wpsuli.hu report – HelloWP Report

Security

Turn off old TLS versions

The server still accepts TLS 1.0 or 1.1, which modern browsers no longer support and which have known weaknesses. TLS 1.2 and 1.3 are enough; set this in the server or CDN configuration.

Cloudflare: SSL/TLS → Edge Certificates

Minimum TLS Version: TLS 1.2

For other setups: nginx, Apache

nginx

In the nginx http block

ssl_protocols TLSv1.2 TLSv1.3;

If a server block or an included file (such as Certbot's /etc/letsencrypt/options-ssl-nginx.conf) also has an ssl_protocols line, change it there too, because the server-level value overrides the http block.

Apache

In the Apache virtual host configuration (does not work in .htaccess)

SSLProtocol -all +TLSv1.2 +TLSv1.3

Security

Set 4 response headers

These security headers are missing or have the wrong value. You set them together in one place.

Cloudflare: Rules → Overview → Create rule → Response Header Transform Rule

Set static: Strict-Transport-Security = max-age=31536000
Set static: X-Content-Type-Options = nosniff
Set static: Referrer-Policy = strict-origin-when-cross-origin
Set static: Cross-Origin-Opener-Policy = same-origin-allow-popups

For other setups: WordPress, nginx, Apache

WordPress

In a new file: wp-content/mu-plugins/hwp-report-headers.php (on Bedrock: web/app/mu-plugins/hwp-report-headers.php)

<?php
add_action( 'send_headers', function () {
    header( 'Strict-Transport-Security: max-age=31536000' );
    header( 'X-Content-Type-Options: nosniff' );
    header( 'Referrer-Policy: strict-origin-when-cross-origin' );
    header( 'Cross-Origin-Opener-Policy: same-origin-allow-popups' );
} );

nginx

In the nginx server block. If a location block has its own add_header, repeat it there: nginx only inherits when the level has none.

add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;

Apache

In the .htaccess file of the web root

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Cross-Origin-Opener-Policy "same-origin-allow-popups"
</IfModule>

Security

Set a Content-Security-Policy

There is no Content-Security-Policy, neither as a header nor in a meta tag. A CSP lists where the page may load scripts, styles and images from, and with a well-configured CSP injected code (XSS) does not run.

Cloudflare: Rules → Overview → Create rule → Response Header Transform Rule

Set static: Content-Security-Policy = object-src 'none'; base-uri 'self'; frame-ancestors 'self'

object-src 'none' also blocks embedded PDFs (<object>, <embed>), and frame-ancestors 'self' stops other sites from showing your pages in a frame. If you rely on either on purpose, adjust the policy first.

For other setups: HTML, nginx, Apache

HTML

In the page <head>

<meta http-equiv="Content-Security-Policy" content="object-src 'none'; base-uri 'self'">

frame-ancestors has no effect in a meta tag, so it is left out here. object-src 'none' also blocks embedded PDFs (<object>, <embed>).

nginx

In the nginx server block. If a location block has its own add_header, repeat it there: nginx only inherits when the level has none.

add_header Content-Security-Policy "object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;

object-src 'none' also blocks embedded PDFs (<object>, <embed>), and frame-ancestors 'self' stops other sites from showing your pages in a frame. If you rely on either on purpose, adjust the policy first.

Apache

In the .htaccess file of the web root

<IfModule mod_headers.c>
    Header always set Content-Security-Policy "object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
</IfModule>

object-src 'none' also blocks embedded PDFs (<object>, <embed>), and frame-ancestors 'self' stops other sites from showing your pages in a frame. If you rely on either on purpose, adjust the policy first.

Security

Stop other sites from framing your page

There is no X-Frame-Options header and no frame-ancestors in the CSP, so another site can load your page in an invisible frame and trick visitors into clicking on it. The X-Frame-Options: SAMEORIGIN header prevents this.

