Top 10 Security Issues Found in Website Audits in 2026

By Tibzi Team — 2026-03-03T14:47:19.126Z

We analyzed hundreds of Romanian websites with Tibzi's 27 audit modules and identified recurring security problems that we come across again and again. This article covers the 10 most common vulnerabilities, why they're dangerous and how you can fix them.

If you own a Romanian website — whether it's an online store, a corporate site, a blog or a portfolio — chances are you have at least 3-4 of these problems. The good news: they can all be fixed.

1. Missing or incomplete security headers

Frequency: ~85% of the websites audited

This is by far the most common problem. Most Romanian sites haven't configured any security headers at all, or have only set them up partially.

What's most often missing:

  • Content-Security-Policy (CSP) — missing on ~95% of sites. It's the most powerful protection mechanism against XSS, but also the most complex to configure.
  • Strict-Transport-Security (HSTS) — missing on ~70% of sites. Without it, an attacker can force an insecure HTTP connection (a downgrade attack).
  • Permissions-Policy — missing on ~90% of sites. It lets you control access to browser APIs (camera, microphone, geolocation).

The fix:

Add the headers to your server configuration. For Apache (.htaccess):

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

For Nginx, add this to the server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Check your configuration with our security check tool.

2. SPF, DKIM and DMARC not configured

Frequency: ~75% have an incomplete setup

Most sites have SPF (thanks to cPanel's automatic configuration), but DKIM and DMARC are often missing. Without DMARC, there's no policy telling recipients' servers what to do with unauthenticated emails.

Consequences:

  • Business emails end up in spam
  • Attackers can send fake emails from your domain (phishing)
  • Poor deliverability for newsletters and order confirmations

The fix:

Add at least these 3 TXT DNS records:

# SPF (example for Google Workspace)
v=spf1 include:_spf.google.com ~all

# DMARC (start with monitoring)
_dmarc.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

# DKIM — enable it from your email provider's control panel

Check your configuration with our email check tool.

3. Information leaks in HTTP headers

Frequency: ~70% of websites

The Server and X-Powered-By headers expose the exact software version: "Apache/2.4.57", "PHP/8.1.28", "nginx/1.24.0". An attacker uses this information to look up vulnerabilities specific to that version.

The fix:

In .htaccess (Apache): ServerSignature Off and Header unset X-Powered-By

In php.ini: expose_php = Off

In Nginx: server_tokens off;

4. Suboptimal SSL certificate configuration

Frequency: ~40% have a suboptimal setup

Most sites have SSL enabled (thanks to Let's Encrypt), but the configuration isn't optimal:

  • TLS 1.0/1.1 still enabled — deprecated protocols, vulnerable to POODLE and BEAST attacks
  • Weak ciphers allowed — RC4, 3DES, export-grade ciphers
  • No forward secrecy — past sessions can be decrypted if the private key is compromised
  • HSTS not enabled — allows a downgrade from HTTPS to HTTP

The fix:

Disable TLS 1.0 and 1.1, and allow only modern ciphers. In LiteSpeed/Apache:

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder on
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM

Run a detailed check with our SSL check tool.

5. No WAF (Web Application Firewall)

Frequency: ~60% have no WAF

Without a WAF, your server takes all the traffic head-on — including SQL injection attempts, XSS, brute-force attacks on the admin area, and the automated vulnerability scans that run constantly across the internet.

The fix:

The simplest free option: Cloudflare. Setting it up takes 15 minutes and gives you a WAF, a CDN, DDoS protection, extra SSL and caching. The free plan is enough for most sites.

6. Missing or broken cookie consent

Frequency: ~55% have problems

Many sites either have no cookie banner at all, have one that doesn't offer a way to refuse (only "Accept"), or load tracking cookies before consent has been given.

Legal requirements:

  • A banner with options to accept, refuse and customize
  • Non-essential cookies must be blocked until consent is given
  • Consent must be withdrawable at any time

Check your compliance with our GDPR check tool.

7. Incomplete or missing company details

Frequency: ~45% don't display all the mandatory details

Legea 365/2002 (Law 365/2002, the Romanian e-commerce law) requires websites to display: the company name, tax ID (CUI), trade register number, registered office address and contact details. Penalties: fines from 5,000 to 100,000 RON.

8. Database ports open to the public

Frequency: ~15% (but critical when it happens)

We've found servers with port 3306 (MySQL) or 5432 (PostgreSQL) open to the internet. This is a critical vulnerability — an attacker can try to brute-force the database credentials and gain full access to all the data.

The fix:

Configure your firewall (iptables/firewalld) to allow access to database ports only from localhost or from specific IP addresses.

9. Incomplete HTTP → HTTPS redirect

Frequency: ~30% have incomplete redirects

The site can still be reached over HTTP (no padlock), which opens the door to traffic interception, cookie theft and confusion for Google (both versions get indexed = duplicate content).

The fix:

# .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

10. Outdated plugins and CMS

Frequency: ~50% of WordPress sites

WordPress with outdated plugins is the most common source of compromised sites. A single vulnerable plugin can give an attacker full access to the site.

The fix:

  • Turn on automatic updates for WordPress core and plugins
  • Uninstall plugins you don't use (don't just deactivate them — uninstall them)
  • Use a WAF (Cloudflare, Wordfence, Sucuri) as an extra layer

How to quickly check for all of these problems

You don't have to check each point by hand. The full Tibzi audit automatically checks 27 modules — including all 10 problems above — and generates a PDF report with the issues found and concrete recommendations for fixing them. Your first audit is free.

Alternatively, if you only want to check one specific category, use our dedicated tools:

  • Security Check — SSL, headers, ports, WAF, blacklist
  • SSL Check — certificate, TLS, forward secrecy, ciphers
  • Email Check — SPF, DKIM, DMARC, MTA-STS
  • GDPR Check — cookies, company details, ANPC (Romania's consumer protection authority), accessibility
  • Performance Test — Core Web Vitals, TTFB, compression