Security Compliance Report: Analysis of example.com Website

Executive Summary

This report presents a comprehensive compliance analysis of the website https://example.com against international security standards including OWASP Top 10 2021, NIST Cybersecurity Framework 2.0, and Microsoft Security Baseline recommendations. The analysis is based on automated security scanning results performed on December 30, 2025, using OWASP ZAP (Zed Attack Proxy) version 2.17.0 by Checkmarx.

Key Findings:

29 security alerts identified across various criticality levels

Critical vulnerability of PII disclosure detected

Absence of basic security controls for web application protection

Website does not comply with fundamental requirements of international security standards

Table of Contents

Analysis Methodology

Scanning Parameters

Tool: OWASP ZAP 2.17.0 by Checkmarx [1]

Scan Date and Time: December 30, 2025, 19:00:53

Target Resource: https://example.com

Total Endpoints: 290

Contexts: All contexts included by default

Risk Levels: High, Medium, Low, Informational

Confidence Levels: User Confirmed, High, Medium, Low

Scan Results Statistics

Technology Stack

Identified technologies on the website:

CMS: WordPress with Block Editor

Web Server: LiteSpeed with LiteSpeed Cache

CDN: Cloudflare with Browser Insights

Programming Language: PHP

Additional Components:

• Blocksy (WordPress theme)
• Stackable (WordPress plugin)
• Gravatar (avatar service)
• Google Font API

Protocols: HTTP/3, HSTS, RSS, Priority Hints

Detailed Vulnerability Analysis

🔴 Critical Vulnerabilities (High Risk)

1. Personal Identifiable Information (PII) Disclosure

CWE-359 | WASC-13 | Confidence: High

Technical Description:

Personal user information accessible without authorization

Violation of data confidentiality principles

Direct violation of GDPR requirements

Business Impact:

Regulatory Risks: GDPR fines up to 4% of annual company revenue

Reputational Damage: Severe damage to customer trust

Legal Consequences: Potential lawsuits from affected individuals

Operational Risks: Mandatory regulator notification within 72 hours

🟡 Medium Risk Vulnerabilities

1. Missing Subresource Integrity (SRI)

CWE-345 | WASC-15 | Count: 5 instances | Confidence: High

Description: External resources loaded without integrity verification, creating supply chain attack risks.

Affected Resources:

• Google Font API
• Cloudflare CDN resources
• External JavaScript libraries

1. Missing Content Security Policy (CSP)

CWE-693 | WASC-15 | Count: 5 instances | Confidence: High

Description: Absence of content security policy makes the site vulnerable to XSS attacks and other injections.

1. Missing Clickjacking Protection

CWE-1021 | WASC-15 | Count: 5 instances | Confidence: Medium

Description: Absence of X-Frame-Options or CSP frame-ancestors headers allows iframe embedding for clickjacking attacks.

🔵 Low Risk Vulnerabilities

1. Transport Security Issues

Strict-Transport-Security Header Not Set (CWE-319, 1 instance)

Strict Transport Security Disabled (CWE-319, 5 instances)

1. Missing X-Content-Type-Options

CWE-693 | WASC-15 | Confidence: Medium

Description: Missing protection against MIME-sniffing attacks.

1. Unix Timestamp Disclosure

CWE-497 | WASC-13 | Count: 4 instances | Confidence: Low

Description: Timestamp disclosure detected, potentially revealing content creation timing information.

ℹ️ Informational Alerts

21 informational alerts identified, including:

• Technology detection (WordPress, PHP, Cloudflare, etc.)
• Caching issues (5 instances)
• Charset mismatch
• Suspicious comments in code (58 instances)

OWASP Top 10 2021 Compliance Analysis

A01:2021 – Broken Access Control

Status: ❌ CRITICAL NON-COMPLIANCE

Identified Issues:

PII Disclosure - direct violation of access control principles

Absence of sensitive information protection mechanisms

Violation of "deny by default" principle

OWASP Recommendations:

• Implement strict access controls
• Log access failures
• Rate limit API requests
• Regular access rights auditing

A03:2021 – Injection

Status: ✅ COMPLIANT (based on scan results)

Result: No SQL, NoSQL, or OS command injection vulnerabilities detected.

A05:2021 – Security Misconfiguration

Status: ❌ CRITICAL NON-COMPLIANCE

Identified Issues:

• Missing CSP (5 instances)
• Missing clickjacking protection (5 instances)
• Improper security header configuration
• Missing X-Content-Type-Options
• HSTS configuration issues

A06:2021 – Vulnerable and Outdated Components

Status: ⚠️ REQUIRES VERIFICATION

Identified Components:

• WordPress (version not determined)
• PHP (version not determined)
• LiteSpeed web server

Multiple plugins: Blocksy, Stackable, LiteSpeed Cache

Recommendations: Detailed version audit of all components required.

A08:2021 – Software and Data Integrity Failures

Status: ❌ NON-COMPLIANT

Issues:

Missing Subresource Integrity for external resources (5 instances)

Risk of compromise through CDN and external libraries

Absence of update integrity verification

A09:2021 – Security Logging and Monitoring Failures

Status: ❌ NON-COMPLIANT

Issues:

• No information about logging systems
• Unknown security monitoring status
• Absence of anomaly detection systems

