Sample Full Scan Report

High Trackers load before consent

What we found: Meta Pixel and Google Analytics 4 load on the first page view, before the visitor makes any choice on the cookie banner.

Why it matters: Visitors' browsing data goes to advertising platforms before they have agreed. Common PDPPL guidance expects opt-in before cookies used for direct advertising, and the EU's ePrivacy rules require consent for non-essential cookies. For a café, it's also a trust issue: guests notice when a banner is just decoration.

Practical fix: Set your consent tool (or Tag Manager consent mode) so these tags fire only after "Accept". Add a "Reject all" button as easy to use as "Accept".

Official source: NCSA PDPPL guidelines (direct marketing) · ePrivacy Directive 2002/58/EC, Art. 5(3)

Consider asking: Licensed lawyer: whether your marketing set-up needs consent under the PDPPL for your specific case.

High Missing HSTS and Content-Security-Policy

What we found: The site uses HTTPS, but doesn't send Strict-Transport-Security or a Content-Security-Policy header.

Why it matters: Without HSTS, a visitor on public Wi-Fi can be downgraded to an insecure connection. Without CSP, an injected script (for example from a compromised plugin) runs with no restrictions, and that's where booking-form skimming starts.

Practical fix: Ask your host or CDN to add HSTS (start with max-age=31536000). Add a CSP in report-only mode first, review what it reports, then enforce it.

Official source: OWASP Top 10:2025, A02 Security Misconfiguration · MDN: Strict-Transport-Security

Consider asking: Qualified security professional: if you suspect a script has already been tampered with.

Medium Privacy notice missing common items

What we found: A privacy notice is linked from the footer, but doesn't say who receives the data (e.g. booking platform), how long it's kept, or how to withdraw consent or make a request.

Why it matters: Guests can't tell what happens to their details, and these are items PDPPL and GDPR guidance commonly expect a notice to cover. It's often the first thing a complainant points to.

Practical fix: Add sections on recipients and processors, retention, rights and how to exercise them, and a contact address. Use NCSA's Privacy Notice guideline as a checklist.

Official source: NCSA Privacy Notice guideline · GDPR Arts. 13–14 (for EU visitors)

Consider asking: Licensed lawyer: to review and approve the final notice wording.

Medium Booking form asks for health details; newsletter box pre-ticked

What we found: The booking form has a free-text "dietary or medical requirements" field and a pre-ticked newsletter checkbox.

Why it matters: Health data is special-nature data under the PDPPL, which carries stricter rules. A pre-ticked box isn't a clear opt-in for marketing.

Practical fix: Make the field optional, explain why you ask, and limit who sees it. Untick the newsletter box and keep marketing consent separate.

Official source: NCSA Special Nature Processing guideline · PDPPL, Law No. 13 of 2016 (Al Meezan)

Consider asking: Licensed lawyer: whether this processing needs NCSA permission in your case.

Medium DMARC set to monitor only

What we found: SPF is present (~all). DMARC exists with p=none and no reporting address. DKIM was found for the mail provider.

Why it matters: Anyone can still send email that appears to come from your domain, such as fake booking confirmations or payment requests, and mailbox providers aren't told to block it.

Practical fix: Add a rua= reporting address, review reports for 2–4 weeks, then move to p=quarantine and later p=reject.

Official source: RFC 7489 (DMARC)

Low CMS version exposed

What we found: /readme.html reveals the CMS version. No backups or .git folder were found.

Why it matters: It tells attackers which known vulnerabilities to try. On its own it's minor; with an outdated CMS it isn't.

Practical fix: Remove or block the file, and keep the CMS and plugins updated.

Official source: OWASP Top 10:2025