Sample
Site audit
Kopų svečių namai · kopu-namai.example
Measured on 12 October 2026.
The site works and looks tidy, but it is slow on a phone, some pages lack a description for search, and one of its doors, the administration login, is open to anyone. Below is what I found, why it matters and what I will do.
In short
- The home page weighs 1.9 MB: photos are sent at the size the camera took them, so on a phone it takes several seconds to load.
- 35 of 150 pages have no description for search, and in a month about 1,800 old addresses are still visited and hit an error.
- The login to the control panel can be reached from anywhere. That is the first thing to fix.
Urgent What to do today
Change the administrator password to a new, long one used nowhere else, and remove users you no longer recognise.
The numbers
| What was measured | Now | Target |
|---|---|---|
| Home page weight | 1.9 MB | up to 0.6 MB |
| Oversized photos | 23 of 27 | 0 |
| Pages without a description | 35 of 150 | 0 |
| Old addresses that hit an error (30 d.) | ≈ 1,800 | almost none |
| Security headers | 0 of 5 | 5 of 5 |
| Plugins | 9, two paid | only those needed |
Speed and page weight
Important
The home page weighs 1.9 MB
- Why it matters
- Photos are sent at the size the camera took them. On a phone the page takes several seconds to load, and many people do not wait that long.
- The fix
- I will shrink the photos to the size they are shown at and serve them in a modern format. The target is up to 0.6 MB.
Technical information
GET / 1,912 KB IMG_4821.jpg 612 KB 4000x3000, shown at 600x450 IMG_4833.jpg 548 KB 4000x3000, shown at 600x450 fonts 3 families, 214 KB
Phones and tablets
Important
No phone number in the menu on a phone
- Why it matters
- A guest who wants to call from a phone has to hunt for the number at the bottom of the page. Whoever cannot find it may book elsewhere.
- The fix
- The number will sit at the top of the menu and call straight away when tapped.
Technical information
viewport 390x844: <header> has 4 links, no tel: links /kontaktai/: the tel: link is only at the bottom, 2,360 px down
Medium
Pinch-zoom is disabled on phones
- Why it matters
- The site forbids zooming with fingers. For anyone who sees poorly and needs to enlarge small text, that is a barrier.
- The fix
- I will allow zooming.
Technical information
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
Search (SEO)
Important
35 of 150 pages have no description
- Why it matters
- Search shows a description under the title. Without one it picks an excerpt from the page itself, often the wrong one, and fewer people click.
- The fix
- I will write a short description for each page in your words and give you the list, so you can see what I changed.
Technical information
<meta name="description"> missing: 35 pages /kambariai/dvivietis/ /naujienos/2019-vasara/ /kontaktai/kaip-atvykti/
Old addresses and links
Important
About 1,800 old addresses lead to an error
- Why it matters
- Addresses from the previous site are still requested from search and other sites. Whoever arrives that way sees an error and leaves.
- The fix
- I will point every old address to its matching new page, so nobody gets lost and your place in search is not lost.
Technical information
404 log, 30 d.: 1,804 different addresses, 6,391 requests /?page_id=212 412 /apartamentai.html 377 /galerija/foto-7 191
Medium
An address that does not exist shows the home page
- Why it matters
- An address that does not exist should say “page not found”. When it shows the home page instead, search may treat it as hundreds of copies of the same page.
- The fix
- I will make such an address show a real “not found” page with a link to the home page.
Technical information
GET /nera-tokio-puslapio/ 200 (should be 404) GET /asdf 200
Readability and accessibility
Minor
A few empty headings
- Why it matters
- A screen reader reads them as empty sections, and search finds the page’s structure harder to follow.
- The fix
- I will remove the empty ones and put the headings in order.
Technical information
<h2></h2> on 7 pages <h4> with no <h3> before on 3 pages
Security
Urgent
The control panel login can be reached from anywhere
- Why it matters
- Anyone who knows the address /wp-login.php can guess passwords. The log already shows over four thousand such attempts a month.
- The fix
- I will change the administrator password with you and switch off the unused XML-RPC. On the new site the login is protected by attempt limits.
Technical information
GET /wp-login.php 200 POST /wp-login.php 4,212 times in 30 d., 89 different addresses XML-RPC (/xmlrpc.php) enabled
Important
The login cookie is unprotected
- Why it matters
- The cookie that tells the site you are signed in lacks the Secure and SameSite flags, because the site’s address in its settings still starts with http://. Such a cookie can travel over an unencrypted connection, and whoever intercepted it could act as you.
- The fix
- On the new site the cookies carry all three flags: Secure, HttpOnly and SameSite.
Technical information
Set-Cookie: wordpress_logged_in_…=…; path=/; HttpOnly missing: Secure; SameSite
Medium
No security headers
- Why it matters
- These are invisible instructions from the server to the browser, such as not letting your site be embedded in someone else’s. Without them the site is easier to turn against its visitors.
- The fix
- I will switch on the basic headers in the new server’s settings.
Technical information
Strict-Transport-Security none Content-Security-Policy none X-Content-Type-Options none Referrer-Policy none X-Frame-Options none
Content
Minor
A placeholder page, “Coming soon”, is public
- Why it matters
- It can be found in search and looks like unfinished work.
- The fix
- I will hide or remove it.
Technical information
GET /netrukus/ 200, indexable title: "Kopų svečių namai – netrukus!"
Enquiries and contact
Minor
The email link opens nothing
- Why it matters
- On a computer with no mail program, clicking the address does nothing, and the person never writes.
- The fix
- Next to the link I will show the address itself, which can be copied, and an enquiry form.
Technical information
<a href="mailto:info@kopu-namai.example">Write to us</a> the form is only on the home page
Statistics and cookies
Medium
The site loads statistics that were shut down long ago
- Why it matters
- The site still calls “Universal Analytics”, which Google switched off in 2023. It slows the page and counts nothing.
- The fix
- I will remove the old code. If you want statistics, I will suggest ones that need no cookies.
Technical information
www.google-analytics.com/analytics.js UA-12345678-1 (account closed)
Running the site
Minor
Nine plugins, two of them paid
- Why it matters
- Each one needs updating, and paid licences expire. Old plugins are the most common way in for an attacker.
- The fix
- The new site will have none, so there is nothing to update. You can let the paid licences lapse.
Technical information
Active: 9 (paid: booking form, gallery) Updates waiting: 5 Last updated: 14 months ago
What works well
Good
The domain and certificate are valid
- Why it matters
- The address works over a secure connection and will not expire soon.
Technical information
domain valid until 2027-03-14 certificate valid until 2027-01-09
Good
No signs of tampering
- Why it matters
- I found no foreign code or hidden links in the files and pages.
Technical information
Checked: 150 pages, 412 files
