{
    "host": "wafcharm.com",
    "host_url": "https://www.wafcharm.com:443/",
    "task_id": "7f8ef689-43b2-4a1d-9bac-ed96f8374347",
    "status": "COMPLETED",
    "inline_connection": "Yes",
    "original_header": {
        "Content-Type": "text/html; charset=UTF-8",
        "Transfer-Encoding": "chunked",
        "Connection": "keep-alive",
        "Date": "Wed, 21 Jan 2026 06:50:12 GMT",
        "Server": "Apache",
        "Vary": "Accept-Encoding",
        "X-Cache": "Miss from cloudfront",
        "Via": "1.1 fa2388d433a66e7365406f5a2a0963fa.cloudfront.net (CloudFront)",
        "X-Amz-Cf-Pop": "BOM78-P9",
        "X-Amz-Cf-Id": "0nr146M7Qa8FRyEOs1kCYeHdUiNS4qaa-tVtMjJiN2RETeRZB1uQYQ=="
    },
    "ip_address": "18.172.78.56",
    "hosting_provider": "Amazon Web Services (AWS)",
    "registrar": null,
    "cms": {
        "WordPress": "7.3.6"
    },
    "cms_cve": null,
    "server": "apache",
    "server_disclosure_cve": null,
    "programming_language": "PHP (WordPress)",
    "technology_disclosure_cve": null,
    "mixed_content_analysis": null,
    "operating_system": "Linux/Unix",
    "open_ports": [
        80,
        443
    ],
    "database_technology": null,
    "javascript_libraries": [
        {
            "jquery": {
                "version": "3.4.1",
                "source": "//cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js?ver=3.4.1"
            },
            "wordpress-popular-posts": {
                "version": "7.3.6",
                "source": "https://www.wafcharm.com/en/wp/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.js?ver=7.3.6"
            },
            "jquery_migrate": {
                "version": "3.1.0",
                "source": "//cdnjs.cloudflare.com/ajax/libs/jquery-migrate/3.1.0/jquery-migrate.min.js?ver=3.1.0"
            },
            "all-in-one-seo-pack": {
                "version": "4.9.2",
                "source": "https://www.wafcharm.com/en/wp/wp-content/plugins/all-in-one-seo-pack/dist/Lite/assets/table-of-contents.95d0dfce.js?ver=4.9.2"
            },
            "contact-form-7": {
                "version": "6.1.4",
                "source": "https://www.wafcharm.com/en/wp/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=6.1.4"
            }
        }
    ],
    "javascript_libraries_cve": {
        "Total CVEs": 2,
        "Critical": 0,
        "High": 0,
        "Medium": 2,
        "Low": 0,
        "jquery-3.4.1": [
            {
                "Id": "CVE-2020-11023",
                "Published": "2020-04-29T21:15:11.743",
                "Description": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
                "Severity": "MEDIUM",
                "Score": 6.9,
                "CWE": "CWE-79"
            },
            {
                "Id": "CVE-2020-11022",
                "Published": "2020-04-29T22:15:11.903",
                "Description": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
                "Severity": "MEDIUM",
                "Score": 6.9,
                "CWE": "CWE-79"
            }
        ]
    },
    "secure_connection": "Enabled",
    "directory_listing": null,
    "passwords_submitted_unencrypted": null,
    "missing_security_headers": [
        "STRICT-TRANSPORT-SECURITY",
        "PERMISSIONS-POLICY",
        "X-FRAME-OPTIONS",
        "CONTENT-SECURITY-POLICY",
        "X-CONTENT-TYPE-OPTIONS",
        "X-XSS-PROTECTION",
        "REFERRER-POLICY",
        "X-PERMITTED-CROSS-DOMAIN"
    ],
    "missing_content_security_policy_header": {
        "issue": "Missing Content-Security-Policy header",
        "severity": "High",
        "cwe_id": "CWE-693",
        "cwe_description": "Failure to enforce mechanisms that protect against unauthorized modifications such as XSS or content injection.",
        "fix": "Implement a strong Content-Security-Policy header such as: \"Content-Security-Policy: default-src 'self'; script-src 'self'\"."
    },
    "missing_strict_transport_security_header": {
        "issue": "Missing Strict-Transport-Security header",
        "severity": "High",
        "cwe_id": "CWE-319",
        "cwe_description": "Sensitive information is exposed in transit due to the absence of secure channel enforcement.",
        "fix": "Enable HSTS with: \"Strict-Transport-Security: max-age=31536000; includeSubDomains; preload\"."
    },
    "missing_referrer_policy_header": {
        "issue": "Missing Referrer-Policy header",
        "severity": "Medium",
        "cwe_id": "CWE-200",
        "cwe_description": "Exposure of sensitive URLs or information to third-party sites.",
        "fix": "Set a secure referrer policy such as: \"Referrer-Policy: no-referrer\"."
    },
    "missing_x_content_type_options_header": {
        "issue": "Missing X-Content-Type-Options header",
        "severity": "Medium",
        "cwe_id": "CWE-16",
        "cwe_description": "Improperly configured security headers allow MIME-type confusion attacks.",
        "fix": "Add the header: \"X-Content-Type-Options: nosniff\"."
