Kaburu Wiki

# Women Unlimited

Domain: womenunlimited.africa Owner: Women Unlimited (SA NGO client) Stack: Divi, WooCommerce, Peach Payments, Wordfence, FastPixel

## Security incident — 2026-07-31

Issue: `wp-content/debug.log` (3.96 MB) publicly accessible at `https://womenunlimited.africa/wp-content/debug.log`. Flagged by Wordfence as Critical (Public Files).

Root cause: Three compounding issues: 1. `WP_DEBUG` set to `true` in `wp-config.php` — production site was logging every PHP warning/fatal to `debug.log` 2. `.htaccess` in `wp-content/` had `<Files “debug.log”> Deny from all</Files>` using Apache 2.2 syntax (`Order deny,allow`) — LiteSpeed ignores this syntax, so the rule was dead 3. No LiteSpeed vhost context blocking the file, so it was served directly with `HTTP 200`

Fix applied: 1. `wp-config.php`: `define('WP_DEBUG', true)` → `false` (line 89). Backups at `*.bak-20260731-0422`. 2. `wp-content/.htaccess`: replaced broken Apache 2.2 deny rule with LiteSpeed-compatible `<IfModule mod_authz_core.c>Require all denied</IfModule>` block (defence in depth) 3. `/usr/local/lsws/conf/vhosts/womenunlimited.africa/vhost.conf`: added exact-path context block (the regex `~ “debug\.log$”` form did NOT match — only exact-path `/wp-content/debug.log` worked):

 ```
 context /wp-content/debug.log {
   allowBrowse  0
   accessControl {
     deny *
   }
 }
 ```

4. Cloudflare cache purged via API (`/zones/{id}/purge_cache`) — single URL purges need a wait, `purge_everything:true` is more reliable 5. Stale `debug.log` file deleted from disk

Verification: - `curl -sI https://womenunlimited.africa/wp-content/debug.log` → HTTP 403 (was 200, 4MB) - File no longer being written to (WP_DEBUG off) - Homepage still 200, `wp-config.php` still protected

Lesson — regex context in LiteSpeed: The regex `~ “pattern$”` form works for things like `\\.user\\.ini$` and `wp-config\\.php$` but did NOT match `debug\\.log$` on this vhost. Exact-path context (`context /wp-content/debug.log`) is the reliable form for blocking specific files. See `wiki/web/litespeed.md` for follow-up note.

—

# Women Unlimited Performance Audit Date: 2026-05-20 Score: 78 mobile vs Myreton 93

## Key Metrics Gap

## Root Causes (Priority Order)

### 1. WooCommerce loading on every page (HIGH IMPACT) WooCommerce loads 7 JS files on the homepage including add-to-cart.min.js, jquery.blockUI, woocommerce.min.js, js-cookie - none needed on homepage. Divi also loads theme-scripts-library-woocommerce.js globally. Fix: Use Code Snippets or Asset CleanUp plugin to dequeue WC scripts on non-shop/cart/checkout pages.

### 2. DiviFlash loading 5 scripts globally (HIGH IMPACT) lightgallery.js, swiper.min.js, contentcarousel.js, blogCarousel.js, df-menu-ext-script.js all load on every page regardless of whether DiviFlash modules are used on that page. Fix: DiviFlash has per-module asset loading setting - enable it. Dashboard > DiviFlash > Performance > Load assets only when module is used.

### 3. Mapster Maps + Google Maps loading globally (MEDIUM) Google Maps API (googleapis.com) detected loading on homepage - map is not on homepage. Complianz is blocking it but the script tag is still being enqueued and parsed. Fix: Dequeue mapster scripts on pages without a map.

### 4. wp-security-audit-log frontend hook (LOW-MEDIUM) WSAL (wp-security-audit-log) has known frontend performance overhead from its hooks. Not on Myreton. Fix: Verify it's needed - MainWP Child handles most audit needs. If just for security logging, Wordfence already covers activity. Consider deactivating.

### 5. 40/47 scripts have no defer/async (MEDIUM) FastPixel's JS optimisation should be deferring these but TBT of 470ms suggests it's not fully working - possibly because WooCommerce scripts have jQuery dependencies that prevent deferral. Fix: In FastPixel settings, add woocommerce scripts to excludes and handle them separately, or use a dedicated WC performance plugin.

### 6. Peach Payments (LOW on homepage, HIGH on checkout) Not loading on homepage but will heavily impact checkout page score. Not a homepage issue but worth noting for overall site performance.

## FastPixel Settings Comparison Both sites have identical FastPixel config - not a settings issue.

## Quick Wins (Do These First) 1. DiviFlash > Performance > per-module asset loading = biggest gain for effort 2. Deactivate wp-security-audit-log if not essential 3. Dequeue WooCommerce scripts on non-WC pages via mu-plugin

## Expected Score After Fixes TBT should drop from 470ms to ~50-80ms = Performance score ~88-92