Blog · What the free audit finds
What a Stranger Learns About Your Site in One Minute
Everything in this article is public. It is what a curious visitor, a vendor sizing you up, a journalist, or a scanner run by someone less friendly can read about your website in about a minute.
The free audit is that minute, run on your behalf. This is what it looks at, in the order a stranger would.
The first ten seconds: the domain
Before touching the site, a stranger reads the domain's public records. Two of them say whether your email can be forged. A missing sender policy record, or one that ends in a permissive rule, means anyone can send mail that appears to come from your address. A missing enforcement record means receiving servers are told nothing about what to do with forgeries.
The certificate that gives the site its padlock carries an expiry date. A date a few days out tells the stranger nobody is watching. So does a site that answers at one address with www and not without, or answers both without choosing one, which splits its search standing in half.
The next twenty: files for machines
The robots file lists what crawlers may not read, and in doing so lists what the organization would rather nobody found. The sitemap lists every public page with the date it last changed, which is an honest calendar of how alive the site is. A contact file for security researchers is either there or, on most sites, is not. An earlier part of this series covers all four.
The next twenty: the platform talks
A WordPress site announces itself in a dozen ways: the paths its stylesheets load from, the version number appended to them, a meta line in the page head. None of that is a problem by itself. What follows can be.
The user list, described in the previous part, hands over login names. The legacy remote interface says whether it is answering. The media library, described in the first part of the series, may be serving board packets and donor lists to anyone who guesses the address. Each of these is one request, and a scanner makes all of them in the time it takes to read this sentence.
The last ten: the page itself
The copyright year in the footer is the fastest read of whether anyone maintains the site. The response headers say which security protections the server sends, and usually that it sends none. The homepage's speed and accessibility measurements say how the site treats visitors on phones and visitors who cannot see it.
A stranger with a purpose now knows the platform, the staff logins, the maintenance habits, the email posture, and where the private documents might be. All of it from public information, none of it requiring a single guess at a password.
What to fix and what to accept
Fix, in this order: the email records, because forged mail from your domain harms other people; the user list and the remote interface, because they turn a public site into a password-guessing target; any document in the media library that was never meant to be public; and the certificate expiry, by putting a name on the calendar.
Accept that the site says it runs WordPress. Hiding it is busywork that fools nobody who matters. Accept the sitemap dates, and let them motivate a publishing rhythm instead. Accept that the copyright year is a habit, and fix the habit.
The free audit is this minute
Every line above is a check the free audit runs, on public information only, in about the same minute. It reads the domain records, the certificate, the four files, the WordPress interfaces, the media library, the headers, and the homepage's measurements, and it writes them up in plain language with the fix beside each finding. That is the whole idea of it: the stranger's minute, spent for you first.