Prioritized Action Plan
24 items, in the order they need to happen · status updated October 7, 2026
10 / 24 Done
Why the order matters
Two problems come before any ranking work. First, a full 1.8 GB backup of the site, including its database, can be downloaded by anyone (C1). Second, the Google listing sends its "Website" clicks to nwautocaretx.com, a second site built by another agency, and Bing and Brave copy that link (C2). Next comes the plumbing that lets Google see the site at all: a page sitemap that currently crashes (C3) and Search Console access (C4). Then the cleanup that stops the site competing with itself (duplicate pages, H1), the fixes that make it usable on a phone (H4, H7), and consistent business facts everywhere (H3, H6). The ongoing AI and search work after that is tracked step by step on the Playbook Action Plan.Status as of October 7, 2026
Done
10
Verified live
In progress
7
Live, with work left
Blocked
5
Client answers / account access
Not started
2
Off-site work
| ID | Status | What's live / what's left |
|---|---|---|
| C1 | In progress | Backup moved out of public (folder now 404), DB password and salts rotated, Feb .wpress deleted. Left: reset admin passwords (owner does this). |
| C2 | Blocked: client / GBP access | GBP still links nwautocaretx.com and uses "Northwest Express Care". |
| C3 | Done | Sitemap loads in seconds: 73 real URLs across page, post and local sitemaps. |
| C4 | Blocked: Search Console owner unknown | IndexNow live as a stopgap; all URLs pushed to Bing/Yandex. |
| H1 | Done | 17 duplicates drafted + 301; Hello World and the xyz preview trashed; archives noindexed. |
| H2 | In progress | REST user list hidden, Hostinger mu-plugins and readme removed, plugins updated, admin tools deactivated. Left: unknown admins (client), Divi beta → stable (staging first). |
| H3 | Done | Valid hours, geo, priceRange, 6 sameAs, business-named author, FAQPage on 9 pages. |
| H4 | In progress | Page cache, images 250 → 75 MB, fonts trimmed, one gtag.js, CLS 0.04. Left: Divi beta inline CSS. |
| H5 | Done | Reviews widget shows 4–5★ only. |
| H6 | Blocked: client to confirm name / hours / story | WordPress site title fixed; directories wait on confirmed facts. |
| H7 | Done | Phone Call + Book Now bar, headline overflow fixed, pinch-zoom allowed. |
| M1 | Done | Sitewide Quick Links bar; menus repointed; 18 pages' "Learn more" links fixed. |
| M2 | Done | One H1 per page with service + Katy on 24 key pages. |
| M3 | Done | Images without alt get a descriptive alt; oversized images compressed (originals kept). |
| M4 | In progress | FAQ blocks on 9 pages; transmission cost & financing guide live. Left: real prices (client). |
| M5 | In progress | Call, text, booking, financing and lead events live (GA4 + Meta). Left: GA4 access for conversions + AI channel group. |
| M6 | Blocked: team names / ASE certs | Nothing published without client facts. |
| M7 | Done | Make-specific section (models, common services, warranty FAQ) on Jeep, Lincoln, Cadillac, GMC, Nissan, Chevrolet, Hyundai, Chrysler, Mitsubishi. |
| M8 | Not started | Yelp claim and review replies not started. |
| L1 | Done | AI-crawler allow mu-plugin + llms.txt live. |
| L2 | In progress | First 2 posts live: transmission warning signs, Texas inspection rules. |
| L3 | Blocked: client call | NW Mobile Auto Care ownership unconfirmed. |
| L4 | Not started | No YouTube or Reddit work yet. |
| L5 | In progress | HSTS, nosniff, frame, referrer and permissions headers live. Left: DMARC (IONOS DNS access). |
Roadmap
Already in Progress (Wabu, October 3)
Not audit fixes, but related
- Privacy Policy page published today at /privacy-policy/ (it isn't linked from anywhere yet, M1)
