DOAP Engineering Daily

Watch the presentation

DevOps & Platforms

DOAP Engineering Daily

September 30, 2026

We’ve been cleaning up after an incident and getting the site running smoothly again.

What we're focused on

We’ve been working on making sure everything is secure and stable after a recent issue. That means removing an attacker’s access, hardening login credentials, and locking down parts of the system that could be risky. We also checked that the core WordPress setup still works as expected and cleaned up a broken caching plugin we use.

A lot of this comes down to putting things back the way they should be—reinstalling trusted themes, disabling plugins that didn’t check out, and making sure files can’t be accidentally overwritten by code that shouldn’t have that access. It's not glamorous work, but it keeps the site safe and predictable.

We’ve also fixed a WordPress caching issue that had been slowing things down. The plugin didn’t finish setting itself up correctly, so we got it back on track with some careful tweaks. Now it’s serving homepage content faster without interfering with booking or other important services.

Taken together, this work reflects a focus on keeping things safe and running smoothly. It isn't about flashy new features or big changes—it's about fixing what was broken and making sure no one can sneak back in.

PM Brief

What changed

The DOAP Workspace engineering team completed critical security and performance fixes following an incident on wordpress.doap.com. Actions included removing a compromised WordPress admin user, rotating database and application credentials, hardening access controls, quarantining untrusted plugins, reinstalling themes from verified sources, and confirming system integrity. Additionally, the Casa de Los Cocos WP Super Cache plugin was repaired to restore homepage caching functionality while maintaining service availability.

Next jobs

No further tasks are listed in this batch for immediate execution. The completed changes have been fully implemented and verified, with no open issues or pending engineering work outlined in the provided data.

▶ Listen to this update

If your mail app does not support the player, open the audio.

▶ Watch the presentation

Managed WordPress

Flores admin credentials rotated following security incident

A confirmed attacker-created WordPress administrator account named 'flores' has been removed from the system, with associated credentials and access revoked.

View completed task →

Managed WordPress

Fixed caching issue on Casa WordPress site

The caching system for the Casa de Los Cocos website has been repaired after a plugin failed to set up properly.

View completed task →

Preview edition — not scheduled for delivery.

View this story online

DOAP Engineering Daily — 2026-09-30