LOCKORA SECURITY AUDIT - SAMPLE REPORT Site: aurora-co.com (fictional demo site) Scanner: Lockora Security Audit v0.4.2 - https://lockora-audit.com/sample-report Score: 78/100 (previous scan 72, +6) Findings: 3 critical, 7 warnings, 24 passed (this file lists the 12 shown on the sample page) This is a demonstration. aurora-co.com does not exist; the findings are representative of what the scan commonly detects on real WordPress sites. ======================================================================== CRITICAL ======================================================================== [CRITICAL] Known vulnerability match - /wp-content/plugins/contact-form-7 Evidence: Contact Form 7 5.8.2 installed; CVE-2023-6449 fixed in 5.8.4 What: The installed Contact Form 7 version allows an unrestricted file upload via the [file] form tag: a crafted filename such as cv.pdf.phtml can bypass sanitization and land in the uploads directory with an executable extension. Why: On hosts that execute .phtml as PHP this is unauthenticated remote code execution from a public contact form. Automated scanners actively probe for this version. Do: Update the plugin from Plugins > Updates, then block PHP execution inside wp-content/uploads at the web server. Vulnerability matching uses the optional Wordfence Intelligence API key; without one Lockora still flags the plugin as behind the current release. Remediation type: Manual fix Reference: https://lockora-audit.com/blog/contact-form-7-security-vulnerabilities [CRITICAL] Authentication keys and salts - wp-config.php Evidence: 3 of 8 keys = "put your unique phrase here" What: Three of the eight authentication keys and salts in wp-config.php were never replaced with unique values, a common leftover from one-click installers. Why: These keys sign session cookies. Predictable keys make forged authentication cookies feasible, undermining every login protection on the site. Do: Use the plugin's Rotate keys action to generate eight fresh high-entropy values, or paste new ones yourself. Rotation logs out all active sessions. Remediation type: Action in Lockora Reference: https://lockora-audit.com/blog/wordpress-wp-config-php-security [CRITICAL] Inactive Administrator - user "webtemp7" Evidence: created 2023-02-11; last activity 26 months ago; 4 Administrators on a 3-person team What: An Administrator account exists that matches no current staff, vendor or service pattern and has been dormant for over two years. The site also has more Administrators than its team size suggests. Why: Dormant privileged accounts are a favourite persistence mechanism after a compromise and widen the attack surface for credential stuffing. Do: Downgrade the account, delete it (reassigning its content), or confirm it is known. Lockora lists the evidence and never deletes users itself. Remediation type: Guided review Reference: https://lockora-audit.com/blog/wordpress-user-roles-permissions-security ======================================================================== WARNING ======================================================================== [WARNING] XML-RPC - /xmlrpc.php Evidence: POST /xmlrpc.php -> 200 OK; system.multicall enabled What: The legacy XML-RPC endpoint is publicly reachable and accepts batched authentication attempts via system.multicall. Why: One HTTP request can carry hundreds of password guesses, bypassing login throttles that only watch wp-login.php. The endpoint can also be abused for pingback reflection DDoS. Do: If nothing on the site uses XML-RPC, switch on the Disable XML-RPC toggle in Lockora. It is reversible. Remediation type: Reversible toggle Reference: https://lockora-audit.com/blog/xmlrpc-php-security-disable-rate-limit [WARNING] Author enumeration / login protection - /?author=1, /wp-json/wp/v2/users Evidence: Two Administrator usernames discoverable; no login-protection or 2FA plugin detected What: Two Administrator usernames are discoverable from public author archives and the REST users route, and no login-protection or two-factor plugin was detected. Why: Known usernames plus an unthrottled login form is a complete brute-force path. Do: Switch on the REST user routes toggle, set display names that differ from login names, and add lockouts and two-factor authentication. Remediation type: Reversible toggle Reference: https://lockora-audit.com/blog/how-to-secure-wordpress-login-page [WARNING] debug.log reachability - /wp-content/debug.log Evidence: GET -> 200 OK; 1.2 MB What: Debug logging writes to the default location inside wp-content and the web server serves the file to anyone who asks for it. Why: The log contains absolute file paths, plugin internals and sometimes database queries, which attackers use to pick working exploits faster. Do: Set WP_DEBUG_LOG to a path outside the web root or turn debug logging off in production, delete the exposed file, and deny direct access to *.log at the web server. Remediation type: Manual fix Reference: https://lockora-audit.com/blog/wordpress-wp-config-php-security [WARNING] readme.html / generator tag - /readme.html Evidence: GET -> 200; What: The stock readme.html is reachable and every page carries a generator meta tag naming the exact WordPress version. Why: Version information lets mass scanners skip straight to the exploits that apply. Do: Switch on the Remove generator tag toggle and delete or block readme.html at the web server. Remediation type: Reversible toggle ======================================================================== PASSED ======================================================================== [PASSED] Core file checksums - WordPress core Evidence: 1,412 files verified against WordPress.org hashes; 0 modified What: Every core file matches the official checksums for this version. Do: No action. Export the file list as CSV or TXT if needed. Remediation type: None [PASSED] wp-content anomaly scan - wp-content Evidence: 0 anomalies What: No executables in uploads, no unexpected PHP outside code directories, no backup or secret-like files. Do: No action. Remediation type: None [PASSED] HTTPS and security headers - Site-wide Evidence: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy present What: The site redirects to HTTPS and sends the basic browser-hardening headers. Do: No action. Remediation type: None [PASSED] SSL certificate expiry / PHP version - Server Evidence: Certificate expires 2026-11-01 (61 days); PHP 8.2 supported What: Certificate renewal is not due yet and the PHP version is supported per WordPress.org Serve Happy data. Do: No action. Remediation type: None [PASSED] Automatic updates / mu-plugins - WordPress core Evidence: Minor releases auto-update; wp-content/mu-plugins absent What: Security releases install without waiting for a person and no must-use plugin directory exists. Do: No action. Remediation type: None Remediation types: "Reversible toggle" is a switch inside the plugin that can be turned back off; "Action in Lockora" is a button that makes one explicit change when clicked; "Guided review" means the plugin shows evidence and you decide; "Manual fix" is guidance for you, your developer or your host. Generated for https://lockora-audit.com/sample-report