- Facebook "Transmission Replacement Quote + Financing" instant form published; ad budget set to $16.13/day. The transmission and financing pages should support that campaign (M4)
- Client is sending new shop photos; Shopmonkey credentials received to look at the scheduler integration
Day 1: Close the Exposure & Fix the Listing
About 1 hour plus a client call (C1, C2, H5)
- Move the 1.8 GB .wpress backup out of the public folder; rotate the database password, security keys and all admin passwords
- Change the Google listing's website to nweautocare.com; ask the client about nwautocaretx.com and the official business name
- Filter the reviews widget to 4–5 stars
Week 1: Let Google See the Site
C3, C4, H1, H2, H3
- Fix the crashing page sitemap; get Search Console owner access, submit the sitemap, add Bing Webmaster Tools and IndexNow
- 301 the old duplicate pages to the live ones; delete Hello World
- Remove unknown admin accounts (after the client confirms), remove Hostinger leftovers, update plugins
- Fix the business schema: hours, profiles, map coordinates; remove the "albertgalopastor1987" author markup
Weeks 2–6: Phone Experience & Consistent Facts
H4, H6, H7, M1, M2, M5
- Mobile speed: remove the 2.1 MB of inline CSS, compress images, stop lazy-loading the hero, one GA4 tag
- Phone header with Call and Book Service; stop the headline overflowing; allow zoom
- Same name, hours and story on Yelp, YellowPages, Nextdoor, Facebook, BBB, Bing Places, Apple
- Link the orphaned Services, Coupons, Financing, Warranty, Vehicles and Mobile Service pages; better H1s and titles
- GA4 events for calls, bookings and financing clicks
Months 2–6: Authority & AI Visibility
M3, M4, M6–M8, L1–L5 · see the AI / SEO Playbook
- Answer-first FAQs and a transmission cost & financing page; team and certification proof
- Build up the car-make pages that already rank; alt text across the site
- Yelp cleanup and a review routine on every platform; Reddit and YouTube presence
- Two posts a month from the Keywords & Content Calendar
- A fresh Semrush pull against today's baseline (42 keywords, ~98 visits/mo)
Critical (fix immediately)
| # | Action | Where | Effort |
|---|---|---|---|
| C1 | Remove the public site backup and change the secrets inside it. /wp-content/ai1wm-backups/nweauto-wabuapps-com-20260223-233509-mclkgvlw4c5w.wpress (1.8 GB, February 23, 2026) returns HTTP 200 to anyone, and its first bytes are a valid backup. It holds the whole database (user accounts, password hashes, form data) and wp-config.php. The retained logs (Dec 2025, May, Jun, Sep, Oct 2026) show no download, but other months aren't kept, so treat it as exposed. Move it out of public_html (or delete it once a copy is kept elsewhere), then change the database password, regenerate the security keys, and reset every admin password. Why: it's the most serious risk on the site. We've found the same problem on another site on this server, so check every site for ai1wm-backups. | Server / wp-cli | 30 min |
| C2 | Point the Google listing at nweautocare.com and settle nwautocaretx.com. The Google Business Profile ("Northwest Express Care", 4.5 / 268) lists nwautocaretx.com as its website, the Clutch Clicks site we audited on August 4. Bing's business panel and Brave's map card show the same link. Since August, nwautocaretx.com grew from 23 keywords / 0 visits to 142 keywords / ~27 visits a month. Change the GBP website to https://nweautocare.com/; fix the listing name once the client confirms the official name; ask who controls nwautocaretx.com, then cancel it and 301 each page to its nweautocare.com match. Why: every "Website" tap from Maps, Bing and Brave currently lands on the wrong site, and ChatGPT and Claude get their business data from Bing and Brave. | GBP / client call | 30 min + call |
