• The state of the production files before the round (read at 16:03) was saved in the code repository separately, before the changes of the round. Since the previous save (5 August 2026), automatic updates had changed or added 4,049 files and deleted 795. The changed and added files were compared with production by checksum: 4,049 of 4,049 match.
• The working copy was restored from production on the same day (files and database). The updates were done on it first.
• On the working copy, outgoing mail and connections to outside services are intercepted and scheduled tasks are switched off, so that the test sends nothing on behalf of the site. Screenshots are taken with analytics and advertising scripts blocked.

3. Updates: versions before and after

Unchanged, because no newer versions existed on the day of the round: the other 29 plugins and the Twenty Twenty-Five theme. 27 of these plugins have automatic updates switched on, two do not (Filenames to latin and JSON Basic Authentication, 6.2). Vue Sun App and JSON Basic Authentication come from outside the wordpress.org directory and have no update channel, so the absence of a newer version says nothing about them. ACF PRO 6.8.10 is the latest version (ACF in the wordpress.org directory has the same numbering, release of 10 September 2026). The child theme is our own and has no outside releases; one function in it was changed (6.1).

4. Security fixes from the release notes

Copy & Delete Posts 1.5.6 (released 18 August 2026)

The release notes list two security fixes and two related bug fixes:

• stronger permission checks when copying and duplicating posts;
• post data and custom fields are sanitised before display, so that content is not exposed;
• copying is available only to users with the right permissions;
• password-protected posts do not expose their content when duplicated.

Automatic updates for this plugin were switched off on production, so the fixes had been waiting since 18 August 2026 (recommendation in 6.2).

WordPress core

• WordPress released two security releases of the 7.1 branch: 7.1.1 (17 September 2026) and 7.1.2 (22 September 2026). The fixes for the 7.0 branch came out on the same days as 7.0.5 and 7.0.6; the site installed both automatically (17 September at 22:54 and 22 September at 16:17).
• 7.1.2 and 7.0.6 close the critical flaw CVE-2026-87902: a path traversal in page template selection, reachable without logging in and under certain conditions leading to code execution on the server. Timeline on 22 September 2026 (UTC+2):
  • 16:01 - WordPress announces the release;
  • 16:17 - the site updates itself to 7.0.6 and sends the administrator an update notification;
  • 19:44 - first observed attempts to exploit the flaw (according to Patchstack).
• WordPress marks version 7.0.6 as outdated but secure. The update to 7.1.2 in this round is a move to the current branch, not a patch for the flaw.

Other components

The release notes contain no security fixes:

• CookieYes 3.5.5 and 3.5.6: compatibility with WordPress 7.1, a translation fix, documentation;
• Redis Object Cache 3.0.0: newer library versions, cache fixes (among others, a write when replacing a key that does not exist, and a connection left hanging in pipeline mode after bulk operations);
• Iconic One 3.3 and 3.4: compatibility with WordPress 6.9 and 7, fixes for PHP warnings, support for old versions of Internet Explorer removed, new text for the link under teasers (effect in 6.1);
• default themes: releases accompanying WordPress 7.1 (documentation, CSS prefixes).

5. Visual comparison before and after

• Scope: 12 pages (home page in Polish and in English, three posts including one in English, a category, two static pages, contact, search results, the 404 error page, the login screen), each on a phone (390 x 844) and a computer (1440 x 900): 24 pairs of screenshots.
• Noise control: before the updates, a second screenshot run without any change gave 24 of 24 identical pairs, so every difference after the update comes from a change, not from the tool.
• After the updates, before the fix: 8 pairs differ (home page in Polish and in English, category, search results, on both devices), from 6.9% to 28.5% of pixels. Cause: the text of the link under teasers (6.1).
• After the fix: 22 of 24 pairs identical to the pixel. The login screen differs by 0.3% (computer) and 1.2% (phone): WordPress 7.1 added a help icon next to "Remember me", underlined the links under the form and labelled the language picker. A change from the release, not a regression.
• Browser console and network: no new errors compared with the state before the updates.
• PHP error log: empty after the views of all 24 screenshots.
• PHP 8.3 (the production server version): syntax of all 531 changed PHP files without errors; behaviour on 8.3 checked after the deployment (section 8).

6. Issues and recommendations

6.1 Link under post teasers (regression caught and fixed before the deployment)

Iconic One 3.4 changed the link under teasers from "Dowiedz się więcej »" (Learn more) to "Read More:" followed by the post title and "»". The new text is missing from the theme's Polish translation, so post lists in Polish showed English text, and the longer link shifted the layout.

A link with the post title would be better for screen readers and search engines, but it changes how post lists look. The owner's decision: the earlier link stays, with no change in look.

