Skip to main content

Hosting and deployment

This page is the inventory of how nutritionistpro.com is deployed. For connecting to the server, see SSH access. For the domain and DNS, see Domain and DNS. For how the site got here, see Moving the site to the new AWS tenant.

The nexgen_v3 tenant, since 2026-10-21

On 2026-10-21 the site moved from a 2021 Bitnami instance in the old Axxya tenant to the instance nutritionistpro-web in the nexgen_v3 tenant (the account that runs the Nexgen apps), on a patched PHP 8.2. The old instance is described at the end of this page until it is deleted.

URLs​

  • Site: https://nutritionistpro.com/. The apex is canonical; www.nutritionistpro.com returns a 301 to it, and so does http://.
  • Admin: https://nutritionistpro.com/wp-admin/, which redirects to the login page at https://nutritionistpro.com/wp-login.php.
  • REST API root: https://nutritionistpro.com/wp-json/. Its url and home values must both read https://nutritionistpro.com; see WordPress configuration.
  • Sitemap: https://nutritionistpro.com/sitemap_index.xml (Yoast SEO).
  • Robots and llms.txt: https://nutritionistpro.com/robots.txt and https://nutritionistpro.com/llms.txt (generated per request and by the Website LLMs.txt plugin respectively).
  • Docs: https://nutritionistpro.com/docs/. This path never reaches WordPress; a Cloudflare Worker serves it from the docs Pages project. See Cloudflare.

The AWS account​

The instance is in the nexgen_v3 tenant (account 202077789656), which is the default AWS CLI profile on the operator's machine and the account that runs the Nexgen apps, the MCP server, the customer API, and the dashboard. Lightsail is a separate console section from the Copilot-managed services, and the instance is the only Lightsail resource in that account.

The Lightsail instance​

  • Region and Availability Zone: us-east-1, zone us-east-1a.
  • Instance name: nutritionistpro-web, tags purpose=nutritionistpro-website and issue=713.
  • Blueprint: WordPress packaged by Lightsail (blueprint id wordpress_ls_1_0), a Debian 12 image with distribution packages, so PHP is patched with apt like any Debian server. This is not the retired Bitnami blueprint; see Which blueprint to launch.
  • Bundle (size): large_3_0, 2 vCPUs, 8 GB RAM, 160 GB SSD.
  • Created: 2026-10-21, with the AWS CLI.
  • Public IP: 35.174.58.107, the Lightsail static IP named nutritionistpro-web-ip, attached to the instance. Private IPv4 172.26.14.0; private hostname ip-172-26-14-0.
  • Networking: no AAAA record points at the instance, and none should be added; Cloudflare serves the site over IPv6 at its own edge. See Domain and DNS.
  • WordPress administrators: Axxya, cawood, julien, randy, and rasool, carried across from the old site. The blueprint's default user account was replaced by the import and does not exist.
  • Firewall (Lightsail networking tab): 80 and 443 admit only Cloudflare's published IPv4 and IPv6 ranges, so the origin cannot be reached directly by IP; 22 admits the operator's IPv4 address plus the four Lightsail aliases for the console's browser SSH client. Tightened to this state at 19:19 UTC on 2026-10-21, after the transfer and the pre-cutover tests; a direct https://35.174.58.107/ request gets no answer. The script that sets the whole rule set (it has to be restated in full, since put-instance-public-ports replaces every rule) is on Moving the site to the new AWS tenant; run it without the extra addresses to restore this state. It needs jq and the nexgen_v3 CLI profile, so run it on the Mac, not on the instance. Cloudflare's ranges change rarely, but if they do the script fetches the current lists.
  • Automatic snapshots: enabled, one per day. Lightsail keeps the last seven.
  • Alarms: none.
  • SSH key: the imported key pair cawood-mac. See SSH access.

Software stack​

Confirmed on the instance on 2026-10-21:

