How to fix

Short, exact instructions for the problems a PageCheck report finds. Each one says what is wrong and how to fix it, with a prompt for a developer's AI assistant and an e-mail for your IT support.

Security

• Your Supabase database can be read by anyone Your site's Supabase database can be read with the public key in the page, because Row Level Security is off.
• Anyone can run your site's scheduled tasks through wp-cron.php Anyone can make WordPress run its scheduled tasks by opening wp-cron.php. Run it from the server instead and close it to the outside.
• WordPress REST API publicly lists the plugins it runs The REST API's index at /wp-json/ names every plugin on the site to anyone who reads it. Hide it and the parts your pages do not call from visitors who are not logged in.
• Visitors pass through several redirects before the page Your site's root addresses (with and without www, http:// and https://) should each reach the page in one permanent redirect, never through plain http://. Set one 301 from every other address straight to the final address.
• WordPress core files generate errors when opened directly WordPress core files generate PHP errors when opened directly: bots can use them to bloat the server's error logs, and with error display on they reveal the server's folders. Close those files to the outside.

E-mail delivery

• Your DMARC policy is "none": anyone can send e-mail in your name The domain's DMARC record only collects reports, so mail forged in its name is still delivered.
• Encryption of mail sent to you can be quietly switched off The domain has no MTA-STS policy, so an attacker between two mail servers can quietly switch off the encryption of mail sent to it. Publish a policy file and two DNS records.
• Your MTA-STS policy for encrypted mail does not work The domain announces an MTA-STS policy that senders cannot use. Depending on the fault, mail loses the protection or is refused. Find the cause and fix it.