High-risk security reports

A

Abacus Finance

abacusfinance.co.uk

40

Abacus Finance is a French-language finance news and advisory website hosted on the domain www.abacusfinance.co.uk. The site provides content related to investment, taxation, accounting, and business news, targeting French-speaking individuals and professionals interested in financial topics. The website is built on WordPress using Elementor and Yoast SEO, indicating a modern CMS infrastructure with SEO optimization. The site implements a cookie consent banner, reflecting some level of privacy compliance, but lacks explicit privacy policy and terms of service pages. Security posture is moderate with HTTPS enabled but missing security headers and no visible vulnerability disclosure or incident response information. WHOIS data for the domain is unavailable due to a Nominet UK registration error, raising concerns about domain legitimacy, though the website content is accessible and professionally presented. Overall, the site is functional and provides relevant financial content but would benefit from enhanced security and compliance documentation.

S

Special Formwork

formwork.co.uk

39

Special Formwork is a UK-based specialist company focused on the design and manufacture of bespoke steel formwork systems for concrete casting, serving the construction and infrastructure sectors. The company positions itself as a leading UK provider with a strong emphasis on quality and innovation, targeting construction companies and civil engineers. Their product portfolio includes column formwork, tunnel and shaft formwork, sea defence solutions, and construction equipment fabrication. The website reflects a professional and consistent brand image aligned with their business focus. Technically, the website is built on WordPress using modern plugins and themes such as Yoast SEO, WPBakery Page Builder, and MonsterInsights for analytics. The site is mobile-optimized with good SEO practices and moderate performance. Security measures include HTTPS enforcement and standard security headers, although some improvements could be made in cookie consent and published security policies. The security posture is solid with no evident vulnerabilities or exposed sensitive data. However, the absence of a visible cookie consent mechanism and lack of published incident response or vulnerability disclosure policies indicate areas for compliance enhancement. The WHOIS data for the domain is unavailable due to a naming rules error, which limits domain legitimacy verification but does not detract from the professional presentation of the website. Overall, the website presents a trustworthy and professional digital presence for Special Formwork, with recommendations to improve privacy compliance and security transparency to further strengthen trust and regulatory adherence.

B

Boningale Ltd.

boningale.co.uk

47

Boningale Ltd. operates one of the UK’s largest horticultural businesses, specializing in large scale nursery production and plant supply across multiple divisions. The company targets industry professionals and large projects within the horticulture and landscape sectors. Their business model focuses on multi-site production, contract growing, and a webshop for plant sales, positioning them as a key player in the UK horticulture market. The website reflects a professional and consistent brand image with good content quality and clear navigation. Technically, the website is built on WordPress 7.0 with modern plugins such as Yoast SEO and Google Tag Manager integration. The site is mobile-optimized and uses asynchronous loading for analytics scripts, indicating a moderate to good digital maturity. However, some accessibility features could be improved, and hosting details remain unknown. From a security perspective, the site enforces HTTPS and avoids exposing sensitive data. However, it lacks important security headers and does not publish a security policy or incident response contacts. The absence of a cookie consent mechanism also indicates partial GDPR compliance. The WHOIS data is unavailable and shows an error from the registry, which raises concerns about domain registration legitimacy despite the professional website presence. Overall, the site presents a low risk to users and appears trustworthy for business purposes, but the domain registration anomaly should be investigated further. Strategic improvements in security headers, privacy compliance, and transparency would enhance trust and reduce potential risks.

