Do you need wp-admin, cPanel, or SSH login credentials to fix our WordPress security or WooCommerce emails?

Never. Both our £12 Instant Drop-In Shield Pack and our $15 24-hour Fiverr async audit operate with zero wp-admin or server access. You simply drop faultypacket-wp-shield.php into /wp-content/mu-plugins/ and paste the pre-built DNS TXT and Cloudflare WAF rules.

Why are WooCommerce order confirmations and Contact Form 7 emails failing with Gmail/M365 550-5.7.26?

By default, WordPress wp_mail() invokes the local web server PHP mail binary without authenticated SMTP, causing Envelope-From (Return-Path) misalignment, missing DKIM signatures, or SPF >10 DNS lookup PermErrors. Our drop-in faultypacket-wp-mail-dkim-smtp.php MU-plugin and SPF/DMARC templates fix this in under 3 minutes without bloated dashboard plugins.

Does the Cloudflare WAF ruleset break WooCommerce PayPal Guest Card Checkout or PayPal webhooks?

No. Our Cloudflare Free-Tier WAF expressions explicitly whitelist /wc-api/, ?wc-api=, /wp-json/wc/, and PayPal Guest Card Checkout/PayPal webhook user-agents while blocking /xmlrpc.php, /wp-json/wp/v2/users enumeration, and PHP2Shell (CVE-2026-109618) query injection.

BUILT FOR WORDPRESS & WOOCOMMERCE OWNERS · NO WP-ADMIN LOGIN NEEDED

Stop WooCommerce Receipts Landing in Spam & Lock Down WordPress in 3 Minutes—Without Installing Another Bloated Plugin.

Check any WordPress or WooCommerce store free in 3 seconds. See if your site leaks admin usernames via /wp-json, leaves xmlrpc.php open to bots, or drops order emails via unauthenticated wp_mail()—and grab the drop-in fix for £12 (or a $15 24-hour Done-For-You fix on Fiverr).

✓ Zero wp-admin Login Required ✓ Live 1.1.1.1 DoH Deliverability Check ✓ Drop-In MU-Plugin (0 DB Queries) ✓ PCI-DSS v4.0.1 Req 6.4.3 Ready

FREE DIAGNOSTIC · LIVE EXTERNAL WORDPRESS, WOOCOMMERCE & EMAIL FLAW FINDER

1. Scan Any WordPress / WooCommerce Domain & Generate Custom Drop-In Fixes

Enter any WordPress or WooCommerce domain below. Your browser queries Cloudflare 1.1.1.1 DNS-over-HTTPS for live wp_mail() deliverability blockers (SPF lookup count, DMARC policy, MTA-STS, MX gateway, CAA) and maps your WordPress attack surface and custom drop-in remediation code in real time:

Choose your WordPress setup (tailors your fix code):

⚖️ Authorised Use & Point-in-Time Diagnostic Notice: Only scan domains or systems you own or have explicit authorisation to test (UK Computer Misuse Act 1990). All checks run passively in your browser via public DNS-over-HTTPS (zero server scraping). Templates & scripts are provided strictly "AS IS" as informational engineering aids—always back up files and test in staging (p=none / CSP-Report-Only) before production rollout. See ICO/GDPR Privacy Notice, Reg. 37 Digital Terms & Liability Cap (£0–£39).

PACK #4 · ZERO WP-ADMIN LOGIN REQUIRED · INSTANT 10-FILE ZIP £12 Impulse Pack · Or Included in £39 4-Pack Bundle

2. WordPress & WooCommerce Drop-In Security & Email Rescue Pack (£12)

Stop paying £149/year for bloated security plugins that slow down checkout or handing wp-admin passwords to strangers. Drop our audited 180-line Must-Use Plugins into /wp-content/mu-plugins/ and apply our webhook-safe Cloudflare WAF and DNS templates in under 3 minutes.

