demo.example-agency.com

Block access to the .git directory immediately. Rotate all credentials found in the repository history.

1. Block access to .git in your web server configuration immediately.
2. Audit the full Git history for secrets: database passwords, API keys, .env files. Rotate every credential found.
3. Ensure your deployment process does not copy the .git directory to production servers.

location ~ /\.git {
  deny all;
  return 404;
}

Restrict access to port 3306 using firewall rules. This service should not be directly exposed to the internet.

1. Add a firewall rule to block external access to port 3306.
2. If remote database access is needed, restrict to specific IP addresses or use SSH tunnelling / VPN.
3. Audit MySQL user accounts and remove any accounts with wildcard host (%) access.

sudo ufw deny 3306/tcp

Review all discovered subdomains. Remove DNS records for decommissioned services. Ensure non-production environments are access-restricted.

1. Audit each subdomain — is it still needed? Remove DNS records for defunct services.
2. Restrict access to development/staging environments using IP allowlists or VPN.
3. Ensure non-production environments do not contain real customer data.

Update WordPress to the latest version (6.x), update all plugins and themes, and disable XML-RPC if not needed.

1. Update WordPress core, all plugins, and all themes to the latest versions.
   Copy

   wp core update && wp plugin update --all && wp theme update --all

2. Disable XML-RPC if not needed for remote publishing or Jetpack.
3. Enable automatic security updates for WordPress core and plugins.

# Block XML-RPC
location = /xmlrpc.php {
  deny all;
  return 404;
}

Add a Content-Security-Policy header to all responses. Start with a restrictive policy and relax as needed.

1. Add the following header to your web server configuration. This is a strict starting policy — adjust the directives if your application requires external resources.
2. Test the policy using Content-Security-Policy-Report-Only first to identify any blocked resources before enforcing.
3. Monitor CSP violation reports to catch any issues in production.

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';" always;

Ensure your TLS certificate auto-renewal is configured and working. Test with a dry-run.

1. Check your certificate auto-renewal configuration.
   Copy

   sudo certbot renew --dry-run

2. If using Let's Encrypt, ensure the certbot timer/cron is active.
   Copy

   sudo systemctl status certbot.timer

Remove or obscure the server version from HTTP response headers.

1. Disable server version disclosure in your web server configuration.
   Copy

   server_tokens off;

server_tokens off;

Add SameSite=Lax (or Strict) to all cookies.

1. Update your application's cookie configuration to include the SameSite attribute. Use 'Lax' for general cookies and 'Strict' for sensitive session cookies.

app.use(session({
  cookie: {
    secure: true,
    httpOnly: true,
    sameSite: 'lax', // or 'strict'
  }
}));

Add a DMARC DNS TXT record. Start with a monitoring policy (p=none) and progress to enforcement (p=quarantine or p=reject) once you have confirmed legitimate email sources.

1. Add the following DNS TXT record to your domain. Replace the email address with your own.
   Copy

   _dmarc.demo.example-agency.com  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc(at)demo.example-agency.com; pct=100"

2. Wait 24–48 hours for DNS propagation, then verify using a DMARC checker.

Enforce tenant ownership checks at the API layer before fetching invoice records.

1. Validate that `invoice.org_id` matches the caller's `org_id` from the authenticated session.
2. Return 404 for non-owned resources to reduce enumeration signal.
3. Add automated authorisation tests for cross-tenant object access.

if (invoice.orgId !== session.orgId) {
  throw new NotFoundError("Invoice not found")
}

No immediate action required. Keep managed WAF rules enabled and review anomaly logs weekly.

No immediate action required. Keep retention and integrity controls under periodic review.