Skip to main content

Changes made in 2026

This page is the change log for the website's configuration: hosting, domain, Cloudflare, wp-config.php, and the plugins that affect how the site is served. It exists so that whoever moves the site to the new AWS tenant knows what differs from a stock Bitnami WordPress install. Day-to-day content edits are not listed. Each entry links to the page that documents the change in full.

Dates to confirm

Entries marked "date to confirm" were reconstructed from the runbook history and public records. Correct them from the Cloudflare audit log, the wp-admin Plugins page, or memory. TODO (step 1).

Timeline​

  • 2026-06-24: the plan to serve the product docs at nutritionistpro.com/docs was settled: move the zone to Cloudflare and route the path with a Worker, rather than a docs subdomain. The public docs Pages project nutritionistpro-public-docs was created. See Documentation.
  • 2026-06-27: nameservers moved from GoDaddy to Cloudflare. The zone was imported with the MX, SPF, and verification records, the apex and www records were proxied, and SSL/TLS was set to Full (strict). See Domain and DNS.
  • Late June 2026 (date to confirm): the Cloudflare Worker on route nutritionistpro.com/docs* went live, serving the docs Pages project. See Cloudflare.
  • July 2026: on the Cloudflare zone, "Block AI training bots" was set to allow crawlers and the Cloudflare-managed robots.txt was turned off, so AI crawlers are no longer blocked. See Cloudflare.
  • 2026-07-26: wp-config.php was changed to hardcode WP_HOME and WP_SITEURL to https://nutritionistpro.com and to set HTTPS on when Cloudflare forwards an HTTPS request. This fixed http:// URLs in the sitemap and robots.txt and stopped the site serving itself under the EC2 hostname. See WordPress configuration. The Website section of these runbooks was written the same day.
  • July 2026: the page indexing report in Google Search Console was reviewed. The findings are on Google Search Console.
  • 2026-09-14: the WPCode snippet that posts desktop trial form entries to the nexgen backend began sending the trial product, so desktop leads enter the right Freshsales journey. See Trial sources. The snippet's install date: date to confirm.
  • 2026-09-17: the Release Notes page was corrupted by the Divi front-end Visual Builder copying the global header and footer into the page, and was repaired. See Milestones and release notes.
  • September 2026 (date to confirm): the Website LLMs.txt plugin was installed to publish llms.txt; it was confirmed rebuilding the file on 2026-09-24. See Content editing.
  • 2026-09-28: the scrolling sale announcement banner in the Divi global header was edited and the procedure recorded. See WordPress configuration.
  • 2026-10-16: the hosting inventory, this change log, the domain page, and the migration procedure were added to the runbooks, and the migration was opened as issue 713.
  • 2026-10-21: PHP released fixes for two critical remote code execution bugs (CVE-2026-109618 and CVE-2026-109619) in PHP 8.2 and later; the site's PHP 7.4 has no fix. The Lightsail firewall was restricted to Cloudflare's ranges on 80 and 443 (closing the origin bypass listed below), and PHP's recommended stopgap settings were applied in the PHP-FPM pool and php.ini. The same day it was found that AWS retires the Bitnami WordPress blueprint on 2026-11-19 with no updates since 2026-05-19, so the migration procedure was rewritten to target the Lightsail-packaged WordPress blueprint. See PHP security stopgap (October 2026) and Moving the site to the new AWS tenant. Tracked in issue 746. The firewall and the server settings were both applied on 2026-10-21, and the log checks that day found scanner noise and an XML-RPC flood from 2026-10-20 but no sign of the PHP bugs being exercised. The same day a Cloudflare custom WAF rule, Block xmlrpc except Jetpack, was added to stop that flood at the edge (see Cloudflare), and the replacement instance nutritionistpro-web was created in the nexgen_v3 tenant from the Lightsail-packaged WordPress blueprint and upgraded to PHP 8.2.35; see Moving the site to the new AWS tenant. That evening the content was copied to it (the database without the Redirection plugin's 863 MB of 404 and redirect log rows, and wp-content without the 2.9 GB of old All-in-One WP Migration and UpdraftPlus backups), the Origin CA certificate was installed, and the new origin passed the curl checks. At about 19:05 UTC the apex A record was changed to the new instance's static IP 35.174.58.107 and the post-cutover checks passed, so the site has run on PHP 8.2.35 in the nexgen_v3 tenant since then. Along the way: the WordPress core files were updated to 7.1.3, the wp-config.php salts were copied so Site Kit stayed connected, WP_CACHE was set for WP Rocket, Gravity Forms was updated to 3.2.0, the Drip add-on was deactivated (Drip is no longer used), thirteen inactive plugins and five unused themes were deleted, and the Redirection plugin's 863 MB of 404 and redirect logs were left behind. Jetpack had to be reconnected after the cutover.
  • 2026-10-27: WP Mail SMTP Pro was switched from Amazon SES to the Microsoft 365 / Outlook mailer, connected as cawood@axxya.com and sending as leads@axxya.com, with Send As granted to the connected account. See Outgoing email.

Other plugin installs or settings changes during the year (Site Kit, WP Rocket, Jetpack Boost, Redirection): dates to confirm from the Plugins page and add here.

Still open​

  • Clear the Amazon SES credentials still saved in WP Mail SMTP, and deactivate their IAM access key. See Outgoing email.
  • Always Use HTTPS is off on the Cloudflare zone. The origin now answers http:// with a 301 to https://, so the practical gap is small, but turning it on at the edge is still the cleaner setting. See Cloudflare.
  • No HSTS header.
  • No DMARC record on nutritionistpro.com. See Domain and DNS.
  • The new instance runs PHP 8.2.35, which upstream stops supporting on 2026-12-31; Debian keeps patching it after that, and Site Health will keep recommending 8.3 or newer. See Moving the site to the new AWS tenant.
  • After the move: run the pending plugin and theme updates (Divi 4.27.9, WP Rocket 3.23.5.1, WP Mail SMTP Pro 4.10.3, Microsoft Clarity), change the administrator password that passed through terminals during the build, delete the deactivated Drip add-on and consider removing UpdraftPlus, install Imagick, and replace the hardcoded http://nutritionistpro.com image URLs in page content (63 of them on the homepage alone) with https:// using wp search-replace. See After the move.
  • The old instance Npro2 in the old Axxya tenant is still running and is to be stopped once the new instance has had a few days of traffic, then snapshotted and deleted. Its static IP StaticIp-3 keeps billing while attached to a stopped instance. Issue 713 and the website part of issue 746 close when that is done.
  • The deploy-docs and runbooks skills in the Axxya-Systems/docs repo and the agent memory have been updated for the new instance; recheck them after the old tenant is closed.