Target ruthlesswp.com
41 out of 100
- Blast radius
- /100
- Grade
- D
Ruthless at WordPress, Careless About Performance and Security
Damage assessment
- 01
Largest Contentful Paint clocks in at 6.2 seconds—visitors will age faster than your content loads.
How to fix this - 02
No Content Security Policy means malicious scripts can waltz in uninvited; security theater at its finest.
How to fix this - 03
REST API happily leaks usernames via /wp/v2/users—attackers can enumerate accounts without breaking a sweat.
How to fix this - 04
Missing X-Frame-Options invites clickjacking attacks; your site is a target painted in neon.
How to fix this - 05
No <h1> tag on the homepage—SEO basics are apparently optional here.
How to fix this - 06
WordPress 7.1 advertised in the page source, handing attackers a roadmap to known vulnerabilities.
How to fix this - 07
Mobile performance score of 65/100 means most users are waiting, tapping, and leaving.
How to fix this
Fix the 6.2-second LCP immediately, then lock down security: enable CSP, hide WordPress version, and block user enumeration. A performance-first plugin shop shouldn't feel like a performance-last website.
By category
- Performance
- 61
- SEO
- 84
- Accessibility
- 68
- Security
- 49
- WordPress health
- 24
- Copy & clarity
- 50
Full report
Every finding, ranked, with fixes. $10.
All 23 findings with severity, evidence, why it matters and how to fix it, with WordPress-specific steps where they apply. Plus a checklist in the order to work through it.
$10, one-time, via Stripe. The private link is emailed to you.
Recovery
We can fix it for you
Tell us what you need. A person replies with a quote within one business day.
Share
Scanned Fri, 18 Sep 2026 15:30:24 GMT. Roast written by AI from the scan data. Passive scan: we only read public pages. Is this your site? Remove this roast.