How to fix what the scan finds
Plain-English guides to the security issues BadgerScan flags, with the exact steps to fix each one. Not sure what applies to you? Run the free scan and it will tell you.
DMARC p=none: What It Means and How to Fix It
HighA DMARC policy of p=none monitors but does not block spoofed email. Here is what p=none means, why it leaves your domain spoofable, and how to move safely to p=reject.
No DMARC Record: What It Means and How to Fix It
HighYour domain has no DMARC record, so anyone can spoof your email. Here is what that means and the step-by-step way to publish DMARC safely, monitor to reject.
No SPF Record: What It Means and How to Fix It
MediumYour domain has no SPF record, so senders can be spoofed. Learn what an SPF record is, why it matters, and the exact TXT record to publish to fix it fast.
Weak SPF Policy (+all or No all): What It Means and How to Fix It
HighYour SPF record ends in +all or has no all mechanism, so it does not stop spoofing. Learn what this means and how to tighten it safely to -all, step by step.
No HSTS Header: What It Means and How to Enable HSTS
MediumYour site is missing an HSTS header, so browsers can be downgraded from HTTPS to HTTP. Here is what that means and the exact steps to enable HSTS safely today.
No Content-Security-Policy: What It Means and How to Fix It
LowYour site sends no Content-Security-Policy header. Learn what CSP does, why it limits cross-site scripting damage, and how to add one safely, report-only first.
Missing Core Security Headers: What They Are and How to Add Them
LowYour site is missing core response headers like X-Frame-Options, X-Content-Type-Options and Referrer-Policy. Learn what each one does and how to add them safely.
Site Not Served Over HTTPS: What It Means and How to Fix It
HighYour site loads over plain HTTP or does not redirect to HTTPS. Learn how to install a free TLS certificate, force a 301 redirect, and add HSTS, step by step.
Expired SSL Certificate: What It Means and How to Fix It
CriticalYour SSL/TLS certificate expired, so visitors see a full-page browser warning. Here is what it means and the exact steps to renew it and stop it lapsing again.
No Two-Factor Login Protection: What It Means and How to Fix It
MediumYour BadgerScan scan found no two-factor or login-protection plugin. Learn what this means and how to require 2FA and block brute-force logins, step by step.
A User Named "admin" Exists: Why to Change It and How
MediumYour scan found a WordPress user named "admin". Here is why that default username is worth changing and the exact safe steps to replace it and lock it down.
Dashboard File Editor Enabled: How to Disable It in WordPress
MediumBadgerScan found your WordPress dashboard file editor is enabled. Here is what it means, why it matters, and the one-line wp-config.php change that fixes it.
Plugins Need Updates: How to Fix Outdated WordPress Plugins
HighYour scan found WordPress plugins that need updates. Learn why outdated plugins are risky and follow the safe, step-by-step way to update them all correctly.
WordPress User Enumeration: What It Means and How to Fix It
MediumWordPress can publish account usernames through the REST API and author URLs. Learn what user enumeration means and the exact steps to lock your site down.