Website Security and Health Report

Typing a specially crafted string into the search box pulls out your entire customer list — names, phone numbers, addresses and order history — with nobody signed in. Confirmed on a test account. No real customer data was touched.

Move every query that takes user input to parameterised statements. Never concatenate input into a query string. This is a fix in the code, not a setting.

The /admin path is guessable, and once inside the system does not limit what each user level can see. An ordinary staff account can read sales figures and customer records for every branch, when it should only see its own.

Enforce permissions on the server for every admin route rather than hiding buttons in the interface, and require two-factor authentication on any account that reaches customer data.

The cookie proving who is signed in is missing HttpOnly and Secure. A script on the page, or anyone listening on public Wi-Fi, can take it and act as that customer or administrator.

Set HttpOnly, Secure and SameSite=Lax on every cookie tied to sign-in. This is a server configuration change and takes minutes.

Response headers publish the exact versions in use. An attacker reads them and immediately knows which publicly known holes for that version are worth trying, which removes the slowest part of their work.

Stop version numbers appearing in HTTP headers and error pages.

An attacker loads your page underneath an invisible layer of their own and gets your customer to click something they never intended, such as confirming an order or changing an account setting.

Add Content-Security-Policy frame-ancestors and X-Frame-Options.

Three resources on the payment page load over plain http. Modern browsers warn about it, which makes customers hesitate at the exact moment they were about to pay, and it lets those files be altered in transit.

Serve every resource on the page over https.

Not a security hole in itself, but you have no control over which pages search engines index.

Add a robots.txt naming the paths you do not want indexed, such as the admin area.

Google picks arbitrary text from the page for the search result, and people do not click it.

Write a short, inviting description for every page that matters.