Weekly SEO + Security Watch — Fleet Playbook

The Fleet › Weekly SEO + Security Watch
🛡 Watcher

Weekly SEO + Security Watch

A read-only guard dog for blitzmetrics.com and dennisyu.com. Each Monday it scans Gmail for malware / rogue-admin / registrar signals and pulls Ahrefs for new toxic backlinks, then reports a GREEN / AMBER / RED status.

This is the fleet’s smoke detector. Every Monday morning it runs a security and SEO sweep on the
two properties that matter — blitzmetrics.com and dennisyu.com — and reports back with a one-glance
GREEN / AMBER / RED status.
It never touches the sites; it only watches and tells you.

What it checks

  1. Site integrity & malware. Scans the last 8 days of Gmail for Wordfence / Sansec / “new admin” /
    defacement signals — including the specific injected-admin pattern from the July 2026 incident (a rogue administrator,
    users-table row 327, that had to be removed).
  2. WordPress admin accounts. Flags any new administrator appearing on the sites.
  3. The backlink attack. Uses the Ahrefs API to pull referring domains marked spam, newest first, and
    counts how many new toxic domains appeared in the last 7 days — then outputs them as ready-to-paste Google disavow lines.
Why overnight? Every scheduled job, every chat you send, and Claude Code all draw
from one shared rolling 5-hour usage window. Running this at 4 AM Monday — hours before Dennis starts work — means
it never competes for the window he’s actively using, and the report is waiting when he wakes up. (It used to fire at
8:01 AM; we moved it overnight and staggered it a full day away from the Sunday-night audit.)

Its place in the loop

The content factory publishes to these sites; this watcher defends them. That’s the recursion in miniature:
the system produces public assets, then schedules its own guard duty over what it produced. It reports to Dennis only —
read-only by design, so a monitor can never become an incident.

← Back to the full fleet

Job facts

SystemCowork cloud scheduled job
TriggerCowork cloud
ScheduleEvery Monday, 4:01 AM PT
Cron (UTC)0 11 * * 1 (UTC)
StatusActive
TimingRescheduled to off-hours
Wired toGmail, Ahrefs, push + email alerts