You already rank. You're just not getting the clicks.

Yesterday's audit looked at your site from the outside, the way Google and a visitor see it. Once you gave us your WordPress login and Google Search Console, we could look under the hood, and there was more than the surface showed. That is a large part of why this is real work, not a quick patch:

• A paid speed plugin (WP Rocket) is installed but switched off, sitting next to a stack of heavy, outdated builder plugins and leftover demo junk.
• An older remote-access feature (XML-RPC) is actually live and reachable, even though a filter hides it from a casual check, a real brute-force and spam door.
• Your login names are exposed publicly, including an unrecognized user account we cannot place.
• No standard analytics is installed at all, so there has been no real measurement of who visits or what converts.
• Search Console shows you rank on page one but lose the clicks (the detail is right below).
• Leftover default and thin pages are sitting in Google's index, and your DNS is still managed off-site from the original build.

Part of the access review was a full plugin audit. The site runs 17 plugins, 12 active and 5 inactive, several months behind on updates, with redundant and leftover ones adding weight and risk. Here is every one and exactly what we do with it.

This is from your own Google Search Console, last 90 days. You are not invisible to Google. You are showing up, near the top, for the terms that matter, and the listing is so generic that people scroll past it. Every page title still ends in "Empresa" instead of your brand and service, so Google shows that as your headline.

From the original build, your nameservers still point off-site, so your DNS is managed elsewhere instead of by you. Your homepage "Services" button also points off-site, to a leftover address from the original build (tampa.colectivohost.com). You own the domain at GoDaddy, so this is clean: we copy your records into a Cloudflare account that is yours, switch the nameservers, and you hold every key. Cloudflare's free firewall also blocks the spam and brute-force traffic the site is exposed to today. We mirror your records first, then switch, so email and the site stay up. Done wrong this takes a site offline, so it is careful work, not a flip of a switch. To be clear, this is a DNS migration only; your hosting does not change. You just upgraded your space, and you keep that exact setup. We are only moving the DNS layer, the part that decides where your domain points, into an account you own.

Google scores your mobile homepage at 50 out of 100. The cause is two things, not a redesign: a paid caching tool is installed but switched off, and one chat-and-forms widget loads a huge share of the page before any photo appears. We configure caching properly for your LiteSpeed host and re-engineer the heaviest widget, and expect the score to climb into the high 70s or 80s. This is precise, hands-on work, not a toggle.

The site is missing standard protective headers, leaves an older remote-access feature (XML-RPC) switched on (a common brute-force and spam target), keeps the WordPress readme and user list public, runs without two-factor login, and exposes an unrestricted Google Maps API key right in the page code (anyone can copy it and run up charges on your Google account). On the server itself, the site runs PHP 7.4, which reached end of life in 2022. It no longer receives security patches and it blocks future WordPress updates. We coordinate moving the server to a current, supported version (PHP 8.x), tested alongside the plugin updates so nothing breaks. Moving your DNS to Cloudflare blocks most of this at the edge; the rest are quick settings on the site. We also clean the exposed author pages and review that unknown account.

The original build left a trail of default and leftover pages that are public, sitting in your sitemap, and visible to Google and anyone who looks:

• The default WordPress "Sample Page" that ships with every new install is still live and in your sitemap.
• Author archive pages at /author/admin/ and /author/jose-g/ are public. They have no real content, they publicly expose WordPress login names, and they create duplicate thin pages.
• Around thirty thin blog posts from 2023, some under 150 words, that drag down how Google rates the whole site.
• Every page title still carries the default theme name, "Empresa." Your brand is literally invisible in search while a placeholder shows in its place.
• The site openly broadcasts its software versions and a public readme, the kind of detail a clean build hides.

Individually small; together they make the site look half-finished to both Google and a careful visitor. They are simply loose ends from the original build, and they are quick to put right. We retire the junk pages, turn off the author archives, clean up the thin posts, replace every placeholder title with your real brand and services, and close the version and readme exposure.

