Good bones. Page 5 on Google.
The site looks unfinished — and you're losing keywords faster than you're gaining them.

Plesk staging URL leaking in font CSS

Confirmed via Chrome DevTools console. All Google Fonts load from https://romantic-euclid.74-208-195-187.plesk.page/... and return CORS-blocked errors. The site uses fallback system fonts on every real visit.

# Console errors observed in browser
Access to font at 'https://romantic-euclid.74-208-195-187.plesk.page/wp-content/uploads/elementor/google-fonts/fonts/inter-ucc73fwrk3iltehus_nvmrmxcp50sjia1zl7.woff2' from origin 'https://winnteamrealtors.com' has been blocked by CORS policy
Failed to load resource: net::ERR_FAILED
# Same failure for Karla, Rufina, Roboto, Montserrat

WordPress admin attack surface exposed

Three separate WP exposures stack together to create a credential-stuffing target.

# Probes
GET https://winnteamrealtors.com/wp-login.php             → 200 OK (open to public)
GET https://winnteamrealtors.com/wp-json/wp/v2/users      → 200 OK · leaks admin username "keithwinnfl_wp_admin"
GET https://winnteamrealtors.com/xmlrpc.php               → 405 (mostly blocked — fine)

Zero security headers present

Direct response header audit returns nothing in the security category. PHP and Plesk both disclose themselves.

# Headers present
server: nginx
x-powered-by: PHP/8.3.30
x-powered-by: PleskLin

# Headers missing
Strict-Transport-Security: NOT SET
Content-Security-Policy: NOT SET
X-Frame-Options: NOT SET
X-Content-Type-Options: NOT SET
Referrer-Policy: NOT SET
Permissions-Policy: NOT SET

Site is shrinking in Google's index

DataForSEO Labs Domain Rank Overview (US, English):

avg_position     43.98 (page 5)
total_ranked     112 keywords
pos_1_10         0
pos_11_20        9
pos_21_30        20
pos_31_40        21
pos_41_50        22
pos_51_100       40

is_lost          89 keywords  ← regressing
is_new           69
is_up            34
is_down          8
# Net: −20 keywords lost vs gained recently

Stale sub-sitemap from 2017

listings-sitemap.xml reports lastmod 2017-02-26. Nine years old. Likely empty or pointing to long-dead listing URLs.

JS console errors on every page load

Uncaught TypeError: Cannot read properties of null (reading 'addEventListener')
Google Maps JavaScript API has been loaded directly without loading=async
Google Maps JavaScript API warning: RetiredVersion
Failed to execute 'postMessage' on 'DOMWindow' ('https://www.youtube.com')
@import rules are not allowed here

Google Maps is on the retired version — when Google enforces the cutover (announced for 2026), Maps will stop rendering entirely on this site.

robots.txt and sitemap_index are correct

robots.txt: Yoast-managed, allows all, declares sitemap. sitemap_index.xml: 13 child maps (post, page, buyer-guide, guarantee, location-profile, neighborhood, seller-guide, talking-house, listings, category, location-type, location, author). HTTPS redirect from HTTP works correctly.

"Test" placeholder URLs are publicly visible in the footer

The "Areas We Serve" footer block links to 16 URLs ending in -Test or -Test-Steven.

Dead and wrong-destination links throughout the footer

• 10 links go to #: Gulf Island, Isla Del Sol, Island Estates, Isle of Palms, Redington Beach, Redington Shores, Sunset Beach, Treasure Island, Westchase, "More Coming Soon!"
• "St Pete Beach" footer link → /m/sand-key (wrong destination)
• "St Petersburg" footer link → /m/sand-key (wrong destination)
• "Contact Us" body CTA → /contact_retired/ (retired page)
• "About Winn Team" footer link → /?page_id=2929040 (ugly URL, should be /about-winnteam/)

Heading hierarchy is broken in both directions

Audit of homepage + community pages reveals two opposite failures.

Title tags and meta descriptions empty or generic

Real E-E-A-T signals are present — just not advertised

• Two named agents with photos: Keith Winn + Yamil Winn
• License numbers in footer: BK3504148 | SL3531363
• 27+ Google reviews embedded with reviewer names and dates (Linda Suminski, Richard Suminski, Rachel Marcano, Audrey Hillman, Richard Hillman, gerard geva, Tulio Zuloaga, Janice Menendez, Betty Locher, Consuelo Rivers, Joe Hillner, Sonny Bissa, Rebecca Larrea, Prov Hogan, Julie Edwards, Don Orsini, Denise Houser, Jose, Yandiraminta Nunez, Rosario Nunez, Jennifer Velasquez, tamara gerardi, Susan Spallone, Christina O'Farrell, Susan Harris)
• Social profiles linked: Facebook, Instagram, YouTube, LinkedIn, TikTok
• Phone + email displayed site-wide
• "Trusted by 1,300+" trust claim

