HHlinor Request a Risk Review
Sample audit

What a real legacy audit delivers.

Anonymized results from a real review of a working ecommerce store on MODX Revolution. About 430 pages, live revenue, no staging environment. The store kept selling the whole time.

Request a Risk Review Read the case studies

Client identity, domain and product details are anonymized. Every number on this page is real, from one audit.

The system map comes first

Before touching anything, we document what the system actually is. Not what everyone thinks it is.

The stack we found

  • MODX Revolution CMS with Fenom templates and snippet chunks.
  • PHP and MySQL on Apache, configured through .htaccess.
  • FTP deployment. No staging environment.
  • Google Search Console, GA4, Yandex Metrica and two Google Tag Manager containers.
  • Two ad networks embedded in templates.

What we checked

  • All 432 URLs in the sitemap and every internal link.
  • All 4,734 images.
  • All 43 blog posts, their facts and their publish dates.
  • Indexing status in Search Console.
  • Analytics and tag setup, page speed, titles and descriptions.

The risk register

Ranked by what could hurt revenue, search visibility or customer trust. Not by what sounds scary.

Critical
Broken internal links.
12 internal links led to 404 pages, 11 of them confirmed in Search Console. Some sat on high-traffic product pages.
Critical
Conflicting analytics setup.
Two different Tag Manager containers were loading, one in the script and one in the no-script block, with GA4 loaded separately on top. Visits could be counted twice or not at all.
High
Pages invisible to Google.
73 pages were not indexed. 37 of them were marked "discovered, not indexed", including real product pages that could be selling.
High
Wrong publish dates.
Every blog post displayed today's date instead of its real date. Old content looked fake-fresh to visitors and to Google.
High
Redirect chains.
The /index.php address redirected to plain http, and the www address took two hops to reach the secure site. A small .htaccess problem with real SEO weight.
High
Sitemap date errors.
34 sitemap entries claimed to be modified in the year 2038. That is one reason Google distrusted those pages.
Medium
Slow responses.
Average response time was 1.37 seconds. 36 pages took over 2 seconds. No caching policy was in place.
Medium
Unreadable URLs.
17 product URLs contained a character browsers show as percent-encoded text. Renaming them needs careful 301 redirects, so it was planned, not rushed.
Medium
Content mismatches.
A category text described products for one vehicle type while the page sold products for another. 45 related product pages were not linked to each other. Some product descriptions were only 24 to 52 words.
Medium
Outdated public claims.
Blog posts repeated prices and legal claims from 2018 that no longer hold, including one claim that was simply wrong.

The 30/60/90 roadmap

Order matters. Safe wins first, risky changes planned, long-term work scheduled.

Days 1-30: safe fixes, already live

All 12 broken links repointed. Publish dates fixed. Five outdated blog posts rewritten with current facts. 45 paired product pages cross-linked. The mismatched category text rewritten for the products it actually sells. Three thin product descriptions rewritten from real specs. Ad blocks removed, originals kept for rollback. Every change backed up, read back byte-exact and verified live.

Days 30-60: planned technical work

Fix the redirect chains in .htaccess, which needs FTP access. Consolidate to one Tag Manager container. Move the 17 unreadable URLs with 301 redirects, done carefully so rankings survive. Fix the sitemap dates.

Days 60-90: deliberate improvement

Caching policy for the slow pages. A blog plan based on real search demand from Search Console. Indexing re-check after Google recrawls the fixed pages.

How the work is done

  • Read-only first. Nothing in production changes during discovery.
  • Every approved fix is backed up before the edit.
  • Every edit is read back byte-exact and checked live after.
  • No specs, facts or findings are invented. Unknown stays unknown.

What the owner received

  • A system map of the real stack.
  • A risk register ranked by business impact.
  • A 30/60/90 roadmap with owners and dependencies.
  • A clear record of what changed and what stayed untouched.

Want this for your system?

Selected legacy ecommerce systems can start with a paid pilot audit in the $500-700 range. Read-only first. You decide what happens next.

Request a Risk Review