01
Context
Renticome rents vehicles and heavy equipment in France through a WordPress and WooCommerce site: a commercial theme carrying its own reservation logic, Elementor Pro for layouts, TranslatePress for multilingual content, and booking confirmation emails that customers rely on. The theme had not been updated since 2021, the plugin list had grown by accretion, custom code was split across two snippet plugins, and saving pages in Elementor returned HTTP 500. There was no malware and the database was a healthy 35 MB: the risk was drift and fragility, not an incident to clean up.
The work grew from that fix into a full technical audit, a hardening pass, a domain-level email deliverability repair plan, and ongoing support as the PHP runtime and builder versions moved underneath the site. The constant across all of it: findings confirmed on production before acting, every change explained in French to an owner who runs the site and its DNS directly, and recommendations kept clearly separate from work actually done.
02
The Challenge
- The theme, unmaintained since 2021, carries the rental logic itself: reservations with day and night modes, minimum rental periods and a custom vehicle taxonomy. Replacing it is a project, not an update.
- Custom code lived in two snippet plugins with unguarded function declarations, and page saves in Elementor failed with HTTP 500.
- Mail from the domain was rejected by Orange with an SPF failure while Gmail and the host accepted it, so the fault stayed invisible until a forwarded booking confirmation bounced.
- Platform changes arrive from outside: on PHP 8.5, deprecation notices from a security plugin's firewall library printed before headers and locked the owner out of the dashboard.
03
Scope and Approach
Diagnosis and immediate fixes
The HTTP 500 on page save was fixed by adding function_exists() guards to the snippet code and moving the three snippets that matter (top-level category filtering, unpaginated catalog archives, sorting by last modified) into FluentSnippets. WPCode Lite and Code Snippets were removed, leaving a single place where custom code lives.
Full technical audit
A written audit in French covering security, performance, code quality, database health and backups: core and server versions, all 20 active plugins with a keep or evaluate call for each, server limits, autoloaded options, table sizes, a malware pattern scan of theme and uploads, and a theme compatibility review against PHP 8.5, Elementor 4 and WordPress 6.9.
Plugin and backup consolidation
Five plugins removed or deactivated: a file manager plugin with a history of critical vulnerabilities, two redundant snippet plugins, a second backup plugin and an unused default plugin. Backups were consolidated on WPvivid alone. A hardening pass and closing report followed, taking the HTTP security header grade from F to A.
Deliverability repair plan
After a forwarded booking confirmation bounced from Orange, the domain's live DNS was inspected and the cause written up as a client handbook in French: which record to delete, which to leave untouched, the exact DMARC record to publish, how to verify after propagation, and a dated plan to move DMARC from monitoring to enforcement.
Ongoing support
Requests handled as they arrive: a dashboard lockout after a PHP 8.5 change, diagnosed without a single file change; a holiday closure popup that had never been lost, only saved as a draft, documented with a one-minute reactivation guide for every season; and a recorded walkthrough of an article built to on-page SEO practice.
04
Architecture flow
05
Technical Deep Dive
Two SPF records, one of them deny-all
The domain published an SPF record authorizing the host's mail servers and, alongside it, a second record reading v=spf1 -all. RFC 7208 allows one SPF record per domain; two turn every evaluation into a permanent error. Orange treats that as a broken domain and rejects with a 5.1.0 SPF failure, while Gmail and the host tolerated it. DKIM was already signing correctly; DMARC was absent.
Why the fix is a deletion, not a rewrite
The repair removes only the deny-all record and leaves the correct one untouched, because deleting the wrong one stops all mail. DMARC starts at p=none with aggregate reports, so nothing is blocked while real traffic is observed, then moves to quarantine at 25, 50 and 100 percent before reject. Each step has a check: a single SPF record in a lookup, a mail-tester score of 9/10 or better, and a real send to an Orange address.
A lockout caused by a deprecation notice
PHP 8.5 deprecates non-canonical casts such as (double) and (boolean). The installed firewall library still used them, so PHP printed notices before WordPress sent its headers and the login cookie was never set. The site served pages; logging in failed. Rolling the runtime back to PHP 8.4 restored access with no code change, and a plugin update is the condition for returning to 8.5.
A theme that owns business logic
The parent theme's functions file runs to 2,804 lines and about 93 functions: deep WooCommerce integration, the reservation system, the vehicle taxonomy, bundled CSS and JS minifiers, and an Instagram integration on an API retired in 2020. Its PHP 8.5 and Elementor 4 issues are minor today but point toward fatal errors under a future PHP major, so the recommendation is a planned migration, not an emergency one.
06
Engineering Decisions
Confirm local findings on production
Part of the audit read from a local copy, and findings from it were labelled as needing production confirmation. Two did not hold: the security keys and the database table prefix were already non-default on production. The closing report states that both came from the local copy rather than presenting them as fixes.
One tool per job
One snippet manager replacing two, one backup plugin instead of two. Every duplicate tool is another update stream, another settings screen and another place for code or backups to hide. Consolidating made the site simpler to maintain before anything new was added.
Hand the owner the fix, with its checks
The owner manages the site and DNS directly and chose to apply the deliverability repair personally, so it shipped as a step-by-step handbook rather than a silent change. Every step names the exact record, the action that applies it and the test that proves it. Recurring tasks, like the seasonal popup, are documented the same way.
07
Results
- HTTP 500 on page save fixed, with custom code consolidated into one snippet manager and its functions guarded.
- Full technical audit delivered in French, followed by a closing report: HTTP security header grade moved from F to A, confirmed with an external scanner.
- Five redundant or risky plugins removed or deactivated, and backups consolidated on a single plugin.
- Orange rejections traced to a duplicate deny-all SPF record, with a domain-specific repair and verification handbook delivered.
- A dashboard lockout after a PHP 8.5 change diagnosed and resolved by rolling back to PHP 8.4, with no code changes.
08
Planned next
- Updating the security plugin so the site can return to PHP 8.5 safely.
- Tightening DMARC from monitoring to quarantine and reject, on the handbook's schedule.
- Evaluating a move off the unmaintained theme while preserving the reservation logic it carries.
- Remaining audit recommendations: off-site backups, uptime monitoring and a staging environment.