SecuvexaCybersecurity by I.T. Experts
UK · £

Sample report — fictional website. Everything below describes an imaginary online shop at shop.example.com (a domain reserved for examples). It shows exactly what you get when you scan your own site.

Free security report

shop.example.com

Scanned 12 October 2026, 9:46 AM IST · https://shop.example.com/

Grade D: Weak

8 issues need attention.

Your site has some serious gaps. The fix plan below lists what to do first and who can do it.

0Critical
1High
6Medium
1Low
See what to fix first Send to your developer

At a glance

How your website looks from the outside, in four areas that matter to a business.

  • Visitor trust & HTTPS

    Needs attention · 1 issue

    Visitors are protected, but some HTTPS settings should be tightened.

  • Hacker entry points

    At risk · 2 issues

    Attackers could use exposed files, outdated software or unsafe scripts to break in.

  • Email impersonation

    Needs attention · 1 issue

    Email protection is only partly set up; fake emails in your name may still get through.

  • Browser protections

    Needs attention · 4 issues

    Some browser protections are missing; adding them is usually quick.

Technical details we checked

SSL / HTTPS

Status
Valid certificate
Issued by
Let's Encrypt (R11)
Expires
24 Oct 2026 (12 days)
Protocol
TLSv1.3

Security headers 2 of 6

  • Content-Security-Policy: missing
  • Strict-Transport-Security: missing
  • X-Frame-Options: missing
  • X-Content-Type-Options: missing
  • Referrer-Policy: present
  • Permissions-Policy: present

Email security

  • SPF: found and strict
  • DMARC: missing
  • DKIM: not detected (may still exist)

Technology and exposure

  • WordPress
  • WooCommerce
  • Apache
  • PHP

1 sensitive file(s) or path(s) are publicly reachable.

What changed since your last scan

Compared with the scan of shop.example.com on 11 Sep 2026.

+4 points Score 52 to 56

1 Fixed since last scan

  • Directory listing enabled

1 New since last scan

  • highOutdated WordPress plugin

Do these first

We grouped the findings into 6 actions, most important first. One action often fixes several issues.

Your score could go from 56 to 95 after the first 5 actions. Completing all 6 could take it to about 100.

An estimate from our scoring model, assuming each fix is completed and confirmed by a new scan.

  1. Action 1: Update WordPress plugins and themes

    +12 points

    Out-of-date plugins and themes are one of the most common ways small WordPress sites get hacked.

    • Who: Your web developer
    • Effort: 30 minutes
    • high 1 issue
    Step-by-step instructions for WordPress are in the full report

  2. Action 2: Renew your SSL certificate and turn on auto-renewal

    +5 points

    When a certificate expires, browsers show a full-page warning that turns most visitors away.

    • Who: You, in your hosting panel
    • Effort: 5 minutes
    • medium 1 issue
    Step-by-step instructions for cPanel (Apache) are in the full report

  3. Action 3: Add security headers

    +12 points

    These free browser settings block clickjacking, content sniffing and data leaks with a few lines of configuration.

    • Who: Your web developer
    • Effort: 30 minutes
    • medium 3 issues
    Step-by-step instructions for WordPress are in the full report

  4. Action 4: Protect your login pages

    +5 points

    Login pages are hit by password-guessing bots around the clock; strong passwords and two-factor login stop most of them.

    • Who: You, in your hosting panel
    • Effort: 30 minutes
    • medium 2 issues
    Step-by-step instructions for WordPress are in the full report

  5. Action 5: Stop fraudsters sending email as your domain

    +5 points

    Without SPF, DKIM and DMARC, anyone can send invoices or payment requests that appear to come from your business.

    • Who: Your email/DNS provider
    • Effort: 30 minutes
    • medium 2 issues
    Step-by-step instructions for cPanel (Apache) are in the full report
Show 1 more action

  1. Action 6: Add a Content Security Policy

    +5 points

    A Content Security Policy limits which scripts can run, which blunts card-skimming and script-injection attacks.

    • Who: Your web developer
    • Effort: Needs a developer
    • medium 1 issue
    Step-by-step instructions are in the full report

Get the step-by-step fixes

The full report adds instructions for WordPress, evidence for every issue and a PDF your developer can work from.

Unlock the fix plan

Top findings

The 8 most important of 10 findings, grouped by area.

Visitor trust & HTTPSNeeds attention

medium SSL certificate expires soon

SSL / HTTPS

Your security certificate expires within the next 30 days. If it is not renewed in time, visitors will see a scary browser warning and may not be able to use your site.

