The first ten seconds: the domain
Before loading a single page, anyone can look up your domain's public records. Two of them show whether your email can be forged.
A missing sender policy record (SPF), or one that ends in a permissive rule, means anyone can send mail that appears to come from your address.
A missing enforcement record (DMARC) means receiving servers get no instructions about what to do with forgeries.
The certificate behind the padlock has an expiry date. If that date is a few days away, it's a good sign nobody is watching it.
So is a site that loads both with and without www and never settles on one. That splits your search standing in half.
The next twenty: files for machines
A few small files sit at fixed addresses on most sites. The four files nobody links to covers each of them. These three reveal the most:
- robots.txt lists what crawlers may not read. That also makes it a list of what the organization would rather nobody found.
- The sitemap lists every public page with the date it last changed. Anyone can see how often the site is actually updated.
- security.txt tells security researchers whom to contact. Most sites do not have one.
The next twenty: the platform
A site built on WordPress shows it in a dozen ways: the paths its stylesheets load from, the version numbers on them, a meta line in the page head. None of that is a problem by itself.
These next three can be. An automated scanner checks all of them in less time than it takes to read this sentence:
- The user list hands over staff login names. Login names are half a login explains why that matters.
- The legacy remote interface, xmlrpc.php, may still be switched on and answering requests.
- The media library may be serving board packets and donor lists to anyone who guesses the address. Your media library is public shows how.
The last ten: the page itself
The copyright year in the footer is the quickest clue to whether anyone maintains the site.
The response headers show which security protections the server sends. Usually there are none.
Speed and accessibility measurements on the homepage show how well the site works for people on phones and people who use a screen reader.
One minute in, someone with bad intentions knows your platform, your staff login names, how well the site is maintained, how your email is set up and where your private documents might be.
All of it came from public information. Nobody guessed a single password.
What to fix and what to accept
Fix these, in this order:
- The email records, because forged mail from your domain harms other people.
- The user list and the remote interface, because together they turn a public site into a password-guessing target.
- Any document in the media library that was never meant to be public.
- The certificate expiry, by putting a person's name on the date.
Don't bother hiding that the site runs on WordPress. It takes work and fools nobody who matters.
Leave the sitemap dates alone. If they look stale, take that as a reason to publish on a regular schedule.
An old copyright year means nobody has a habit of checking the footer. Update the year, then make checking it part of your routine.
Run the free audit on your site
Every check above is part of the free audit. It reads public information only, and it takes about the same minute.
It covers your domain records, the certificate, the files for machines, the WordPress interfaces, the media library, the headers and the homepage's measurements. Each finding is written in plain language with the fix beside it.
Enter your domain below to see what a stranger sees.
Leland Fiegel