# Women Unlimited

Domain: womenunlimited.africa
Owner: Women Unlimited (SA NGO client)
Stack: Divi, WooCommerce, Peach Payments, Wordfence, FastPixel

## Security incident — 2026-07-31

**Issue:** `wp-content/debug.log` (3.96 MB) publicly accessible at `https://womenunlimited.africa/wp-content/debug.log`.
Flagged by Wordfence as Critical (Public Files).

**Root cause:** Three compounding issues:
1. `WP_DEBUG` set to `true` in `wp-config.php` — production site was logging every PHP warning/fatal to `debug.log`
2. `.htaccess` in `wp-content/` had `<Files "debug.log"> Deny from all</Files>` using Apache 2.2 syntax (`Order deny,allow`) — **LiteSpeed ignores this syntax**, so the rule was dead
3. No LiteSpeed vhost context blocking the file, so it was served directly with `HTTP 200`

**Fix applied:**
1. `wp-config.php`: `define('WP_DEBUG', true)` → `false` (line 89). Backups at `*.bak-20260731-0422`.
2. `wp-content/.htaccess`: replaced broken Apache 2.2 deny rule with LiteSpeed-compatible `<IfModule mod_authz_core.c>Require all denied</IfModule>` block (defence in depth)
3. `/usr/local/lsws/conf/vhosts/womenunlimited.africa/vhost.conf`: added exact-path context block (the regex `~ "debug\.log$"` form did NOT match — only exact-path `/wp-content/debug.log` worked):
   ```
   context /wp-content/debug.log {
     allowBrowse  0
     accessControl {
       deny *
     }
   }
   ```
4. Cloudflare cache purged via API (`/zones/{id}/purge_cache`) — single URL purges need a wait, `purge_everything:true` is more reliable
5. Stale `debug.log` file deleted from disk

**Verification:**
- `curl -sI https://womenunlimited.africa/wp-content/debug.log` → **HTTP 403** (was 200, 4MB)
- File no longer being written to (WP_DEBUG off)
- Homepage still 200, `wp-config.php` still protected

**Lesson — regex context in LiteSpeed:** The regex `~ "pattern$"` form works for things like `\\.user\\.ini$` and `wp-config\\.php$` but did NOT match `debug\\.log$` on this vhost. Exact-path context (`context /wp-content/debug.log`) is the reliable form for blocking specific files. See `wiki/web/litespeed.md` for follow-up note.

---

# Women Unlimited Performance Audit
Date: 2026-05-20
Score: 78 mobile vs Myreton 93

## Key Metrics Gap
| Metric | WU | Myreton |
|--------|-----|---------|
| Performance | 78 | 93 |
| TBT | 470ms | 10ms |
| Speed Index | 4.2s | 1.8s |
| LCP | 3.1s | 2.9s |
| Scripts loading | 47 | ~25 |

## Root Causes (Priority Order)

### 1. WooCommerce loading on every page (HIGH IMPACT)
WooCommerce loads 7 JS files on the homepage including add-to-cart.min.js,
jquery.blockUI, woocommerce.min.js, js-cookie - none needed on homepage.
Divi also loads theme-scripts-library-woocommerce.js globally.
Fix: Use Code Snippets or Asset CleanUp plugin to dequeue WC scripts on
non-shop/cart/checkout pages.

### 2. DiviFlash loading 5 scripts globally (HIGH IMPACT)
lightgallery.js, swiper.min.js, contentcarousel.js, blogCarousel.js,
df-menu-ext-script.js all load on every page regardless of whether
DiviFlash modules are used on that page.
Fix: DiviFlash has per-module asset loading setting - enable it.
Dashboard > DiviFlash > Performance > Load assets only when module is used.

### 3. Mapster Maps + Google Maps loading globally (MEDIUM)
Google Maps API (googleapis.com) detected loading on homepage - map is
not on homepage. Complianz is blocking it but the script tag is still
being enqueued and parsed.
Fix: Dequeue mapster scripts on pages without a map.

### 4. wp-security-audit-log frontend hook (LOW-MEDIUM)
WSAL (wp-security-audit-log) has known frontend performance overhead
from its hooks. Not on Myreton.
Fix: Verify it's needed - MainWP Child handles most audit needs.
If just for security logging, Wordfence already covers activity.
Consider deactivating.

### 5. 40/47 scripts have no defer/async (MEDIUM)
FastPixel's JS optimisation should be deferring these but TBT of 470ms
suggests it's not fully working - possibly because WooCommerce scripts
have jQuery dependencies that prevent deferral.
Fix: In FastPixel settings, add woocommerce scripts to excludes and
handle them separately, or use a dedicated WC performance plugin.

### 6. Peach Payments (LOW on homepage, HIGH on checkout)
Not loading on homepage but will heavily impact checkout page score.
Not a homepage issue but worth noting for overall site performance.

## FastPixel Settings Comparison
Both sites have identical FastPixel config - not a settings issue.

## Quick Wins (Do These First)
1. DiviFlash > Performance > per-module asset loading = biggest gain for effort
2. Deactivate wp-security-audit-log if not essential
3. Dequeue WooCommerce scripts on non-WC pages via mu-plugin

## Expected Score After Fixes
TBT should drop from 470ms to ~50-80ms = Performance score ~88-92