WordPress.com loads in 10 seconds. Ground zero for performance damage.

Damage assessment

01
LCP 10.0 s. Visitors have time to brew coffee and reconsider their choices.
How to fix this
02
INP 214 ms. The site responds to clicks the way a bomb-disposal robot responds to questions.
How to fix this
03
Lighthouse performance 62/100 mobile. A passing grade in demolition school, not web performance.
How to fix this
04
/xmlrpc.php is enabled. The back door is open, painted red, and labelled for brute-force attacks.
How to fix this
05
Content Security Policy missing. No rulebook for what scripts can detonate on this site.
How to fix this
06
22 inline script blocks. Each one a small charge embedded in the page load sequence.
How to fix this
07
First Contentful Paint 3.0 s. Visitors wait three seconds just to see something, anything.

Disable xmlrpc.php immediately to close the brute-force vector. Then address LCP: audit third-party scripts, defer non-critical JavaScript, and optimize image delivery. Performance is the blast radius here.

By category

Performance: 53
SEO: 100
Accessibility: 88
Security: 80
WordPress health: 42
Copy & clarity: 100

Full report

Every finding, ranked, with fixes. $10.

All 14 findings with severity, evidence, why it matters and how to fix it, with WordPress-specific steps where they apply. Plus a checklist in the order to work through it.

$10, one-time, via Stripe. The private link is emailed to you.

Recovery

We can fix it for you

Tell us what you need. A person replies with a quote within one business day.

Share on X Share on LinkedIn

Scanned Tue, 22 Sep 2026 15:57:56 GMT. Roast written by AI from the scan data. Passive scan: we only read public pages. Is this your site? Remove this roast.