Feli-Scan Deep Scan · Sample report

Website security report
Sunshine Plumbing & Drain (example)

  • Site: sunshineplumbing-example.com
  • Scan type: Passive Deep Scan (read-only, from the outside)
  • Prepared: October 23, 2026
  • Prepared by: Feli-Scan, automatically

Summary

FGrade

This website could be taken over by anyone on the internet, without a password, until it is patched. It runs PHP 7.4 on WordPress with three plugins that have published vulnerabilities, no firewall or CDN, and a login open to automated password guessing. PHP 7.4 will never receive the PHP2Shell fix, so the server must be upgraded, not just patched.

1Critical
4High
6Medium

The free scan runs 27 passive checks. The Deep Scan runs 60+ passive checks, including email authentication, certificates, subdomains, exposed files, open ports and a crawl of the site. Both only read what any visitor can see. Nothing on the site is changed.

Findings

CriticalPHP 7.4.33: exposed to PHP2Shell, no patch exists for this version
Evidence
$ curl -sI https://sunshineplumbing-example.com/
HTTP/1.1 200 OK
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.33
Why it mattersCVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) allow unauthenticated remote code execution against PHP versions up to 8.5.11. PHP 7.4 reached end of life in 2022 and will not be fixed.
FixMove the site to PHP 8.3.36 or newer. Update the theme and plugins first so nothing breaks. Your host or developer can do this; ask them for PHP-FPM rather than mod_php.
High3 plugins behind a release with published vulnerabilities
Evidence
contact-form-7   5.7.2   (current 6.x)
elementor        3.14.0  (current 3.x)
wp-file-manager  6.9     (known unauthenticated RCE, CVE-2020-25213)
Why it mattersEach is on public exploit lists and scanned for automatically.
FixUpdate contact-form-7 and elementor from the WordPress dashboard. Remove wp-file-manager, or replace it with a maintained alternative.
HighXML-RPC answers requests
Evidence
POST /xmlrpc.php -> 200 (system.listMethods)
Why it mattersXML-RPC lets attackers try thousands of passwords in one request.
FixDisable XML-RPC with a security plugin, a server rule, or your CDN settings.
HighAdmin usernames are listed publicly
Evidence
/wp-json/wp/v2/users -> admin, sunshine, webdev2019
Why it mattersAttackers start password guessing with real usernames.
FixBlock the users endpoint for visitors who are not signed in, and use two-factor sign-in on every admin account.
HighNo firewall or CDN in front of the site
EvidenceDNS points straight at the origin server. No CDN or WAF response headers were seen.
Why it mattersEvery request, including attack traffic, reaches PHP directly.
FixPut the site behind a CDN or web application firewall service (many have a free tier). Your DNS provider or host can set this up.
MediumSix hardening gaps: headers, directory listing, readme, jQuery, DMARC, form protection
EvidenceNo HSTS, CSP or X-Frame-Options; /wp-content/uploads/ listing on; /readme.html present; jQuery 1.12.4; no DMARC record; contact form without bot protection.
Why it mattersIndividually small, together they make every other weakness easier to use and the business easier to impersonate.
FixAdd the headers, turn directory listing off, delete the readme, update jQuery with the theme, publish a DMARC record, and add a honeypot or CAPTCHA to the form. Each has a step-by-step guide written for your setup in the portal.

Fix plan

Ordered safest first. Each step says who can do it and roughly how long it takes. Monitor writes this plan for your own setup (your DNS provider, host, CMS and email provider).

  1. Step 1
    Update plugins and the theme, and remove wp-file-manager. Do this first; it is safe and reversible if you take a backup.
    You, in the WordPress dashboard · about 30 min
  2. Step 2
    Turn off XML-RPC, hide the users endpoint and require two-factor sign-in for admins.
    You or your web person · about 30 min
  3. Step 3
    Fix the six hardening gaps: security headers, directory listing, readme, DMARC and form protection.
    You, your host or your DNS provider · about 1 hour
  4. Step 4
    Put a CDN or web application firewall in front of the site.
    Your DNS provider or host · about 1 hour
  5. Step 5
    Upgrade PHP from 7.4 to 8.3.36 or newer on the server.
    Your host or developer · half a day, and the most urgent

What to do next

With Feli-Scan Monitor ($99/month) this scan runs on your site every day, and we email you the moment anything changes. Monitor watches and reports; it does not change your website. If you would rather not do the fixes yourself, AI Hacker Shield (from $999) is the done-for-you service: a specialist calls you, we quote a fixed price, and with your signed authorization our team fixes it and sends a before/after report.

This is a sample built from a typical small-business site; the business name and address are invented. Client reports are confidential to the client.

Scan my website free →