£12 one-off instant ZIP download · or £39 for all 4 FaultyPacket Packs (Save £45)

What's Inside the 10-File ZIP Archive 19.9 KB

mu-plugins/faultypacket-wp-shield.php — Blocks unauthenticated /wp-json/wp/v2/users enumeration (403), disables xmlrpc.php, strips ?ver= leaks, blocks ?author=N scans, and injects OWASP + PCI-DSS v4.0.1 Req 6.4.3 checkout CSP headers.
mu-plugins/faultypacket-wp-mail-dkim-smtp.php — Lightweight phpmailer_init drop-in enforcing authenticated STARTTLS, Return-Path alignment, and matching Message-ID domains to cure Gmail/M365 550-5.7.26 receipt drops.
server-configs/htaccess-apache-litespeed-wp-hardening.conf & nginx-wordpress-fastcgi-hardening.conf — Blocks /wp-content/uploads/*.php webshells, .env, wp-config.php.bak, and PHP2Shell (CVE-2026-109618).
cloudflare-waf/cloudflare-wp-woocommerce-waf-expressions.txt — 3 copy-paste Cloudflare Free WAF rules protecting /wp-login.php & /wc-api/ while whitelisting PayPal Guest Card Checkout & PayPal webhooks.
pci-dss-v4-checkout/woocommerce-pci-dss-4.0.1-script-inventory-and-csp.csv + dns-deliverability/woocommerce-spf-dmarc-mta-sts-templates.txt + verify-wp-posture.sh / .ps1.

Interactive Output Preview (Zero Placeholders) Live Sample

/* /wp-content/mu-plugins/faultypacket-wp-shield.php (Excerpt) */
add_filter( 'xmlrpc_enabled', '__return_false', 9999 );
add_filter( 'rest_endpoints', function( $endpoints ) {
    if ( is_user_logged_in() && current_user_can( 'list_users' ) ) return $endpoints;
    $block = function() {
        return new WP_Error( 'fp_rest_user_enumeration_blocked',
            'Unauthenticated REST user enumeration blocked.', array( 'status' => 403 ) );
    };
    if ( isset( $endpoints['/wp/v2/users'] ) ) {
        foreach ( $endpoints['/wp/v2/users'] as $i => $h ) {
            $endpoints['/wp/v2/users'][$i]['permission_callback'] = $block;
        }
    }
    return $endpoints;
}, 9999 );

Preview Sample WooCommerce 550-5.7.26 Deliverability & PCI-DSS v4.0.1 Audit Output

[PASS] /wp-json/wp/v2/users -> HTTP 403 (fp_rest_user_enumeration_blocked)
[PASS] /xmlrpc.php -> HTTP 403 (Cloudflare WAF Rule FP-WP-01 Active)
[PASS] WooCommerce /checkout/ CSP -> PCI-DSS v4.0.1 Req 6.4.3 PayPal Guest Card Checkout/PayPal Whitelisted
[PASS] wp_mail() Return-Path & Message-ID -> Aligned with SPF (-all, 4/10 lookups) & DMARC (p=reject)

Live Code Preview · See What's Inside

Inspect Real Production Outputs From the £12 WP & WooCommerce Shield PackZero Obfuscation · Zero DB Queries

Click any tab below to inspect the actual drop-in mu-plugins PHP code, Cloudflare/Nginx/Apache rules, PCI-DSS v4.0.1 checkout script register, and CLI verifier before spending a penny:

⚡ Buy £12 WP & WooCommerce Shield Pack — Instant Self-Serve ZIP (PayPal)

💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee

🛠️ Or Order Done-For-You Custom Fix on Fiverr (US$15 / US$30 / US$55) → ★ Best Value: Buy £39 Complete 4-Pack Compliance & Web Shield Bundle — Save £45 (PayPal)

Already Purchased or Have a Redemption Code? Unlock Instant ZIP DownloadInstant SHA-256 Verified

Enter the 17-character Transaction ID from your PayPal receipt (or the redemption code we emailed you) to unlock your archive:

💡 Want 1-Click Live HTTP Header & PHP2Shell Inspection in Chrome? Install our 100% Free Forever FaultyPacket Security, DNS & PHP2Shell Inspector (Chrome Web Store) or grab the Direct Developer .ZIP (31.5 KB).

HONEST OPTIONS · FIX IT FREE VS. £5–£39 PACKS VS. $15 FIVERR FIX

Scanner Finding → Free DIY Fix → Paid Pack or 24h Done-For-You Mapping

Every FaultyPacket diagnostic separates what was observed publicly, the free DIY remediation step you can apply yourself immediately, the matching self-serve ZIP pack (£12–£39) or 24h Fiverr Done-For-You gig ($15–$175), and the exact evidence scope & exclusions. Looking for how we handle DNS transport failures? Open the Interactive Evidence Comparison Lab → or view our Sample Audit Report →.

