The problem. We inherited a web server running five live websites, ours and our clients’. The man who built it had passed away and left no handoff notes. Then a critical security flaw was announced in the language those sites run on, and four of the five were on a version that would never be fixed.
What we did, in one working day.
- Snapshotted the server and backed up every database before touching anything.
- Mapped everything we’d inherited: which site lived where and what it ran on.
- Moved all five sites to a current, supported version, one at a time, each verified live before the next.
- Brought WordPress, themes and plugins current, including a major upgrade on three sites.
- Ran a deep security check against official published copies of every file. Clean.
- Fixed what it turned up: a contact form that had never delivered mail now delivers end to end.
The result. Five sites patched, current and verified clean, and a server we now run and document ourselves.
Technical detail
- Droplet snapshot and per-site database dumps first; snapshot kept as evidence.
- Read-only inventory script, reviewed and hash-checked before its single run.
- PHP runtime migration off an end-of-life branch, lowest-risk site first, each verified live.
- File integrity checked against official checksums for core and plugins.
- Mail delivery fixed at the domain-authentication level; spam protection restored.