Website check
wordpress.org
In plain English
This site scores B (81/100), a solid result with some hardening gaps. The most important fix is adding a Content Security Policy, which limits which scripts can run on the page and makes code-injection attacks harder. Visitors have no reason to worry from this check alone, but the owner should confirm the server's PHP version is current, since this scan could not see it.
No Content Security Policy
A Content Security Policy limits which scripts can run, which blunts attacks that inject code to steal logins or change the page.
How to fix: Add a Content-Security-Policy header. Start in report-only mode, then enforce it once nothing breaks.
HSTS lasts less than 6 months
Browsers forget the HTTPS-only rule quickly, so the protection lapses between visits.
How to fix: Raise max-age to at least 15552000 (6 months). 31536000 (1 year) is typical.
max-age=3600
No X-Content-Type-Options header
Browsers may guess file types, which can let an uploaded file run as a script.
How to fix: Send X-Content-Type-Options: nosniff.
No Referrer-Policy header
Some browsers may pass full page addresses, including any private details in them, to other sites visitors go to.
How to fix: Send Referrer-Policy: strict-origin-when-cross-origin (or stricter).
WordPress version visible
The page shows which WordPress version it runs, which makes it easier for attackers to target known flaws.
How to fix: Keep WordPress updated and remove the version from the generator tag (many security plugins can do this).
generator: WordPress 7.2-beta1-64675
Runs PHP (version hidden)
The site appears to run on PHP but does not say which version. A critical PHP flaw, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), was patched on 21 October 2026.
How to fix: Confirm your server or host has applied the 21 October 2026 PHP security release (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later).
WordPress detected
No Permissions-Policy header
This header lets the site switch off features like the camera, microphone and location for itself and anything it embeds.
How to fix: Send a Permissions-Policy header that turns off features you do not use, for example camera=(), microphone=(), geolocation=().
What the agent did (13 steps)
- 01Picked up a daily rating check
- 02Looking up wordpress.org and connecting over HTTPS
- 03Connected over HTTPS: wordpress.org answered 200
- 04Certificate from Let's Encrypt, valid 61 more days (TLSv1.3)
- 05Read the security headers: HSTS, X-Frame-Options set; missing CSP, nosniff, Referrer-Policy
- 06Runs PHP (WordPress detected) but hides the version, so PHP2Shell can't be ruled out from outside
- 07Platform: WordPress 7.2
- 08Found 1 script source from other sites
- 09Plain http:// redirects to HTTPS
- 10Old TLS 1.0/1.1: refused
- 11security.txt found
- 12Email spoofing protection: SPF set, DMARC set
- 13Scored 81/100, grade B. Writing it up in plain English
Technical details (31)
- ip
- 66.6.42.252
- caa
- 0 issue "letsencrypt.org;validationmethods=dns-01;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/53691143", 0 iodef "mailto:caa@wordpress.org"
- php hints
- WordPress detected
- php php2shell
- unknown
- tls cipher
- TLS_AES_128_GCM_SHA256
- tls issuer
- Let's Encrypt
- tls subject
- wordpress.org
- tls validTo
- 2026-12-22T19:43:57.000Z
- tls daysLeft
- 61
- tls protocol
- TLSv1.3
- tls authorized
- true
- email spf
- v=spf1 ip4:66.6.42.0/24 ip4:66.155.40.0/24 include:helpscoutemail.com -all
- email apex
- wordpress.org
- email dmarc
- v=DMARC1; p=reject; rua=mailto:dmarc-reports@automattic.com;
- status
- 200
- cookies
- headers server
- nginx
- headers x-frame-options
- SAMEORIGIN
- headers strict-transport-security
- max-age=3600
- finalUrl
- https://wordpress.org/
- platform
- WordPress
- requests
- 3
- timingMs
- 1025
- reachable
- true
- redirects
- oldTlsProbe
- rejected
- securityTxt
- true
- httpRedirect
- redirects to https
- wordpressVersion
- 7.2
- thirdPartyScripts
- 1
- thirdPartyScriptHosts
- stats.wp.com
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.