The website at www.ipu.co.uk is currently inaccessible, returning a 403 Forbidden error page with no accessible content. The WHOIS lookup for the domain failed, indicating the domain name 'www.ipu.co.uk' is invalid under Nominet UK naming rules, and no registrar or registration data is available. This suggests the domain is either misconfigured, not properly registered, or non-existent. Due to the lack of accessible content, metadata, or business information, a comprehensive analysis of the company's operations, services, or market position is not possible. The technical infrastructure cannot be assessed beyond the error page, and no security headers or HTTPS information is present. Privacy and compliance policies are absent, and no contact or incident response information is found. Overall, the website presents significant accessibility and legitimacy issues, resulting in a very low trust and security posture score.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

N

Nationwide Cleaning

nationwidecleaning-fm.co.uk

49

Nationwide Cleaning is a family-owned, private limited company based in Croydon, UK, specializing in commercial and transport cleaning services. The company targets businesses in sectors such as transport, education, healthcare, and leisure, emphasizing long-term client relationships and personalized service. The website presents a professional image with clear service offerings and contact information, supported by client logos and accreditations. Technically, the site uses common web technologies including Bootstrap and jQuery, though some libraries are outdated. Security measures are basic, with cookie consent implemented but lacking advanced protections such as security headers or CAPTCHA on forms. The domain WHOIS data is unavailable due to a registration error, which raises concerns about domain legitimacy despite the professional website content. Overall, the site is functional and trustworthy from a content perspective but would benefit from improved security and compliance documentation.

The website www.intercover.co.uk currently presents only a security verification page utilizing Google reCAPTCHA v3, indicating that access to the full site content is blocked by a Web Application Firewall or bot protection mechanism. Due to this, no substantive business information, contact details, or policies are accessible. The domain WHOIS lookup failed with an error from Nominet UK citing domain naming rules violations, suggesting the domain may be invalid or misconfigured. This severely limits the ability to assess the company's legitimacy or operational details. Technically, the site uses Bootstrap 5.3.3 and Google reCAPTCHA but lacks visible HTTPS confirmation or security headers, indicating a weak security posture. Overall, the site quality and trustworthiness are low due to blocked content and lack of transparency.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

E

Eskmuir Properties Ltd

eskmuir.co.uk

42

Eskmuir Properties Ltd is a UK-based property investment manager specializing in commercial real estate investments tailored primarily for charities and family trusts. Established in 1990, the company has a strong track record of delivering consistent dividend growth and capital appreciation through active asset and fund management. Their website reflects a professional and focused business with clear communication of their services and investment philosophy. Technically, the site is built on WordPress using the Divi theme, with modern plugins enhancing functionality and SEO. Security posture is good with HTTPS enforced, but lacks some advanced security headers and cookie consent mechanisms. Overall, the site is trustworthy and well-maintained, supporting Eskmuir's market position as a niche real estate investment manager.

The website www.marchantlewis.com is currently inaccessible and displays a generic 'Site not found' error page indicating the site is unpublished or the domain is not assigned. There is no visible business content, contact information, or policies available on the site. The WHOIS lookup confirms that the domain is not registered or inactive, with no registrar or creation date information available. This suggests that the domain is either unregistered or expired, and no legitimate business presence exists at this URL. From a technical perspective, the site only loads a minimal HTML error page with a single external font resource. There are no scripts, forms, or analytics detected. Security posture cannot be assessed due to lack of HTTPS and security headers. Privacy and compliance policies are absent, and no contact or business information is provided. The overall risk assessment is high due to the lack of domain registration, absence of website content, and no security or compliance measures. This site should not be considered a legitimate or operational business website at this time. Strategic recommendations include registering the domain properly, deploying a secure and compliant website with clear business information, and implementing standard security best practices.

The website www.leighacademy.org.uk is currently inaccessible, presenting a 403 Forbidden error page served by nginx with embedded Cloudflare challenge scripts, indicating that access is blocked by a Web Application Firewall or security mechanism. Due to this blockage, no meaningful content, metadata, or business information could be extracted from the site. The WHOIS lookup failed with an error indicating the domain name violates Nominet UK naming rules, resulting in no registrar, creation, or expiry data being available. This lack of WHOIS transparency and the access restrictions raise concerns about the domain's legitimacy and operational status. From a technical perspective, the site shows no accessible content or detectable technologies, frameworks, or CMS platforms. No security headers or SSL configuration details are available, and no privacy, cookie, or terms of service policies are found. The absence of contact information, incident response details, or vulnerability disclosure mechanisms further limits the ability to assess the site's security posture or compliance with data protection regulations. Given the current state, the security posture is weak due to the lack of accessible information and transparency. The domain's WHOIS inconsistency and the WAF blockage suggest potential operational or configuration issues. The overall risk assessment is elevated due to these factors, and strategic recommendations focus on resolving access issues, improving transparency, and implementing standard security and privacy practices. In summary, the site is effectively blocked from analysis, and no substantive business or security insights can be drawn without further access or data. Contacting the site administrators or relevant authorities is advised for a more thorough evaluation.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

