Some WordPress mail integrations ask for broad Gmail access even though the site only needs to send messages. That is more access than a contact form, password reset, or transactional email workflow should need.

The risk is not abstract. A broad Gmail permission can give an integration visibility into mail that has nothing to do with WordPress. If the site only needs to submit outgoing messages, there is no good operational reason to grant it the ability to read the mailbox as well.

On a cold load of the static export, the Astra site title could briefly look skewed before settling into place. The page itself was not broken, but the first visible moment was enough to make the header look unreliable.

This appeared after generating a static version of a WordPress site using Astra. It was most noticeable on a fresh visit, before the browser had anything cached. Once the animation settled, the title looked normal, which made the issue harder to reproduce if the page was simply refreshed over and over.

When Mailcow runs on a separate machine, forwarding its TCP traffic through HAProxy can leave the logs showing the forwarding layer instead of the connecting client. That defeats the point of checking the mail logs when the original source IP matters.

The service still receives traffic, so the forwarding path can look healthy at first. The problem becomes visible when investigating delivery, abuse, rate limits, or client behaviour and every connection appears to originate from the proxy instead of the real sender.

The first Staatic export from LocalWP on macOS can succeed, which makes the next failure confusing. Nothing obvious changes in WordPress, yet publishing the same site a second time from the same LocalWP session can break.

That sequence matters. This was not a case where Staatic could never generate the site. The first publish established that the site, plugin, and destination could work together. The trouble appeared after a previous export had already completed.

Mailcow was sending from the public IP of the machine where it was installed. That was the wrong address for this domain: the SPF record expected mail to leave through a different machine.

The server could send mail, so the problem did not first look like networking. The important detail appeared on the receiving side. The message was evaluated against the public IP that actually delivered it, not the public IP that the domain owner expected it to use.

Unlocking a virtual machine from the command line was not reliable in VMware Fusion on macOS. The limitation was easy to misread as an incorrect command, a damaged virtual machine, or a stale lock file, because all three can produce similar-looking failures.

The useful comparison was running the same task in VMware Workstation on Windows. Against a comparable virtual-machine setup, the command-line workflow worked there. That moved the focus away from the VM and toward the difference between the two VMware products.