1. Missing DMARC / SoftFail SPF / No MTA-STSEMAIL AUTH

Why It Matters: Unauthenticated senders can spoof executive domains or downgrade SMTP TLS.

Free DIY Fix: Publish _dmarc TXT "v=DMARC1; p=quarantine; rua=..." and flatten SPF to ≤10 lookups ending in -all.

Paid Pack / 24h DFY: £24 DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack (or $25–$95 Fiverr DMARC Gig).

Scope & Exclusions: Public DNS/TXT/MX & MTA-STS records only; excludes internal Exchange/Workspace tenant admin access.

2. WordPress `wp_mail` / REST / XML-RPC ExposureWP & WOO

Why It Matters: Unauthenticated user enumeration, XML-RPC brute-force amplifiers, and WooCommerce receipts landing in spam.

Free DIY Fix: Disable xmlrpc.php, filter /wp-json/wp/v2/users, and align SMTP DKIM/SPF headers.

Paid Pack / 24h DFY: £12 WP & WooCommerce Shield Pack (faultypacket-wp-shield.php MU-plugin) or $15–$55 Fiverr 24h Fix.

Scope & Exclusions: Zero wp-admin credentials required; drop-in MU-plugin + DNS records.

3. PHP2Shell (`CVE-2026-109618` & `-109619`)RUNTIME / WAF

Why It Matters: Exposed PHP runtime banners, FastCGI/PHP-FPM env injection (CVE-2026-109618 & sibling CVE-2026-109619), and missing HSTS/CSP.

Free DIY Fix: Patch PHP runtime, set expose_php = Off, and lock FastCGI SCRIPT_FILENAME boundaries.

Paid Pack / 24h DFY: £24 DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack (Nginx/Apache/IIS/Cloudflare rules + IOC script) or $30–$110 Fiverr Gig.

Scope & Exclusions: Edge WAF/server config & passive header/IOC verification; non-intrusive (zero exploitation).

4. NIS2 Art. 21 / DORA & CE v3.3 ("Danzell") GapsGOVERNANCE

Why It Matters: Supply-chain DNS email posture blind spots and IASME Cyber Essentials v3.3 ("Danzell") assessment failures.

Free DIY Fix: Use our free browser NIS2 25-domain auditor & CE v3.3 readiness scorer with evidence-aware DoH checks.

Paid Pack / 24h DFY: £19 NIS2 Bulk Pack / £29 CE v3.3 Pack / £39 Complete 4-Pack Compliance & Web Shield Bundle (or $35–$175 Fiverr).

Scope & Exclusions: Public DNS posture score (0–100) & self-assessment templates; not an accredited certification body.

🔄 Opt-In Domain & WordPress Drift MonitoringDNS TXT VERIFIED

Want continuous checks after fixing your records? Pack and Fiverr buyers can enrol domains in our Opt-In Drift Monitor by publishing a read-only _faultypacket-verify.<domain> DNS TXT ownership token.

Zero-Spam Guarantee: Outbound drift alerts ([email protected]) are disabled by default and only fire when both explicit consent and _faultypacket-verify TXT ownership are verified and a baseline SPF/DMARC/MTA-STS/WP header drifts.

🏢 For Web Agencies & MSPs: Multi-Domain & White-Label ScorecardsMSP & AGENCY READY

Managing 10–250 client WordPress sites or Microsoft 365 domains? Our £39 Complete 4-Pack Compliance & Web Shield Bundle and Fiverr Pro Tiers include multi-domain batch auditing and White-Label Executive HTML Scorecards (--agency-name / --white-label) ready to hand directly to your clients.

Email [email protected] or order via Fiverr (@faultypacket) with your agency name and domain list.

GIG #2 SPOTLIGHT · 24H ASYNC DELIVERY (US$15 / US$30 / US$55) OR £12 INSTANT WP SHIELD PACK

Zero Calls · Zero wp-admin Login · 24h Delivery

Need Done-For-You WordPress, WooCommerce & PHP2Shell Hardening + wp_mail() Rescue in 24 Hours?

