SecuvexaCybersecurity by I.T. Experts
US · $

Sample report — fictional website. Everything below describes an imaginary online shop at shop.example.com (a domain reserved for examples). It shows exactly what you get when you scan your own site.

Premium security report

shop.example.com

Scanned 12 October 2026, 9:46 AM IST · https://shop.example.com/

Grade D: Weak

8 issues need attention.

Your site has some serious gaps. The fix plan below lists what to do first and who can do it.

0Critical
1High
6Medium
1Low
Download PDF Scan again

At a glance

How your website looks from the outside, in four areas that matter to a business.

  • Visitor trust & HTTPS

    Needs attention · 1 issue

    Visitors are protected, but some HTTPS settings should be tightened.

  • Hacker entry points

    At risk · 2 issues

    Attackers could use exposed files, outdated software or unsafe scripts to break in.

  • Email impersonation

    Needs attention · 1 issue

    Email protection is only partly set up; fake emails in your name may still get through.

  • Browser protections

    Needs attention · 4 issues

    Some browser protections are missing; adding them is usually quick.

Technical details we checked

SSL / HTTPS

Status
Valid certificate
Issued by
Let's Encrypt (R11)
Expires
24 Oct 2026 (12 days)
Protocol
TLSv1.3

Security headers 2 of 6

  • Content-Security-Policy: missing
  • Strict-Transport-Security: missing
  • X-Frame-Options: missing
  • X-Content-Type-Options: missing
  • Referrer-Policy: present
  • Permissions-Policy: present

Email security

  • SPF: found and strict
  • DMARC: missing
  • DKIM: not detected (may still exist)

Technology and exposure

  • WordPress
  • WooCommerce
  • Apache
  • PHP

1 sensitive file(s) or path(s) are publicly reachable.

What changed since your last scan

Compared with the scan of shop.example.com on 11 Sep 2026.

+4 points Score 52 to 56

1 Fixed since last scan

  • Directory listing enabled

1 New since last scan

  • highOutdated WordPress plugin

Do these first

We grouped the findings into 6 actions, most important first. One action often fixes several issues.

Your score could go from 56 to 95 after the first 5 actions. Completing all 6 could take it to about 100.

An estimate from our scoring model, assuming each fix is completed and confirmed by a new scan.

Instructions are tailored to WordPress, which we detected on your site.

  1. Action 1: Update WordPress plugins and themes

    +12 points

    Out-of-date plugins and themes are one of the most common ways small WordPress sites get hacked.

    • Who: Your web developer
    • Effort: 30 minutes
    • high 1 issue
    How to do it on WordPress
    1. Take a full backup first.
    2. Go to Dashboard > Updates and update every plugin and theme named in the findings.
    3. Delete plugins and themes you no longer use; inactive ones can still be attacked.
    4. Switch on auto-updates for plugins you trust (Plugins > Enable auto-updates), then scan again.

    Fixes: Outdated WordPress plugin

  2. Action 2: Renew your SSL certificate and turn on auto-renewal

    +5 points

    When a certificate expires, browsers show a full-page warning that turns most visitors away.

    • Who: You, in your hosting panel
    • Effort: 5 minutes
    • medium 1 issue
    How to do it on cPanel (Apache)
    1. Log in to cPanel and open SSL/TLS Status.
    2. Select your domain and its www version, then click Run AutoSSL.
    3. Wait a few minutes and open your site in a private window to check the padlock.
    4. Leave AutoSSL switched on so the certificate renews itself.

    Fixes: SSL certificate expires soon

  3. Action 3: Add security headers

    +12 points

    These free browser settings block clickjacking, content sniffing and data leaks with a few lines of configuration.

    • Who: Your web developer
    • Effort: 30 minutes
    • medium 3 issues
    How to do it on WordPress
    1. Install a reputable headers plugin, or ask your developer to add the headers to .htaccess.
    2. Turn on Strict-Transport-Security, X-Frame-Options (SAMEORIGIN), X-Content-Type-Options (nosniff), Referrer-Policy and Permissions-Policy.
    3. Clear any caching plugin and scan again.

    Fixes: HSTS is not enabledSite can be embedded by other websites (clickjacking)X-Content-Type-Options header missing

  4. Action 4: Protect your login pages

    +5 points

    Login pages are hit by password-guessing bots around the clock; strong passwords and two-factor login stop most of them.

    • Who: You, in your hosting panel
    • Effort: 30 minutes
    • medium 2 issues
    How to do it on WordPress
    1. Install a security plugin with login limiting and two-factor login (for example Wordfence or Solid Security).
    2. Turn on two-factor login for every administrator.
    3. Disable XML-RPC and hide the public user list if you do not need them (most security plugins have a switch).
    4. Remove administrator accounts nobody uses.

    Fixes: WordPress usernames are publicly listedWordPress login page is publicly reachable

  5. Action 5: Stop fraudsters sending email as your domain

    +5 points

    Without SPF, DKIM and DMARC, anyone can send invoices or payment requests that appear to come from your business.

