WebForensik

Your HSTS max-age is too short (only 604800 seconds) — browsers "forget" the HTTPS requirement quickly. Recommended: at least 180 days (15552000 seconds), preferably 1 year (31536000).

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

⚠ If another Strict-Transport-Security entry exists, replace it (don’t add a second one — only the first takes effect).

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>

✓ How to verify it works: curl -I https://your-domain.com | grep -i strict — max-age must be at least 15552000.

Your CSP exists but has no script-src — meaning scripts are unrestricted. Scripts are the most common XSS vector. Add script-src together with the other essential directives.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>

⚠ Replace the existing CSP line (do not add a second one). This policy is deliberately pragmatic — it allows inline styles and data: URIs for images because almost all themes (especially WordPress!) need this. If you use external scripts (CDN), append the domain to script-src: script-src 'self' https://cdn.example.com. For maximum security later, gradually tighten style-src to 'self' and verify in the browser (F12 → Console) that no inline-style violations appear.

<IfModule mod_headers.c>
    Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'"
</IfModule>

add_action('send_headers', function () {
    header("Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' https: data:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'");
});

✓ How to verify it works: F12 → Network → Response Header content-security-policy contains "script-src 'self'". Console: no script blocks, no "Refused to load…" messages.

Cookies without the "Secure" flag are also sent over unencrypted HTTP — and can be intercepted by anyone on the same WLAN. There’s no reason to omit Secure on HTTPS-only sites.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always edit Set-Cookie "^(.*)$" "$1; Secure" "expr=!(resp('Set-Cookie') -strmatch '*Secure*')"
</IfModule>

⚠ This header appends "; Secure" to cookies that don’t have it yet. Requires Apache 2.4+. The cleaner fix is to correct the code that sets the cookie (PHP: session.cookie_secure=1 in php.ini, or setcookie() with "secure" => true).

add_filter('secure_logged_in_cookie', '__return_true');
add_action('init', function () {
    if (!headers_sent()) {
        @ini_set('session.cookie_secure', '1');
        @ini_set('session.cookie_httponly', '1');
        @ini_set('session.cookie_samesite', 'Lax');
    }
});

✓ How to verify it works: F12 → Application → Cookies → your-domain.com. The "Secure" column should show a checkmark for every cookie.

Cookies without the "HttpOnly" flag can be read by JavaScript — an XSS attacker can steal session cookies and impersonate the logged-in user. Set HttpOnly for all cookies JavaScript doesn’t actively need.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always edit Set-Cookie "^(.*)$" "$1; HttpOnly" "expr=!(resp('Set-Cookie') -strmatch '*HttpOnly*')"
</IfModule>

⚠ Cleaner: set cookies with HttpOnly directly (PHP: setcookie(..., [..., 'httponly'=>true])). Exception: cookies that JS actively reads (e.g. some consent cookies).

@ini_set('session.cookie_httponly', '1');
@ini_set('session.cookie_secure', '1');

✓ How to verify it works: F12 → Application → Cookies → "HttpOnly" column shows checkmarks everywhere (except for deliberately JS-readable cookies like the consent cookie).

Without "SameSite" cookies are sent on requests from foreign sites — the basis of CSRF attacks (a foreign page silently triggers actions in your name because the login cookie travels along). Set SameSite=Lax as a minimum.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always edit Set-Cookie "^(.*)$" "$1; SameSite=Lax" "expr=!(resp('Set-Cookie') -strmatch '*SameSite*')"
</IfModule>

⚠ SameSite=Lax is a good default. Strict is safer but breaks external links (user clicks from Google to your site — cookies are NOT sent, login is lost). None allows cross-site but requires "; Secure".

@ini_set('session.cookie_samesite', 'Lax');
@ini_set('session.cookie_secure', '1');
@ini_set('session.cookie_httponly', '1');

✓ How to verify it works: F12 → Application → Cookies → "SameSite" column should show "Lax" or "Strict" everywhere, not empty.

GDPR-relevant: visitor data (at least IP + User-Agent) is transmitted to servers outside the EU/EEA. Since the Schrems-II ruling (2020) this requires Standard Contractual Clauses + supplementary technical measures AND prior consent. Best fix: replace with EU alternatives where possible.

✓ How to verify it works: Load in incognito mode, F12 → Network → list all requests → check "Domain" column for non-EU servers. After migration no unrequested US domains should load.