This is the part that is genuinely a lot of work, and it is where most of the ranking and click gains come from. You have more than 60 live URLs on the site, roughly 13 pages and 47 blog posts, and not one of them carries a noindex tag. That means Google treats every single one as fair game, so every single one has to be looked at individually.

For each page and post we rewrite the title and description to match what people actually search, fix or add the heading, strip the page-builder clutter, sort the internal links, and decide whether the page should be sharpened, merged into a stronger one, or retired. The thin old posts come down, the service pages get rewritten around real demand, and the leftover junk pages go. It is dozens of individual judgment calls across the whole site, not a setting we flip once.

For a single-location studio, local is where the growth is. Right now there is no structured business data, no hours, no map, and no reviews on the site, and your Google Business Profile looks dormant (no recent posts or updates). That profile is roughly a third of what decides whether you show up in the local map results, and it is sitting idle.

We add the local business data, hours, a map, and your real Google reviews to the site, give every service page a proper heading, and get your Google Business Profile active again. We also retire the leftover starter page and the old thin blog posts that are dragging the rest down, and add the technical files (a clean robots file and an llms file) that help both Google and the newer AI search tools read and cite you.

Right now there is no standard analytics on the site, so there is no clean record of who visits or what converts. We set up proper analytics plus a lightweight first-party traffic tracker for raw numbers, and connect it to your Search Console, so every change we make can be measured against a real before-and-after. The Cloudflare move also includes free privacy-friendly visitor analytics at no extra cost.

Your site runs a generic CRM chat widget that replies from canned scripts and, as noted above, loads a large share of the page on its own. We replace it with a lightweight knowledge-base assistant trained on your own treatments, pricing, policies, and FAQs, so it answers real questions, "what is cryo slimming," "is it safe," "how much," "can I book," in both English and Spanish, and captures the lead. A genuine assistant that actually knows your business, not a stock bot, and much lighter on the page.

Your top menu carries ten items all competing for attention (Home, About, Services, Emsculpt Neo, icoone, Cryo Laser, FAQ, Results, Contact, Blog). We streamline the navigation so your money pages stand out and the menu reads cleanly on a phone.

The footer is a loose block, not a proper structure, and it is doing real harm. It still reads "© 2023", three years stale, which signals an abandoned site. It has no Terms of Service, no hours, and no email. It also carries leftover builder and theme credit links in the footer that quietly pass your link value off-site. We rebuild the footer cleanly: your business details, hours, a map link, real navigation, a current copyright, a proper Terms of Service alongside the privacy policy, and the leftover credit links removed. These are the small, visible places where a site looks finished, and right now yours does not.

This is not a simple one, two, three job priced off a quick glance. The plan behind it pulls data from several places at once: 90 days of your own Google Search Console, live keyword demand for the Sarasota market, Google PageSpeed, a full review from inside your WordPress, and security and indexing scans. We are reading your entire search footprint and the guts of the site, not just looking at the homepage. Because we are improving your existing site rather than rebuilding it from scratch, this stays a single flat project, and it is a substantial amount of skilled work once you add it all up: the domain move, the security fixes, the speed work, the title and click recovery, the local SEO and Google Business Profile, the analytics and tracking setup, the Search-Console-guided targeting, the content cleanup, a decluttered header, a rebuilt footer with proper legal pages, and a bilingual AI knowledge-base assistant to replace the stock chat bot.

• Your Google Business Profile. It looks dormant. Are you managing it, or has it been left alone? We can take it over.
• Analytics. Do you have a Google Analytics account anywhere, or should we create one fresh?
• Your hosting plan. You just upgraded your space, which is great. Who is your host, what plan are you on, and what does it cost? Your site stays right where it is; we just want the full picture so we tune the caching and speed work to what you have.
• The 2hhqp user. There is a WordPress user we do not recognize, next to your admin and the original developer. Is it yours?

To start, we need your WordPress admin (received), your GoDaddy login for the domain move, and access to your Google Business Profile. We do the rest.