A

Amity Insulation Services Limited

amitygroup.co.uk

47

Amity Insulation Services Limited is a well-established UK-based company specializing in asbestos surveying, removal, and related environmental and safety training services. With over 30 years of industry experience, the company holds multiple certifications including ARCA awards and ISO 9001 accreditation, positioning it as a trusted leader in the Oxfordshire region. The website reflects a professional business presence with clear service offerings and comprehensive contact information. Technically, the site is built on WordPress with standard plugins and Google Analytics integration, offering good performance and mobile optimization. Security posture is solid with HTTPS enabled, though additional security headers and explicit security policies could enhance protection. Privacy compliance is addressed with visible cookie and privacy policies including consent mechanisms. The absence of WHOIS data due to querying the 'www' subdomain limits domain registration trust verification, but overall business credibility remains high based on website content and certifications.

LW Developments Ltd is a well-established UK-based real estate development company specializing in land acquisition, planning, and construction of residential and mixed-use schemes. With over 40 years of experience, the company holds a strong market position supported by industry certifications such as RICS and memberships like the Herts Chamber of Commerce. Their website reflects a professional and consistent brand image targeting landowners, local authorities, and residential property buyers. Technically, the website is built on WordPress with modern libraries such as jQuery and Swiper.js, hosted via Nimbus CDN with Azure DNS services. The site is mobile-optimized and SEO-friendly, though performance is moderate. Security is adequate with HTTPS enforced and domain transfer protections, but lacks advanced security headers and explicit incident response policies. Security posture is solid but could be improved by enabling DNSSEC, adding security headers, and publishing clear security policies. Privacy compliance is basic with privacy and cookie policies present but no active consent mechanism. No vulnerabilities or suspicious activities were detected. Overall, the website and domain registration data align well, indicating a trustworthy and credible business presence online.

New Holland Sheet Metal is a small manufacturing service provider specializing in metal cutting, laser cutting, welding, and rolling services based in Letchworth. The website is built on WordPress using the Divi theme and hosted on a provider indicated by the nameservers 'mysecurecloudhost.com'. The technical infrastructure is basic but functional, with HTTPS enabled and moderate performance. However, the site lacks key compliance elements such as privacy and cookie policies, and no contact information or social media presence is evident in the provided content. Security posture is moderate with HTTPS but missing important security headers and DNSSEC. Overall, the site appears legitimate and established given the domain age but would benefit from improved compliance and security practices.

The website www.clr.com appears to be inaccessible or inactive as indicated by the WHOIS data showing no registration record and the incomplete HTML content provided. The lack of substantive content, absence of privacy and cookie policies, and no contact information suggest the site is either not live or blocked. The technical infrastructure shows use of common web technologies such as Google Tag Manager, Typekit fonts, and FontAwesome icons, and the CMS appears to be WordPress. However, no security headers or SSL configuration details were available to assess the security posture. Overall, the site lacks critical trust and compliance indicators, resulting in a very low risk and credibility score.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

P

Project8ball

project8ball.com

40

Project8ball is a UK-based digital agency presenting itself as a disruptive creative and functional service provider. The website indicates a transition to a new brand, VerticalVertical.com, suggesting a strategic rebranding after 8 years of operation. The company targets businesses seeking digital agency services, emphasizing creativity and timely project delivery. The site is built on WordPress with modern plugins and frameworks, reflecting a moderate level of digital maturity. Security posture is adequate with HTTPS enabled but lacks advanced security headers and explicit privacy or cookie policies. The absence of WHOIS data for the domain raises some concerns about domain registration legitimacy, though the website content and branding appear professional. Overall, the site is safe, professional, and moderately trustworthy but would benefit from enhanced privacy compliance and security practices.

