Feli-Scan Deep Scan & Fix · Sample report

Website security report
Sunshine Plumbing & Drain (example)

  • Site: sunshineplumbing-example.com
  • Scan type: Authorized deep scan (external + authenticated)
  • Prepared: October 23, 2026
  • Reviewed by: Certified AI professional, Felican AI

Summary

FBefore

This website could be taken over by anyone on the internet, without a password, until it is patched. It runs PHP 7.4 on WordPress 6.4 with three plugins that have published vulnerabilities, no firewall, and an admin login open to automated password guessing. PHP 7.4 will never receive the PHP2Shell fix, so the server must be upgraded, not just patched.

2Critical
5High
6Medium

The free scan grades a site from the outside. The Deep Scan adds an authorized active scan (OWASP ZAP and Nuclei, non-destructive templates), an authenticated review of the hosting account, CMS, plugins and user accounts, a malware and backdoor sweep of the files and database, and a check of backups. Everything below was confirmed, not inferred.

Findings

CriticalPHP 7.4.33: exposed to PHP2Shell, no patch exists for this version
Evidence
$ curl -sI https://sunshineplumbing-example.com/
HTTP/1.1 200 OK
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.33
$ php -v   (on host)
PHP 7.4.33 (cli) (built: Nov 2022)  mod_php
Why it mattersCVE-2026-109618 and CVE-2026-109619 (CVSS 9.2) allow unauthenticated remote code execution against any PHP version from 5.4 to 8.5.11. PHP 7.4 reached end of life in 2022 and will not be fixed. Apache mod_php is the highest-risk configuration. CISA’s guidance for PHP 8.1 and earlier is to take the system offline until upgraded.
FixUpgrade the server to PHP 8.3.36 (done: plugins and theme updated first for compatibility, PHP-FPM instead of mod_php). Confirmed closed with the watchTowr detection artifact generator.
CriticalBackdoor file found in uploads from a prior compromise
Evidence
/wp-content/uploads/2024/03/wp-cache.php
  eval(base64_decode($_POST['c'])) … modified 2024-03-19
/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php (CVE-2020-25213)
Why it mattersThe site was already entered through the file-manager plugin in 2024. The leftover shell gives an attacker full control regardless of any other fix, and is the kind of thing a free external scan cannot see.
FixShell removed, plugin removed, all admin passwords and salts rotated, database checked for injected users and content, host notified.
High3 plugins with published vulnerabilities
Evidence
contact-form-7   5.7.2   -> CVE-2023-6449 (unrestricted upload)
elementor        3.14.0  -> CVE-2023-48777 (RCE, contributor+)
wp-file-manager  6.9     -> CVE-2020-25213 (unauth RCE)
Why it mattersEach is on public exploit lists and scanned for automatically.
Fixcontact-form-7 and elementor updated to current; wp-file-manager removed.
HighNo web application firewall
EvidenceDNS points straight at the origin server (DigitalOcean 143.x.x.x). No CDN or WAF headers.
Why it mattersEvery request, including attack traffic, reaches PHP directly.
FixSite moved behind a WAF with the PHP2Shell rule set, origin IP restricted to the firewall’s ranges.
HighXML-RPC enabled and in active use by attackers
Evidence
access.log: 41,206 POST /xmlrpc.php in 7 days from 312 IPs
  system.multicall · wp.getUsersBlogs (password guessing)
Why it mattersThousands of password guesses per request.
FixXML-RPC disabled; login limited to 5 attempts; two-factor sign-in required for all admins.
HighAdmin accounts: 4 administrators, one unknown, weak passwords
EvidenceUsers admin, sunshine, webdev2019, wp_support1 (created 2024-03-19, unknown to owner). Two passwords found in public breach lists.
Why it mattersThe unknown account was created the day of the 2024 compromise.
FixRogue account removed, remaining admins reduced to two with new passwords and two-factor.
HighNo working backup
EvidenceBackup plugin configured but last successful run 2025-02-11; destination storage full.
Why it mattersA ransomware or defacement event would have meant rebuilding from nothing.
FixDaily off-site backups to a separate account; restore tested on a staging copy.
MediumSix hardening gaps: headers, directory listing, readme, jQuery, DMARC, form protection
EvidenceNo HSTS/CSP/X-Frame-Options; /wp-content/uploads/ listing on; /readme.html present; jQuery 1.12.4; no DMARC record; contact form without bot protection.
Why it mattersIndividually small, together they make every other weakness easier to use and the business easier to impersonate.
FixAll six closed. Headers set at the firewall, listing off, readme removed, jQuery updated with the theme, DMARC published at p=quarantine, honeypot plus rate limit on the form.

Remediation plan (as executed)

  1. Hour 0–2
    Firewall in front of the site with PHP2Shell rules; XML-RPC off; login rate limit. Stops the bleeding before anything is changed on the server.
    Done
  2. Hour 2–4
    Full backup to off-site storage; restore verified on a staging copy.
    Done
  3. Hour 4–8
    Malware sweep; backdoor and rogue admin removed; all credentials and salts rotated.
    Done
  4. Hour 8–16
    Plugins and theme updated on staging, tested, then PHP upgraded 7.4 → 8.3.36 with PHP-FPM; site re-tested end to end.
    Done
  5. Hour 16–20
    Hardening: security headers, directory listing, readme, DMARC, form protection, two-factor sign-in.
    Done
  6. Hour 20–24
    Re-scan (external + authenticated); report delivered; handover to monthly Protect.
    Done

Before and after

Before · Grade F · 22/100

  • PHP 7.4.33, mod_php, no fix available
  • Active backdoor from 2024
  • 3 vulnerable plugins, rogue admin
  • No firewall, no backups
  • 41k password-guessing requests per week

After · Grade A · 96/100

  • PHP 8.3.36 on PHP-FPM, PHP2Shell closed and verified
  • Clean files and database, credentials rotated
  • All plugins current, 2 admins with two-factor
  • Firewall, daily off-site backups, tested restore
  • Weekly re-scan and 24-hour patching under Protect

What happens next

Under Feli-Scan Protect this site is re-scanned every week, patched within 24 hours of any PHP, WordPress or plugin security release, backed up daily, and reported on monthly. The owner can forward this report to their cyber-insurance carrier; it covers the questions most carriers now ask.

This is a sample built from a typical small-business site; the business name and address are invented. Client reports are confidential to the client.

Scan my website free →See the service →