    },
    "missing_httponly_flag_in_cookies": {
        "issue": "Missing HttpOnly flag in cookies",
        "severity": "High",
        "cwe_id": "CWE-1004",
        "cwe_description": "Cookies accessible by JavaScript can be stolen via XSS.",
        "fix": "Set the HttpOnly flag to prevent client-side script access."
    },
    "missing_secure_flag_in_cookies": {
        "issue": "Missing Secure flag in cookies",
        "severity": "High",
        "cwe_id": "CWE-614",
        "cwe_description": "Cookies without the Secure flag may be sent over unencrypted connections.",
        "fix": "Enable the Secure flag for all session or sensitive cookies."
    },
    "secret_files_detection": [
        "https://www.wafcharm.com:443/robots.txt",
        "https://www.wafcharm.com:443/sitemap.xml"
    ],
    "robots_txt_file_found": null,
    "waf_detection": [
        "AWS WAF"
    ],
    "ssl_certificate": null,
    "loose_cookie_domain": null,
    "csp_header_analysis": null,
    "openapi_disclosure": null,
    "password_leakage": null,
    "error_messages_analysis": null,
    "path_disclosure": null,
    "rate_limit_headers": null,
    "email_extraction": null,
    "xml_rpc_endpoint_detection": null,
    "http_methods_allowed": [
        "GET",
        "POST",
        "PUT",
        "PATCH",
        "DELETE",
        "OPTIONS",
        "HEAD"
    ],
    "enabled_debug_method": "No",
    "enabled_options_method": "Yes",
    "cross_domain_inclusion": [
        "ajax.googleapis.com",
        "www.wafcharm.com",
        "www.google.com",
        "fonts.googleapis.com",
        "fonts.gstatic.com",
        "www.googletagmanager.com",
        "www.youtube.com"
    ],
    "file_upload": null,
    "client_access_policies": [],
    "x_frame_options": "Missing X-Frame-Options",
    "x_xss_protection": "Missing x-xss-protection header",
    "htaccess_exposure": null,
    "host_header_injection": null,
    "captcha_detection": null,
    "password_field_with_autocomplete": null,
    "spf": null,
    "dmarc": null,
    "dkim": null,
    "unencrypted_viewstate": null,
    "total_scans": [
        "Inline Connection",
        "Ip-Address",
        "Cloud_Provider",
        "Server Disclosure",
        "Technology Disclosure",
        "Cms Detection",
        "Mixed Content Analysis",
        "Operating-System",
        "Open Ports Scan",
        "Database",
        "Javascript Libraries",
        "Secure Connection Check",
        "Directories Listing Exposed",
        "Password Exposing Pages",
        "Missing Security Headers",
        "Missing Content-Security-Policy",
        "Missing Strict-Transport-Security",
        "Missing Referrer-Policy",
        "Missing X-Content-Type-Options",
        "Missing Cookie http flag",
        "Missing Cookie secure flag",
        "Secret Files Detection",
        "WAF-Detection",
        "SSL Certificate Validation",
        "Loose Cookie Domain",
        "CSP Header Analysis",
        "OpenAPI Disclosure",
        "Password Leak Detection",
        "Path Disclosure",
        "Error Messages Analysis",
        "Rate Limit Headers",
        "Email Extraction",
        "Xml-RPC Endpoint Detection",
        "HTTP Methods Allowed",
        "Enabled Debug Method",
        "Enabled OPTIONS Method",
        "Cross-Domain Inclusion",
        "File Upload Detection",
        "Client Access Policies",
        "X-FRAME OPTIONS",
        "X-XSS PROTECTION",
        ".htaccess Exposure"
    ],
    "executive_summary": {
        "Severity": "Medium",
        "Total Checks Passed": 18,
        "Passed Cases": [
            "Mixed Content (HTTP on HTTPS)",
            "Open Ports Scan",
            "Secure Connection",
            "Directory Listing Exposed",
            "Passwords submitted unencrypted",
            "WAF Detection",
            "Loose cookie domain",
            "Content Security Policy Misconfiguration",
            "OpenAPI Disclosure",
            "Password Leakage",
            "Error Messages Analysis",
            "Path Disclosure",
            "Rate Limit Headers",
            "Emails exposed",
            "Enabled OPTIONS Method",
            "File Upload Detection",
            ".htaccess Exposure",
            "Host Header Injection"
        ],
        "Total Checks Failed": 18,
        "Failed Cases": [
            "Server Disclosure",
            "Technology Disclosure",
            "Javascript Libraries",
            "Missing Security Headers",
            "Missing Content-Security-Policy header",
            "Missing Strict-Transport-Security header",
            "Missing Referrer-Policy header",
            "Missing X-Content-Type-Options header",
            "Missing HttpOnly flag in cookies",
            "Missing Secure flag in cookies",
            "Secret Files Detection",
            "robots.txt file found",
            "SSL Certificate",
            "Enabled Debug Method",
            "Cross-Domain Inclusion",
            "Client Access Policies",
            "X-FRAME OPTIONS",
            "X-XSS PROTECTION"
        ],
        "Total CVEs Found": 2,
        "Critical": 0,
        "High": 0,
        "Medium": 2,
        "Low": 0,
        "Total CWEs Found": 7
    },
    "total_scan_time": "1 minute, 0.45 seconds",
    "scan_start_timestamp": "2026-01-21 06:50:10"
}