R

Reface Scotland

refacescotland.co.uk

49

Reface Scotland is a well-established bespoke furniture company specializing in replacement kitchen doors, fitted kitchens, bedrooms, and custom home office designs. With over 30 years of experience and a strong market position in Scotland, the company offers made-to-measure furniture solutions with a focus on quality and customer service, including free home measure and design visits. The website is built on WordPress using the Enfold theme and incorporates modern digital marketing tools such as Google Analytics, Facebook Pixel, and Google Tag Manager, reflecting a mature digital infrastructure. Security posture is solid with HTTPS and no exposed sensitive data, though explicit security headers and policies are not fully visible. Privacy compliance is lacking due to missing privacy and cookie policies, which is a notable gap. Overall, the domain registration data supports the legitimacy and longevity of the business, and the website presents a professional and trustworthy image.

The website for www.bunchrewhousehotel.com is currently inaccessible beyond a security verification page employing Google reCAPTCHA v3, which blocks access to any substantive content. This prevents extraction of business details, contact information, or policies. The domain WHOIS query returned no registration data, indicating the domain may be unregistered or WHOIS data is unavailable, which raises legitimacy concerns. Technically, the site uses modern front-end frameworks like Bootstrap and implements bot protection, but lacks visible security headers or SSL configuration details. No privacy or cookie policies are present, and no contact or business transparency information is available. Overall, the site exhibits a low security posture and poor user experience due to blocked content and lack of trust signals.

L

Letting Solutions Letting Agents

letting-solutions.co.uk

46

Letting Solutions Letting Agents is a professional property letting agency operating primarily in West Lothian, UK. The company offers a comprehensive range of services for tenants and landlords including property letting, management, corporate lets, and instant rental valuations. The website positions the company as a leading independent letting agent in the region, targeting local tenants and landlords. Technically, the website is built on modern frameworks such as Next.js and React, providing a responsive and user-friendly experience. The site includes rich content, clear navigation, and integrates social media and scheduling tools like Calendly. Security-wise, the site uses HTTPS and avoids exposing sensitive data, but lacks some recommended security headers and explicit privacy or cookie policies, which are areas for improvement. The WHOIS lookup for the domain failed due to querying a subdomain rather than the registered domain, which slightly impacts trust from a domain registration perspective. Overall, the website is professional, trustworthy, and well-structured but would benefit from enhanced privacy compliance and security header implementation.

Scotia Handling Services is a UK-based small business specializing in construction equipment handling and testing services, particularly focusing on lifting equipment safety. The company has a well-established domain since 2004, indicating a stable market presence. Their website is built on WordPress using the Divi theme, incorporating standard tracking tools such as Google Analytics and Google Tag Manager. The site demonstrates moderate digital maturity with good mobile optimization and basic SEO practices. However, it lacks comprehensive privacy and terms of service documentation, which are critical for compliance and user trust. Security posture is adequate with HTTPS enabled but lacks advanced security headers and incident response information. Overall, the website is functional and professional but would benefit from enhanced compliance and security measures.

NJSR Chartered Architects LLP is a UK-based architectural firm with offices in Southport and Manchester. The website currently serves as a placeholder announcing an upcoming new website launch. Contact information for both offices is clearly provided, indicating an operational business focused on architectural services. The technical infrastructure is basic, utilizing jQuery and Nicepage for site construction, with limited SEO and accessibility features. Security posture is minimal with no detected security headers or privacy policies, and WHOIS data is unavailable due to domain registration issues, which raises concerns about domain legitimacy or configuration. Overall, the site is functional but lacks comprehensive security and privacy compliance measures.

