Security Scan Results
https://nairobi.go.ke
Scan complete
nairobi.go.ke
Poor — Multiple Issues Found
19 issues detected
Scanned 4 months ago
19
Total
0
Critical
2
High
9
Medium
WordPress version 6.0.1 detected
Plugin 'contact-form-7' v5.6.2: Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
Plugin 'contact-form-7' v5.6.2: Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload
Plugin 'contact-form-7' v5.6.2: Contact Form 7 <= 5.9.4 - Unauthenticated Open Redirect
Plugin 'contact-form-7' v5.6.2: Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
Plugin 'wp-shortcode' v1.4.16: WP Shortcode by MyThemeShop <= 1.4.16 - Cross-Site Request Forgery
SSL certificate error -- site may have an invalid or expired certificate
WP_DEBUG is disabled (no PHP errors visible)
Missing security header: X-Frame-Options -- Prevents clickjacking attacks
How to fix: Add to .htaccess: Header always set X-Frame-Options "SAMEORIGIN" — prevents clickjacking attacks.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Content-Security-Policy -- Controls resource loading
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
SSL error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)
HTTP correctly redirects to HTTPS
Cookies missing security flags (SameSite, Secure): __wpdm_client, cookiesession1
How to fix: Set cookie security flags in wp-config.php: @ini_set("session.cookie_httponly", 1); @ini_set("session.cookie_secure", 1); @ini_set("session.cookie_samesite", "Lax");
2 trusted external script(s): platform.twitter.com (Social Media), www.google.com (Google)
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49