{
  "title": "20 findings from ResaHost’s retained website audit reports",
  "source": "https://audit.resahost.net/",
  "collected_at": "2026-09-10T10:24:59.460284+00:00",
  "saved_reports": 209,
  "distinct_domains": 165,
  "diagnostics_domains": 128,
  "unit": "domain; the number of separate businesses was not verified",
  "method": "Latest stored report per domain. Letter case, a leading www and trailing dot were normalised; other subdomains were not merged. Not a random sample. Denominators vary by observation. Threat examples are not verified breaches.",
  "facts": [
    {
      "number": 1,
      "group": "Email",
      "label": "No DMARC record found at the queried DNS name.",
      "numerator": 51,
      "denominator": 85,
      "percent": 60,
      "note": "An MX record was found and the DMARC query returned a result; module and query errors were excluded. This concerns the queried name, not the absence of every possible email defence."
    },
    {
      "number": 2,
      "group": "Email",
      "label": "DMARC policy was p=none.",
      "numerator": 22,
      "denominator": 85,
      "percent": 25.9,
      "note": "The same MX population as observation 1. The p field did not request quarantine or rejection. Message delivery was not tested."
    },
    {
      "number": 3,
      "group": "Email",
      "label": "DMARC policy requested quarantine or rejection.",
      "numerator": 12,
      "denominator": 85,
      "percent": 14.1,
      "note": "The same MX population: 11 quarantine policies and one reject policy. Receiver behaviour, any legacy pct setting and SPF/DKIM alignment were outside this calculation."
    },
    {
      "number": 4,
      "group": "Email",
      "label": "No SPF record found in the audit DNS query.",
      "numerator": 5,
      "denominator": 85,
      "percent": 5.9,
      "note": "An MX record was present and the SPF check returned a result. This is not evidence of successful email impersonation."
    },
    {
      "number": 5,
      "group": "Email",
      "label": "DKIM record found with at least one tested selector.",
      "numerator": 36,
      "denominator": 128,
      "percent": 28.1,
      "note": "A positive DNS finding from 128 reports with results. Failure to find a record does not demonstrate missing DKIM: the detector tried a limited list of selector names."
    },
    {
      "number": 6,
      "group": "HTTP headers",
      "label": "HSTS header absent from the recorded HTTP response.",
      "numerator": 84,
      "denominator": 127,
      "percent": 66.1,
      "note": "127 reports had HTTP status 200–399 and stored headers. This describes the response, not every mechanism through which a browser might enforce HTTPS."
    },
    {
      "number": 7,
      "group": "HTTP headers",
      "label": "Content-Security-Policy header absent.",
      "numerator": 102,
      "denominator": 127,
      "percent": 80.3,
      "note": "The same 127-response set. HTML CSP meta elements and other defensive measures are outside this metric."
    },
    {
      "number": 8,
      "group": "HTTP headers",
      "label": "X-Frame-Options header absent.",
      "numerator": 92,
      "denominator": 127,
      "percent": 72.4,
      "note": "The same response set. CSP frame-ancestors can provide a corresponding embedding restriction."
    },
    {
      "number": 9,
      "group": "HTTP headers",
      "label": "X-Content-Type-Options header absent.",
      "numerator": 88,
      "denominator": 127,
      "percent": 69.3,
      "note": "The same response set. This measures header presence, not whether content can be exploited."
    },
    {
      "number": 10,
      "group": "HTTP headers",
      "label": "Referrer-Policy header absent.",
      "numerator": 113,
      "denominator": 127,
      "percent": 89,
      "note": "The same response set. Browser defaults and HTML meta policies are outside this calculation."
    },
    {
      "number": 11,
      "group": "HTTP headers",
      "label": "Permissions-Policy header absent.",
      "numerator": 115,
      "denominator": 127,
      "percent": 90.6,
      "note": "The same response set. Absence does not show that the site obtained permission to use a visitor’s devices."
    },
    {
      "number": 12,
      "group": "WordPress",
      "label": "WordPress identified by the technology detector.",
      "numerator": 89,
      "denominator": 128,
      "percent": 69.5,
      "note": "128 latest reports had a technology-detector structure. Other platforms and undetected WordPress installations are possible."
    },
    {
      "number": 13,
      "group": "WordPress",
      "label": "At least one detected plugin version was older than its WordPress.org reference version.",
      "numerator": 46,
      "denominator": 73,
      "percent": 63,
      "note": "73 sites had a detected version and a WordPress.org reference for at least one plugin. Both versions needed two or three numeric components and a successful comparison. One older version was sufficient for a finding. Installed versions inferred from public files were not verified through an administrative login."
    },
    {
      "number": 14,
      "group": "WordPress",
      "label": "Public author information or a redirect to an author page found.",
      "numerator": 59,
      "denominator": 80,
      "percent": 73.8,
      "note": "80 WordPress sites had a positive result or neither checked route was left untested. This does not mean a password leak or disclosure of a login identifier."
    },
    {
      "number": 15,
      "group": "PHP",
      "label": "A numeric PHP version was identified.",
      "numerator": 25,
      "denominator": 128,
      "percent": 19.5,
      "note": "25 out of 128 diagnostic reports exposed an identifiable numeric version. Unknown and non-numeric values were not findings. The other 103 sites remain unresolved."
    },
    {
      "number": 16,
      "group": "PHP",
      "label": "Identified PHP version belonged to the PHP 5 or 7 series.",
      "numerator": 7,
      "denominator": 25,
      "percent": 28,
      "note": "Only the 25 identified versions are in the denominator: two PHP 5 and five PHP 7 findings. This is not a count of all unsupported PHP branches."
    },
    {
      "number": 17,
      "group": "Protocols",
      "label": "No IPv6 AAAA record found for the audited domain.",
      "numerator": 93,
      "denominator": 125,
      "percent": 74.4,
      "note": "125 explicit DNS results. Timeouts and unknown results were excluded. This is not an assessment of the entire organisation’s IPv6 capability."
    },
    {
      "number": 18,
      "group": "Protocols",
      "label": "HTTP/2 was not used in the test connection.",
      "numerator": 9,
      "denominator": 121,
      "percent": 7.4,
      "note": "121 explicit protocol results. This says nothing about every connection to the site or its perceived speed."
    },
    {
      "number": 19,
      "group": "Resources",
      "label": "Retrieved HTML contained references to unencrypted HTTP resources.",
      "numerator": 6,
      "denominator": 127,
      "percent": 4.7,
      "note": "127 reports had a resource-check result and HTTP status 200–399. An HTML reference does not show that the browser loaded the resource or that every resource was examined. Successful HTML retrieval could not be verified for all negative resource findings."
    },
    {
      "number": 20,
      "group": "Protocols",
      "label": "The audit TLS connection used TLS 1.3.",
      "numerator": 120,
      "denominator": 127,
      "percent": 94.5,
      "note": "127 reports had an identified TLS version; the remaining seven used TLS 1.2. TLS 1.2 is not classified as unsafe by this observation."
    }
  ],
  "derived_facts": [
    {
      "label": "No DMARC record found or p=none",
      "numerator": 73,
      "denominator": 85,
      "percent": 85.9
    },
    {
      "label": "Identified PHP branch outside PHP-project support on 10 September 2026",
      "numerator": 9,
      "denominator": 25,
      "percent": 36.0
    }
  ]
}