Order our 100% asynchronous WordPress, WooCommerce & PHP Web Server Hardening service on Fiverr (@faultypacket) starting at $15 with zero calls or wp-admin logins required, or download the self-service £12 WordPress & WooCommerce Drop-In Shield Pack instantly:

🟢 Hire FaultyPacket on Fiverr — WP, WooCommerce & PHP Hardening (US$15 / US$30 / US$55) → ⬇ Buy Instant WP & WooCommerce Shield Pack — £12

View All 4 Live Fiverr Gigs (@faultypacket) ↗

TWO SIMPLE WAYS TO FIX IT · £5–£39 INSTANT ZIP OR $15+ DONE-FOR-YOU ON FIVERR 100% Transparent Pricing · Zero Calls Required

⚡ Option 1: Buy on This Website via PayPal (£12–£29 Single Pack · £39 Complete 4-Pack Compliance & Web Shield Bundle)

Instant 0-Second Self-Serve Template ZIP. You immediately download our unencrypted production scripts, MU-plugins, server configs, and templates, and you fill in your own domain name using our 3-minute Quick-Start guide. Lowest flat price because no custom engineer time is required.

🛠️ Option 2: Order on Fiverr ($15–$175 · Basic / Standard / Premium Tiers)

Custom “Done-For-You” 24h Engineering. Why Fiverr costs more: our engineers run a deep external server & DNS probe on your live domain(s) and custom-write every record and config file specifically for your domain, IPs, and mail/payment stack—ready to paste with zero editing. Includes a custom 0–100 Executive HTML Scorecard written for your company, multi-domain tiers (1–5 domains or 25–250 suppliers), live post-fix verification, and all 4 Packs (£84 value) free on Premium.

Gig #1 · Domain DMARC, SPF, DKIM & MTA-STS Audit + DNS Fix Pack£24 Self-Serve ZIP · US$25 / US$35 / US$50 Fiverr

Full RFC 7489/7208/8461 external audit (SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA) + Cloudflare/BIND/M365 DNS Fix ZIP (incl. Google/Yahoo 550 5.7.26 bulk-sender compliance).

⚡ £24 Website ZIP (Self-Serve): Instant download of generic DNS templates, 10-page PDF handbook & Python CLI scanner (you plug in your domain).

🛠️ US$25 / US$35 / US$50 Fiverr (Done-For-You): We audit 1 domain ($25), 3 domains + MTA-STS ($35), or 5 domains + Live Post-Fix Re-Scan + All 4 Packs ($50) & write your exact DNS records + custom Executive HTML Scorecard.

🛠️ Order Done-For-You Custom Audit on Fiverr (US$25 / US$35 / US$50) → ⚡ Or Buy Self-Serve Template ZIP — £24 (Instant PayPal Download)

Gig #2 · WP, WooCommerce & PHP2Shell Hardening£12 WP / £24 PHP ZIP · US$15 / US$30 / US$55 Fiverr

Zero-login WordPress/WooCommerce /wp-json/wp/v2/users, xmlrpc.php, PCI-DSS v4.0.1 CSP & wp_mail() 550-5.7.26 rescue + PHP2Shell (CVE-2026-109618) FastCGI/CGI lockdown, MU-plugins & Cloudflare WAF ZIP.

⚡ £12 WP Pack (or £24 PHP Pack) on Website (Self-Serve): Instant 11-file drop-in MU-plugin, Nginx/Apache, Cloudflare WAF & SMTP rescue ZIP (you drop onto your server).

🛠️ US$15 / US$30 / US$55 Fiverr (Done-For-You): We run a live external HTTP/DNS probe on your site, pre-fill your domain’s exact configs & custom Scorecard ($15 1-Site WP/Email · $30 Full WP + PHP2Shell Lockdown · $55 3-Site + Re-Scan + All 4 Packs).

🛠️ Order Done-For-You Custom Fix on Fiverr (US$15 / US$30 / US$55) → ⚡ Or Buy Self-Serve WP Shield ZIP — £12 (Instant PayPal Download)

Gig #3 · Cyber Essentials v3.3 (“Danzell”) & Entra ID Pre-Audit£29 Self-Serve ZIP · US$35 / US$55 / US$85 Fiverr

Mandatory April 2026 NCSC/IASME v3.3 gap analysis (cloud MFA anti-spoofing, passwordless readiness, 1-day leaver SLA, Device Code block) + offline Graph PowerShell collector & IASME model answers.