A

Arch Safety

archsafety.com

46

Arch Safety is a specialized training and site services provider focused on rope access, safety, and rescue training primarily serving the energy sector in Ireland. They hold leading positions in GWO and IRATA training, offering a range of accredited courses and site services tailored to industrial clients. The website reflects a professional and consistent brand image with clear navigation and relevant content for their target audience. Technically, the website uses modern frameworks such as Bootstrap 5 and jQuery, integrates Google Maps API, and employs secure HTTPS connections. The site is mobile optimized and performs moderately well, though accessibility features could be improved. No major technical issues or vulnerabilities were detected, but security headers are not visibly implemented. From a security perspective, the site enforces HTTPS and uses secure forms with CSRF tokens. However, it lacks visible security policies, incident response contacts, and cookie consent mechanisms, which are important for compliance and user trust. The absence of WHOIS data reduces domain trustworthiness, though the professional site and accreditations mitigate some concerns. Overall, Arch Safety presents a credible and professional online presence with room for improvement in privacy compliance and security transparency. The domain registration ambiguity warrants monitoring but does not currently indicate malicious intent.

KCP Car and Commercial Ltd. is a family-owned UK-based distributor specializing in automotive parts for cars, light commercial vehicles, and trucks. The company offers a large inventory of over 50,000 part numbers from reputable brands, serving garage customers across the UK and export markets. Their business model focuses on quality products, technical support, and reliable delivery services. The website reflects a basic but functional online presence with clear contact information and business details. Technically, the website uses older web technologies including jQuery 1.4.4 and basic HTML/CSS. There is no evidence of modern CMS or frameworks, and mobile optimization is poor. The site lacks HTTPS enforcement and security headers, which poses risks to user data and trust. No privacy or cookie policies are present, indicating low privacy compliance. From a security perspective, the site shows weaknesses such as outdated libraries and missing HTTPS, which are critical vulnerabilities. The WHOIS data is unavailable due to domain naming rules violation, raising concerns about domain legitimacy. However, the website content and business information appear consistent and professional, suggesting the main domain may be valid but was queried incorrectly. Overall, the website has moderate business credibility but requires urgent improvements in security posture, privacy compliance, and technical modernization to reduce risks and enhance trust.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

The website www.oldcourtelectrical.co.uk is currently inaccessible, returning a 403 Forbidden error page that blocks access to any meaningful content. The WHOIS lookup for the domain failed with an error indicating the domain name violates Nominet UK's naming rules, suggesting the domain may be invalid or misconfigured. No business information, contact details, or policies are available on the site, severely limiting the ability to assess the company's operations or legitimacy. Technically, the site lacks security headers, privacy compliance indicators, and any analytics or tracking technologies. The overall digital maturity is very low, with poor content quality and minimal technical implementation. Security posture cannot be properly evaluated due to the lack of accessible content and metadata. The domain's WHOIS data absence and invalid status raise significant trust concerns. Strategic recommendations include resolving domain registration issues, enabling HTTPS, implementing security best practices, and publishing essential business and privacy information to improve credibility and compliance.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

H

Highsted Grammar School

highsted.kent.sch.uk

47

Highsted Grammar School is a well-established educational institution in the United Kingdom, focusing on secondary and sixth form education for young women. The school emphasizes a supportive and cohesive community environment that fosters leadership and personal development. The website reflects a professional and comprehensive digital presence, providing detailed information about the school, curriculum, wellbeing, and community engagement. The target audience includes students, parents, and the local community. Technically, the website is built on WordPress with modern JavaScript libraries for interactive elements and is optimized for mobile devices with good SEO practices. Security posture is solid with HTTPS enforced and secure form handling, though there is room for improvement in security headers and explicit incident response policies. Privacy compliance is addressed with clear privacy and cookie policies, though a cookie consent mechanism is not evident. Overall, the website is trustworthy and professionally maintained, supporting the school's reputation and operational needs.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

The website www.akelacl.com is currently inaccessible, returning a 403 Forbidden error page which blocks access to any content or metadata. The domain WHOIS query returned no records, indicating the domain may be unregistered, expired, or otherwise not active. Due to the lack of accessible content, no business information, contact details, or security policies are available for analysis. The technical infrastructure appears minimal or non-existent, with no detectable security headers or HTTPS configuration. This severely limits the ability to assess the website's digital maturity or security posture. Overall, the site presents a high risk due to inaccessibility and lack of transparency, and it is not possible to verify legitimacy or compliance.