The story is here. It's just not getting credit from Google because it's not in schema (see §06) and not in the metadata (see C-04).

llms.txt contains test content and a typo in the title

# Title line of /llms.txt
# Winn Team Realtors: Expert Realtors specializing in East Lake Woodlands, Clearwater Beach, Dunedin, Safety Harborand Palm Harbor, FL.
#                                                                                                                  ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑
#                                                                                                                  missing space

# Posts section
- [Test Taxonomy](https://winnteamrealtors.com/test-taxonomy/)
# ↑ placeholder leaking to ChatGPT, Claude, Perplexity

# Pages section — client one-off custom-search pages exposed publicly
- [Rick & Linda Custom Searches](https://winnteamrealtors.com/rick-linda-custom-searches/)
- [Ultimar & Dan's Island for Lou](https://winnteamrealtors.com/ultimar-dans-island-for-lou/)
- [Lorenzo Family](https://winnteamrealtors.com/lorenzo/)
- [Steve A Custom Home Finder](https://winnteamrealtors.com/steve-a/)

# A page that actively tells AI it's unreliable
- [Structural Integrity Reserve Notes - Not Authoritative.](https://winnteamrealtors.com/structural_integrity_notes/)

llms.txt does NOT lift Google AI Overviews

Per Google's 2026-05-15 AI Optimization Guide, llms.txt is not a ranking lever for AI Overviews or AI Mode. Google explicitly says it's not required. The real Google AI levers are: standard SEO, snippet eligibility (no nosnippet), unique POV, crawlable JS-rendered DOM, and Google Business Profile.

llms.txt hygiene still matters for non-Google AI engines — Perplexity, ChatGPT browse, Claude web search. Worth fixing.

AI crawlers are not blocked at the edge

robots.txt is permissive (full Allow). Plesk WAF does not appear to challenge GPTBot, ClaudeBot, PerplexityBot, or Google-Extended on the limited probes available. Direct curl with browser UA returns 200.

Stop the bleeding. Lock down the site.

1. Fix the Plesk staging URL leak in Elementor fonts (T-01)
2. Plug WP user enumeration + harden wp-login + enable 2FA (T-02)
3. Add security headers + hide PHP/Plesk version (T-03)
4. Remove all 16 "Test" placeholder URLs from footer (C-01)
5. Fix 10 dead # footer links (C-02)
6. Fix wrong-destination links (St Pete Beach, St Petersburg, contact_retired) (C-02)
7. Switch Google Maps to loading=async + non-retired loader (T-06)

Make the metadata actually do its job.

1. Rewrite all page titles with geo + value-prop pattern (C-04)
2. Bulk-add meta descriptions in Yoast (C-04)
3. Fix the 7-H1 carousel on the homepage; collapse to one H1 (C-03)
4. Add H1 to community pages — start with East Lake Woodlands (C-03)
5. Clean llms.txt: fix typo, noindex Test Taxonomy, noindex client custom-search pages, noindex structural_integrity_notes (AI-01)
6. Add 301 redirect: /?page_id=2929040 → /about-winnteam/
7. Disable or rebuild the listings-sitemap.xml from 2017 (T-05)
8. Disable author-sitemap.xml (T-02 / T-05)

Show Google the authority that's already on the page.

1. Add RealEstateAgent schema with areaServed, serviceArea (§06)
2. Add Person schema for Keith + Yamil with identifier = license IDs BK3504148 / SL3531363
3. Add AggregateRating + Review for the 27 displayed Google reviews — biggest rich-result win on the site
4. Add LocalBusiness with address + geo
5. Build a Sold/Closed Properties page (the "1,300+" proof) — currently unsupported claim

Speed up the render. Start ranking content.

1. Carousel hero → static hero (perf + LCP + CLS)
2. Defer chat widget + reCAPTCHA until interaction
3. Enable WebP/AVIF via Elementor or an image-optimization plugin
4. Publish 4 long-form posts: zillow appraisals, cash offer pinellas, safety harbor neighborhoods, tampa bay relocation
5. Cross-link new posts from homepage + community pages

The subdomain decision.

Most of your ranking equity sits on homes.winnteamrealtors.com. Google treats that as a separate site. Talk to Steven (IDX vendor) about whether listings can be served as winnteamrealtors.com/homes/ instead. Consolidating to a subdirectory unifies authority. This is multi-week and IDX-vendor-dependent — not in the Week 1–4 plan, but every short-term improvement should be designed assuming this consolidation will eventually happen.