NIST Cybersecurity Framework 2.0 Compliance

GOVERN (Governance) - 20% Compliance

GV.OC-01: Organizational Cybersecurity

• ❌ No evidence of formalized security policy

GV.RM-01: Risk Management

• ❌ No cybersecurity risk management procedures implemented

GV.SC-01: Supply Chain Management

• ❌ No external resource integrity controls

IDENTIFY (Identification) - 60% Compliance

ID.AM-02: Software Asset Inventory

• ✅ Partially completed - main components identified

ID.RA-01: Vulnerability Assessment

• ✅ Completed - security scanning performed

ID.RA-02: Threat Analysis

• ❌ No systematic threat analysis

PROTECT (Protection) - 15% Compliance

PR.AC-01: Identity and Authentication Management

• ❌ Insufficient data for assessment

PR.DS-01: Data at Rest Protection

• ❌ PII disclosure detected

PR.DS-02: Data in Transit Protection

PR.PT-01: Audit/Logging

• ❌ Insufficient information about audit systems

DETECT (Detection) - 0% Compliance

DE.CM-01: Network Monitoring

• ❌ No evidence of monitoring

DE.AE-01: Anomaly Detection

• ❌ No anomaly detection systems

RESPOND (Response) - 0% Compliance

RS.RP-01: Response Planning

• ❌ No evidence of response plan

RS.CO-01: Communications

• ❌ No incident notification procedures

RECOVER (Recovery) - 0% Compliance

RC.RP-01: Recovery Planning

• ❌ No evidence of recovery plan

RC.CO-01: Recovery Communications

• ❌ No recovery communication procedures

Microsoft Security Baseline Compliance

Transport Security

• ❌ CRITICAL DEFICIENCIES:

Strict-Transport-Security header not set (1 instance)

Strict transport security disabled (5 instances)

No mandatory HTTPS enforcement for all resources

Content Protection

• ❌ CRITICAL DEFICIENCIES:

• X-Content-Type-Options header missing
• Content Security Policy missing (5 instances)
• No MIME-sniffing attack protection
• Missing clickjacking protection

Resource Integrity

• ❌ MEDIUM RISK:

Missing Subresource Integrity attribute for external resources (5 instances)

Risk of external library compromise from Google Font API, Cloudflare, and other CDNs

• No resource loading integrity verification
• Data Management

• ❌ CRITICAL RISK:

• Personal data disclosure detected
• No data classification
• No access control for sensitive information

Vulnerability Remediation Plan

Phase 1: Critical Fixes (0-7 days)

• Day 1: Immediate identification and blocking of PII disclosure sources
• Day 2: Implement masking/encryption of sensitive data
• Day 3: Deploy strict access controls for personal data
• Day 3: Notify regulators per GDPR requirements (72 hours)

🔧 PRIORITY 2: Basic Security Headers (4-7 days)

• Day 4-5: Implement Content Security Policy

Content-Security-Policy: default-src 'self'; 

script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com;

style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;

img-src 'self' data: https: https://secure.gravatar.com;

• frame-ancestors 'none';
• base-uri 'self';

• Day 6: Configure clickjacking protection

X-Frame-Options: DENY

• Day 6: Configure HSTS

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• Day 7: Testing and validation of changes

Phase 2: Medium Priority Fixes (8-30 days)

Week 2: Subresource Integrity

• Implement SRI for all external resources

<link href="https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;700&display=swap" 
      rel="stylesheet" 
      integrity="sha384-hash" 
      crossorigin="anonymous">
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js" 
        integrity="sha384-vtXRMe3mGCbOeY7l30aIg8H9p3GdeSe4IFlP6G8JMa7o7lXvnz3GFKzPxzJdPfGK" 
        crossorigin="anonymous"></script>

Week 3: Additional Security Headers

• Implement X-Content-Type-Options

X-Content-Type-Options: nosniff

• Configure additional headers

X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()

Week 4: Component Audit

• Verify WordPress, PHP, and all plugin versions
• Update outdated components
• Remove unused plugins and themes
• Configure automatic security updates

Phase 3: Long-term Improvements (31-90 days)

Month 2: Monitoring and Logging

• Implement security monitoring system (SIEM)
• Configure centralized logging
• Create security dashboards
• Set up suspicious activity alerts

Month 3: Procedures and Policies

• Develop information security policy
• Create incident response procedures
• Develop post-incident recovery plan
• Train staff on cybersecurity fundamentals
• Regular penetration testing

Conclusion

The security analysis of website https://example.com revealed critical deficiencies in information protection. The site does not comply with fundamental requirements of international security standards OWASP Top 10 2021, NIST CSF 2.0, and Microsoft Security Baseline.

Current Risk Level: 🔴 CRITICAL

Primary Threat: Personal user data disclosure

Regulatory Risks: High GDPR fines (up to 4% of annual revenue)

Reputational Risks: Severe customer trust loss

Operational Risks: Potential business suspension

Standards Compliance:

• Standard
• Compliance Level
• Critical Issues

OWASP Top 10 2021

• 20%
• A01, A05, A08, A09
• NIST CSF 2.0
• 19%
• All functions except partial identification

Microsoft Security Baseline

• 15%
• Transport, content, data

Key Recommendations:

Immediate remediation of personal data disclosure (0-3 days)

Implementation of basic protection mechanisms for web application (4-7 days)

Regular updates of all system components

Establishment of procedures for monitoring and incident response

Staff training on information security fundamentals

Improvement Forecast:

After Phase 1: Risk reduction to 🟡 MEDIUM (critical vulnerability elimination)

After Phase 2: Risk reduction to 🔵 LOW (basic protection)

After Phase 3: Achievement of 🟢 ACCEPTABLE security level (standards compliance)

Next Steps: It is recommended to immediately begin implementation of Phase 1 of the vulnerability remediation plan, with special attention to eliminating personal data disclosure and notifying regulators in accordance with GDPR requirements.

References

[1] OWASP Foundation. (2024). OWASP Zed Attack Proxy (ZAP). https://zaproxy.org
[2] OWASP Foundation. (2021). OWASP Top 10:2021. https://owasp.org/Top10/2021/
[3] NIST. (2024). The NIST Cybersecurity Framework (CSF) 2.0. https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20