The Website Exposure Report
The Website Exposure Report is what the free website health check sends you. It reads your website as an ordinary visitor would and reports whether the software it runs on still receives security updates, whether its security headers, certificate and email authentication are in order, and what could not be seen from outside.
What it reads
Software currency The server software, frameworks and public code libraries your site declares, and whether each version is current, behind on updates or no longer supported.
Security headers Whether the headers that tell a browser how to protect a visitor are present and set.
Certificate Whether the site's certificate is valid, current and correctly configured.
Email authentication Whether SPF, DKIM and DMARC are published for the domain, and whether the DMARC policy enforces anything.
Everything is read from outside, as a browser reads it. Nothing is probed, nothing is signed into and nothing is sent to your site beyond an ordinary page request.
How to read it
Every item carries one of three states, written in words and marked with its own symbol, so the report reads the same in black and white and to anyone who cannot tell colours apart.
| State | Meaning |
|---|---|
| Current | The version in use still receives security updates. |
| Behind | A newer release exists. The version in use is behind on security updates. |
| No longer supported | The version in use has reached the end of its life and receives no security updates. |
The first page shows how many items sit in each state. That is a count, not a grade: one item that is no longer supported matters more than three that are behind, and the report says which item it is.
A fourth state, Could not be read, covers anything the report could not see from outside. It is listed, not counted.
What it cannot see
Many websites hide the version of the software they run, and some should. Where the report cannot read a version it says so, and it does not guess. Confirming it needs a check run with the business’s permission and access, which the free check never has.
The Digital Trust Audit asks a business for what could not be seen from outside. The free check does not.
A sample report
This sample is for Quillfield, a fictional business. No real business appears on this page.
Digital Trust Audit
Website Exposure Report
quillfield.example
Read 26 October 2026
One item is no longer supported. Two are behind.
- Current
- 3
- Behind
- 2
- No longer supported
- 1
Web serverCurrent
The version the server announces still receives security updates.
Server-side languageNo longer supported
The version announced has reached the end of its life and receives no security updates.
Code library loaded on every pageBehind
A newer release exists; the version in use is behind on security updates.
Content management systemCould not be read
The site does not publish a version. Not counted.
Security headersBehind
Two of the four protections browsers look for are sent.
CertificateCurrent
Valid, current and sent with its full chain.
Email authenticationCurrent
SPF, DKIM and DMARC are published and the DMARC policy enforces.
What the report is tested against
The notices below are the ones the report is tested against; the full list, with every notice and its publisher, is on the advisories page.
Node.js — the runtime under many modern websites and web apps
Flagged · Remote code execution; a public proof of concept appeared on 22 October
All supported lines before 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older get no fix. Fixed in 22.23.4, 24.22.1, 26.12.1.
A memory fault in the code that unpacks compressed web traffic lets an attacker run their own program on the server. Any site built on a modern JavaScript framework, or any web app a developer built in the last five years, is likely to be running Node.js somewhere.
PHP — the language under WordPress and most PHP sites
Flagged · Two critical flaws allow code to run on the server with no login
Every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12.
Two faults in PHP itself let an attacker run code on the web server without logging in. The PHP version is usually set by the hosting provider rather than the site owner, so a site stays on an affected version until someone asks for the update.
Next.js — the framework behind many agency-built React websites
Flagged · Two flaws allow code to run on the server with no login
16.0.0–16.4.0 and 15.x before 15.5.28. Next.js 14 and older get no fix. Fixed in 16.4.1, 15.5.28.
Two separate faults let an attacker run code on the server without logging in, one through cached functions and one through image handling. Agencies have built thousands of UK business websites on Next.js since 2022; the owner usually knows only that it is “a React site”.
Bricksforge — an add-on for the Bricks site builder on WordPress
Flagged · Attacks seen from 7 October
3.1.8.9 and earlier. Fixed in 3.1.8.10.
A file-upload fault lets anyone place and run a PHP script on the site. It is a commercial add-on sold alongside the Bricks builder, so it is on sites whose owner never chose it by name.
WordPress — the platform behind roughly four in ten websites
Flagged · Attacks began within hours of the notice
Versions before 7.1.2, 7.0.6, 6.9.9 and 6.8.10. Fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10.
A fault in WordPress itself lets an attacker run code on the server when particular theme and server settings are in place. Automatic updates close it on most sites, but sites where updates were switched off by a developer years ago stay open.
| Published | Software | What it means | Source |
|---|---|---|---|
Node.js — the runtime under many modern websites and web apps Flagged · Remote code execution; a public proof of concept appeared on 22 October All supported lines before 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older get no fix. Fixed in 22.23.4, 24.22.1, 26.12.1. | A memory fault in the code that unpacks compressed web traffic lets an attacker run their own program on the server. Any site built on a modern JavaScript framework, or any web app a developer built in the last five years, is likely to be running Node.js somewhere. | Node.js | |
PHP — the language under WordPress and most PHP sites Flagged · Two critical flaws allow code to run on the server with no login Every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Fixed in 8.2.35, 8.3.36, 8.4.27, 8.5.12. | Two faults in PHP itself let an attacker run code on the web server without logging in. The PHP version is usually set by the hosting provider rather than the site owner, so a site stays on an affected version until someone asks for the update. | PHP | |
Next.js — the framework behind many agency-built React websites Flagged · Two flaws allow code to run on the server with no login 16.0.0–16.4.0 and 15.x before 15.5.28. Next.js 14 and older get no fix. Fixed in 16.4.1, 15.5.28. | Two separate faults let an attacker run code on the server without logging in, one through cached functions and one through image handling. Agencies have built thousands of UK business websites on Next.js since 2022; the owner usually knows only that it is “a React site”. | Next.js | |
Bricksforge — an add-on for the Bricks site builder on WordPress Flagged · Attacks seen from 7 October 3.1.8.9 and earlier. Fixed in 3.1.8.10. | A file-upload fault lets anyone place and run a PHP script on the site. It is a commercial add-on sold alongside the Bricks builder, so it is on sites whose owner never chose it by name. | Patchstack | |
WordPress — the platform behind roughly four in ten websites Flagged · Attacks began within hours of the notice Versions before 7.1.2, 7.0.6, 6.9.9 and 6.8.10. Fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10. | A fault in WordPress itself lets an attacker run code on the server when particular theme and server settings are in place. Automatic updates close it on most sites, but sites where updates were switched off by a developer years ago stay open. | WordPress |
A website running software named here could be affected. The free check reads what your site declares and tells you.
There is no fix list
The report states what was found and what the state means. It does not say what to buy, in what order or from whom. We do not sell remediation, we take no commission from anyone who does, and we do not name a supplier. Any competent supplier can work from the report, and you choose who.
Where it fits
The free check is automated. No human reviews it, it produces no findings detail and it cannot earn certification. The Digital Trust Audit is human-verified against the published standard, and certification is earned only from that.
Frequently asked questions
See how your website reads from the outside.
The free check is automated and costs nothing. The report comes back the same working day.
Request the free check