  • Operating system: Debian 12 (bookworm), kernel 6.1.0-54-cloud-amd64, with unattended security updates from bookworm-security.
  • Web server: Apache 2.4.68 with OpenSSL 3.0.22, running PHP as an Apache module (mod_php, mpm_prefork), so there is no PHP-FPM. ServerName nutritionistpro.com is set globally.
  • PHP: 8.2.35 (Debian package php8.2, the release of 2026-10-21 that fixes CVE-2026-109618 and CVE-2026-109619). The web server's php.ini is /etc/php/8.2/apache2/php.ini, set to upload_max_filesize = 64M, post_max_size = 64M, memory_limit = 256M, and max_execution_time = 120. Imagick is not installed; WordPress uses GD. Upstream support for PHP 8.2 ends on 2026-12-31, after which Debian's security team keeps patching it until bookworm's end of life in mid-2028; Site Health will keep recommending PHP 8.3 or newer. See The patched PHP gate.
  • Database: MariaDB 10.11.19, local to the instance. Database size: 245 MB after the import on 2026-10-21. The old site's database was 1,154 MB because the Redirection plugin's 404 and redirect logs had grown to 863 MB; those two tables were carried across empty. To list the biggest tables: sudo -u www-data wp --path=/var/www/html db query "SELECT table_name, ROUND((data_length+index_length)/1024/1024) AS mb, table_rows FROM information_schema.tables WHERE table_schema=DATABASE() ORDER BY mb DESC LIMIT 10".
  • WordPress: 7.1.3 (updated from the image's 7.1 on 2026-10-21), with WP_AUTO_UPDATE_CORE set to minor in wp-config.php, as on the old site.
  • WP-CLI: /usr/local/bin/wp; run it as sudo -u www-data wp --path=/var/www/html.
  • wp-content after the import: uploads 685 MB, plugins 503 MB, themes 82 MB. The old site's 2.9 GB of stale backup folders (ai1wm-backups and updraft) were left behind.

Origin TLS certificate​

Cloudflare's encryption mode is Full (strict), so the origin must present a valid certificate for nutritionistpro.com. The certificate is a Cloudflare Origin CA certificate (RSA) for nutritionistpro.com and *.nutritionistpro.com, valid until 2041-10-17, installed in /etc/apache2/sites-enabled/default-ssl.conf as /etc/ssl/certs/nutritionistpro-origin.pem with the key at /etc/ssl/private/nutritionistpro-origin.key. There is no renewal job and nothing to expire for fifteen years. It is trusted only by Cloudflare, which is fine because the firewall admits only Cloudflare; a browser or curl that reaches the origin directly sees an untrusted certificate, and testing the origin by IP means curl -k or temporarily trusting Cloudflare's Origin CA root, as described under Test the new origin before cutover. The local copies of the certificate and key are in the operator's private keys folder under WordPress_NewAWS_Oct_2026_keys.

Outgoing mail​

WordPress sends mail (Gravity Forms notifications, account and update notices, the weekly mail report) through the WP Mail SMTP Pro plugin. Since 2026-10-27 its mailer is Microsoft 365 / Outlook, connected as cawood@axxya.com and forcing leads@axxya.com as the sender (the first test failed with ErrorSendAsDenied; see Outgoing email); before then it was Amazon SES, also sending as leads@axxya.com. Every email it sends, what it is for and when, is on Outgoing email. Its credentials must not be written here.

Mail for the domain itself (the @nutritionistpro.com mailboxes) is Microsoft 365, not this server; see Domain and DNS.

Backups​

  • Lightsail automatic snapshots, daily, last seven kept. A snapshot is the only full backup of the instance, including the database and wp-config.php. Take a manual snapshot before any risky change; see Taking a manual snapshot.
  • All-in-One WP Migration 7.112 is installed and can export the database, uploads, plugins, and theme into one file by hand; the free version has no schedule and caps imports well below this site's size. The old site's exports were not carried across.
  • UpdraftPlus 1.26.13 is active but has nothing scheduled (last log entry 2026-06-05), so it is effectively unused and a candidate for removal.
  • Backups that only exist on the instance are lost with it, so neither plugin replaces the Lightsail snapshot.

Taking a manual snapshot​

Take one before any change that is hard to undo from wp-admin: a database search-replace, a plugin or theme install or update, a WordPress core update, or a change to wp-config.php or the Apache configuration. The site stays up while the snapshot is taken, and it usually finishes in a few minutes.

In the console: sign in to the nexgen_v3 tenant (account 202077789656), open Lightsail in N. Virginia (us-east-1), open the instance nutritionistpro-web, go to the Snapshots tab, and click Create snapshot. Give it a name that says why it was taken, for example nutritionistpro-web-before-origin-ip-fix-2026-10-27. Wait until it shows as available before starting the change.

