The standard behind Quartermaster
One tool for each job. Patched on a schedule. Tested before it goes live.
Each requirement names the standard first and our usual tool second. We review existing tools before replacing them. Hosting, licenses, and other vendor fees are yours unless your agreement includes them.
1. Hosting and delivery
| Requirement | Standard tool | Notes |
|---|---|---|
| Managed WordPress hosting with staging | WP Engine | |
| CDN and firewall in front of the site, HTTPS forced | Cloudflare | Blocks bad traffic before it reaches WordPress. |
| Page caching | The host’s cache | No separate caching plugin. |
| Media stored off the web server | WP Offload Media with Amazon S3 | The S3 bucket lives in the client’s own AWS account. |
| Compressed images | One image optimizer | The tool is selected for the site. |
| Unused scripts removed (optional) | Perfmatters | For sites that fail Core Web Vitals. |
2. Security
| Requirement | Standard tool | Notes |
|---|---|---|
| Login protection and malware scanning | Wordfence | The only security plugin on the site. |
| Two-factor authentication enforced for every admin and editor | Wordfence | |
| Least-privilege roles | WordPress core | Authors are not admins. Old accounts are removed. |
| Activity log | WP Activity Log | Retention capped at three months. Failed-login logging off, because Wordfence already records those. |
| In-dashboard code editor turned off | One line in the site config | A stolen admin login cannot plant code through the dashboard. |
| XML-RPC blocked | Cloudflare rule | Closes an old login route that attackers use to guess passwords in bulk. |
| Spam filtering | Akismet | For sites with comments or public forms. |
3. Maintenance
| Requirement | Standard | Notes |
|---|---|---|
| Updates on a schedule | Routine patches within 30 days; critical patches within 48 hours when an update or workable mitigation exists | Covers WordPress core, plugins, themes, and PHP. |
| Current PHP version | A version still receiving security fixes | |
| Licenses renewed | Every premium plugin has an active license | A lapsed license stops updates silently. |
| Every change tested first | Staging before production | |
| Backups | Daily, stored off the server, with a restore tested on staging every quarter | |
| Short plugin list | One tool per job, reviewed quarterly | Inactive plugins are deleted, not left in place. |
| Scheduled tasks run by the server | WP Engine Alternate Cron | Off by default on WP Engine. Without it, scheduled posts can publish late on a heavily cached site. |
| Post revisions kept, with a cap | Five per post on WP Engine | WP Engine turns revisions off by default, which leaves editors with no edit history. |
4. Measurement
| Requirement | Standard tool | Notes |
|---|---|---|
| One tag manager container, placed in the theme | Google Tag Manager | No Site Kit. Site Kit ties the integration to a single Google account. |
| One analytics tag, loaded only through the tag manager | GA4 | Prevents double counting. |
| Search Console verified by DNS | Google Search Console | DNS verification survives a theme change. |
| Bing verified | Bing Webmaster Tools | |
| Cookie consent where required | Complianz or CookieYes | The tool is agreed for the site. |
5. SEO and distribution
| Requirement | Standard tool | Notes |
|---|---|---|
| Titles, descriptions, canonicals, and schema on every page | Yoast SEO | |
| Sitemaps that list only indexable pages | Yoast SEO | No redirects, errors, or noindex pages in the sitemap. |
| News sitemap and NewsArticle schema | Yoast News | For sites that publish news. |
| Large image previews allowed | max-image-preview:large | Google requires this, or AMP, for large images in Discover. |
| Featured images at least 1,200px wide | Editorial practice | Google’s stated minimum for Discover. |
| Open Graph and Twitter card tags | Yoast SEO | |
| Valid RSS feeds | WordPress core | Feeds return valid XML and link to production URLs. |
| Redirects managed in one place, with 404 monitoring | Redirection | Sites with Yoast Premium can use its redirect manager instead. |
| Topic pages and internal linking | Field Guide | |
| A deliberate AI crawler policy | Cloudflare and robots.txt | Allow or block by choice. Several sites we reviewed were blocking AI crawlers without having decided to. |
| Apple News distribution (optional) | Publish to Apple News | Daily news publishers only. Requires Apple’s channel approval and PHP 8.3. |
No AMP. Google no longer requires it for Top Stories.
6. Content and editorial
| Requirement | Standard tool | Notes |
|---|---|---|
| Structured content fields | ACF Pro | |
| Multiple authors and guest authors, each with an author page | Co-Authors Plus | Suits papers with several authors and outside scholars. |
| Footnotes | Modern Footnotes | For research and policy content. |
| Data tables | TablePress (Premium) |
7. Email
| Requirement | Standard tool | Notes |
|---|---|---|
| Site email sent through an authenticated service | One SMTP plugin | The tool is selected for the site. A second mail plugin can intercept delivery. |
| Sending from the client’s own domain | SPF, DKIM, and DMARC records | Without these, form notifications and password resets get rejected. |
| Mail delivery | Brevo or Amazon SES | Accounts stay in the client’s name. Usage fees are separate unless the agreement includes them. |
8. Optional modules
| Need | Standard tool |
|---|---|
| Forms | Gravity Forms |
| Events | The Events Calendar |
| Archive search | SearchWP or FacetWP |
9. Monitoring
Every Quartermaster site includes Fire Watch monitoring. It checks the pages, feeds, sitemaps, tags, and records that keep a publisher’s site visible.
10. Accessibility
Templates are checked against WCAG 2.1 AA. Automated checks are followed by a manual review of keyboard navigation and alt text.