Common vulnerabilities on SME websites

1. Missing security headers

Without Strict-Transport-Security, browsers may fall back to HTTP. Without Content-Security-Policy or frame-ancestors, your pages can be framed for clickjacking or made more exposed to XSS. Fix: set the headers at your host or CDN (recommended values).

2. Cookies without Secure, HttpOnly or SameSite

Session cookies missing these flags are easier to steal or misuse. Fix: set Secure; HttpOnly; SameSite=Lax (or Strict) on session cookies.

3. Accidentally public files

/.git/, .env, database dumps and backup.zip files left in the web root can expose source code and credentials. Fix: block dot-files at the server and remove backups from public folders.

4. Outdated CMS, plugins and libraries

Old jQuery versions, abandoned WordPress plugins and unpatched themes are a common route in (OWASP A03:2025). Fix: keep an inventory, update monthly, and remove what you don't use.

5. Server and version disclosure

Headers such as Server: Apache/2.4.29 or X-Powered-By: PHP/7.2 help attackers target known flaws. Fix: suppress version strings.

6. Mixed content and HTTP forms

An HTTPS page that loads scripts over HTTP, or a form that posts to HTTP, undermines encryption. Fix: serve everything over HTTPS and add upgrade-insecure-requests to your CSP.

7. Weak email authentication

No DMARC, or a policy of p=none left in place for years, lets criminals spoof your domain in invoice and booking scams. Fix: see SPF, DKIM and DMARC.

8. Admin panels without MFA

/wp-admin or a hosting control panel with a password only (OWASP A07:2025). Fix: turn on MFA and limit login attempts.