© 2026 Pulse WP·Only scan sites you own or have explicit permission to scan.·
LegalTermsPrivacy
Buy me a coffee
Security01Vulnerabilities02Plugins03Theme04Exposure05HTTP Headers06SSL / TLS
Performance07Core Web Vitals08Improvement tips09Server10Resources
Accessibility11Audit
SEO12On-page13Social sharing14Technical15SEO audit
Recommendations
New scan
demo.wordpress.org
…·47s
WordPress6.4.2
PHP7.4.33
ServerApache/2.4.54 (Debian)
ThemeDivi
AuthorElegant Themes
Version4.22.1
Security23
Performance31
Accessibility74
SEO83
CRITIQUE
23/100
overall score
Security
23
01Detected vulnerabilities
critical

Click a vulnerability to show details

criticalCVE-2024-1071
Ultimate Member Plugin - Unauthenticated SQL Injection
Ultimate Member 2.7.0
9.8CVSS
criticalCVE-2023-5561
WordPress Core - SSRF via DNS Rebinding
WordPress Core 6.4.2
9.8CVSS
highCVE-2023-6553
Backup Migration - RCE via PHP deserialization
Backup Migration 1.3.7
8.8CVSS
highCVE-2023-47184
Divi Theme - Stored XSS in the Text module
Divi 4.22.1
6.4CVSS
mediumCVE-2023-39999
WordPress Core - Sensitive data exposure via REST API
WordPress Core 6.4.2
4.3CVSS
02Plugins
critical
PluginVersionLatestVulnerabilities
Ultimate Member2.7.02.8.3
? 2 vulns▼
Really Simple SSL7.0.59.1.0
? 1 vuln▼
Backup Migration1.3.71.4.2
? 1 vuln▼
WPForms Lite1.8.11.9.2
? 1 vuln▼
WooCommerce8.3.19.8.0
✓ None
Contact Form 75.85.9.5
✓ None
Yoast SEO21.723.4
✓ None
Elementor3.18.23.24.0
✓ None
03Active theme
high
NomDivi
AuteurElegant Themes
Installed version4.22.1Outdated → 4.25.0
Child themeNo
Vulnerabilities1 vulnerabilityy
04Exposition & Configuration
high
[!]
XML-RPC active
xmlrpc.php accessible - brute-force & DDoS pingback risk
high
[!]
User enumeration
REST API reveals user logins: ["admin"]
medium
[!]
Login page exposed
/wp-login.php accessible without IP restriction or rate limiting
medium
[!]
Directory listing enabled
/wp-content/uploads/ exposes the structure of uploaded files
medium
[!]
readme.html exposed
readme.html reveals the exact WordPress version to attackers
low
[!]
license.txt exposed
license.txt confirms WordPress usage and its version
low
[✓]
WP_DEBUG disabled
WP_DEBUG is disabled in production - no sensitive information exposed
OK
[✓]
Public registration
Public registration is disabled
OK
05HTTP security headers
high
HeaderStatutValeur / RecommandationSeverity
Strict-Transport-Security✓ Presentmax-age=31536000OK
X-Content-Type-Options✓ PresentnosniffOK
X-XSS-Protection✓ Present1; mode=blockOK
Content-Security-Policy✗ AbsentDefine a strict CSP policy to prevent XSS attackshigh
X-Frame-Options✗ AbsentAjouter: X-Frame-Options: SAMEORIGINmedium
Referrer-Policy✗ AbsentAjouter: Referrer-Policy: strict-origin-when-cross-originlow
Permissions-Policy✗ AbsentLimit browser permissions (camera, microphone, geolocation)low
Cross-Origin-Embedder-Policy✗ AbsentConsider: Cross-Origin-Embedder-Policy: require-corpInfo
Cookie security
CookieSecureHttpOnlySameSite
wordpress_logged_in_abc123✓ Yes✓ Yeslax
wordpress_test_cookie✗ No✗ No✗ Not set
PHPSESSID✗ No✓ Yes✗ Not set
06SSL / TLS
medium
HTTPS✓ Active
Certificate✓ Valid
ExpirationExpires in 18 days6/22/2026
TLS ProtocolTLSv1.2
IssuerLet's Encrypt
Performance
31
Mobile
31
Poor
Desktop
68
Needs improvement
07Core Web Vitals
high
LCP
Largest Contentful Paint
BonPassableMauvais
5.2s2.1sField data Poor
FCP
First Contentful Paint
BonPassableMauvais
3.1s1.2sField data Needs improvement
TBT
Total Blocking Time
BonPassableMauvais
1840ms320ms
CLS
Visual Stability
BonPassableMauvais
0.210.05Field data Needs improvement
Speed Index
Speed Index
BonPassableMauvais
6.8s2.8s
INP
Interaction responsiveness
Field data Needs improvement
08Improvement tips
low
Optimizations5
  • −1.2 s
    Eliminate render-blocking resources
    4 resources detected
  • −284 KB
    Remove unused JavaScript
    284 KB unused
  • −320 KB
    Serve properly sized images
    Estimated savings: 320 KB
  • −420 KB
    Use next-generation image formats
    Estimated savings: 420 KB (WebP/AVIF)
  • −180 KB
    Use video formats for animations
    2 GIFs detected
Diagnostics3
  • DOM size too large
    2,847 elements

