E-waste recycling
Dunn & Son Electronic Recycling: a clean rebuild of a site that was working against its owner
A twenty-year-old Fresno e-waste business inherited a WordPress stack from a prior developer: an unlicensed page-builder install with open API routes, a hidden administrator account, indexable content the owner never wrote, and a contact form that had never delivered a single message. We rebuilt the same design on maintained GPL tooling, fixed outbound mail, hardened the install, and verified each fix on the live site.
- Client
- Dunn & Son Electronic Recycling
- Year
- 2025
- Timeline
- Site launched October 2025. Security and mail remediation completed November 2026; the clean build was parity-checked on staging, then rolled out to production on the client domain.
- What we built
- WordPressElementorAstraPROElements (GPL fork)PHP 8.3LiteSpeed
The challenge
Dunn & Son has been recycling electronics in Fresno since 2005, and describes itself as one of the oldest e-waste companies in California. The site looked the part: a full-bleed hero, a background video, a red call-to-action and six content pages.
Underneath, a prior developer had left an unauthorized Elementor Pro build. It was not a cosmetic shortcut; it was an attack surface: six REST routes with no permission check, a licence record that did not match a real subscription, and update checks pointed at infrastructure the client did not control.
Two things made it expensive rather than merely embarrassing. The contact form had never delivered a message, because PHP mail was disabled on the account and every enquiry was written into a void. And an article that the client never wrote, in a custom post type, authored by a user ID that no longer existed, was live and indexable.
What we did
The client liked the design, so the rebuild had a rule: the replacement had to be structurally identical, not "an improvement we preferred". We worked on a staging fork of the same install and compared the two builds until the only difference left was the domain name embedded in Elementor's generated stylesheets.
In parallel we removed what should not have been there. The unauthorized builder gave way to PROElements, the maintained GPL fork of the same codebase, which updates from its own GitHub releases and needs no licence key. The injected article was archived internally and deleted from the index, along with the hidden administrator and the companion plugin that injected an "Update Chrome" banner over the site. That stack now runs on production.
Mail was the fix that mattered most commercially. WordPress sends through authenticated SMTP from a domain that has SPF and DKIM, so the notification arrives instead of being dropped by a disabled local sendmail. Enquiries route to the client; replies go to the visitor.
The rest is the work that never shows on a screenshot: per-page titles and descriptions, Open Graph tags, LocalBusiness structured data with the real address and hours, one h1 per page, a main landmark, alt text on all 43 images, login throttling, XML-RPC off, and a privacy policy rewritten from scratch rather than left as plugin boilerplate.
Proving the rebuild, not promising it
Elementor emits a stylesheet per page and those files embed absolute URLs, so a fork will never match byte-for-byte everywhere. We used that as the measurement rather than as an excuse.
The home page carries 11 sections and 85 widgets on both sites, in the same order and of the same types. Two of the shared stylesheets are byte-identical; the third differs only because the staging hostname is sixteen characters longer and appears nine times. When a stylesheet went missing entirely on the staging copy, we treated it as a fault, rebuilt the cache and checked every page again rather than declaring the rebuild done.
The check that keeps this honest is the one that caught a real defect: a duplicate h1 had been baked into the header by Elementor's element cache, so it replayed on every page long after the code that produced it was gone. Every page on both sites now measures one h1, with the HTML closing properly.
What runs in production today
The live domain serves the rebuilt install: PROElements and free Elementor, not the unauthorized builder we removed during remediation. The six open REST routes from that old package no longer answer. Contact mail uses SMTP; hardening (login throttling, XML-RPC off, security headers) and the accessibility and SEO passes from the rebuild are on the pages the public crawls.
We still treat the story as engineering notes, not a scorecard. Traffic, ranking, and lead-volume numbers are deliberately absent here because we did not measure them for this write-up. If those change, this page should be updated from fresh evidence—not from a stale staging checklist.
Results
- unauthenticated plugin endpoints
- 6 → 0
- widgets preserved in the rebuild
- 85/85
- stylesheet files matched
- 23/23
Related services
Planning something similar?
Tell us about what you need and when you need it — we will reply within one business day.
Dunn & Son Electronic Recycling · www.skyhighdesigns.com