| C3 | Fix the crashing page sitemap. /page-sitemap.xml runs for ~184 seconds, then returns HTTP 200 with "Allowed memory size of 1073741824 bytes exhausted… Divi/includes/builder-5/server/FrontEnd/Module/Style.php line 454". So none of the 87 pages are in a working sitemap; the only valid entries are Hello World and the blog category. The error also exposes a server path. In Rank Math, turn off "Include images" for the sitemap (and/or lower items per page from 200), update Rank Math and Divi, then confirm the sitemap loads in seconds and lists only the live pages (after H1). | Rank Math / wp-cli | 30–60 min |
| C4 | Get Search Console access; add Bing. As wabuwebdesign@gmail.com there's no access to sc-domain:nweautocare.com or https://nweautocare.com/, but a google-site-verification TXT record exists at IONOS, so another Google account owns the property. Find the owner (client, the original builder, or Clutch Clicks) and get added as owner; otherwise verify a new property as Wabu. Then submit the fixed sitemap and check the Sitemaps list for anything unexpected (this server had a compromise in September 2026), plus Page indexing, Manual actions and Security issues. Set up Bing Webmaster Tools (import from GSC) and IndexNow. | GSC / Bing / IONOS DNS | 45 min |
High (within 1–2 weeks)
| # | Action | Where | Effort |
|---|---|---|---|
| H1 | Consolidate the duplicate pages. An older "-katy-tx" set of service pages (May 2026) is still live next to the July 2026 set, all indexable: oil change, brake repair, transmission, three inspection pages, wheel alignment, A/C, diagnostics, fluid flush, tire shop and module reprogramming each exist twice. There are also homepage and services copies (/auto-repair-in-katy-tx/, /home_old/, /new/, /services-2/, /service-page/) and the default Hello World post. 301 each old page to its live match (shocks & struts → /steering-suspension-repair/; cooling system → the closest live page or a new one). Don't just delete them: some hold the rankings, e.g. "transmission flush katy" #1 on /auto-repair-in-katy-tx/ and "shocks and struts replacement katy" #9 on the old shocks page. Delete Hello World and close comments; noindex the author and blog-category archives. | Rank Math Redirections / WP | 2–3 hrs |
| H2 | Admin and server hygiene. There are 4 administrators: albertgalopastor1987 (the original installer, Nov 2025), jd (josephdavidfabiana@gmail.com, Dec 2025), plus marco and info@wabuweb.com. Confirm the first two with the client, then remove them and reassign their content to a real author. Hide the public REST user list (/wp-json/wp/v2/users shows all 4 usernames), remove the Hostinger leftovers (hostinger-preview-domain.php, hostinger-auto-updates.php), delete readme.html, update the 8 plugins with pending updates (Rank Math 1.0.269 → 1.0.279, Reviews plugin 13.2.9 → 14.2, …), and plan a move from Divi 5 public beta to a stable release. | wp-cli / server | 1 hr |
| H3 | Fix the schema. Set the hours to match the Google listing in valid format (Mon–Fri 08:00–18:00, Sat 08:00–16:00, no Sunday entry) instead of "Monday,Friday 08:00-19:00", "Saturday 08:00–16:00" (en-dash) and "Sunday CLOSE". Remove the Person + Article markup that names "albertgalopastor1987" as the author of every page. Add geo (29.8650537, -95.7030771), sameAs (8+ profiles: GBP, Facebook, Yelp, BBB, CARFAX, Nextdoor, YellowPages, MapQuest), priceRange, areaServed, hasMap, foundingDate 2017. Ready-to-paste code on Schema & GEO Tactics. | Rank Math | 1 hr |
| H4 | Make the site fast on phones. Lighthouse mobile: home 16 (LCP 34.6 s, CLS 0.754, 7.6 MB), /brake-repair/ 27 (LCP 23.1 s). Each page carries ~2.1 MB of inline CSS from Divi 5 beta; switch Divi to external static CSS files (or add a caching/critical-CSS setup). Convert van-work-no-letters-980x653.png (1.1 MB) and leaderboard_banner_wide.png (410 KB) to WebP; don't lazy-load the hero image; reserve image space to stop the jumps; remove one of the two GA4 tags (G-HF68X7Z5KG, G-F3ZB43T30G); self-host or drop the icons hot-linked from irp.cdn-website.com. Target mobile 60+. | Divi / server | 4–6 hrs |
