The situation: a six-year-old WordPress site and an AI pilot
The company is a Swedish wholesaler with a few dozen employees, selling both to businesses and to consumers. Its website was built in WordPress six years ago, and two years later a webshop plugin was added for consumer orders. The person who built the site is no longer involved, and updates are done by whoever has time. Last spring the marketing team started a pilot with an AI chatbot on the website, connected to the product catalogue. Management wants to know whether to rebuild the site, what to do with the chatbot and what is risky right now. That question became the brief for a review of web, IT and AI.
What we looked at
We read the site the way a visitor, a search engine and an attacker would. That covered the WordPress installation, the theme and plugins, the PHP version, speed on a mobile connection, data from Search Console and how the shop's checkout behaves. For hosting and domains we followed the chain from registrar to DNS and on to the servers and services each record points at, including the records for email. In the AI pilot we looked at which provider and model it uses, where the API key is kept, what data the chatbot sends and how its answers are checked. We also asked who has access to what, and who would notice if something broke.
What we found on the website
The site runs on a PHP version that no longer receives security updates, and eleven of its 38 plugins are waiting for updates. Two of them have been abandoned by their developers. The theme is built on a page builder that loads a large number of scripts on every page, and big, uncompressed product images make the largest content element load slowly on mobile. Search visibility is good for the brand name but weak for product categories, because the category pages have little text and duplicate titles. The checkout works but asks for an account before payment. The website review describes the same areas in general terms.
What we found in hosting, domains and email
The domain is registered in a private account belonging to a former employee, so the company cannot renew or move it without that person. DNS sits with a third provider. An old subdomain still points, through a CNAME record, at a hosting service where the campaign site has been deleted, which means someone else could claim the name there and show their own content on the company's subdomain. The SPF record does not include the newsletter tool, so those mailings fail SPF, and there is no DMARC record at all. Backups are taken, but nobody had tried restoring one.
What we found in the AI pilot
The chatbot is a plugin that calls an AI provider directly, with an API key stored in the WordPress settings and created in a consultant's personal account. There is no spending limit, and the invoice goes to the consultant's card. The chatbot receives the whole conversation, including names and order numbers customers type in, and nobody has decided whether that is acceptable or where the data is processed. The answers are not tested against a set of known questions, so nobody knows how often it gives a wrong price or delivery time. Questions of this kind are part of the AI review.
What we would do first, and what can wait
First, the domain moves to an account the company owns, the dangling subdomain is removed, a restore from backup is tested, and PHP and the plugins are updated with a staging copy of the site as a safety net. Next, the newsletter tool is added to SPF, and DMARC is published with p=none to start collecting reports. The chatbot gets a key in the company's own account with a spending limit, and a short test set of real questions before it is shown to more visitors. A new website can wait. Category texts, titles and image sizes can be fixed on the current site, and a rebuild becomes a decision for next year, made with better data.
What they got in writing
The company received a written recommendation of a few pages. It describes the current state in plain language, orders the risks by how much harm they can do and gives the options for each one, with what each option requires. For the larger questions, rebuilding the site and expanding the chatbot, it sets out what needs to be known before deciding. It also states what we would do first. The document belongs to the company and can be handed to whoever does the work, in-house or outside.