Example – fictitious sample company

This is what your security report looks like

You get exactly this report for your own website – with an overall grade, a traffic light for each check, a clear explanation and ready-made fixes for your IT team to copy. Expand the findings.

Check my website for free

musterbau-gmbh.de

Sample data

Action needed Grade C

Summary · checked on 28.10.2026, 13:46

A solid foundation – one urgent item and three improvements.

Act now: outdated WordPress version visible
Improve: security headers, DMARC, security.txt
8 checks without findings

1 Act now 3 Improve 8 OK

Encryption

4 of 4 OK

Headers & cookies

1 of 2 OK

Email protection

1 of 2 OK

Visibility

2 of 4 OK

Act now

You should have these items fixed soon.

Detectable CMS / visible version

Reconnaissance

Your website reveals an outdated WordPress version. Attackers specifically look for sites like this.

What to do: Update WordPress and plugins, enable automatic updates, remove the version information.

Responsible: Web developmentEffort: low

Ready-made fix to copy

More important than hiding: keep the system and extensions up to date (enable automatic updates).

nginx

server_tokens in the http { … } block, the other lines in the server block.

server_tokens off;
fastcgi_hide_header X-Powered-By;
proxy_hide_header X-Powered-By;

Apache

ServerTokens only works in the server configuration, not in .htaccess. Additionally in php.ini: expose_php = Off

# httpd.conf / apache2.conf
ServerTokens Prod
ServerSignature Off

# .htaccess
<IfModule mod_headers.c>
  Header unset X-Powered-By
</IfModule>

IIS (web.config)

In the web.config in the website's root directory, inside <configuration>.

<system.webServer>
  <security>
    <requestFiltering removeServerHeader="true" />
  </security>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

WordPress

In the functions.php of your child theme or in a small custom plugin. Configuring the web server (nginx/Apache tab) is better if you have access.

remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

Cloudflare

Setting in the Cloudflare dashboard, no code needed.

Cloudflare dashboard → musterbau-gmbh.de → Rules → Transform Rules → “Modify Response Header” → create a rule for all requests
Remove: X-Powered-By

Technical details for your IT team (1 finding)

High WordPress 6.1 visible from outside – version with known security vulnerabilities

Recommendation: Update WordPress and all plugins and hide the version number.

<meta name="generator" content="WordPress 6.1">

Improve

No acute risk – but these items will make your website more secure.

Security headers

OWASP Secure Headers Hardening

Protection against malicious code (CSP) is missing

What to do: A Content Security Policy limits which scripts may be loaded – an important protection against cross-site scripting.

Responsible: Web development / hostingEffort: low

Ready-made fix to copy

Only set HSTS once the site and all subdomains are reliably reachable via HTTPS. The suggested Content Security Policy is a safe baseline that does not block any scripts. Test stricter rules (script-src) in a test environment first.

nginx

In the website's server { … } block (port 443), then: sudo nginx -t && sudo systemctl reload nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache (.htaccess)

In the .htaccess file in the website's root directory (the mod_headers module must be enabled).

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set Content-Security-Policy "frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

IIS (web.config)

In the web.config in the website's root directory, inside <configuration>.

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
      <add name="Content-Security-Policy" value="frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests" />
      <add name="X-Content-Type-Options" value="nosniff" />
      <add name="X-Frame-Options" value="SAMEORIGIN" />
      <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

WordPress

In the functions.php of your child theme or in a small custom plugin. Configuring the web server (nginx/Apache tab) is better if you have access.

add_action('send_headers', function () {
    header("Strict-Transport-Security: max-age=31536000; includeSubDomains");
    header("Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests");
    header("X-Content-Type-Options: nosniff");
    header("X-Frame-Options: SAMEORIGIN");
    header("Referrer-Policy: strict-origin-when-cross-origin");
});

Cloudflare

Setting in the Cloudflare dashboard, no code needed.

Cloudflare dashboard → musterbau-gmbh.de → Rules → Transform Rules → “Modify Response Header” → create a rule for all requests
Set static: Strict-Transport-Security = max-age=31536000; includeSubDomains
Set static: Content-Security-Policy = frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests
Set static: X-Content-Type-Options = nosniff
Set static: X-Frame-Options = SAMEORIGIN
Set static: Referrer-Policy = strict-origin-when-cross-origin

In Cloudflare, enable HSTS under SSL/TLS → Edge Certificates → HSTS.

Technical details for your IT team (2 findings)

Medium Protection against malicious code (CSP) is missing

Recommendation: Set a Content Security Policy that only allows your own scripts.

Reference: OWASP Secure Headers
Low Protection against embedding in other sites (X-Frame-Options) is missing

Recommendation: Set X-Frame-Options: SAMEORIGIN or frame-ancestors in the CSP.

Reference: OWASP Secure Headers

Email spoofing protection (DMARC)

Email security

DMARC is only in monitoring mode (p=none)

What to do: After a test phase, set DMARC to quarantine or reject.

Responsible: IT / hostingEffort: low

Ready-made fix to copy

Your DMARC record only monitors. Switch it to “quarantine” or “reject”.

2. Recommended

Create a TXT record in your domain's DNS management or replace the existing one.

Type:  TXT
Name: _dmarc.musterbau-gmbh.de
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@musterbau-gmbh.de; fo=1

Forged emails end up in spam. Set this after 2–4 weeks of monitoring without problems.

3. Strict

Create a TXT record in your domain's DNS management or replace the existing one.

Type:  TXT
Name: _dmarc.musterbau-gmbh.de
Value: v=DMARC1; p=reject; rua=mailto:dmarc@musterbau-gmbh.de; fo=1

Forged emails are rejected – the goal once all legitimate senders are covered by SPF/DKIM.

Technical details for your IT team (1 finding)

Medium DMARC is only in monitoring mode (p=none)

Recommendation: After a test phase, set DMARC to quarantine or reject.

v=DMARC1; p=none;

Security contact (security.txt)

RFC 9116 Transparency

No security.txt found

What to do: Provide a contact address for security reports at /.well-known/security.txt.

Responsible: Web developmentEffort: low

Ready-made fix to copy

security.txt

Save as a text file at https://musterbau-gmbh.de/.well-known/security.txt (.well-known folder in the website's root directory).

Contact: mailto:security@musterbau-gmbh.de
Expires: 2027-10-27T00:00:00Z
Preferred-Languages: de, en
Canonical: https://musterbau-gmbh.de/.well-known/security.txt

The contact address must be reachable. Renew the expiry date (Expires) after one year at the latest.

WordPress

For the content, see the “security.txt” tab.

Upload the security.txt file to the /.well-known/ folder via FTP or your host's file manager (create the folder if necessary).

Technical details for your IT team (1 finding)

Low No security.txt found

Recommendation: Provide a contact address for security reports at /.well-known/security.txt.

Reference: RFC 9116

Checked and OK (8)

Your website passed these checks.

TLS certificate & encryption Encryption

HTTPS reachable Encryption

Redirect to HTTPS Encryption

Content embedded without encryption Encryption

Email spam protection (SPF) Email security

Secure cookies Hardening

Visible software versions Information leaks

Internal paths in robots.txt Reconnaissance

See what this looks like for your website

Free account in one minute, no payment details – your own report is ready in about a minute.

Check website for free

All information on this page is sample data for a made-up company. The check is an automated, passive external check of publicly accessible information – not a penetration test.