    • Who: Your email/DNS provider
    • Effort: 30 minutes
    • medium 2 issues
    How to do it on cPanel (Apache)
    1. Open cPanel > Email Deliverability and click Repair (or Install) for SPF and DKIM.
    2. If your email is with Google Workspace or Microsoft 365, use their SPF include and DKIM record instead.
    3. In Zone Editor add a TXT record named _dmarc: v=DMARC1; p=quarantine; rua=mailto:you@yourdomain.
    4. Check that normal email still arrives, then scan again.

    Fixes: No DMARC record (email spoofing risk)DKIM signing not detected

Show 1 more action

  1. Action 6: Add a Content Security Policy

    +5 points

    A Content Security Policy limits which scripts can run, which blunts card-skimming and script-injection attacks.

    • Who: Your web developer
    • Effort: Needs a developer
    • medium 1 issue
    How to do it
    1. Start with a Content-Security-Policy-Report-Only header so nothing breaks.
    2. List the outside services your site really uses (analytics, fonts, payments, chat).
    3. Tighten the policy until the reports are clean, then switch to the enforcing header.
    4. Avoid 'unsafe-inline' and 'unsafe-eval' for scripts where possible.

    Fixes: No Content Security Policy

All findings

Grouped by area. Open any finding for the explanation and what to do.

Visitor trust & HTTPSNeeds attention

medium SSL certificate expires soon

SSL / HTTPS

Your security certificate expires within the next 30 days. If it is not renewed in time, visitors will see a scary browser warning and may not be able to use your site.

Affected: https://shop.example.com/

Evidence

Certificate expires on 2026-10-24 (in 12 days)
What to doRenew the certificate now, and make sure automatic renewal is switched on so this never becomes an outage.

How to fix it

cPanel: SSL/TLS Status > Run AutoSSL.
Certbot: sudo certbot renew --dry-run (fix any errors it shows), then confirm the systemd timer or cron job exists.
Cloudflare edge certificates renew automatically; this warning then refers to your origin certificate.

References

Hacker entry pointsAt risk

high Outdated WordPress plugin

Technology

One of the plugins on your WordPress site is older than the latest version published on wordpress.org. Plugins are the most common way small WordPress sites get hacked: when a security fix is released, the details become public and bots start looking for sites that have not updated yet. We compared the version your site shows with the official wordpress.org listing; we did not test the plugin for any specific weakness.

Affected: https://shop.example.com/wp-content/plugins/shop-slider-pro/

Evidence

Plugin "shop-slider-pro" 2.1.0 is installed; wordpress.org lists 3.4.2 (fictional sample data).
What to doBack up the site, then update the plugin (and any others with updates waiting). If you no longer use the plugin, deactivate and delete it.

How to fix it

WordPress: take a backup (e.g. UpdraftPlus or your host's backup tool), then Dashboard > Updates > select the plugin > Update Plugins. Turn on "Enable auto-updates" for the plugin on the Plugins screen.
WP-CLI: wp plugin update <slug>   (or: wp plugin update --all)
cPanel: use your host's backup first (cPanel > Backup or JetBackup), then update from the WordPress dashboard; Softaculous / WordPress Toolkit can also update plugins and switch on auto-updates.
Premium plugins bought outside wordpress.org: download the latest zip from the vendor and upload it under Plugins > Add New > Upload Plugin (WordPress offers to replace the old version).
Remove plugins you do not use: deactivate, then Delete.

References

medium WordPress usernames are publicly listed

Exposed files

Your WordPress site publishes the login names of its users through its API. Attackers use these names for password-guessing attacks against your admin login.

Affected: https://shop.example.com/wp-json/wp/v2/users

Evidence

/wp-json/wp/v2/users lists 2 user names
What to doRestrict the users REST endpoint to logged-in users and protect the login page.

How to fix it

Plugin: a security plugin (e.g. Wordfence, Solid Security) can block user enumeration.
Code (functions.php):
  add_filter('rest_endpoints', function ($e) { if (!is_user_logged_in()) { unset($e['/wp/v2/users'], $e['/wp/v2/users/(?P<id>[\d]+)']); } return $e; });
Also enable two-factor login for admins.

References

info WordPress login page is publicly reachable

Admin

Your WordPress login page is open to the internet, as on most WordPress sites. Bots constantly try passwords against it, so it must be protected with strong passwords and ideally two-factor login.

Affected: https://shop.example.com/wp-login.php

Evidence

/wp-login.php is reachable
What to doUse strong unique passwords, enable two-factor authentication and limit login attempts.

How to fix it

Install a security plugin with login rate-limiting and 2FA (e.g. Wordfence, Solid Security, WP 2FA).
Optional: restrict /wp-login.php by IP or add HTTP Basic Auth in front of it; Cloudflare: WAF rate-limiting rule on /wp-login.php.

References

Email impersonationNeeds attention

medium No DMARC record (email spoofing risk)

DNS and email

DMARC tells email providers what to do with emails that pretend to come from your domain, and sends you reports about them. Without it, phishing emails using your name are more likely to reach your customers' inboxes. Gmail and Yahoo now require DMARC for bulk senders.