A

AD Architects

adarchitects.co.uk

45

AD Architects is a UK-based architectural firm specializing primarily in healthcare architecture, with additional focus on education, community, and residential sectors. The company operates from Hertford and London offices and is part of the larger Sweco group. Their website presents a professional image with clear descriptions of their services, project showcases, and a commitment to sustainability and BIM technologies. The firm targets healthcare providers, educational institutions, and private clients seeking specialized architectural solutions. Their market position is that of an established regional player with a niche focus on healthcare architecture. Technically, the website is built on WordPress and uses common plugins such as Yoast SEO and AddToAny for social sharing. The site is mobile-optimized with good navigation and SEO practices. However, some technical improvements could be made, such as implementing security headers and activating Google Analytics tracking properly. The site uses HTTPS with a valid SSL certificate, ensuring secure communication. From a security perspective, the website shows a good posture with no visible vulnerabilities or exposed sensitive data. The absence of security headers and cookie consent mechanisms are areas for improvement, especially for GDPR compliance. The WHOIS data query failed due to the use of a subdomain in the lookup, but the website content and contact information strongly indicate legitimacy. No signs of malicious activity or suspicious content were found. Overall, AD Architects presents a credible and professional online presence with room for technical and compliance enhancements. Strategic improvements in security headers, privacy compliance, and analytics configuration would strengthen their digital maturity and trustworthiness.

The website www.abbasmarquees.co.uk is currently inaccessible beyond a security verification page employing Google reCAPTCHA v3, indicating the presence of a Web Application Firewall (WAF) or bot protection mechanism. No meaningful business content, metadata, or contact information is accessible, severely limiting the ability to analyze the company's offerings or market position. The domain WHOIS lookup failed due to an invalid domain format, suggesting misconfiguration or non-legitimate registration, which further impacts trust and credibility. Technically, the site uses Bootstrap 5.3.3 and Google reCAPTCHA v3, but lacks visible HTTPS enforcement and security headers, indicating a weak security posture. The minimal content and absence of privacy or cookie policies reflect poor privacy compliance. No business or security policies, certifications, or incident response information are available. Overall, the site presents a high risk due to its inaccessibility, lack of transparency, and invalid domain registration. Strategic recommendations include resolving domain registration issues, implementing HTTPS and security headers, publishing privacy and cookie policies, and providing clear business contact information to improve trust and compliance.

Colour Gro Ltd is a small UK-based wholesale supplier specializing in quality plants for garden centres, including bedding, edibles, perennials, and herbs. The website serves as a basic informational portal providing contact details and company credentials but lacks advanced features or interactive elements. The company appears to be positioned as a niche supplier within the horticulture retail sector, targeting garden centres and wholesale buyers. Technically, the website is simple, built with basic HTML and CSS, without modern frameworks or CMS detected. There is no evidence of HTTPS or security headers, and no analytics or tracking scripts are present. Mobile optimization and accessibility are basic, and SEO features are minimal. The lack of privacy and cookie policies indicates low digital maturity and compliance. From a security perspective, the absence of HTTPS and security headers, combined with the failure to provide WHOIS data due to domain naming rules violations, raises concerns about domain legitimacy and overall security posture. No vulnerabilities or malicious content were detected, but the site lacks essential security best practices and compliance documentation. Overall, the website presents a low-risk profile but requires significant improvements in security, privacy compliance, and technical modernization to enhance trustworthiness and user experience.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

