- Main website and five reachable web subdomains
- Twenty-five representative pages and endpoints
- DNS, TLS, redirects, headers and cookies
- Common exposed-file and backup paths
- Public APIs, documents and service pages
- Visible software and public advisory correlation
- Manual verification of reported evidence
Demonstration report · fictional and anonymized data
External Website
Security Review
n••••••-dental.com
A detailed example of the report delivered after a non-intrusive review of a public website and its reachable web subdomains.
01 · Executive summary
Two issues require immediate action
The review confirmed that an unauthenticated API returns internal records and that an HTTPS redirect can pass through HTTP while the session cookie lacks the Secure attribute. Seven additional findings increase exposure or disclose unnecessary technical information.
2High
4Medium
3Low
FIRST 24 HOURS
- Restrict the public records API and review its historical access logs.
- Remove every HTTPS-to-HTTP redirect and correct session cookie attributes.
- Remove public project files, test scripts and internal documents.
02 · Scope and limitations
Publicly reachable surface reviewed
- No account login or authenticated areas
- No form submissions or test records
- No injection, brute force, fuzzing or file uploads
- No exploitation of suspected vulnerabilities
- No source code, server, database or cloud access
- No load, stress or denial-of-service testing
- No compliance certification or pentest attestation
Important limitation: this report describes what was observable from the public internet during the review window. It cannot prove that no other vulnerability or randomly named private file exists.
03 · Confirmed findings
Nine findings supported by observable evidence
F-01 High
Public API returns internal records without authentication
A custom REST endpoint returned internal training results to an unauthenticated request. The response contained user identifiers, test history, answers and completion timestamps.
OBSERVED EVIDENCE
GET https://academy.n••••••-dental.com/wp-json/internal/v1/resultsHTTP/2 200 · content-type: application/json · response size: 2.4 MBObserved fields: user_id, test_id, answer, score, completed_at WHY IT MATTERS
Anyone who knows or discovers the route can retrieve internal records. Search engines, browser extensions, third-party scripts or automated scanners may also retain the response.
RECOMMENDED FIX
Require an authenticated session and an explicit capability check for the route. Return only records belonging to the current user unless an administrator permission is present. Review access logs for earlier requests.
CLOSURE CONDITION
An unauthenticated request returns 401 or 403, and authorized users receive only the records allowed for their role.
F-02 High
HTTPS request is redirected through HTTP while the session cookie lacks Secure
Several directory URLs redirected from HTTPS to HTTP before returning to HTTPS. The PHP session cookie was scoped to the parent domain and did not include Secure or SameSite.
OBSERVED EVIDENCE
GET https://n••••••-dental.com/admin → 301 Location: http://n••••••-dental.com/admin/Set-Cookie: PHPSESSID=…; Domain=n••••••-dental.com; HttpOnlyStrict-Transport-Security: header not present WHY IT MATTERS
A browser can send a valid session cookie over an unencrypted request before the second redirect. Parent-domain scope may also expose the cookie to unrelated or third-party subdomains.
RECOMMENDED FIX
Correct HTTPS detection at the application or reverse proxy, remove every HTTP destination from HTTPS responses, make the cookie host-only and add Secure, HttpOnly and SameSite. Enable HSTS after every subdomain supports HTTPS.
CLOSURE CONDITION
All HTTP requests redirect directly to HTTPS, HTTPS responses never point to HTTP, and the session cookie is host-only with Secure, HttpOnly and SameSite.
F-03 Medium
Build, dependency and test files are publicly accessible
Files that are not required by visitors were included in the production web root. They disclose exact dependency versions, application structure and source-level information.
OBSERVED EVIDENCE
GET /package-lock.json → 200 OKGET /composer.lock → 200 OKGET /assets/app.js.map → 200 OKGET /test.php → 200 OK WHY IT MATTERS
The files reduce the work required to identify outdated components, internal paths and suitable public vulnerabilities. A forgotten test script can also become dangerous after a future code change.
RECOMMENDED FIX
Exclude development files from the deployment artifact. Deny public access to dependency manifests, source maps and test/install scripts at the web-server level. Remove unused files from the server.
CLOSURE CONDITION
Every listed path returns 403 or 404 and is absent from the next production artifact.
F-04 Medium
Internal documents are listed and downloadable without login
The public media API listed documents intended for staff use. Direct file URLs remained accessible even when the associated page was not linked from the website.
OBSERVED EVIDENCE
GET /wp-json/wp/v2/media?media_type=application → 200 OK23 documents listed: PDF, DOCX, PPTX and XLSXGET /wp-content/uploads/2026/06/internal-standard.pdf → 200 OK WHY IT MATTERS
Unlinked is not private. Anyone can enumerate or share the files, and search engines or archives may preserve copies after access is closed.
RECOMMENDED FIX
Move private documents outside the public uploads directory and serve them through an authenticated download controller. Remove public copies and request cache/search removal where required.
CLOSURE CONDITION
The media API no longer lists private documents and direct unauthenticated downloads return 401, 403 or 404.
F-05 Medium
Visible CMS and plugin versions match known security advisories
The public site disclosed versions of the CMS, runtime and several plugins. Two detected versions fall within ranges affected by published security advisories.
