Every check Wardzo runs
The full list of passive checks in a Wardzo scan, by category and severity, generated from the same catalogue the scanner uses.
This list is generated from the same catalogue the scanner uses, so it is always current. All checks are passive: Wardzo reads what your site serves publicly, identifies itself as WardzoBot, respects robots.txt for crawling, and never sends attack payloads, guesses passwords or scans ports.
Security
| Check | Severity | How to fix |
|---|---|---|
| Site is not available over HTTPS Without HTTPS, everything your visitors send and receive can be read or modified in transit, and browsers label the site "Not secure". | critical | Enable a TLS certificate (free from Let's Encrypt or your host) and serve the site on https://. |
| HTTP does not redirect to HTTPS Visitors who type your domain without https:// stay on an unencrypted connection. | medium | Add a permanent (301/308) redirect from http:// to https:// at your host, CDN or web server. |
| SSL/TLS certificate is not valid Browsers show a full-page security warning, and most visitors leave. | critical | Renew or re-issue the certificate for this exact hostname and make sure the full certificate chain is installed. |
| SSL certificate expires in less than 14 days When it expires, browsers block the site with a security warning. | high | Renew the certificate now and check that automatic renewal is working. |
| SSL certificate expires within 30 days Auto-renewal sometimes fails silently. Expired certificates take sites offline for visitors. | medium | Confirm auto-renewal is configured, or renew manually. |
| Outdated TLS protocol negotiated TLS 1.0 and 1.1 are deprecated and considered insecure. | medium | Disable TLS 1.0/1.1 and enable TLS 1.2 and 1.3 on your server or CDN. |
| Scripts or frames loaded over insecure HTTP Browsers block active mixed content, which breaks features, and an attacker on the network could inject code. | medium | Load every script, stylesheet and iframe over https://. |
| Images or media loaded over insecure HTTP Mixed content removes the padlock and can be tampered with in transit. | low | Change the image/media URLs to https://. |
| Form submits to an insecure HTTP address Anything typed into the form, including passwords or personal data, is sent unencrypted. | medium | Point the form action to an https:// URL. |
| Strict-Transport-Security (HSTS) header is missing Without HSTS, a visitor's first request can be downgraded to HTTP by an attacker on the same network. | medium | Send "Strict-Transport-Security: max-age=31536000; includeSubDomains" on HTTPS responses. |
| HSTS max-age is shorter than 6 months A short max-age gives weaker protection against downgrade attacks. | low | Raise max-age to at least 15552000 (180 days), ideally 31536000. |
| Content-Security-Policy header is missing CSP is the strongest browser defence against cross-site scripting (XSS) and injected scripts. | medium | Add a Content-Security-Policy. Start with default-src 'self' and allow only the domains you use; use nonces instead of 'unsafe-inline'. |
| CSP allows 'unsafe-inline' scripts 'unsafe-inline' lets injected inline scripts run, which removes most of CSP's XSS protection. | low | Replace 'unsafe-inline' in script-src with per-request nonces or hashes (most frameworks support this). |
| No clickjacking protection Other sites can embed your pages in an invisible frame and trick users into clicking. | low | Send "Content-Security-Policy: frame-ancestors 'self'" (or X-Frame-Options: DENY). |
| X-Content-Type-Options header is missing Browsers may "sniff" files as a different type, which can turn uploads into scripts. | low | Send "X-Content-Type-Options: nosniff". |
| Referrer-Policy header is missing Full URLs (which may contain tokens or private paths) can leak to third-party sites. | low | Send "Referrer-Policy: strict-origin-when-cross-origin". |
| Permissions-Policy header is missing Permissions-Policy limits which browser features (camera, microphone, location) embedded content can use. | info | Send e.g. "Permissions-Policy: camera=(), microphone=(), geolocation=()". |
| Cookies set without Secure or HttpOnly flags Cookies without Secure can travel over HTTP; without HttpOnly they can be read by injected scripts. | low | Set Secure, HttpOnly and SameSite on session and authentication cookies. |
| Server software version is disclosed Exact versions in headers help attackers find known vulnerabilities quickly. | low | Remove version numbers from the Server and X-Powered-By headers. |
| Environment file (.env) is publicly readable .env files usually contain database passwords and API keys. Anyone can download them. | critical | Remove the file from the web root or block dotfiles at the server, then rotate every secret it contained. |
| Git repository (.git) is publicly accessible Attackers can download your full source code and history, including old secrets. | critical | Block access to /.git at the web server (or deploy without the .git folder) and rotate any secrets in the history. |
