What Was Measured
Over the past 30 days, 80,681 website security scans were run across 80,635 unique small-business WordPress sites. These non-intrusive scans evaluated key technical signals visible to visitors and search engines, including cookie security, mixed content enforcement, SSL/TLS configuration, server version leakage, and the presence of critical security headers.
Definitions:
- Cookie Security: Measures if cookies—especially sensitive session cookies—are set with the Secure, HttpOnly, and SameSite attributes.
- Mixed Content: Rates whether all web resources (images, scripts, styles) are loaded over HTTPS rather than a mix of encrypted and unencrypted (HTTP) connections.
A “Good” grade in each area requires complete, correct implementation—not simply the presence of HTTPS or cookies.
Key Findings from Recent Scans
Grade Distribution (Last 30 Days)
| Grade | Site Count | Percent (%) |
|---|---|---|
| A | 236 | 0.3 |
| B+ | 1263 | 1.6 |
| B | 853 | 1.1 |
| C+ | 17646 | 21.9 |
| C | 9859 | 12.2 |
| D | 20045 | 24.8 |
| F | 22951 | 28.4 |
Security Check Pass Rates
| Security Check | Good (%) | Non-Good (%) |
|---|---|---|
| All Security Headers | 0.3 | 99.7 |
| Content Security Policy | 0.0 | 100.0 |
| Cookie Security | 81.5 | 18.5 |
| Mixed Content | 61.4 | 38.6 |
| Server Banner (no version) | 1.4 | 98.6 |
- Combined Weakness Rate:
Across 17,544 measured sites, 43.4% did not achieve a “Good” rating in both cookie security and mixed content enforcement.
Why Cookie Security and Mixed Content Matter—Individually
Cookie Security
Cookies are small pieces of data that store session information when users log in, shop, or change preferences. Three cookie flags matter most:
- Secure: The cookie is only sent over HTTPS.
- HttpOnly: Can’t be accessed by client-side scripts, reducing some classes of attacks.
- SameSite: Limits cookies to same-site requests, protecting against cross-site request forgery.
If these are missing, attackers may have an easier time stealing session data with packet captures (on HTTP) or browser-based injection, especially in insecure or public networks.
Mixed Content
“Mixed content” means a page loads some resources (like images or scripts) over plain HTTP while the rest of the page uses HTTPS. When browsers encounter this, they may:
- Block risky resources, breaking site features.
- Warn visitors, lowering trust and engagement.
- Fail to protect all data, exposing parts of a page to interception.
Mixed content especially undermines efforts to secure cookies, as sensitive data can ‘leak’ over unprotected connections.
How These Weaknesses Compound—Business Context
When both cookie security and mixed content controls are misconfigured, the effect is not just additive but compounding:
Example: Even if a site uses Secure and HttpOnly cookie flags, a single HTTP-included image or script can expose those cookies to man-in-the-middle attacks. Modern browsers are better at blocking these risks, but few small-business sites are fully protected by default.
Business Impact: For ecommerce, membership, donation, or customer dashboard sites, attackers do not need to break encryption. They just need one mixed-content link and one unflagged cookie to target account sessions, possibly leading to unauthorized access if session hijacking succeeds.
This is not theoretical:
- According to CVE-2016-5696, real-world attackers exploited TCP packet sequence flaws combined with weak HTTPS deployments and absent Secure flags to harvest session cookies on vulnerable WordPress hosting stacks.
Common Causes Behind the Numbers
“Good” Cookie Security (81.5%):
The most common missing flag is SameSite. Many plugins and themes set cookies for analytics or preferences and omit this attribute. Major checkout and login plugins do better, but gaps persist.“Good” Mixed Content (61.4%):
Most failures are due to legacy image URLs, plugin-inserted scripts, or external widgets still pointing to http:// addresses. Even a single HTTP reference forces a non-Good rating.“Good” Both:
Only 56.7% of graded scans had both strict cookie security and completely enforced HTTPS for all assets.
Practical Examples
Example 1: Contact Form Submissions
A customer submits a request through a secure contact form. If a tracking pixel loads over HTTP, any session cookies—if not set with Secure and SameSite—may be sent over an unencrypted channel. An attacker with access to the same WiFi network could potentially capture that data.
Example 2: WooCommerce Checkout
A shop configures HTTPS for payments, but its logo and a marketing script are loaded from an old HTTP URL. If Cart or session cookies lack the Secure attribute, these cookies could be transmitted insecurely, risking session hijack even on a “padlocked” page.
Why You Should Care: SEO, Trust, and Liability
- Visitors see browser warnings or breakages.
- Search engines flag and potentially lower rankings for sites with mixed content or persistent session weaknesses.
- Certain privacy and payment regulations may require full cookie security for compliance.
Effective WordPress security isn’t just about avoiding breaches; it’s about keeping your experience trustworthy from login to checkout.
Frequently Asked Questions
Q: Is “padlock” in the browser enough?
A: No. The padlock indicates HTTPS is present, not that cookies and assets are fully secure. Only 6.1% of scanned sites had fully hardened SSL/TLS.
Q: What is SameSite, and why is it so often missing?
A: SameSite restricts when cookies are sent with cross-site requests, blocking several common attack patterns. WordPress core now sets it by default, but not all plugins follow suit.
Q: What’s the real-world risk for a small business?
A: If attackers can hijack logged-in sessions using both cookie and mixed content weaknesses, they may gain access to orders, messages, or billing. Fixing both closes the window for these opportunistic attacks.
What You Can Do Right Now
1. Run a comprehensive website security scan
Automated scanners can identify mixed content sources and check all relevant cookie flags in one pass, prioritized by browser and attack model. See what your real users and search engines see—don’t rely on spot checks.
2. Audit all external assets
Update URLs to https:// for every image, script, or embedded widget. Check theme options and plugin settings for legacy links.
3. Review your plugins for cookie management
Make sure any plugin handling logins, carts, or user profiles sets cookies with Secure, HttpOnly, and SameSite. Defer to WordPress core where possible.
4. Strengthen SSL/TLS configuration
Don’t just enable HTTPS—enforce HSTS, use modern protocols, and test for weak ciphers.
5. Set a regular cadence for security reviews
Security is process, not a one-time fix. Integrate checks for cookie policy and asset links into monthly or quarterly site maintenance.
Final Thoughts
244,343 scans across 166,465 unique small-business WordPress sites found that fewer than two-thirds consistently protected both cookie data and all page assets end-to-end. Weaknesses rarely appear alone: website security scans uncover the layered, compounding gaps in real deployments—giving you a prioritized, practical chance to close them before they lead to lost trust or business disruption.
Next step:
Don’t guess where you stand. Run a scan purpose-built for WordPress and WooCommerce, and address your first finding before moving to the next. Start your WordPress site scan now to see your real exposure score and fix what actually matters.