Affected: _dmarc.example.com

Evidence

No DMARC record at _dmarc.example.com
What to doPublish a DMARC record. Start with p=none to collect reports, then move to quarantine or reject.

How to fix it

Add a TXT record named _dmarc with value:
  v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1
After 2-4 weeks of clean reports change to p=quarantine, then p=reject.
Cloudflare: Email > DMARC Management can set this up.

References

info DKIM signing not detected

DNS and email

DKIM adds a digital signature to your emails so receivers can confirm they really came from you. We checked common settings and did not find it; it may still be set up under a different name.

Affected: example.com

Evidence

No DKIM key at common selectors (default, google, selector1, selector2, k1, mail)
What to doEnable DKIM signing with your email provider and publish the DNS key it gives you.

How to fix it

Google Workspace: Admin console > Apps > Gmail > Authenticate email > Generate new record.
Microsoft 365: Defender portal > Email authentication > DKIM.
cPanel: Email > Email Deliverability > DKIM > Install the suggested record.

References

Browser protectionsNeeds attention

medium No Content Security Policy

Security headers

A Content Security Policy tells browsers which scripts are allowed to run on your pages. Without it, if an attacker manages to inject code (for example through a vulnerable plugin or a form), it will run in your visitors' browsers and can steal logins or show fake payment pages.

Affected: https://shop.example.com/

Evidence

Content-Security-Policy header not present
What to doAdd a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing legitimate breaks.

How to fix it

Starter policy (adjust the allowed domains for your analytics, fonts, payment widgets):
  Content-Security-Policy: default-src 'self'; script-src 'self' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; object-src 'none'

Apache (.htaccess):
  Header always set Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
Nginx:
  add_header Content-Security-Policy "default-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self'" always;
Cloudflare: Rules > Transform Rules > Modify Response Header > Set static.
WordPress: use a headers plugin (e.g. "HTTP Headers") or add the header in .htaccess; test with Content-Security-Policy-Report-Only first.

References

medium HSTS is not enabled

Security headers

HTTP Strict Transport Security (HSTS) tells browsers to always use the secure version of your site. Without it, an attacker on public Wi-Fi can silently downgrade a visitor to the insecure version and read or change what they see.

Affected: https://shop.example.com/

Evidence

Strict-Transport-Security header not present
What to doAdd the Strict-Transport-Security header once HTTPS works on every page and subdomain.

How to fix it

Apache (.htaccess):
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Nginx:
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Cloudflare: SSL/TLS > Edge Certificates > HTTP Strict Transport Security (HSTS) > Enable.
Start with max-age=86400 if unsure, then raise it to one year.

References

medium Site can be embedded by other websites (clickjacking)

Security headers

Other websites can load your pages invisibly inside their own and trick visitors into clicking buttons on your site (for example "Pay" or "Delete account"). This is called clickjacking.

Affected: https://shop.example.com/

Evidence

Neither X-Frame-Options nor CSP frame-ancestors is set
What to doAdd X-Frame-Options: SAMEORIGIN, or a Content-Security-Policy frame-ancestors directive.

How to fix it

Apache (.htaccess):
  Header always set X-Frame-Options "SAMEORIGIN"
Nginx:
  add_header X-Frame-Options "SAMEORIGIN" always;
Modern alternative (in your CSP): frame-ancestors 'self';
WordPress admin already sends this header; it is the public pages that need it.

References

low X-Content-Type-Options header missing

Security headers

Without this header, some browsers try to "guess" what a file is, which can let an uploaded file be run as a script.

Affected: https://shop.example.com/

Evidence

X-Content-Type-Options header not present
What to doAdd X-Content-Type-Options: nosniff.

How to fix it

Apache: Header always set X-Content-Type-Options "nosniff"
Nginx:  add_header X-Content-Type-Options "nosniff" always;
Cloudflare: Transform Rules > Modify Response Header.

References

Score history for shop.example.com

Verify your fixes

After you or your developer make changes, scan shop.example.com again. The new scan checks the live site from scratch and shows what changed since this one.

This form is disabled in the sample. Scan your own website to use it.

Keep it secure

Websites change after today: plugins age, certificates expire and settings get undone. Choose how you want to keep watch.

Free Security Watch

Keep an eye on your website, free

  • A short re-scan summary by email once a month: your score, what changed and the top issues.
  • A reminder 21 and 7 days before your SSL certificate expires.
  • A reminder 30 days before your domain registration expires, when the registry publishes the date.

Up to 3 websites per email address. Unsubscribe with one click from any email. Need weekly scans, every finding and instant alerts? See Monitoring ($349 / year).

We will email you a link to confirm. Nothing is sent until you click it.

A deeper check

An automated scan sees only the outside. A security analyst can test logins, forms and payments by hand and retest after you fix.

Ask about an audit

This is an automated, non-destructive assessment of what was publicly visible at the time of the scan. It does not test login areas or business logic, and a good score does not guarantee a website cannot be hacked. Score projections are estimates. Terms

Now see your own website's report

The free scan takes about 30 seconds and needs no sign-up. You will get a score, the risk areas and your fix plan, like the sample above.

Scan my website free Try the free tools