| WordPress config backup is publicly readable Backup copies of wp-config.php are served as plain text and reveal database credentials and salts. | critical | Delete the backup file from the server and change the database password and WordPress salts. |
| Database dump is publicly downloadable SQL dumps can contain user data, password hashes and secrets. | critical | Delete the dump from the web root, store backups outside public folders, and review whether personal data was exposed. |
| .npmrc with an auth token is public npm tokens let attackers publish packages or read private ones as you. | critical | Remove the file from the web root, revoke the token on npmjs.com and create a new one. |
| .htpasswd file is publicly readable Password hashes can be cracked offline. | high | Move .htpasswd outside the web root and change the passwords. |
| phpinfo() page is public It reveals server paths, versions, modules and sometimes environment variables. | medium | Delete the phpinfo file from the server. |
| Apache server-status page is public It shows live requests, client IPs and internal URLs. | medium | Restrict /server-status to localhost or disable mod_status. |
| .DS_Store file is public macOS folder metadata lists file names in the folder, which can reveal hidden files. | low | Delete .DS_Store files from the server and add them to .gitignore. |
| docker-compose.yml is publicly readable It reveals your infrastructure and sometimes passwords. | medium | Remove the file from the web root. |
| Site backup archive is publicly downloadable Backup archives usually contain the full source code, configuration files and database credentials. | critical | Delete the archive from the web root, keep backups outside public folders, and rotate any credentials it contained. |
| Credentials file is publicly readable Cloud or deployment credentials (AWS keys, SFTP passwords) give attackers direct access to your infrastructure. | critical | Remove the file from the web root, revoke and rotate the credentials, and check your provider for unexpected activity. |
| Application error log is publicly readable Debug logs reveal file paths, SQL queries, plugin versions and sometimes user data or tokens. | medium | Delete the log, turn off public debug logging (e.g. WP_DEBUG_LOG or APP_DEBUG) and block *.log files at the web server. |
| Framework debug endpoint is public Debug endpoints such as Spring Boot Actuator expose configuration, environment variables and internal state. | high | Disable the endpoint in production or restrict it to an internal network or authenticated admins. |
| Directory listing is enabled Anyone can browse the files in these folders, including uploads, backups and documents that were never linked. | medium | Disable directory indexes (Apache: "Options -Indexes"; nginx: "autoindex off") or add an empty index file. |
| Supabase tables are readable by anyone (Row Level Security off) Your public anon key is in the page source, and these tables return rows to it. Anyone can download their contents. | critical | Enable Row Level Security on every listed table (ALTER TABLE ... ENABLE ROW LEVEL SECURITY) and add policies that only allow the rows each user should see. |
| Firebase Realtime Database is readable without login The database rules allow public reads, so anyone can download its contents. | critical | In the Firebase console, change the Realtime Database rules so ".read" requires auth (and only the user's own data), then review what was exposed. |
| Production source maps are public Source maps let anyone read your original, unminified source code, including comments and internal endpoints. | medium | Disable production source maps or upload them privately to your error tracker instead of serving them. |
| Secret API key found in public JavaScript Anyone can open DevTools and copy the key. Leaked keys lead to stolen data and surprise bills. | critical | Revoke/rotate the key now, then move the call to a server-side route or function so the key never reaches the browser. |
| Credential found in public JavaScript This looks like a credential that should not be shipped to browsers. | high | Confirm what the credential grants, rotate it, and move its use to the server side. |
| Google API key found in public JavaScript Browser-side Google keys (Maps, Firebase) are normal, but an unrestricted key can be abused by others at your cost. | low | In Google Cloud Console, restrict the key to your domains (HTTP referrers) and to only the APIs it needs. |
| Supabase anon (public) key found The anon key is meant to be public, but it can read any table without Row Level Security (RLS). | info | Make sure RLS is enabled on every table. On paid plans, verify your domain and Wardzo checks whether any table is readable without login. |
| Spam content shown only to Googlebot (cloaking) This is a classic sign of a hacked site: search engines see spam links or pages that visitors never see, and Google may penalise or flag the site. | critical | Treat it as a compromise: scan the server files and database for injected code, update everything, change passwords, then request a review in Google Search Console. |