| H5 | Stop showing the 1-star review. The Google reviews widget on the homepage and most service pages includes "This is the worst place to go… These people will rip you off your money." Set the plugin's filter to 4–5 stars only. | WP Reviews plugin | 15 min |
| H6 | One set of facts everywhere. Pick one name (the listing says "Northwest Express Care"; the site says "Northwest Express Auto Care"; WordPress says "NW Express Auto Care"), one set of hours (6 PM vs 7 PM weekdays; Brave even shows Sunday 9–1), and one history (founded 2017 vs "second generation, 30 years" on Nextdoor vs "third-generation, 45 years" in Brave's summary). Then update Yelp, YellowPages, Nextdoor (phone typo 832-683-4478), Facebook, BBB, Bing Places and Apple Business Connect, and the WordPress site title. | Off-site | 2–3 hrs over 2 weeks |
| H7 | Fix the phone layout. On a 390 px phone the header shows only the logo (no phone, no Book Service), and the H1 and services panel run off the right edge. Add Call and Book Service to the mobile header or a fixed bottom bar, resize the H1 to wrap, stack the panel, and remove user-scalable=no from the viewport tag. | Divi | 1–2 hrs |
Medium (within 1 month)
| # | Action | Where | Effort |
|---|---|---|---|
| M1 | Link the orphaned money pages. 26 published pages have no internal links, including /services/, /coupons/, /financing/, /warranty/, /vehicles/, /mobile-service/ and the new /privacy-policy/. Add them to the menu or footer, and link /vehicles/ to the 40 car-make pages. | Divi menu / footer | 1 hr |
| M2 | Better H1s and titles. Put the service and city first ("Oil Change in Katy, TX") and give each page one H1. Today many H1s are a bare word ("Alignments", "TUNE-UP", "Brake Repair"); /tire-shop/ has two H1s ("Tire Types", "How do I know when to replace my tires?") and /about/ has two. | Divi / Rank Math | 2 hrs |
| M3 | Alt text and image weight. 994 of 1,201 images have no alt text (83%). Start with the logo, icons and the images on the menu-linked pages; compress the oversized PNGs. | Media library | 3 hrs |
| M4 | Answer-first content. Add a short FAQ to each main service page, answered in the first 1–3 sentences, and build a transmission cost & financing page ("transmission replacement cost" gets 6,600 US searches a month) to support the Facebook transmission campaign. Publish the real specials and prices as text. Questions are listed on AI / GEO. | WordPress | Ongoing; first 4 pages in Months 1–2 |
| M5 | Measurement. Keep one GA4 property (find out who owns each tag, open question 3), and add events for tel: clicks, Shopmonkey "Book Service" clicks and financing clicks, plus a channel group for AI assistants (ChatGPT, Perplexity, Gemini, Copilot, Claude). | GA4 / Header Footer Code Manager | 1 hr |
| M6 | Proof behind the claims. Replace "NWE-certified technicians" and "certified Master Technicians" with real ASE certifications, name the team (owner, David the service manager, technicians) with photos, and show the 2017 story and the 36-month/36K-mile TechNet warranty on every service page. Needs client input. | About + service pages | 2 hrs after input |
| M7 | Car-make pages. 40 template pages (~1,150 words each). Several already rank: Lincoln #9, Cadillac #9, Jeep #12, Lincoln service #14, GMC #14, Nissan #15, Chevrolet #18, Hyundai #20, Chrysler #20, Mitsubishi #19. Give those real make-specific content (common problems the shop sees, models serviced). Consider consolidating discontinued brands (Plymouth, Saturn, Pontiac, Mercury, Saab, Hummer, Scion). | WordPress | Ongoing |
