Customers getting their order confirmations again

The result

Customers of Mitchell's cigar shop receive their order confirmation emails again. A security hole in the software that links the shops to the till was found and written up with the fix.

Both shops are on current versions, with a backup taken before every change. The owner has a clear report on every serious fault, and a specific plan for speeding up the shop pages without breaking the filters and search.

The problem

Mitchell's is a family-run wine merchant in Sheffield. It sells online through two shops, one for wine, spirits and beer and one for cigars and tobacco, both fed from the shop's till system. The wine shop alone lists more than 2,500 products across nearly 200 categories.

That takes a lot of moving parts, and when one misbehaves it does it quietly. A customer does not get an order confirmation. A shop filter shows yesterday's results. A sales report says a product sold nothing when it did.

What we did

We audited both shops from the ground up, fixed what was urgent ourselves, and wrote the rest up so each supplier could fix its own software. Then we brought everything up to date safely.

For the technical reader:

• Code-level audit (June 2026). We reviewed the source of the plugins the shops depend on and traced their behaviour on the live sites, writing each finding up with the file and line, impact, reproduction and fix. Findings included a SQL injection in the Epos Now till-sync plugin's REST API (with the prepared-statement fix); two plugins that read order data in a way that breaks under WooCommerce's newer order storage, one of which made sales reports show zero revenue; a fatal error in the page builder when a product had been deleted; and a payment-gateway fragility under object caching. We wrote interim guards for the most serious issues.
• Caching diagnosed (June 2026). Edge caching on shop pages had been switched off because it broke filtering, sorting, search and pagination. Sort and page links were being cached as if they were one page, and the pages carried live security tokens the filters needed fresh. We turned that into a specific rule set.
• Order confirmations fixed (August 2026). The cigar shop's mail plugin had fallen back to the host's basic PHP mail instead of sending through Microsoft 365. We fixed the configuration, checked the wine shop's SPF, DKIM and DMARC, and verified delivery on both sites.
• Updates (August 2026). Full backups of both sites, then every plugin and theme updated, including a WooCommerce major version with a database migration, with checks that the shop loaded and the email settings survived.

If your shop runs on WooCommerce and nobody is looking under the bonnet, we can.