With the AWS CLI on the default profile (the nexgen_v3 tenant), from the Mac:

SNAP="nutritionistpro-web-before-<change>-$(date +%Y-%m-%d)"
aws lightsail create-instance-snapshot --region us-east-1 --instance-name nutritionistpro-web --instance-snapshot-name "$SNAP"
aws lightsail get-instance-snapshot --region us-east-1 --instance-snapshot-name "$SNAP" --query 'instanceSnapshot.state' --output text

Repeat the last command until it prints available (it prints pending while the snapshot runs). To list the instance's snapshots, newest first:

aws lightsail get-instance-snapshots --region us-east-1 --query "reverse(sort_by(instanceSnapshots[?fromInstanceName=='nutritionistpro-web'], &createdAt))[].[name,state,createdAt]" --output table

Manual snapshots are kept until someone deletes them, unlike the seven automatic ones, and Lightsail bills for their storage. Delete one in the console once the change it protected has been checked and has run for a few days.

Restoring does not roll the instance back in place. It creates a new instance from the snapshot, which then takes over the static IP:

aws lightsail create-instances-from-snapshot --region us-east-1 --instance-snapshot-name "$SNAP" --instance-names nutritionistpro-web-restored --availability-zone us-east-1a --bundle-id large_3_0 --key-pair-name cawood-mac
aws lightsail detach-static-ip --region us-east-1 --static-ip-name nutritionistpro-web-ip
aws lightsail attach-static-ip --region us-east-1 --static-ip-name nutritionistpro-web-ip --instance-name nutritionistpro-web-restored

The Cloudflare A record stays 35.174.58.107 because the static IP moves with it. Check the new instance's firewall on its Networking tab and set it back to the Cloudflare-only rules with the script linked under The Lightsail instance if it does not match, then clear the WP Rocket cache. Keep the original instance stopped, not deleted, until the restored one has been checked.

Theme and plugins​

The theme is Divi 4.27.6 by Elegant Themes (4.27.9 available), with the Theme Builder providing the global header (including the scrolling announcement banner) and footer. The license is active on the new instance; the license account: TODO (step 1). Twenty Twenty-Five is kept as WordPress's fallback theme; the image's other default themes were deleted.

Plugins and what each one is for, with versions from the new instance on 2026-10-21. License accounts marked TODO (step 1) come from each plugin's settings page in wp-admin.

  • Yoast SEO 28.7: the sitemap, page titles, meta descriptions, and the robots.txt block. See Content editing.
  • Website LLMs.txt 8.6.3: generates llms.txt. See Content editing.
  • Gravity Forms 3.2.0 (updated from 2.10.5 during the move; license account: TODO (step 1)) with GravityExport Lite 2.7.4 (gf-entries-in-excel): the contact form and the two desktop trial forms. Drip for Gravity Forms 2.1.2 is installed but was deactivated on 2026-10-21 because Drip is no longer used; delete it. See Trial sources.
  • WPCode 2.4.0 (insert-headers-and-footers): the freshsales-trial-lead webhook PHP snippet that posts trial form entries to the nexgen backend for Freshsales, the inactive backfill snippet, and the pricing JSON-LD header snippet. See Trial sources.
  • WP Rocket 3.23 (3.23.5.1 available; license Multi 500, valid to 2027-02-04; license account: TODO (step 1)): page cache, delayed JavaScript, lazy loading, preloading. Needs WP_CACHE true in wp-config.php and its own block in .htaccess. Clear its cache after a header or theme change, and after any change made directly in the database. Divi keeps its own generated CSS as well: after a database change that touches page styles or image URLs, also clear it under Divi > Theme Options > Builder > Advanced > Static CSS File Generation > Clear, then clear WP Rocket. Its advanced-cache.php drop-in is the one wp plugin list shows.
  • Site Kit by Google 1.190.0: connects Search Console, Analytics, and Ads. Connected Google account: TODO (step 1). It encrypts its credentials with the wp-config.php salts, which is why the salts were copied from the old instance.
  • Microsoft Clarity 0.10.37: session analytics (Clarity project yx5vt2wpe7) and its Brand Agents feature, an AI assistant for visitors. Both are in use. Brand Agents is what loads the obfuscated script adsagentclientafd-b7hqhjdrf3fpeqh2.b01.azurefd.net/frontendInjection.js (script id brand-agent-frontend-js-module) on every page and registers the adsagent/v1 REST namespace; that script is expected. The plugin's own wp-admin page asks to sign in to Microsoft before it shows the dashboard, but tracking works without it.
  • Jetpack 16.3.1: stats and the XML-RPC connection to WordPress.com, connected as owner cawood@axxya.com (free plan). Jetpack Boost is not installed. The connection had to be re-established after the cutover, which is only possible once DNS points at the instance.
  • Redirection 5.10.1: URL redirects. Rule count: TODO (step 1). The rules moved with the database; the 404 and redirect logs started empty on the new instance. Consider turning its 404 logging off or capping its retention so the database does not grow by hundreds of megabytes again.
  • All-in-One WP Migration 7.112 and UpdraftPlus 1.26.13: backups, see above.
  • WP Mail SMTP Pro 4.9.0 (4.10.3 available): outgoing mail, see Outgoing email.
  • All-in-One Video Gallery (AIOVG) 4.9.7: the video pages; owns the /player-embed/ and /video-tag/ URLs.
  • ARPrice 3.9: the pricing tables.
  • Cookiebot 4.7.5: the cookie consent banner.
  • Ninja Tables 5.2.18, Robo Gallery 5.2.6, WordPress Popular Posts 7.4.3, Blog Designer 3.1.8, WOW Carousel for Divi Lite 3.3.1: content widgets used on individual pages.
  • Enhanced Media Library 2.9.4, Export Media with Selected Content 2.1.4, Robin Image Optimizer 2.0.9: Media Library organization, export, and image compression.
  • Sidebar Manager 2.0.0: custom sidebars.
  • Under Construction Page 5.83: a maintenance-page plugin. It is active, so its maintenance mode must stay switched off.
  • WordPress Importer 0.9.7: the standard WXR importer.
  • Better Search Replace 1.4.11: installed but inactive. Activate it only for a site-wide URL change and deactivate it afterwards; see Content editing.
  • The plugin behind the mcp REST namespace: TODO (step 1). None of the names above obviously owns it.