W

West Hill Park School

westhillpark.com

49

West Hill Park School is an independent preparatory school located in Hampshire, UK, offering education for children aged 2 to 13, including nursery, pre-prep, prep, and boarding services. The school emphasizes outdoor learning, small class sizes, and a supportive community environment. It is part of the Radley Schools Group and holds memberships with recognized educational associations, enhancing its market credibility. The website reflects a professional and well-structured digital presence, targeting parents and guardians seeking quality independent education for their children. Technically, the website is built on WordPress 7.0 with modern front-end libraries such as Swiper.js, AOS, and Slick Carousel, ensuring a responsive and engaging user experience. SEO is enhanced through Yoast SEO plugin and structured data (JSON-LD) is implemented for better search engine understanding. Cookie consent is managed via CookieYes, demonstrating GDPR compliance. Hosting is provided by Fasthosts Internet Ltd, a reputable provider. From a security perspective, the site uses HTTPS with no visible critical vulnerabilities. It employs Google reCAPTCHA to mitigate spam and bot attacks and provides granular cookie consent options. However, there is no explicit security policy or incident response information published, which could be improved to enhance transparency and trust. Overall, West Hill Park School's website is a secure, compliant, and professionally maintained platform that effectively supports its educational mission and business objectives. Strategic recommendations include publishing a dedicated security policy, incident response contacts, and vulnerability disclosure information to further strengthen security posture and stakeholder confidence.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.

QED Project Engineering Limited is an established engineering services company, originally founded in 1978 as Quindes Limited. The company specializes in providing tailored engineering design solutions and personnel secondment services primarily to process and manufacturing industries. Their business model focuses on flexibility, offering services ranging from detailed engineering drawings to turnkey project management. Despite a long history and ISO 9001 certification, the website's technical infrastructure is outdated, relying on deprecated Flash technology and lacking modern security practices such as HTTPS and security headers. The absence of WHOIS registration data raises concerns about domain legitimacy, although the website content appears professional and safe. Overall, the company presents as a niche engineering service provider with room for digital modernization and improved security posture.

Spedeworth Motorsports operates as a UK-based motorsports event promoter specializing in stock car racing. The website serves primarily as an introductory landing page featuring an embedded Facebook video and minimal additional content. The business targets motorsports enthusiasts and event attendees within the UK. The digital presence is basic with limited content and dated design elements, indicating a low level of digital maturity. Technically, the site uses simple HTML, CSS, and JavaScript with no modern frameworks or CMS detected. Security posture is weak, lacking essential HTTP security headers and comprehensive SSL/TLS configuration, though HTTPS redirection is implemented via JavaScript. Privacy and cookie policies are absent, and no contact or incident response information is provided, which impacts compliance and trust. The domain WHOIS lookup failed due to the domain name violating Nominet UK naming rules, raising concerns about domain legitimacy and registration consistency. Overall, the site presents a low-risk profile but requires significant improvements in security, privacy compliance, and content richness to enhance trust and professionalism.

G

Guideline Surface Marking ltd

guidelineltd.co.uk

44

Guideline Surface Marking ltd is a UK-based national line marking contractor with over 40 years of industry experience. The company provides a wide range of surface marking services including road marking, car park line marking, warehouse floor marking, and sports venue markings. They serve a diverse clientele including local authorities, businesses, and large commercial entities. The website reflects a professional and trustworthy business with multiple industry certifications and accreditations, positioning them as a leading service provider in their sector. Technically, the website is built on WordPress with a modern tech stack including jQuery, Google Analytics, Microsoft Clarity, and Google Tag Manager. The site is mobile optimized, has good SEO practices, and uses cookie consent mechanisms to comply with privacy regulations. Hosting and domain registration are consistent with a legitimate UK business, though DNSSEC is not enabled, and some security headers are missing. From a security perspective, the site uses HTTPS and implements cookie consent, but lacks explicit security policies, incident response contacts, and vulnerability disclosure mechanisms. No critical vulnerabilities or exposed sensitive data were detected. The overall security posture is moderate with room for improvement in DNS security and HTTP headers. Overall, the website is safe, professional, and compliant with GDPR requirements. It effectively supports the business's credibility and market position. Strategic recommendations include enabling DNSSEC, adding security headers, publishing security and incident response policies, and implementing a vulnerability disclosure program to enhance trust and security maturity.

TLS configuration is broken — Guard could not complete a full scan, but the certificate state alone is a high-severity finding the recipient should action immediately.