Mazik Global UK — Public Site Audit

Layer	Value
Hosting	Hostinger (hPanel + hcdn CDN)
Web server	hcdn (Hostinger edge)
Runtime	PHP 8.3.33
CMS	WordPress 7.1
Theme	royal-elementor-kit
Page Builder	Elementor 4.2.4
SEO Plugin	All in One SEO 5.0.1.1
Analytics	Site Kit by Google 1.187.0 → GA4 (GT-WPQVZFMJ)
Minify	WP Optimize (wpo-minify)
Other Plugins	Essential Addons for Elementor (Lite), CookieAdmin

🔒 Security Findings

CRIT-01 · XML-RPC fully exposed with method list leaked CRITICAL

POST /xmlrpc.php returns 200 and lists every method including system.multicall, system.listMethods, and pingback.ping. This is the classic WordPress brute-force / DDoS / amplification vector — attackers can run tens of thousands of auth attempts per request via system.multicall, and pingback.ping is used for DDoS reflection.

curl -sk -X POST https://mazikglobal.co.uk/xmlrpc.php \ -H "Content-Type: text/xml" \ -d '<methodCall><methodName>system.listMethods</methodName></methodCall>' → returns full method list including pingback.* and system.multicall

FixBlock xmlrpc.php at the edge or in functions.php:

add_filter('xmlrpc_enabled', '__return_false');

Or in nginx:

location = /xmlrpc.php { deny all; }

Confirm Jetpack/contact forms don't need it first.

CRIT-02 · WordPress version + readme/license publicly accessible CRITICAL

Three telltale files return 200:

/readme.html → HTTP 200 (reveals "PHP 8.3 / MySQL 8.0 or MariaDB 10.11") /license.txt → HTTP 200 /wp-login.php → HTTP 200

Combined with the generator meta tags (WordPress 7.1, Elementor 4.2.4, AIOSEO 5.0.1.1, Site Kit 1.187.0), an attacker has an exact fingerprint to cross-reference against WPScan / Patchstack vulnerability databases before they even try to log in.

FixAdd to .htaccess / nginx:

location ~* /(readme\.html|license\.txt|wp-config-sample\.php)$ { deny all; }

Remove the generator meta tag and disable WP version exposure:

remove_action('wp_head', 'wp_generator');

HIGH-01 · Zero standard security response headers HIGH

Only 1 header is set, and it's the weakest possible CSP (upgrade-insecure-requests doesn't block anything — just rewrites http→https).

Header	Status
Content-Security-Policy	Weak (upgrade only)
X-Frame-Options	MISSING — clickjacking risk
X-Content-Type-Options	MISSING — MIME sniffing risk
Strict-Transport-Security	MISSING — no HSTS preload
Referrer-Policy	MISSING — leaks referrer to all 3rd parties
Permissions-Policy	MISSING — camera/mic/geolocation defaults open

FixIn nginx add:

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

HIGH-02 · WordPress REST API fully exposed to anonymous callers HIGH

/wp-json/ returns 200 with the full namespace listing (v2 posts, pages, users, media). Combined with exposed xmlrpc, the attacker has two parallel brute-force channels.

FixIf public read is needed, restrict write endpoints:

add_filter('rest_authentication_errors', function($result) {
    if (!is_user_logged_in() && !in_array($_SERVER['REQUEST_URI'], [allowed_public])) {
        return new WP_Error('rest_forbidden', 'Authentication required.', ['status' => 401]);
    }
    return $result;
});

Or just block /wp-json/ at the edge if no frontend depends on it.

HIGH-03 · Contact info invisible to crawlers + AI assistants HIGH

Phones appear only as fragments in HTML text (no tel: link, no schema), and no contact email appears in the homepage body. The Organization JSON-LD has no email, telephone, or address properties — meaning when Google, Bing, ChatGPT, Perplexity, or Gemini summarize Mazik Global, they have no structured way to surface a way to contact the business.

FixAdd to Organization schema:

"contactPoint": {
  "@type": "ContactPoint",
  "telephone": "+44-...",
  "contactType": "sales",
  "areaServed": "GB",
  "availableLanguage": "English"
}

And use real <a href="tel:..."> and <a href="mailto:..."> links in the footer/contact page.

📈 SEO Findings

MED-01 · Meta keywords tag missing (low impact, but expected) MEDIUM

Empty <meta name="keywords">. Google ignores it but other crawlers and some CMS tools still index it. Easy win.

MED-02 · OG image too small for social sharing MEDIUM

The og:image is only 512x512px. LinkedIn, Twitter, Facebook, Slack, and WhatsApp all prefer at least 1200x630px for rich previews — below 600px looks blurry when shared.

og:image = https://mazikglobal.co.uk/wp-content/uploads/2025/07/cropped-Dp-Mazik.png declared dimensions: 512x512

FixExport a 1200x630 version of the logo/brand banner and update the AIOSEO social image setting.

