Security Scan Results
https://www.sptr.ru
Scan complete
www.sptr.ru
Poor — Multiple Issues Found
19 issues detected
Scanned 1 month ago
19
Total
1
Critical
1
High
3
Medium
WP_DEBUG is disabled (no PHP errors visible)
PHP 8.4.6 detected (supported version)
X-Powered-By header exposed: PHP/8.4.6 — reveals server software
How to fix: Hide X-Powered-By header. In php.ini set expose_php = Off, or add Header unset X-Powered-By to .htaccess.
Missing security header: X-Content-Type-Options -- Prevents MIME-type sniffing
How to fix: Add to .htaccess: Header always set X-Content-Type-Options "nosniff" — prevents MIME-type sniffing.
Missing security header: Strict-Transport-Security -- Enforces HTTPS connections
How to fix: Add to .htaccess or nginx: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Missing security header: Referrer-Policy -- Controls referrer information
Missing security header: Permissions-Policy -- Controls browser feature access
2 of 6 security headers configured
SSL certificate valid (80 days remaining) — issued by Let's Encrypt
HTTP correctly redirects to HTTPS
Cookies missing security flags (SameSite, Secure): PHPSESSID
How to fix: Set cookie security flags in wp-config.php: @ini_set("session.cookie_httponly", 1); @ini_set("session.cookie_secure", 1); @ini_set("session.cookie_samesite", "Lax");
WordPress configuration file exposed
/wp-config.php
Debug log exposed
/wp-content/debug.log
WordPress readme exposed (version info)
/readme.html
WordPress license file exposed
/license.txt
REST API user enumeration blocked
wp-cron.php is publicly accessible (potential DDoS vector)
/wp-cron.php
How to fix: Disable WP-Cron in wp-config.php with define("DISABLE_WP_CRON", true) and use a real server cron job instead.
No external scripts detected
Checked against 11 blacklist services
Your site needs immediate attention
We found critical security issues. Our experts can clean your site and fix all vulnerabilities within 24 hours.
Get Expert Cleanup — $49