Imagick, loopbacks, and the https that wasn't

The asks, and where they landed

Christopher came to the chat with three requests and stayed for a tour of the whole basement:

1. Imagick - installed first for the service site (Martin G.), then, when Christopher asked the right follow-up question, extended to all four websites: main, service, newsletter, publications (Denis S.).
2. The loopback 400s - Site Health’s complaint that the server couldn’t talk to itself. WPX’s logs showed the real story: their firewall had been denying REST API access to an ASN it flagged as “mimicking Chrome.” The fix: a permanent whitelist of the server’s own IPs (194.1.147.16 and 194.1.147.34) and standard user-agent strings, so internal REST loopbacks - and the automation tooling the Tech Committee was openly planning - would never be intercepted as a “malicious hacker script.”
3. MariaDB 10.6+ - declined, on purpose: shared host, the version is a deliberate stability choice, and WordPress 7.0 installs happily on 10.3+. The badge is cosmetic.

The rest of the tour

• Redis object cache: not available on the WordPress plan (WooCommerce/Agency only), and “not required either” at our scale.
• PHP 8.4 held (8.5 available; Elementor/Astra caution won the day).
• The https error on the subdomain - Christopher solved it himself mid-chat: the WordPress and Site Address URLs in Settings → General were missing the “s.” Manually corrected, saved, error gone.
• The zip module ghost - server-side present and working, yet Site Health kept insisting it was missing. PHP version swap didn’t clear it; cache-flush rituals didn’t clear it. Filed under known-benign, never to be chased again.
• UpdraftPlus restored by adding RewriteRule .* - [E=noabort:1] to the .htaccess files.

Why this morning matters

The whitelist is the quiet headliner. It’s the reason background tasks, cron-driven updates, and later the Tech Committee’s API-driven automation could talk to the sites without tripping the firewall. The chat also produced the fellowship’s working list of ignorable warnings - so no future volunteer burns an evening on the MariaDB badge or the zip ghost. (Gemini’s suggestion to add WP_DISABLE_DEVELOPMENT_PLUGINS to wp-config was politely declined - the constant isn’t real for this purpose, and Denis S. said as much.)