Only some of your external resources (0 of 3) are protected by SRI. Add integrity attributes to the remaining ones too.

✓ How to verify it works: F12 → Console on page load: no "Failed to find a valid digest" messages. Source: all external <script>/<link> have an integrity attribute.

SRI (Subresource Integrity) is a checksum in HTML that defines what an externally loaded file MUST look like. If someone tampers with the external file (e.g. a CDN gets compromised), the browser refuses to load it. You add the "integrity" attribute on the script/link tag.

✓ How to verify it works: F12 → Network → requests with status 200 from CDN domains (cdn.jsdelivr.net, cdnjs.cloudflare.com etc.) → in HTML source the tag must contain "integrity=\"sha384-…\" crossorigin=\"anonymous\"".

CAA records (Certification Authority Authorization) define in DNS which Certificate Authorities are allowed to issue certificates for your domain. Without a CAA record an attacker could request a fraudulent certificate for your domain at any CA. CAA is pure DNS configuration — set in your registrar/DNS-panel, NOT in WordPress.

Name   Type   Flag   Tag      Value
@      CAA    0      issue    "digicert.com"
@      CAA    0      issue    "letsencrypt.org"
@      CAA    0      iodef    "mailto:security@your-domain.com"

✓ How to verify it works: On https://www.ssllabs.com/ssltest/analyze.html?d=your-domain.com → "DNS CAA" section → all your CAs should be listed. Or via dig: dig CAA your-domain.com.

SPF (Sender Policy Framework) defines in DNS which servers may send emails on behalf of your domain. Without SPF any phisher can spoof emails from you — and recipients are more likely to fall for them.

✓ How to verify it works: dig TXT your-domain.com | grep spf — or online https://www.kitterman.com/spf/validate.html.

DMARC combines SPF and DKIM into an explicit instruction for receiving mail servers: "What to do if emails claim to come from us but SPF/DKIM fail?" Without DMARC each server decides — usually generously. With DMARC=reject you effectively prevent phishing in your name.

✓ How to verify it works: dig TXT _dmarc.your-domain.com — or online https://dmarcian.com/dmarc-inspector/.

A security.txt (RFC 9116) tells security researchers how to responsibly report vulnerabilities to you. Without it, reports may go to spam or never be sent. A plain text file at the correct path is enough.

Apache server (classic hosting at most providers)

File: /.well-known/security.txt (create the folder if it doesn’t exist)

Contact: mailto:security@your-domain.com
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en, de
Canonical: https://your-domain.com/.well-known/security.txt

⚠ Replace "security@your-domain.com" with your actual security contact (or a generic info@). "Expires" must be a future date and should be renewed regularly. The file is plain .txt, not PHP.

Contact: mailto:security@your-domain.com
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en, de
Canonical: https://your-domain.com/.well-known/security.txt

✓ How to verify it works: Open https://your-domain.com/.well-known/security.txt in a browser — content must be visible (no 404).

Network Error Logging (NEL) reports network errors to an external server. As with external reporting: mention in privacy policy and verify GDPR compliance of the recipient.

Apache server (classic hosting at most providers)

File: .htaccess in the web root

<IfModule mod_headers.c>
    Header always unset NEL
    Header always unset Report-To
</IfModule>

⚠ If you don’t actively need NEL: these two lines remove both reporting headers. If you do: document it in the privacy policy.

<IfModule mod_headers.c>
    Header always unset NEL
    Header always unset Report-To
</IfModule>

✓ How to verify it works: F12 → Network → first request → Response Header: NO "nel" or "report-to" anymore (or deliberately documented).

Your site sends error or CSP reports to an external service (Report-To: a.nel.cloudflare.com). GDPR-relevant: at least IP address and URL are transmitted. Verify (a) the recipient is GDPR-compliant, (b) the transfer is mentioned in your privacy policy, (c) a data processing agreement (DPA) exists.

✓ How to verify it works: Privacy policy contains an entry about error reporting + DPA is in place. In incognito: F12 → Network → no unintended reporting requests.

No imprint (legal notice) found — mandatory in Germany under § 5 DDG for all business-grade websites (and effectively for many other commercial sites in the EU). Even private blogs with ad or affiliate revenue typically require one. Violations are commonly targeted by warning letters.

✓ How to verify it works: Footer on every page → link "Imprint" or "Legal notice" visible → opens the imprint page with all mandatory information.