⚡ £29 Website ZIP (Self-Serve): Instant download of our offline Graph PowerShell collector, IASME v3.3 Editable Response Guidance & Templates & 1-Day Leaver SOP.

🛠️ US$35 / US$55 / US$85 Fiverr (Done-For-You): We run your external v3.3 boundary pre-audit ($35 1-Domain · $55 3-Domain + Custom Entra/MFA Plan · $85 5-Domain + Assessor Sign-Off Dossier + All 4 Packs) & write your custom Gap Report.

🛠️ Order Done-For-You Pre-Audit on Fiverr (US$35 / US$55 / US$85) → ⚡ Or Buy Self-Serve CE v3.3 Pack ZIP — £29 (Instant PayPal Download)

Gig #4 · NIS2 Art. 21 & DORA 25–250 Supplier Bulk Security Audit£19 Self-Serve CLI · US$50 / US$95 / US$175 Fiverr

Automated non-intrusive posture audit of up to 25, 100, or 250 vendor domains + board-ready HTML Executive Dossier, risk-scored CSV register, 30-day vendor remediation notices & Python CLI scanner.

⚡ £19 Website ZIP (Self-Serve CLI): Instant download of our Python 3 Bulk Supplier CLI Scanner & CSV templates to run vendor scans yourself on your own machine.

🛠️ US$50 / US$95 / US$175 Fiverr (Done-For-You Managed Batch Audit): Send us your vendor list—we scan 25 ($50), 100 ($95), or 250 ($175) supplier domains for you & deliver a finished Art. 21/28 Board HTML Dossier, Risk-Scored CSV + All 4 Packs included.

🛠️ Order Done-For-You 25–250 Vendor Audit on Fiverr (US$50 / US$95 / US$175) → ⚡ Or Buy Self-Serve Bulk CLI Pack — £19 (Instant PayPal Download)

⚡ 100% Asynchronous Delivery (Zero Meetings Required): All Fiverr gigs and compliance packs are delivered as self-contained, board-ready HTML executive reports + copy-paste DNS/server configs via Fiverr or [email protected]—no sales calls or calendar bloat.

TOOLS WE ACTUALLY TRUST · ZERO ADS · ZERO TRACKING PIXELS

Production Infrastructure Recommendations

Recommended Infrastructure & Vetted Security Stack (When Fixing Your DNS, Identity & Endpoints)

When remediating RFC 7208 SPF 10-lookup limits, hosting MTA-STS TLS policies, containing PHP2Shell at the edge, or enforcing UK Cyber Essentials v3.3 ("Danzell") and EU NIS2 Art. 21 controls, these are the four practitioner-vetted platforms we recommend:

1. Cloudflare DNS, WAF & RegistrarDNS / MTA-STS / WAF

Free anycast DNS with instant TXT/SPF propagation, free Universal SSL for mta-sts.<domain> static Pages hosting, and managed WAF rulesets for PHP2Shell edge containment.

Visit Cloudflare (cloudflare.com) ↗

2. 1Password BusinessCE v3.3 Passkeys & Secrets

Enforces UK Cyber Essentials v3.3 ("Danzell") passwordless / passkey & secrets management controls across hybrid Windows and iOS estates.

Visit 1Password Business ↗

3. Proton Pass / Proton Mail BusinessGDPR & NIS2 Art. 21(2)(j)

Swiss/EU GDPR & NIS2 Art. 21(2)(j) end-to-end encrypted mail and credential vault for high-assurance executive communications.

Visit Proton Business ↗

4. Resend Transactional SMTP / APISubdomain DKIM Isolation

Developer-grade transactional SMTP/API with isolated subdomain DKIM (send.<domain>) so marketing/app mail never pollutes your root SPF 10-lookup budget.

Visit Resend (resend.com) ↗

100% FREE FOREVER · NO POPUPS · NO SIGNUPS

Saved you an afternoon of headaches? Buy me a coffee. ☕

I built these scanners and Chrome extensions so you can get instant answers without booking a sales call or handing over your email—if they just saved your day, a coffee keeps the late-night builds going.