    A large DOM increases memory usage and slows style recalculation. Aim for fewer than 1,500 nodes.

  • High third-party code impact
    6 sources - 3.2 s blocking

    Third-party code can significantly impact performance (Google Analytics, Facebook Pixel, etc.).

  • Excessive JavaScript execution time
    4.8 s JS processing

    Reduce the time spent parsing, compiling and executing JavaScript.

09Server
ok
Response timeFast1840 ms
Compression✓ gzip
Cache-Control✓ public, max-age=3600
10Resources & loading
medium
Scripts bloquants4 without defer/async
Lazy loading images7 / 14
Dimensions images (CLS)9 / 14 with width+height
Formats modernes
✗ WebP✗ AVIF
Resource hintspreload×2 preconnect×1
Scripts tiers6 scripts externes
Accessibility
74
11Audit
medium
Detected issues38 passeds
  • Insufficient contrast ratio
    4 elements affected

    Many visually impaired users cannot read content if the contrast between background and foreground colors is too low.

  • Images without alt attribute
    3 images out of 14

    Image elements must have alt attributes to be accessible to assistive technologies.

  • Links without discernible name
    2 anonymous links

    Link names must be discernible by assistive technologies for correct navigation.

SEO
83
12On-page SEO
medium
Balise titleOKAccueil - Mon Site WordPress (30 chars.)
Meta descriptionToo short(48 chars.)
Balise H1OK (×1)Digital solutions for your business
Balises H24 found
Images sans alt3 / 14
URL canonique✓ Set
Languefr-FR
Indexation✓ Indexable
Viewport✓ Set
Favicon✓ Present
hreflangNot set
13Social sharing
medium
Open Graph
✓ og:title✗ og:description✗ og:image
Twitter CardAbsente
Structured data✓ JSON-LD detectedWebSite, Organization
14Technical
medium
robots.txt✓ PresentNo Sitemap directive
Sitemap XMLNot found
HTML validity
3 errors, 7 warnings
  • L.42The element "div" is not allowed as a child of "ul" in this context.
  • L.156The attribute "onclick" is not allowed on element "a" at this point.
  • L.298End tag "p" seen, but there was no open element.
15Technical SEO audit
medium
Detected issues16 passeds
  • Meta description too short or missing
    48 characters (recommended: 120–158)

    Meta descriptions can appear in search results and influence click-through rate.

Recommendations
Security
critical
#1
criticalUpdate WordPress to 6.8.1

Fixes 2 critical CVEs (SSRF, data exposure). Perform a full backup before updating.

Learn more →
#2
criticalUpdate Ultimate Member to 2.8.3

Fixes CVE-2024-1071, an unauthenticated SQL injection with CVSS 9.8. Risk of complete database compromise.

Learn more →
#3
highMigrate PHP to 8.2 minimum

PHP 7.4 reached end-of-life in December 2022 and no longer receives security patches. PHP 8.2 also offers better performance.

Learn more →
#4
highDisable or secure XML-RPC

Block xmlrpc.php via .htaccess or use a security plugin. If Jetpack is used, whitelist only Automattic IPs.

Learn more →
#5
highConfigure a Content-Security-Policy header

Add a strict CSP header to significantly reduce the XSS attack surface. Start in report-only mode to identify violations.

Learn more →
#6
mediumRestrict access to wp-login.php

Limit login page access to administrator IPs only via .htaccess or a WAF (Cloudflare, etc.).

Learn more →
#7
mediumDisable user enumeration

Add a redirect_canonical filter or use a security plugin to hide logins via the REST API and /?author=N URLs.

Learn more →
#8
mediumOptimize mobile performance (score: 31)

Eliminate 4 render-blocking resources, remove unused JavaScript (284 KB) and convert images to WebP to save ~420 KB.

Learn more →
#9
lowDelete readme.html and license.txt

These files reveal the exact WordPress version to attackers and facilitate targeting. Delete them or block them in .htaccess.

Learn more →
Report generated on 5/26/2026, 2:32:11 PM