| M8 | Reputation beyond Google. Claim Yelp (2.5 from 15), fix its hours, and reply to the recent complaints; ask happy customers to review on Yelp and Facebook too; keep replying to every Google review. | Yelp / Facebook / GBP | Ongoing |
Low (backlog)
| # | Action | Where | Effort |
|---|---|---|---|
| L1 | Explicit AI-crawler rules + llms.txt. Add Wabu's standard wp-content/mu-plugins/ai-crawler-robots.php (explicit Allow: / for GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-SearchBot, PerplexityBot, Google-Extended), then test with each crawler's user agent. llms.txt is cheap but no major engine uses it. | Server | 15 min |
| L2 | Blog. The blog holds only Hello World. Two posts a month from the content calendar (Texas inspection guide, transmission warning signs, Katy summer A/C, and so on). | WordPress | Ongoing |
| L3 | NW Mobile Auto Care. The homepage links to nwmobileautocare.com, a JavaScript-only Base44 site that AI crawlers can't read, with its own Google listing (5.0, 2 reviews). If it's the same business, connect the two clearly and make /mobile-service/ on nweautocare.com the main page for it. | Client call | — |
| L4 | YouTube and Reddit. Two Reddit threads (r/houston, r/Katy) are in Google's top 10 for "auto repair katy". Build an honest presence there, and start short repair-explainer videos on YouTube. | Off-site | Ongoing |
| L5 | Security headers and DMARC. None of HSTS, CSP, X-Frame-Options, X-Content-Type-Options or Referrer-Policy is sent, and there's no DMARC record for the Google Workspace mail domain. Add them (DMARC at p=none first). | .htaccess / IONOS DNS | 30 min |
Expected Sequence and Outcomes
- Day 1: the backup is no longer public, and the Google listing sends visitors to nweautocare.com instead of the duplicate site
- Weeks 1–4: a working sitemap and Search Console give Google the real page list for the first time, and the duplicates stop competing. Rankings that sit just off page 1 (Jeep #12, GMC #14, Nissan #15, suspension repair #17) are the first to move
- Months 2–4: with a fast mobile site, better H1s and answer-first FAQs, the core service pages start ranking for terms with no page in the top 100 today: "oil change katy" (320/mo), "auto repair katy" (210), "tire shop katy" (170), "transmission repair katy" (110)
- Months 4–6: with consistent facts across the web and a better Yelp profile, ChatGPT and Claude describe the shop the same way the Google listing does
- These are directional estimates, not guarantees. Measure success in calls, Shopmonkey bookings and financing applications, not just rankings.
Questions for the Client
- Do you know nwautocaretx.com (built by Clutch Clicks)? Are you paying for it? Who changed the Google listing's website to it? (C2)
- Who are albertgalopastor1987@gmail.com and josephdavidfabiana@gmail.com? Both are WordPress administrators. OK to remove them? (H2)
- Which Google account owns Search Console for nweautocare.com? Who owns the GA4 tags G-HF68X7Z5KG and G-F3ZB43T30G? (C4, M5)
- What is the official business name, "Northwest Express Auto Care" or "Northwest Express Care"? What are the real hours: 6 PM or 7 PM on weekdays, and is Sunday closed? (C2, H3, H6)
- The shop was founded in 2017. Is "second generation / 30 years" or "third generation / 45 years" accurate? What are the owners' names? (H6, M6)
- How many technicians are ASE-certified, and in what? OK to name David (service manager), Carlos and Ricco on the site? (M6)
- Is NW Mobile Auto Care (nwmobileautocare.com) your business? Who built it? (L3)
- OK to publish prices (oil change, inspection, the $87 Holiday Travel Special) as text and keep the current coupons? (M4)
- Which financing is current: Synchrony, Koalafi, or EasyPay? (M4)