Target sandra-appeldoorn.nl
39 out of 100
- Blast radius
- /100
- Grade
- C
Overgangscoach site needs urgent performance and security work before launch.
Damage assessment
- 01
LCP 11.7 seconds. Visitors will have completed their own life transition by the time content loads.
How to fix this - 02
Total blocking time 217 ms. The browser is too busy to respond to input; interactivity arrives fashionably late.
How to fix this - 03
/xmlrpc.php is enabled. The back door is open, painted red, and labelled.
How to fix this - 04
WordPress 7.1.1 advertised in page source. Attackers now have a shopping list of known vulnerabilities.
How to fix this - 05
Content Security Policy header missing. No filter between the site and injected malicious scripts.
How to fix this - 06
No X-Frame-Options or frame-ancestors header. The site can be embedded in a clickjacking overlay undetected.
How to fix this - 07
REST API /wp/v2/users route exposes usernames. Attackers have half the credentials they need.
How to fix this
Fix the LCP latency first: 11.7 seconds is disqualifying for any coaching site. In parallel, disable xmlrpc.php and add security headers (CSP, HSTS, X-Frame-Options). These are the blast crater and the one that stops it widening.
By category
- Performance
- 50
- SEO
- 100
- Accessibility
- 89
- Security
- 49
- WordPress health
- 0
- Copy & clarity
- 100
Full report
Every finding, ranked, with fixes. $10.
All 21 findings with severity, evidence, why it matters and how to fix it, with WordPress-specific steps where they apply. Plus a checklist in the order to work through it.
$10, one-time, via Stripe. The private link is emailed to you.
Recovery
We can fix it for you
Tell us what you need. A person replies with a quote within one business day.
Share
Scanned Wed, 23 Sep 2026 13:19:42 GMT. Roast written by AI from the scan data. Passive scan: we only read public pages. Is this your site? Remove this roast.