| Googlebot and visitors are redirected to different places Different redirects for search engines and people are a common sign of a malicious redirect hack. | high | Check .htaccess, server config, plugins and injected scripts for user-agent based redirects. |
| Spam-like keywords found on the homepage Pharma, casino or loan keywords on an unrelated site can indicate injected SEO spam. | low | If these words do not belong on your site, search your pages and database for injected links. |
| Homepage redirects to another domain This is often intentional, but unexpected off-site redirects can be a sign of a hijack. | info | Confirm the redirect target is yours and intended. |
| Googlebot user agent got a different response Often caused by bot protection (which blocks fake Googlebots like ours), but worth a look. | info | Use Google Search Console's URL Inspection to see what the real Googlebot receives. |
SEO health
| Check | Severity | How to fix |
|---|---|---|
| Homepage is set to noindex Search engines are told not to list your homepage, so it will disappear from Google. | critical | Remove "noindex" from the robots meta tag or X-Robots-Tag header (often a leftover "discourage search engines" setting from staging). |
| Some pages are set to noindex These pages will not appear in search. Fine if intentional (e.g. thank-you pages), harmful if not. | low | Review the listed pages and remove noindex from any that should rank. |
| robots.txt blocks search engines from the whole site "Disallow: /" for all crawlers or Googlebot stops search engines from crawling any page. | critical | Remove "Disallow: /" from robots.txt (common leftover from development). |
| robots.txt is missing Not fatal, but robots.txt is where crawlers look for your sitemap and rules. | low | Add a robots.txt with "User-agent: *", "Allow: /" and a Sitemap: line. |
| No XML sitemap found Sitemaps help search engines discover and refresh your pages faster. | low | Generate /sitemap.xml (most CMSs and frameworks can) and reference it in robots.txt. |
| AI crawlers are blocked in robots.txt Blocked AI crawlers cannot read your site, so it is less likely to be cited by ChatGPT, Claude, Perplexity or Google's AI features. Fine if intentional. | low | If you want AI visibility, allow these user agents in robots.txt. |
| Pages without a <title> The title is the main headline in search results. | medium | Give every page a unique, descriptive <title> (about 50–60 characters). |
| Titles longer than 65 characters Long titles get cut off in search results. | info | Shorten titles to roughly 50–60 characters, most important words first. |
| Duplicate page titles Identical titles make pages compete with each other and confuse searchers. | low | Write a unique title for each page. |
| Pages without a meta description Search engines will invent a snippet, which is often less compelling. | low | Add a unique meta description (about 140–160 characters) to each important page. |
| Canonical tags point to another domain You are telling Google the "real" page lives elsewhere, so these pages may not rank. | medium | Point canonical tags to the page's own URL on your domain. |
| Broken internal pages (4xx/5xx) Broken links waste crawl budget and frustrate visitors. | medium | Fix or redirect the listed URLs, and update links that point to them. |
| Homepage has no mobile viewport tag Without it, phones render a zoomed-out desktop page, which hurts mobile rankings. | low | Add <meta name="viewport" content="width=device-width, initial-scale=1">. |
| Homepage <html> has no lang attribute The lang attribute helps screen readers and search engines understand the page language. | info | Add e.g. <html lang="en">. |
Uptime
| Check | Severity | How to fix |
|---|---|---|
| Homepage is not responding Visitors and search engines cannot reach your site. | critical | Check your hosting, DNS and server logs. |
| Homepage returns an error status Visitors see an error page instead of your site. | critical | Check your server logs for the cause of the error. |
| Homepage is slow to respond (over 3 seconds) Slow responses hurt conversions and Core Web Vitals. | medium | Add caching or a CDN, and check for slow database queries or plugins. |
| Homepage response time is over 1.5 seconds Faster first responses improve user experience and LCP. | low | Enable page caching and compression (gzip/brotli). |
Related
- How the Wardzo score works
How Wardzo calculates the overall 0–100 score, the Security, SEO health and Uptime sub-scores, severity weights and letter grades.
- Website security monitoring
Outside-in security monitoring for live websites. Wardzo finds leaked API keys in JavaScript, exposed .env and .git files, weak security headers, SSL problems and cloaking, then tells you how to fix them.
- SEO health monitoring
Catch the SEO mistakes that silently remove you from Google and AI search, including accidental noindex, robots.txt blocks, missing sitemaps, wrong canonicals, broken pages and blocked AI crawlers.