Deleted during the move (they were inactive on the old site or bundled with the image): Akismet, All in One SEO Pack, AMP, ARPrice Responsive Pricing Table, Email Marketing, Google Analytics for WordPress, Hello Dolly, Simple Tags, Tidio Live Chat, W3 Total Cache, WP-Optimize, the free WP Mail SMTP, and Amazon Polly.

Connected external services​

  • Cloudflare: DNS, CDN, WAF, and the /docs Worker. See Cloudflare.
  • Google Search Console: the https://nutritionistpro.com/ URL-prefix property, owned by cawood@axxya.com. See Google Search Console.
  • Google Tag Manager: the website loads container GTM-TTMXW7G2. The Nexgen apps use a different container; see Conversion tracking.
  • Freshsales: receives desktop trial leads through the nexgen backend, not directly. See Trial sources.
  • The nexgen_v3 tenant: the app, trial, api, mcp, and dev subdomains are its services, listed on Nexgen V3 deployment. The website links to the shop and the trial registration on them.

The old instance​

Kept for rollback until the new instance has had a few days of traffic, then to be stopped, snapshotted, and deleted; see After the move.

  • Old Axxya tenant, account 898347667108, console at 898347667108.signin.aws.amazon.com/console, AWS CLI profile axxya-old on the operator's machine (its stored key belongs to another team member's IAM user; replacing it is a pending cleanup, or the profile can go when the account is closed).
  • Instance Npro2, us-east-1a, bundle large_2_0, created 2021-10-14, static IP StaticIp-3 = 54.162.107.22, dual-stack with IPv6 2600:1f18:1bb4:4500:af44:a308:37a7:ee7c, private IP 172.26.11.45. Bitnami WordPress stack 5.8.1-18: Apache 2.4.51, OpenSSL 1.1.1n, PHP 7.4.24 under PHP-FPM, MariaDB 10.3.31, all out of support and unpatched for CVE-2026-109618 and CVE-2026-109619. Its firewall has admitted only Cloudflare on 80 and 443 since 2026-10-21 (PHP security stopgap (October 2026)); its Let's Encrypt certificate renews from the bitnami user's crontab and was valid to 2027-01-01.
  • Automatic snapshots daily (seven kept) plus six manual snapshots, the newest Npro2-1792594309-Oct21_2026 taken before the stopgap changes. Its wp-content still holds 2.0 GB of All-in-One WP Migration exports and 887 MB of UpdraftPlus backups.
  • A second Lightsail instance in that account, Axxya (static IP 3.92.153.207, created 2021-09-13), hosted the retired axxya.com site, which now redirects to nutritionistpro.com at the Cloudflare edge. It was still running an unpatched PHP 7.4.21 open to the internet on 2026-10-21 and is being stopped. Nothing on this site depends on it.

What is not here​

  • The product documentation at /docs is a separate Docusaurus site deployed from the Axxya-Systems/docs repo to Cloudflare Pages. See Documentation.
  • The Nexgen apps and the MCP server run in the nexgen_v3 tenant under AWS Copilot. They share the AWS account with this instance and nothing else.
  • The pricing pages on the website are hand-maintained copies of the app's prices. See Pricing.