EAGLE SOLUTIONS
In short: Of 87 Harghita company websites, 3 had an invalid certificate, on 2 no HTTPS connection could be made at all, and 13% of the sites with a valid certificate do not redirect to https. 8 sites reveal their PHP version, and 6 of those no longer get security updates.
Website security HTTPS comes first, but it does not end there. Most of security cannot be seen from the outside, but part of it can: the certificate, the redirect, the error pages and how much the server reveals about itself. In the third part of the series on the websites of 100 companies in Harghita County, I measured this visible layer on the 87 websites that exist.
Important: this is not a penetration test. I did not try to break into any website; I only checked what any visitor's browser sees. An exposed version number does not by itself mean a site is vulnerable, but it shows where it is worth looking.
How I measured
The measurement was taken on 27 September 2026. The sample: the 50 largest companies in Harghita County from the Termene 2025 revenue ranking, and 50 small businesses from different sectors, 87 of which have a website. With my own script I checked the certificate (validity, issuer, expiry), the redirect from the http address and the server response headers, and loaded the homepage in a Playwright-based browser.
Limits: the small-business half contains only companies with a working website, so the share of broken websites cannot be compared between the groups. I measured each website once, so a temporary error on that day may show up in the numbers.
Website security HTTPS basics: certificate and redirect
Of the 87 websites, 82 have a valid certificate. The rest:
- 3 websites have an invalid certificate: two expired, and one issued for a name other than the domain. Visitors see a full-screen warning, and most of them turn back there.
- On 2 websites no HTTPS connection could be made at all; they are only reachable unencrypted.
Of the 82 websites with a valid certificate, 11 (13%) do not redirect from the unencrypted http address to https. Anyone who types just the domain into the browser or clicks an old link lands on the unencrypted page, where the browser shows "Not secure". The share is 22% for the large companies and 8% for small businesses.
Money cannot be the excuse: of the 81 working websites, 69 use a free Let's Encrypt certificate. It renews automatically if the hosting is set up properly, and the redirect is a single rule.
Error pages instead of a homepage
Of the 87 websites, 3 homepages returned an error code (500, 503 and 403). 500 and 503 mean a server error. A 403 may also be a firewall that blocked the automated browser, which cannot be decided from the outside.
Together with the invalid certificates, 6 websites showed no content, and all 6 belong to large companies: 16% of the measured top 50 websites. At a company like that, probably nobody knows the website is down, because the staff do not work through the website.
Exposed server and PHP versions
The server often reveals in its response headers what software it runs. That is not a mistake in itself, but if the version number is visible too, automated attackers use it to pick targets.
- 8 websites reveal their PHP version. Of these, 6 run PHP versions (7.2, 7.3, 7.4, 8.0 and 8.1 twice) that no longer receive security updates, according to the official PHP support table. The 8.1 branch dropped out of support at the end of 2025.
- 8 websites also show the web server version, including nginx and Apache versions that are several years old.
One important caveat: Linux distributions often fix security issues while keeping the old version number, so an old Apache version does not necessarily mean a vulnerable server. With PHP, however, end of support is a real line. Hiding the version is a setting, and upgrading PHP in the hosting panel is usually a single choice, if the site's code can handle it.
An old WordPress version on display
Of the 77 working websites I checked in detail, 39 run WordPress. Of those, 28 print their exact version in the page source, and of these:
- 14 run the latest version, 7.1.2;
- 14 run an older one, and 6 are on the 5.x branch or older, released years ago.
The WordPress team officially supports only the latest version. Older branches may still get fixes, but there is no guarantee, and next to a 5.x core the plugins and the theme are rarely up to date either. I explained why WordPress needs regular maintenance here.
What to check on your own website now
- Type your domain into the browser with
http://: does it take you to thehttps://address? - Click the padlock: how long is the certificate valid, and does it renew automatically?
- In the browser developer tools (F12 → Network), look at the homepage response headers: is there an
X-Powered-By: PHP/…line? - In the page source (Ctrl+U), search for
generator. If it shows a WordPress version, is it the latest?
Security does not stop at the website: if your company emails are not authenticated, anyone can send mail in your name. It happened to me, and I wrote about how I fixed it.
If you cannot check any of these yourself, send me your website address and I will take a look. With monthly maintenance, monitoring the certificate, the PHP version and WordPress updates is included from the start.
