Website check
wordpress.org
In plain English
wordpress.org scores B (81/100). The biggest issue: no Content Security Policy (plus 4 more).
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
HSTS lasts less than 6 months
Browsers forget the HTTPS-only rule quickly, so the protection lapses between visits.
How to fix: Raise max-age to at least 15552000 (6 months). 31536000 (1 year) is typical.
max-age=3600
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
WordPress version visible
The page shows which WordPress version it runs, which makes it easier for attackers to target known flaws.
How to fix: Keep WordPress updated and remove the version from the generator tag (many security plugins can do this).
generator: WordPress 7.2-beta1-64675
Runs PHP (version hidden)
The site appears to run on PHP but does not say which version. A critical PHP flaw, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), was patched on 21 October 2026.
How to fix: Confirm your server or host has applied the 21 October 2026 PHP security release (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later).
WordPress detected
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
Technical details (31)
- ip
- 2620:109:b00a::4206:2afc
- caa
- 0 issue "letsencrypt.org;validationmethods=dns-01;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/53691143", 0 iodef "mailto:caa@wordpress.org"
- php hints
- WordPress detected
- php php2shell
- unknown
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- Let's Encrypt
- tls subject
- wordpress.org
- tls validTo
- 2026-12-22T19:43:57.000Z
- tls daysLeft
- 61
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:66.6.42.0/24 ip4:66.155.40.0/24 include:helpscoutemail.com -all
- email apex
- wordpress.org
- email dmarc
- v=DMARC1; p=reject; rua=mailto:dmarc-reports@automattic.com;
- status
- 200
- cookies
- headers server
- nginx
- headers x-frame-options
- SAMEORIGIN
- headers strict-transport-security
- max-age=3600
- finalUrl
- https://wordpress.org/
- platform
- WordPress
- requests
- 3
- timingMs
- 2494
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- wordpressVersion
- 7.2
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- stats.wp.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.