☕ Buy Adam a £5.00 Coffee via PayPal →

LIVE 30-MINUTE SCRAPED SECURITY & CVE RADAR · SYNCED 2026-10-28 20:32 UTC

Breaking NCSC, CISA, THN, WordPress & PHP Advisories Mapped to Instant UK Domain Fixes

Pre-rendered every 30 minutes from 6 official security feeds (UK NCSC, CISA KEV, The Hacker News, WordPress.org Security, BleepingComputer, PHP.net) for instant search-engine & AI answer-engine indexing. Open the full 12-Advisory UK Threat & CVE Radar → or subscribe via RSS 2.0 Threat Feed (`feed.xml`).

GitHub Security Advisories · CVE-2026-108360 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-108360: [phpoffice/phpspreadsheet] PhpSpreadsheet:… ↗

## Summary PhpSpreadsheet's `Worksheet\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetch

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗

GitHub Security Advisories · CVE-2026-108082 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… ↗

### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?<!\s)` lookbehind. A run of whitespace placed bef

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗

GitHub Security Advisories · CVE-2026-109413 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… ↗

### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nestin

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗

GitHub Security Advisories · CVE-2026-116675 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… ↗

### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed bef

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗

Stop WooCommerce Receipts Landing in Spam & Lock Down WordPress in 3 Minutes—Without Installing Another Bloated Plugin.

1. Scan Any WordPress / WooCommerce Domain & Generate Custom Drop-In Fixes

WordPress Deliverability & External Hardening Readiness

2. WordPress & WooCommerce Drop-In Security & Email Rescue Pack (£12)

What's Inside the 10-File ZIP Archive 19.9 KB

Interactive Output Preview (Zero Placeholders) Live Sample

Inspect Real Production Outputs From the £12 WP & WooCommerce Shield PackZero Obfuscation · Zero DB Queries

Already Purchased or Have a Redemption Code? Unlock Instant ZIP DownloadInstant SHA-256 Verified

Scanner Finding → Free DIY Fix → Paid Pack or 24h Done-For-You Mapping

1. Missing DMARC / SoftFail SPF / No MTA-STSEMAIL AUTH

2. WordPress wp_mail / REST / XML-RPC ExposureWP & WOO

3. PHP2Shell (CVE-2026-109618 & -109619)RUNTIME / WAF

4. NIS2 Art. 21 / DORA & CE v3.3 ("Danzell") GapsGOVERNANCE

🔄 Opt-In Domain & WordPress Drift MonitoringDNS TXT VERIFIED

🏢 For Web Agencies & MSPs: Multi-Domain & White-Label ScorecardsMSP & AGENCY READY

Need Done-For-You WordPress, WooCommerce & PHP2Shell Hardening + wp_mail() Rescue in 24 Hours?

Gig #1 · Domain DMARC, SPF, DKIM & MTA-STS Audit + DNS Fix Pack£24 Self-Serve ZIP · US$25 / US$35 / US$50 Fiverr

Gig #2 · WP, WooCommerce & PHP2Shell Hardening£12 WP / £24 PHP ZIP · US$15 / US$30 / US$55 Fiverr

Gig #3 · Cyber Essentials v3.3 (“Danzell”) & Entra ID Pre-Audit£29 Self-Serve ZIP · US$35 / US$55 / US$85 Fiverr

Gig #4 · NIS2 Art. 21 & DORA 25–250 Supplier Bulk Security Audit£19 Self-Serve CLI · US$50 / US$95 / US$175 Fiverr

Recommended Infrastructure & Vetted Security Stack (When Fixing Your DNS, Identity & Endpoints)

1. Cloudflare DNS, WAF & RegistrarDNS / MTA-STS / WAF

2. 1Password BusinessCE v3.3 Passkeys & Secrets

3. Proton Pass / Proton Mail BusinessGDPR & NIS2 Art. 21(2)(j)

4. Resend Transactional SMTP / APISubdomain DKIM Isolation

Saved you an afternoon of headaches? Buy me a coffee. ☕

Breaking NCSC, CISA, THN, WordPress & PHP Advisories Mapped to Instant UK Domain Fixes

CVE-2026-108360: [phpoffice/phpspreadsheet] PhpSpreadsheet:… ↗

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… ↗

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… ↗

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… ↗

2. WordPress `wp_mail` / REST / XML-RPC ExposureWP & WOO

3. PHP2Shell (`CVE-2026-109618` & `-109619`)RUNTIME / WAF