Security Posture
Snapshot

Neither hostname returns a Content-Security-Policy header. No CSP meta tag is present in the HTML. The browser receives zero instruction about which scripts, styles, images, fonts, and connections are authorized.

Without CSP, the browser will execute any script injected into the page — whether from a vulnerable WordPress plugin, a compromised form handler, a stored XSS payload, or a malicious ad/widget script. On a dental practice site that collects patient names, phone numbers, and appointment details through web forms, a successful XSS attack could exfiltrate every form submission to an attacker-controlled server without any visible indication to the user or the practice.

The Apache configuration on this GoDaddy shared hosting plan does not include any CSP directives. The WordPress theme does not output a CSP meta tag. No WordPress security plugin with header management is installed.

Implement a CSP header via .htaccess starting in report-only mode (Content-Security-Policy-Report-Only) to identify all legitimate sources. Once validated, switch to enforcement mode. Start with: default-src 'self'; script-src 'self' https://www.googletagmanager.com https://connect.facebook.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self'; frame-src 'self' [appointment-widget-origin]; base-uri 'self'; form-action 'self'.

SSL Labs scan confirms the server accepts connections over TLS 1.0 and TLS 1.1 in addition to TLS 1.2 and 1.3. This is the primary reason for the B grade rather than A.

TLS 1.0 and 1.1 contain known vulnerabilities (BEAST, POODLE) and are deprecated by all major browsers as of 2020. While modern browsers will negotiate TLS 1.2+, keeping these protocols enabled signals to security scanners, partners, and technically aware patients that the practice's infrastructure is not maintained. It also fails PCI DSS requirements if the site processes or intends to process payment card data.

The GoDaddy shared hosting environment has not updated its default Apache SSL configuration to disable TLS 1.0/1.1. The site does not override this via .htaccess (shared hosting may not allow SSLProtocol directives depending on the plan).

Contact GoDaddy support to request TLS 1.0 and 1.1 be disabled for this hosting account. If GoDaddy cannot accommodate this on shared hosting, consider migrating to a provider that allows full TLS configuration control, or place a Cloudflare proxy in front of the site (free tier) which enforces TLS 1.2+ by default.

/wp-admin and /wp-login.php are publicly accessible and return the standard WordPress login form. No rate limiting, CAPTCHA, IP allowlisting, or two-factor authentication challenge is observed. The default 'admin' username returns a different error message than a non-existent username, confirming username enumeration is possible.

Automated brute-force tools target /wp-login.php on every publicly visible WordPress site. Without rate limiting or lockout, an attacker can attempt thousands of password combinations. Combined with the confirmed 'admin' username, the attack surface is reduced to password-only brute force against a known account.

Default WordPress installation with no security hardening plugin. XML-RPC (xmlrpc.php) is also accessible, providing an alternative brute-force vector that allows multiple login attempts per request.

Install a WordPress security plugin (Wordfence, Solid Security) that provides login rate limiting, CAPTCHA on the login form, and two-factor authentication. Disable XML-RPC if not required. Rename or restrict access to wp-login.php via .htaccess IP allowlisting if the practice team accesses the admin from known IP addresses.

Server: Apache/2.4.58 (cPanel), X-Powered-By: PHP/7.4.33, and <meta name="generator" content="WordPress 6.4.2"> are all present in HTTP responses and HTML source. Additionally, PHP 7.4 reached end-of-life in November 2022 and no longer receives security patches.

An attacker performing reconnaissance can immediately identify the exact web server, PHP version, and CMS version. This allows targeted exploit selection — if a WordPress 6.4.2 vulnerability is disclosed, the attacker knows this site is running the exact affected version without any guessing. The end-of-life PHP version is particularly concerning as it may contain unpatched vulnerabilities.

GoDaddy shared hosting defaults to exposing server version information. WordPress outputs the generator meta tag by default. No steps have been taken to suppress these disclosures.

Remove the WordPress generator meta tag by adding remove_action('wp_head', 'wp_generator') to functions.php. Suppress X-Powered-By via .htaccess (Header unset X-Powered-By). Request GoDaddy suppress the Server version header, or proxy through Cloudflare which replaces it. Upgrade PHP to 8.1+ through the GoDaddy hosting control panel.

Neither hostname returns X-Frame-Options or Referrer-Policy headers.

Without X-Frame-Options, the entire site can be embedded in an iframe on any external domain — enabling clickjacking attacks where a malicious site overlays invisible UI elements on top of Summit Ridge Dental's pages to trick users into clicking hidden buttons. Without Referrer-Policy, the full URL of the page a patient is visiting (which may include appointment booking parameters or patient identifiers in query strings) is sent to every external resource loaded on the page.

No header management has been configured on this hosting environment beyond the defaults.

Add via .htaccess: Header always set X-Frame-Options "SAMEORIGIN" and Header always set Referrer-Policy "strict-origin-when-cross-origin".

HSTS header is present but with max-age=86400 (1 day). Best practice minimum is 31536000 (1 year). The includeSubDomains directive is absent. The domain is not on the HSTS preload list.

A 1-day max-age means a browser that hasn't visited the site in 24 hours will attempt an HTTP connection before being redirected to HTTPS, creating a window for man-in-the-middle attacks on public Wi-Fi networks.

The HSTS header was likely set by GoDaddy's default configuration with a conservative max-age rather than the OWASP-recommended value.

Increase max-age to 31536000. Add includeSubDomains directive. Once stable, submit the domain to hstspreload.org for browser preload list inclusion.