# Remediation Roadmap — example-roofing.com **Audit ID:** `saor-aud-7f3c9e2a` **Date:** 2026-04-29 **Engineer:** Saor Systems · Saor Core v0.4.2 This document is engineer-ready. Hand it to your developer or your dev shop. Every fix below maps to a specific finding in `audit_2026-04-29.json`. --- ## Summary - **5 leaks classified** · 2 critical · 3 high - **Estimated daily revenue at risk:** $2,100/day (~$63k over 30 days) - **Total remediation effort:** ~25 engineer-hours - **Expected lead recovery after fixes:** 12–18% --- ## Priority 1 — Critical (do this week) ### P1a. Plug the Pipedrive ingest leak (saor-find-001) **Symptom:** 14% of form submissions never become Pipedrive records. **Root cause:** Single Zapier hop, no retry, no backfill, no alarm. **Fix:** 1. Replace the Zapier `wpforms → pipedrive` zap with a self-hosted webhook handler (`/api/lead-router`) that retries 3× with exponential backoff. 2. Add an alert: `count(form_submissions) - count(pipedrive_creates)` over a rolling 6h window. If delta > 5, page the on-call. 3. **Backfill:** the 58 missed records are still in the WPForms entries DB. Export → transform → ingest via Pipedrive REST API. **Effort:** 6 hours **Impact:** +1–3 leads/day recovered ($300–$900/day) ### P1b. Migrate off Zapier task-quota cliff (saor-find-002) **Symptom:** 3 of 12 zaps silently 4xx'd in the last 24h. **Root cause:** Account is at 92% of monthly task quota. Failures bubble up as 200s to the source but 429 to downstream steps. **Fix:** 1. Migrate critical paths (`lead_router_v2`, `smsfollowup_premium`, `calendar_invite`) to **Make.com** or self-hosted **n8n**. Cheaper, no monthly task ceiling. 2. Add Zapier quota alarms at 80% / 90% / 95%. 3. Insert a retry buffer (`leads.failed_outbound`) so any non-2xx triggers a redrive cron. **Effort:** 10 hours **Impact:** +1–2 leads/day recovered ($300–$600/day) --- ## Priority 2 — High (do within the month) ### P2a. TLS modernization (saor-find-003) - Upgrade to TLS 1.3 + OCSP stapling - Cloudflare proxy in front of origin - Re-issue cert with 2-cert chain max - **Effort:** 2 hours · **Impact:** ~6.4% mobile bounce reduction ### P2b. Mobile form refactor (saor-find-004) - Reduce visible fields from 7 to 4 (progressive disclosure) - Scroll-to-button on focus-blur of last field - `env(keyboard-inset-height)` safe area for iOS Safari - **Effort:** 3 hours · **Impact:** ~38% recovery of currently-abandoning iOS <15 users ### P2c. TTFB and render-blocking (saor-find-005) - Defer 4 non-critical `` scripts - Inline critical CSS for above-the-fold - Preload the form-handler endpoint - Move Google Tag Manager to a worker - **Effort:** 4 hours · **Impact:** ~32% mobile session-loss recovery at p95 --- ## Validation plan After each fix, validate against the existing audit telemetry: 1. **CRM ingest delta:** rerun the WPForms-vs-Pipedrive diff. Target: <2% delta. 2. **Webhook reliability:** synthetic submission every 30 min for 7 days. Target: 100% delivery. 3. **TLS handshake:** WebPageTest from 4 geos. Target: p50 <200ms, p95 <300ms. 4. **Mobile form:** real-user RUM — submission completion rate on iOS 14. Target: parity with iOS 15+. 5. **TTFB:** real-user metrics. Target: p95 <600ms on 4G. A re-audit in 30 days should confirm 12–18% lead recovery. --- ## What we did NOT do (deliberate) - Did not audit ad creative, campaign targeting, or paid-media spend. - Did not audit copy or landing-page messaging. - Did not modify any production system during the scan. These are out of scope for a Saor Systems audit. Saor finds the leaks in the plumbing. What flows *through* the plumbing — your offer, your copy, your ads — is between you and your marketing partner. --- ## Questions If your dev shop pushes back on any of the above, send the question to `hello@saor.systems`. Free clarification within 30 days of report delivery. — Saor Systems