Cloudflare: Rules → Overview → Create rule → Response Header Transform Rule

Set static: X-Frame-Options = SAMEORIGIN

For other setups: WordPress, nginx, Apache

WordPress

In a new file: wp-content/mu-plugins/hwp-report-clickjacking.php (on Bedrock: web/app/mu-plugins/hwp-report-clickjacking.php)

<?php
add_action( 'send_headers', 'send_frame_options_header' );

nginx

In the nginx server block. If a location block has its own add_header, repeat it there: nginx only inherits when the level has none.

add_header X-Frame-Options "SAMEORIGIN" always;

Apache

In the .htaccess file of the web root

<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>

Basics

Return 404 for missing pages

A missing page gets status 200 and a normal page from the server, not 404. This is a soft 404: Google handles it badly and fake pages can end up in the index. Make missing pages return 404.

Performance

Stop scripts from blocking rendering

2 scripts in the <head> load without async or defer and halt the page from rendering until they are downloaded and run. Add defer, or move them to the bottom of the page.

In the page <head>

<script defer src="/app.js"></script>

A defer script runs after the HTML is parsed, in order with the other defer scripts. If an inline script uses its code (jQuery, for example), it breaks because of the delay: defer that one too, or leave this script without defer. In WordPress, strategy => defer in wp_enqueue_script() does the same for your own scripts (since 6.3).

Accessibility

Improve text contrast

Some text has low contrast against its background. WCAG asks for at least 4.5:1 for normal text and 3:1 for large text. For low-vision visitors and in bright sunlight it is hard to read; darken the text or lighten the background.

Security

Do not expose the software version

The X-Powered-By header reveals the exact version: PHP/8.4.27. An attacker can see right away which known bugs to try; turn off the version output in the server or PHP configuration.

Cloudflare: Rules → Overview → Create rule → Response Header Transform Rule

Remove: X-Powered-By

For other setups: PHP, nginx, Apache

PHP

In php.ini (or ask your host)

expose_php = Off

nginx

In the nginx location ~ \.php$ block, next to the fastcgi_pass line

fastcgi_hide_header X-Powered-By;

Apache

In the .htaccess file of the web root

<IfModule mod_headers.c>
    Header unset X-Powered-By
    Header always unset X-Powered-By
</IfModule>

Performance

Add a Cache-Control header

The home page response has no Cache-Control, so browsers and CDNs can only guess how long to keep it. Give changing HTML a short max-age, and images, CSS, JS and fonts a long one.

In a new file: wp-content/mu-plugins/hwp-report-cache-control.php (on Bedrock: web/app/mu-plugins/hwp-report-cache-control.php)

<?php
add_action( 'send_headers', function () {
    if ( ! is_user_logged_in() ) {
        header( 'Cache-Control: no-cache' );
    }
} );

For other setups: nginx, Apache

nginx

In the nginx http block

map "$upstream_http_cache_control:$sent_http_content_type" $hwp_cc {
    "~^:text/html" "no-cache";
    default "";
}

In the nginx server block. If a location block has its own add_header, repeat it there: nginx only inherits when the level has none.

add_header Cache-Control $hwp_cc always;

Apache

In the .htaccess file of the web root

<IfModule mod_headers.c>
    Header setifempty Cache-Control "no-cache" "expr=%{CONTENT_TYPE} =~ m#^text/html#"
</IfModule>

Performance

Add an ETag or Last-Modified header

The site sends neither, so returning visitors download everything again even if nothing changed. With either one the browser can ask whether anything changed and get a short "no".

SEO

Adjust the description length

The meta description is 209 characters; Google cuts it off after about 160. Put the important part first and shorten it.

WordPress

Remove exposed files

These files can be downloaded by anyone: readme.html. They may hold credentials, logs or backups. Delete them from the server or block access.

In the nginx server block, before the location ~ \.php$ block

location ~* (^|/)(readme\.html)(/|$) {
    deny all;
}

Put it before your other regex locations, because nginx uses the first one that matches. If those sit inside a location / { … }, put it there, before them: the nested regex wins over the outer one. If a matching prefix location has the ^~ modifier, nginx skips the regexes: add it there too. Deleting the files is best.

