Outside-in security snapshot
Street Digital Group · South Florida small-business checkup
Overall grade: C — fixable gaps
Public records show email spoofing protections are incomplete, the TLS certificate expires soon, and basic browser security headers are missing. None of this means you were “hacked.” It means a stranger can already see openings worth closing.
No DMARC policy published
What we saw: DNS has SPF, but no _dmarc.coralbay-dental.example TXT record.
What this means: Other mail systems don’t get a clear rule for fake messages that pretend to be your office. Scammers can more easily send “from your front desk” about invoices or appointment changes.
How to fix: Add a DMARC record starting with monitoring mode, e.g. v=DMARC1; p=none; rua=mailto:HelpMe@streetdigitalgroup.com; then move to p=quarantine / p=reject once legitimate mail sources are confirmed. Your domain host or Microsoft 365 / Google Workspace admin panel usually has a guided setup.
TLS certificate expires in 18 days
What we saw: HTTPS works today; certificate notAfter ≈ Nov 20, 2026.
What this means: After expiry, browsers show scary warnings. Patients may bounce, and some email or partner portals that check your site can fail.
How to fix: Renew now (Let’s Encrypt auto-renew if you use it, or renew in your hoster’s SSL panel). Turn on auto-renewal and calendar a reminder 30 days out.
HTTP does not redirect to HTTPS
What we saw: http://coralbay-dental.example returned 200 on plain HTTP instead of a 301 to HTTPS.
What this means: Someone typing the site without “https” can land on an unencrypted page. Search engines and browsers prefer a single secure URL.
How to fix: In your host (or Cloudflare), enable “Always Use HTTPS” / force HTTPS redirect so every HTTP request becomes HTTPS.
Missing common security headers
What we saw: No Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, or Referrer-Policy on the homepage response.
What this means: Browsers don’t get extra instructions that block some common web tricks. Headers alone don’t stop every attack, but they’re a low-cost hardening step — and the same ones Street Digital Group documents for its own site.
How to fix: Add headers at the CDN/host layer (see project _headers for a Cloudflare Pages example). Start with X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, HSTS once HTTPS is solid, then a careful CSP.
Public generator meta shows WordPress 5.8
What we saw: HTML includes <meta name="generator" content="WordPress 5.8"> (illustrative).
What this means: Advertising an old major version helps attackers pick known exploits. It may be outdated meta even if you upgraded — either way, don’t publish the version string.
How to fix: Update WordPress/core/plugins/themes, remove or hide generator tags, and keep auto-updates on for minor releases.
Domain expiry ~ 4 months out
What we saw: Public registration data (sample) shows expiry around March 2027.
What this means: Not urgent, but domain loss is painful for email and patient booking links.
How to fix: Enable auto-renew and confirm the registrar account recovery email still works.
Recommended next step
Fix DMARC + HTTPS redirect + certificate renewal first (highest patient-facing risk). Then add security headers and clean up CMS version disclosure. For a paid Street Digital Group checkup, we can walk through each change with you, include a domain-verified Have I Been Pwned review of exposed staff addresses, and optionally set monthly monitoring (starting at $50/mo). Deeper testing only with written permission.