Every week we review the websites of Spanish SMEs. We are not after headlines: we look for what an attacker would find in the first ten minutes, with no exotic tools and without touching anything that is not already exposed to the public. And we almost always find the same five flaws.
The good news: none of them needs a big budget to fix. The bad news: while they stay open, they are the door through which email spoofing, website hijacking and data protection fines walk in. Here are the five, with how to check whether you have them and how to close them.
1. Your domain does not protect email (SPF, DKIM and DMARC)
This is by far the most common flaw and the most dangerous one for an SME. If your domain does not have SPF, DKIM and DMARC properly configured, anyone can send emails that appear to come from @yourcompany.com. It is the source of 80% of CEO fraud and of the fake invoices that end up as real transfers.
How to check it
Look up the TXT records of your domain. If there is no v=DMARC1; p=reject policy (or at least p=quarantine) at _dmarc.yourdomain.com, you are unprotected.
How to close it
Publish an SPF record listing your mail servers, enable DKIM signing at your provider and roll out DMARC starting in monitor mode (p=none) until you reach p=reject. Cost: zero euros, a few hours of a technician's time.
2. The website sends no security headers
When your browser loads a website, the server can send instructions to protect you: force HTTPS, prevent the site from being embedded in someone else's iframe (clickjacking), or limit where scripts are loaded from. Most SME websites send none of them.
How to check it
Look at your website's response headers. If you do not see Strict-Transport-Security, Content-Security-Policy or X-Frame-Options, they are all in the red.
How to close it
They are added in the server or CDN configuration in minutes. HSTS and X-Frame-Options are immediate; the CSP takes a bit more care so as not to break the site, but the security payoff is huge.
3. The CMS and plugins are out of date
43% of the world's websites run on WordPress, and most hacks do not exploit WordPress itself: they exploit an un-updated plugin. A public vulnerability from six months ago is still a vulnerability today if nobody has clicked Update.
How to check it
Compare the versions of your CMS and plugins against the latest releases. Any component with a known CVE is an invitation.
How to close it
Update everything, remove the plugins you do not use (each one is attack surface) and enable automatic updates for security patches. If you have plugins abandoned by their author, replace them.
4. Files and panels that should not be public
It is surprising what gets left accessible by oversight: .git folders that expose your entire source code, .env files with database passwords, .zip or .sql backups in the web root, admin panels with no IP restriction. An attacker does not need to break in: they download it directly.
How to check it
Try to access yourdomain.com/.git/config, yourdomain.com/.env and your backup paths. If they download anything, you have a serious problem.
How to close it
Block those directories on the server, move backups out of the web root, restrict the admin panel by IP or with two-factor authentication, and never upload the .env to the production server.
5. HTTPS done badly (or half-done)
Having a padlock is not enough. We see sites serving mixed content (HTTP inside HTTPS), that do not redirect HTTP to HTTPS, or that still accept old, insecure versions of TLS. The result: browser warnings that scare off customers and interceptable connections.
How to check it
Go in via http:// and check that it automatically redirects you to https://. Verify that the certificate is valid and that no resources are still loading over HTTP.
How to close it
Force the 301 redirect to HTTPS, disable TLS 1.0/1.1, renew the certificate (Let's Encrypt is free and automatic) and fix the mixed content.
The underlying pattern
None of these five flaws is the fault of a bad provider or a careless team. They are the result of nobody having the explicit job of looking after security. Your developer makes the website work; your marketing agency makes it sell. Security falls into no man's land until someone exploits it.
The initial audit is quick and the five fixes fit into a week of work. Closing them is not the expensive part: the expensive part is the incident that arrives when you do not.
At Blurtek we audit SME websites and close these flaws before they become a problem. If you want to know how yours stands, we will give you a free 20-minute review and tell you exactly what you have left open. Write to us at admin@blurtek.com or call us at +34 604 84 48 03.
Solicitar diagnóstico