Security Scan Results
https://crockhamhillvillagehall.co.uk
Scan complete
crockhamhillvillagehall.co.uk
Fair — Some Issues Found
23 issues detected
Scanned 3 months ago
23
Total
0
Critical
0
High
13
Medium
WordPress version 6.8.1 detected
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.61.0
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.58.2
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.58.2
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.58.4
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.58.3
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.58.8
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.62.3
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.69.0
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.64.1
Plugin 'so-widgets-bundle' v1.1: SiteOrigin Widgets Bundle [so-widgets-bundle] < 1.51.0
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL certificate valid (190 days remaining) — issued by Sectigo Limited
HTTP correctly redirects to HTTPS
REST API user enumeration blocked
No external scripts detected
Checked against 11 blacklist services
Want to find hidden issues?
This surface scan checks what's publicly visible. A deep scan connects via SSH to check file integrity, database injections, and hidden backdoors.
Run Deep Scan — $1