For other setups: Apache

Apache

In the .htaccess file of the web root, above the # BEGIN WordPress line

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule (^|/)(readme\.html)(/|$) - [F,L,NC]
</IfModule>

A subfolder .htaccess with its own RewriteEngine line does not inherit these rules unless it also has RewriteOptions Inherit.

Performance

Reduce the number of scripts

The page loads 26 scripts; up to 20 is fine. Each one has to be downloaded, parsed and run, which you feel on slow phones. Remove plugins and tracking codes you do not use.

Performance

Use a modern image format

3 images are still JPEG or PNG and at least 10 KB. WebP or AVIF usually gives the same quality in a smaller file. Convert them; browsers support both nearly everywhere.

In the page HTML

<picture>
  <source srcset="image.avif" type="image/avif">
  <source srcset="image.webp" type="image/webp">
  <img src="image.jpg" width="640" height="360" alt="What the image shows">
</picture>

Create the .avif and .webp files from the same image first. The browser downloads the first source whose format it knows; the others get the .jpg.

Performance

Set image sizes and lazy-load them

Images without a size: 4; below-the-fold images loading right away: 6. The first makes the page jump, the second takes bandwidth from more important content. Give every image a size, and add loading="lazy" to the ones below the fold.

In the page HTML

<img src="image.webp" width="640" height="360" alt="What the image shows" loading="lazy">

Use loading="lazy" only on images below the fold; never on the ones at the top of the page, especially the hero image.

Accessibility

Add a skip link to the content

There is no “Skip to content” link at the start of the page. This matters mainly for keyboard users: without it they have to step through the whole menu on every page. Put a link at the start of the <body> that points to <main>.

In a classic theme header.php, right after the wp_body_open(); call

<a class="skip-link screen-reader-text" href="#content">Skip to content</a>

Point href to the id of the main content element of your theme. The theme CSS hides the screen-reader-text class and shows it on focus; if your theme lacks it, add the CSS lines under the HTML variant too (the link also has the .skip-link class). Block themes do not need this: since WordPress 5.8 core adds a skip link to the <main> element.

For other setups: HTML

HTML

In the page HTML

<a class="skip-link" href="#content">Skip to content</a>
…
<main id="content">
…
</main>

Make the link the first focusable element in <body>. You may hide it only if it becomes visible on keyboard focus; with display: none the keyboard cannot reach it either. If you already have a <main> element, just add the id to it.

In the site (or theme) stylesheet

.skip-link:not(:focus) { position: absolute; width: 1px; height: 1px; overflow: hidden; clip-path: inset(50%); white-space: nowrap; }
.skip-link:focus { position: fixed; top: 8px; left: 8px; z-index: 100000; padding: 8px 16px; background: #fff; color: #000; }

Basics

Measure who visits your site

We found no analytics on the page. Without measuring, you do not know which pages bring visitors and what works. Pick a tool (GA4 or a cookieless one such as Plausible) and set it up in line with the law.

wpsuli.hu

Turn off old TLS versions

nginx

Apache

Set 4 response headers

WordPress

nginx

Apache

Set a Content-Security-Policy

HTML

nginx

Apache

Stop other sites from framing your page

WordPress

nginx

Apache

Return 404 for missing pages

Stop scripts from blocking rendering

Improve text contrast

Do not expose the software version

PHP

nginx

Apache

Add a Cache-Control header

nginx

Apache

Add an ETag or Last-Modified header

Adjust the description length

Remove exposed files

Apache

Reduce the number of scripts

Use a modern image format

Set image sizes and lazy-load them

Add a skip link to the content

HTML

Measure who visits your site

Security 5 / 13 passed

Performance 13 / 19 passed

SEO 10 / 11 passed

Accessibility 5 / 7 passed

Basics 9 / 11 passed

Privacy 2 / 2 passed

WordPress 2 / 3 passed

What runs on your site?