6.2 Plugins without automatic updates

Switched off on production for: Copy & Delete Posts, CookieYes, Redis Object Cache, Filenames to latin and JSON Basic Authentication. Recommendation:

• Copy & Delete Posts and CookieYes: switch on (security fixes will not wait for the round);
• Redis Object Cache: leave for the rounds, because a drop-in file in the content folder is updated together with the plugin;
• Filenames to latin: last release 9 August 2020, tested with WordPress 5.5; the plugin is no longer developed, to be replaced or removed;
• JSON Basic Authentication: inactive, from outside the wordpress.org directory, to be removed (6.3).

6.3 Inactive plugins and themes

Inactive plugins: Broken Link Checker, JSON Basic Authentication, Vue Sun App, WP Slug Post Type Custom Language (last release 24 December 2022). Inactive themes: five default themes (Twenty Nineteen to Twenty Twenty-Five). The code of an inactive plugin or theme still sits on the server and can be reachable from outside. Recommendation: remove the plugins that are not needed and keep one default theme as a fallback.

6.4 Firewall working files in the code repository

The firewall (Wordfence) writes its configuration and rules to its working folder, and they change while the site runs. The folder was in the code repository, so every round started with changes that are not changes to the site. Recommendation: exclude this folder from the repository.

6.5 Backup folder without an access block (fixed on 24 September 2026)

After an automatic update to version 5.0.4 (9 September 2026), the Duplicator backup plugin created a new folder for backups. Its protection only forced files to download and did not block access from outside, and the earlier folder with a manually added block was gone. The next backup of the site (database and files) would therefore have been publicly downloadable. On the day of the read the folder held no backup.

A lesson for care: an automatic plugin update can remove a protection that was set up by hand earlier, so the round checks backup folders, not just version numbers.

6.6 Menu cut off on phones (a fault from before the round, fixed at the deployment)

After opening the menu on a phone, one of its five items was visible: the list unfolded inside a bar 100 pixels high, the other items lay outside it and could not be tapped. Before the deployment this was checked on production at four screen widths (360, 390 and 767 pixels and a phone held sideways): the fault showed on all four, so it existed before the round, not after it. Cause: a style rule of the parent theme positions the menu list absolutely inside the bar.

A before-and-after screenshot comparison (section 5) will not show this fault, for two reasons: the screenshots show the page with the menu closed, and a fault present before and after produces identical screenshots. From this round on, the check also covers states after a click (open menu and submenu, search, consent banner) and checks them on their own terms, not only by comparison.

This check also shows that on a phone the cookie consent banner covers the menu button until the reader answers the banner. That is common behaviour for consent banners; it stays as it is.

6.7 Backups only on the same server

UpdraftPlus backs up the database daily and the files only by hand, and it stores both on the same server, with no remote copy. A server failure or takeover takes the site together with its backups. The site files, including uploaded images, are in the code repository off the server, so the missing link is the database.

The owner's decision of 24 September 2026: deferred. The site's content changes rarely, and the database backup made before the changes of this round is stored off the server, so a failure would only lose the changes made since the last round. The recommendation comes back when the site is developed again.

7. Round time

UTC+2, 23 September 2026.

The time for the "before" screenshots includes about 5 minutes of a one-off change to the tool (blocking analytics scripts on the copy); in later rounds this time drops out.

Deployment to production, 24 September 2026 (after the owner's approval, section 8):

8. Deployment to production and checks after it

UTC+2, 24 September 2026. The owner approved the deployment in the morning; deployed on a Thursday, not on a Friday.

• Production state just before the deployment: compared file by file with the read of 23 September 2026, 16:03, on which the round was tested: no changes. Changes made on production by automatic updates (outside the code repository) were saved in the repository, and the round was moved onto that save. The file tree after the move is identical to the one tested on the copy, apart from four plugin working files (backups and sitemap) that the round does not touch.
• Database backup just before the deployment: 08:46, 137 tables, dump completed correctly, stored off the server.
• Switch: 08:48. Database version unchanged (61833), so no database upgrade. Page cache and object cache cleared.
• Check from outside (a browser with a real user agent, not a bot): home page in Polish and in English, a post, a category, contact and the login screen respond correctly; the link under teasers on the home page and in the category is in Polish (5 of 5, none in English); site assets at version 7.1.2; no PHP error messages in the page code. The pages render on the production server, that is on PHP 8.3.
• Menu on phones: before the deployment one of five items at each of the four widths, after the deployment five of five (6.6).
• PHP error log: on the day of the deployment the site kept no PHP error log (debug mode off), so the check after the deployment relied on page responses and full display in a browser, not on a log. On the same day, writing errors to a file outside the public folder was switched on, without showing them to visitors; a test entry sent by the site reached that file.
• Deployment time with checks: 7 minutes (section 7).