Review crawlability, indexing signals, page metadata, internal links, structured data and performance priorities before deciding what should change.
Scope stays tied to the website and outcome you actually need rather than expanding into unnecessary work.
I start with evidence from the live site, source code, Search Console or the relevant technical layer. Changes are kept recoverable, and the result is checked against the original problem instead of stopping at a plugin setting or a green score.
SEO and security work can remove technical problems and improve the site foundation. Search performance still depends on relevance, competition, useful content, reputation and external signals. Security risk can be reduced, not reduced to zero.
Send the public URL and the problem. Do not send passwords in the enquiry form.