femalemasseuse.co.uk

Results Summary

34 findings detected across femalemasseuse.co.uk.

11 components identified. WordPress detected: Yes.

Severity Breakdown

Total findings detected across all components. The public summary below groups findings by vulnerability type. To see every affected component in full detail, run a free scan on your own domain at vulnify.app/tools.

Findings Overview

34 unique issues shown below, grouped from 34 total findings. When a vulnerability affects multiple components, it is listed once with the affected component count.

• high Strict-Transport-Security (HSTS): missing

  Ensures the browser only connects over HTTPS

• high CSP missing default-src directive

  Missing default-src weakens baseline fallback behavior.

• medium Comprehensive mode confirmed more version-level WordPress evidence than the homepage alone

  Homepage version-confirmed components: 9; comprehensive version-confirmed components: 10.

• medium xmlrpc.php responded on the public WordPress surface

  Observed xmlrpc.php status 405. Restrict or disable xmlrpc unless a business-critical workflow still requires it.

• medium REST API user-related routes appear discoverable from wp-json output

  The wp-json response referenced user endpoints. Review whether public user enumeration should be constrained on this site.

• medium Public readme artifact disclosed WordPress core version evidence

  GET /readme.html responded with status 200 and exposed WordPress version clue 2.

• medium WordPress installation or upgrade surfaces responded publicly

  HEAD /wp-admin/install.php -> 200; HEAD /wp-admin/upgrade.php -> 200.

• medium Public plugin readme files confirmed additional version evidence

  post-views-counter v1.7.15, wp-call-button v1.4.4, contact-form-7 v6.1.7, google-site-kit v1.188.0, gtranslate v5.0.1, wordpress-seo v28.2

• medium xmlrpc.php advertised methods that are often abused

  A read-only system.listMethods call returned 80 method name(s). Risky names present: system.multicall, pingback.ping, wp.getUsersBlogs. Those methods were not called.

• medium The public WordPress version is behind the current release

  Public version clue 2. Current WordPress.org release 7.1.3. Confirm the version in wp-admin before updating.

• medium One or more detected plugins are behind the WordPress.org release

  post-views-counter 1.7.15 -> 1.8.0; contact-form-7 6.1.7 -> 6.2.2; wordpress-seo 28.2 -> 28.7

• medium X-Frame-Options: missing

  Prevents clickjacking attacks

• medium X-Content-Type-Options: missing

  Prevents MIME-type sniffing

• medium X-XSS-Protection: missing

  Legacy XSS protection (modern browsers use CSP)

• medium Referrer-Policy: missing

  Controls how much referrer information is shared

• medium Permissions-Policy: missing

  Controls browser features and APIs

• medium [REDACTED]: missing

  Restricts Adobe Flash and PDF policies

• medium CSP missing object-src restriction

  Object/embed content is not explicitly restricted.

• medium CSP missing frame-ancestors

  Clickjacking protection may be incomplete without frame-ancestors.

• medium Potentially sensitive paths are accessible

  /admin (200, admin-surface, confidence:medium), /wp-admin (200, admin-surface, confidence:medium), /wp-login.php (200, reachable-artifact, confidence:medium), /readme.html (200, reachable-artifact, confidence:medium)

What the WordPress Stack Check Covers

This security profile for femalemasseuse.co.uk was generated by Vulnify. The check analyzes:

• WordPress core version detection and known vulnerability lookup
• Active theme identification and security assessment
• Plugin inventory with version and CVE checks
• Security headers and hardening controls
• Exposed wp-config and sensitive file checks
• XML-RPC and REST API exposure assessment

Prioritized Actions

• highUpdate WordPress core
• highUpdate the listed plugins
• highAdd Strict-Transport-Security (HSTS) header
• highSet default-src baseline
• highHarden cookies
• highRestrict sensitive paths
• highAdd edge-layer deny rules
• mediumRestrict or disable xmlrpc.php
• mediumReview REST API user exposure
• mediumRemove public WordPress version artifacts
• mediumConstrain public maintenance surfaces
• mediumClose xmlrpc.php or remove the unused methods
• mediumAdd X-Frame-Options header
• mediumAdd X-Content-Type-Options header
• mediumAdd Referrer-Policy header

About This Check

This report was generated using Vulnify's free security tools. Results reflect the configuration at the time of the check. For ongoing monitoring, detailed remediation guidance, and vulnerability scanning across 50+ security tests, create a free Vulnify account.

Last checked: October 18, 2026