Sample report · fictional business

Website Security Assessment

Prepared for Example Bakery Ltd · examplebakery.co.uk · Essential Assessment

Verdict

Affected: action needed this week

Your website is exposed to a publicly known PHP flaw and two plugin flaws. None show signs of having been exploited yet. All of them can be fixed in about two hours of work.

High

Medium

Low

Passed

Findings and what to do

High

Website runs PHP 7.4, which no longer receives security fixes

What it means: Any new flaw found in PHP 7.4 will never be fixed. Your site is exposed to issues that newer versions have already patched.
What to do: Ask your host to switch the site to PHP 8.4 (in most control panels this is a single setting). Test the site afterwards.
Effort: 30-60 minutes

High

Two WordPress plugins have known security flaws

What it means: A contact form plugin and a slider plugin are out of date. Both have publicly known flaws that attackers actively scan for.
What to do: Update the contact form plugin. Remove the slider plugin: it's no longer maintained, and your homepage doesn't use it.
Effort: 15 minutes

Medium

No automatic backups

What it means: If the site were hacked or broken by an update, there's no recent copy to restore.
What to do: Turn on your host's daily backups (included in your current plan) or install a backup plugin that saves offsite.
Effort: 10 minutes

Low

Server software versions are visible to the public

What it means: Your site tells visitors which PHP and server versions it runs. It's not a flaw in itself, but it helps attackers.
What to do: Hide version headers. It's a two-line setting change.
Effort: 5 minutes

What passed

HTTPS is set up correctly, the WordPress core is up to date, admin accounts use strong passwords, file permissions are sensible, no malware was found, and the admin login is protected against repeated guessing.

Get a report like this for your site