Security Scan Results

WP_DEBUG is disabled (no PHP errors visible)

6 of 6 security headers configured

SSL certificate valid (73 days remaining) — issued by Google Trust Services

HTTP correctly redirects to HTTPS

Cookies missing security flags (SameSite): __cf_bm

How to fix: Set cookie security flags in wp-config.php: @ini_set("session.cookie_httponly", 1); @ini_set("session.cookie_secure", 1); @ini_set("session.cookie_samesite", "Lax");

WordPress license file exposed

/license.txt

REST API user enumeration blocked

wp-cron.php is publicly accessible (potential DDoS vector)

/wp-cron.php

How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.

Suspicious inline JavaScript: unicode-escaped strings

How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.

Suspicious inline JavaScript: unicode-escaped strings

How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.

Suspicious inline JavaScript: unicode-escaped strings

How to fix: Inspect this inline JavaScript carefully — obfuscated code can indicate malware injection.

No external scripts detected