old-clinic.example

Polyclinique Saint-Élie, Achrafieh · Sunday 1 November 2026, 11:05 Beirut time

Grade F: Urgent care needed

Three serious problems need attention this week. Anyone can download the file that holds your site’s passwords, WordPress is three years out of date, and the admin login is open to the whole internet. For a clinic, a break-in could expose patients’ appointment requests. All three can be fixed in a day, without a new website.

Fix this with Codatale Run a deeper scan

3 to fix now
2 to fix soon
1 worth doing
Fix the urgent ones to reach a C.

What we found

Most important first

Fix nowExposed files· SecurityFix time: 1 hour

Your site’s passwords file is public

Your site keeps its secret settings in a file called .env, and anyone can download it. It holds the password to the database where appointment requests are stored, and the password to your email account. With it, someone can read or delete patient messages without ever logging in.

Fix nowWordPress and plugin versions· SecurityFix time: 2 to 3 hours

Your WordPress is more than three years out of date

Version 6.1.1 came out in November 2022. Dozens of security fixes have been released since, and the problems they fix are public, so automated tools try them on every site that still runs old versions.

Fix nowOpen admin pages· SecurityFix time: 1 hour

Anyone can try to log in to your admin page

The admin login answers anyone, from anywhere, and an older feature called XML-RPC is still on, which lets someone try hundreds of passwords in a single request. Combined with the outdated WordPress, this is how most clinic and small-business sites get taken over.

Fix soonHTTPS certificate· SecurityFix time: 20 minutes

Your security certificate expires in 6 days

On 7 November, browsers will show patients a full-page warning that your site is not safe, and most will leave. It looks like automatic renewal is not set up.

Fix soonSecurity headers· SecurityFix time: 30 minutes

Your site doesn’t ask browsers to protect visitors

None of the five standard browser protections are switched on, so your pages can be framed by fake sites and loaded without encryption.

Worth doingCookie security· SecurityFix time: Included above

Two cookies can travel without encryption

The appointment form’s cookies are missing the flag that keeps them on encrypted connections.