MED-03 · Schema markup incomplete — missing contactPoint, address, founder MEDIUM

The Organization JSON-LD has logo, sameAs (X + LinkedIn only), but no address, contactPoint, founder, or foundingDate. For an AI-driven consultancy named on the Microsoft partner list, this is a missed opportunity to dominate the entity graph.

MED-04 · H1 missing on homepage MEDIUM

0 <h1> tags found on the homepage. 43 <h2> tags instead. Search engines expect exactly one H1 that states the page's main topic. Elementor users regularly miss this when they build with sections instead of a proper semantic structure.

FixAdd a single H1 like "AI-Driven Microsoft Cloud Solutions for UK Enterprises" near the top, and demote other headings to H2/H3 properly.

LOW-01 · Only 2 social profiles in sameAs — Facebook/YouTube/GitHub missing LOW

For a Microsoft Cloud + AI consultancy, YouTube (demos, webinars) and GitHub (open-source AI agents, technical credibility) are high-value entity-graph signals. Facebook is still important for B2B reach in UK SMB market.

LOW-02 · 5 case studies for an enterprise Microsoft partner is thin LOW

NHS, nonprofit, healthcare — strong verticals, but only one written case study per vertical. Buyers in the UK public-sector / NHS space expect 8-15 published wins before they trust a partner.

LOW-03 · Last blog post date not visible from homepage LOW

The "Latest from Our Experts" section shows post titles but not dates. Search engines and buyers both want to see recency — and the sitemap's lastmod is 7 Sep 2026, suggesting the blog is somewhat stale.

⚡ Performance Findings

MED-P1 · Homepage HTML is 604 KB uncompressed MEDIUM

Large for a content page. Likely cause: Elementor's heavy DOM (43 H2s, 33 images, multiple sections). After gzip this drops significantly, but the DOM complexity slows render. Service pages observed loading in 1.64s which is acceptable but not great.

LOW-P1 · LCP image likely unoptimized LOW

33 images on homepage with no observed loading="lazy", srcset, or modern format hints in the first paint. Hero/LCP image should be preloaded and served as WebP/AVIF.

✅ What Mazik Global is Doing Right

Clean SEO foundation — AIOSEO is installed and configured. Canonical, OG tags, Twitter cards, JSON-LD all in place.
HTTPS enforced with proper 301 redirect from http → https.
Microsoft partner credentials surfaced — Awards, Microsoft Partner badges, healthcare partner badges all linked from About.
Strong sitemap hygiene — AIOSEO generates sub-sitemaps (post, page, category, templates, mega menu) with lastmod dates. 192 indexed URLs.
Verticalised product framing — MazikCare / MazikNFP / PowerGov is exactly the kind of entity SEO that wins in Microsoft Cloud procurement searches.
GA4 + Search Console wired via Site Kit (verified via generator meta).
WPO minify active — JS/CSS are concatenated, footer-loaded.

🎯 90-Day Priority Roadmap

Priority	Action	Effort
1	Disable xmlrpc.php + add all 6 missing security headers	~1 day
2	Block readme.html / license.txt / wp-config-sample.php at edge	~30 min
3	Add real contact info to Organization JSON-LD + footer tel:/mailto:	~1 day
4	Add a single semantic H1 to homepage + rebalance H2/H3 hierarchy	~1 day
5	Replace OG image with 1200x630 version	~2 hrs
6	Restrict wp-json to authenticated users or block at edge	~2 hrs
7	Publish 3-5 more case studies (NHS, SMB ERP, Public Sector)	ongoing
8	Add YouTube + GitHub + Facebook to sameAs + footer	~1 day
9	Audit LCP image → preload + WebP/AVIF conversion	~1 day
10	Verify WordPress 7.1 version report is correct (or downgrade to 6.x stable)	~30 min

📋 Methodology & Scope

Non-invasive external scan only. No login attempts, no exploit attempts, no scans beyond what a normal browser does.
Tools used: HTTP HEAD/GET probes, sitemap parsing, HTML meta/OG/JSON-LD extraction, header inspection, endpoint enumeration (login, xmlrpc, wp-json, readme, license, debug.log, .env).
Did NOT touch: wp-admin auth, database, server config, customer data, payment flows.
Re-test anytime with: curl -sIL https://mazikglobal.co.uk/ or browser DevTools → Network tab.

📦 Want the raw scan data? This audit's data JSON is available at /audit-data.json.

⚡ Mazik Global UK — Public Site Audit

🛠️ Discovered Stack

🔒 Security Findings

📈 SEO Findings

⚡ Performance Findings

✅ What Mazik Global is Doing Right

🎯 90-Day Priority Roadmap

📋 Methodology & Scope