Affected: https://shop.example.com/

What to doRenew the certificate now, and make sure automatic renewal is switched on so this never becomes an outage.

Hacker entry pointsAt risk

high Outdated WordPress plugin

Technology

One of the plugins on your WordPress site is older than the latest version published on wordpress.org. Plugins are the most common way small WordPress sites get hacked: when a security fix is released, the details become public and bots start looking for sites that have not updated yet. We compared the version your site shows with the official wordpress.org listing; we did not test the plugin for any specific weakness.

Affected: https://shop.example.com/wp-content/plugins/shop-slider-pro/

What to doBack up the site, then update the plugin (and any others with updates waiting). If you no longer use the plugin, deactivate and delete it.
medium WordPress usernames are publicly listed

Exposed files

Your WordPress site publishes the login names of its users through its API. Attackers use these names for password-guessing attacks against your admin login.

Affected: https://shop.example.com/wp-json/wp/v2/users

What to doRestrict the users REST endpoint to logged-in users and protect the login page.

Email impersonationNeeds attention

medium No DMARC record (email spoofing risk)

DNS and email

DMARC tells email providers what to do with emails that pretend to come from your domain, and sends you reports about them. Without it, phishing emails using your name are more likely to reach your customers' inboxes. Gmail and Yahoo now require DMARC for bulk senders.

Affected: _dmarc.example.com

What to doPublish a DMARC record. Start with p=none to collect reports, then move to quarantine or reject.

Browser protectionsNeeds attention

medium No Content Security Policy

Security headers

A Content Security Policy tells browsers which scripts are allowed to run on your pages. Without it, if an attacker manages to inject code (for example through a vulnerable plugin or a form), it will run in your visitors' browsers and can steal logins or show fake payment pages.

Affected: https://shop.example.com/

What to doAdd a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing legitimate breaks.
medium HSTS is not enabled

Security headers

HTTP Strict Transport Security (HSTS) tells browsers to always use the secure version of your site. Without it, an attacker on public Wi-Fi can silently downgrade a visitor to the insecure version and read or change what they see.

Affected: https://shop.example.com/

What to doAdd the Strict-Transport-Security header once HTTPS works on every page and subdomain.
medium Site can be embedded by other websites (clickjacking)

Security headers

Other websites can load your pages invisibly inside their own and trick visitors into clicking buttons on your site (for example "Pay" or "Delete account"). This is called clickjacking.

Affected: https://shop.example.com/

What to doAdd X-Frame-Options: SAMEORIGIN, or a Content-Security-Policy frame-ancestors directive.
low X-Content-Type-Options header missing

Security headers

Without this header, some browsers try to "guess" what a file is, which can let an uploaded file be run as a script.

Affected: https://shop.example.com/

What to doAdd X-Content-Type-Options: nosniff.

2 more findings + evidence + step-by-step fixes

Unlock the complete report with technical evidence for every issue, fixes your developer can copy, and a PDF to share.

Unlock the full report

Fix these issues with confidence

Recommended for this report

Premium Automated Report

£39 one-time
  • Step-by-step fix plan for WordPress
  • All findings, including 2 hidden ones
  • Evidence, affected URLs and copy-paste fixes
  • Professional PDF to share with your developer
Unlock full report

Professional Audit

from£790

A security analyst manually tests shop.example.com, including things an automated scan cannot see, and retests after you fix.

Book audit Ask a question

Verify your fixes

After you or your developer make changes, scan shop.example.com again. The new scan checks the live site from scratch and shows what changed since this one.

This form is disabled in the sample. Scan your own website to use it.

Keep it secure

Websites change after today: plugins age, certificates expire and settings get undone. Choose how you want to keep watch.

Free Security Watch

Keep an eye on your website, free

  • A short re-scan summary by email once a month: your score, what changed and the top issues.
  • A reminder 21 and 7 days before your SSL certificate expires.
  • A reminder 30 days before your domain registration expires, when the registry publishes the date.

Up to 3 websites per email address. Unsubscribe with one click from any email. Need weekly scans, every finding and instant alerts? See Monitoring (£279 / year).

We will email you a link to confirm. Nothing is sent until you click it.

This is an automated, non-destructive assessment of what was publicly visible at the time of the scan. It does not test login areas or business logic, and a good score does not guarantee a website cannot be hacked. Score projections are estimates. Terms

Now see your own website's report

The free scan takes about 30 seconds and needs no sign-up. You will get a score, the risk areas and your fix plan, like the sample above.

Scan my website free Try the free tools