OBSERVED EVIDENCE
Server: nginx/1.21.1 · X-Powered-By: PHP/7.4.33CMS generator and public assets disclose WordPress and plugin versionsVersion correlation only — vulnerabilities were not exploited WHY IT MATTERS
An attacker can prioritize components with relevant public research instead of testing the site blindly. Actual exploitability depends on configuration and was not verified in this review.
RECOMMENDED FIX
Update the runtime, CMS and affected plugins on a staging copy, remove components that are not required and establish a monthly update process. Hide unnecessary version headers after patching.
CLOSURE CONDITION
The affected components are on supported versions and the public response no longer discloses unnecessary version details.
F-06 Medium
Administrative and service subdomains are exposed to the public internet
The domain has public admin, mail, CRM and connector hosts. A health endpoint discloses software and integration state; one alias points to a third-party service while sharing the parent cookie scope.
OBSERVED EVIDENCE
admin.n••••••-dental.com → login page reachableconnector.n••••••-dental.com/health → 200 OK · installed: truebooking.n••••••-dental.com → CNAME to third-party service WHY IT MATTERS
Public management surfaces increase the number of systems that must be patched and monitored. Shared cookie scope can extend trust to hosts that are operated by another provider.
RECOMMENDED FIX
Remove unused DNS records, restrict management interfaces by VPN or allowlist where practical, protect accounts with MFA and keep cookies host-only. Limit health responses to the minimum required status.
CLOSURE CONDITION
Unused hosts no longer resolve, restricted hosts reject public access and no session cookie is sent to unrelated subdomains.
F-07 Low
Browser security headers are incomplete
The reviewed pages do not define a Content Security Policy, HSTS, framing restrictions or a referrer policy.
OBSERVED EVIDENCE
content-security-policy: not presentstrict-transport-security: not presentx-content-type-options: not presentreferrer-policy: not present WHY IT MATTERS
Missing browser controls do not create a breach by themselves, but they reduce protection against injected scripts, clickjacking, content-type confusion and unintended referrer disclosure.
RECOMMENDED FIX
Add the headers at the web-server or edge layer. Introduce CSP in report-only mode first, inventory required origins and then enforce it. Test every public page before enabling HSTS for subdomains.
CLOSURE CONDITION
The agreed headers are present on all reviewed HTML responses without breaking required site functionality.
F-08 Low
User, software and document metadata provide unnecessary reconnaissance data
Public endpoints disclose an administrator username. An uploaded image retains the author name, camera body serial number, lens serial number and original capture time.
OBSERVED EVIDENCE
GET /wp-json/wp/v2/users → 200 OK · slug: adminPublic JPEG contains EXIF artist, body serial, lens serial and captured_atGPS coordinates were not present WHY IT MATTERS
The information can support targeted password attacks, phishing and identification of staff or equipment. It is not sensitive enough to justify a higher severity on its own.
RECOMMENDED FIX
Disable public user enumeration where it is not required, use non-obvious administrative usernames and strip EXIF metadata from public images during upload or deployment.
CLOSURE CONDITION
Anonymous user enumeration is blocked and the replaced image contains no private EXIF fields.
F-09 Low
Third-party scripts execute on pages that collect contact details
Chat, analytics, call-tracking and session-recording scripts run with the same browser privileges as the website on pages containing name and phone fields.
OBSERVED EVIDENCE
9 third-party script origins observed on the contact pageNo Content Security Policy limits script originsObserved test values were not transmitted in the reviewed session WHY IT MATTERS
Any loaded script can technically read form values before submission. This is a supply-chain and privacy exposure even when no current transmission of full field values is observed.
RECOMMENDED FIX
Remove integrations that are not required, load optional scripts only after consent, explicitly exclude sensitive fields from session recording and introduce a restrictive CSP.
CLOSURE CONDITION
Only approved scripts load on form pages, sensitive fields are excluded from recording and CSP restricts scripts to the documented allowlist.
04 · Checked but not found
Important exposure types with no confirmed result
Negative results are recorded so the client can distinguish completed checks from items that were outside scope.
- ✓No accessible .env, .git/HEAD or private key files were found.
- ✓No standard SQL dumps, ZIP/TAR backups or database exports were found.
- ✓No public debug.log, error.log or access.log was found at the checked paths.
- ✓No directory listing was enabled for uploads, plugins or backup directories.
- ✓No existing form submissions were readable through the reviewed public endpoints.
- ✓No Swagger, GraphQL introspection page or framework actuator endpoint was exposed.
- ✓No brute force, injection payload, file upload or vulnerability exploitation was performed.
05 · Remediation sequence
Recommended order of work
PriorityActionOwnerTarget
P0Restrict public records API and document downloadsBackend / CMSToday
P0Correct HTTPS redirects and session cookie scopeDevOpsToday
P1Remove build files, source maps and test scriptsDevelopment1–2 days
P1Patch runtime, CMS and affected pluginsDevelopment3–5 days
P2Restrict service hosts and remove stale DNSIT / DevOps1 week
P2Add browser headers and reduce third-party scriptsFrontend / Legal1–2 weeks
06 · Re-check
One verification pass is included
Within 30 days, the client can request one re-check of the URLs and closure conditions listed in this report. The re-check does not expand the original scope or search for new issues.
EXPECTED OUTPUT
Closed
Evidence no longer reproduces.
Partially closed
Risk is reduced but the closure condition is not fully met.
Open
Original evidence still reproduces.