Skip to main content

Security report for flowers24.lv

FLOWERS24 LTD · Retail · Latvia

High risk. 13 critical or high findings in GDPR compliance, Network security and 3 other checks.

Security score

46/100

Risk levelHigh

Flowers24.lv is a small e-commerce business specializing in flower and teddy bear sales with delivery services primarily targeting the Latvian market, especially Riga. The website is built on WordPress with WooCommerce, leveraging popular plugins and integrations for e-commerce functionality and marketing. The company presents clear contact information and maintains a presence on multiple social media platforms, enhancing customer engagement. The site includes privacy and cookie policies with consent mechanisms, indicating awareness of GDPR compliance. Technically, the site is hosted on SiteGround and uses modern web technologies, but lacks some security headers that could improve its security posture. The absence of WHOIS data limits domain legitimacy verification, but the website content and business information appear consistent and professional. Overall, the site offers a good user experience with clear navigation and product presentation, suitable for its target audience.

Scanned

NIS2 and GDPR posture

NIS2 posture
2/ 100 · Critical
GDPR posture
48/ 100 · High
Checks completed
7of 7

Indicative only: based on publicly visible signals, not a certification or legal assessment. NIS2 signals relate to Article 21 of Directive (EU) 2022/2555; GDPR signals to Articles 7, 12, 13 and 32 of Regulation (EU) 2016/679 and Article 5(3) of the ePrivacy Directive.

Priority findings

13 findings rated critical or high. Fix these first.

  1. GDPR compliance

    These are the privacy signals visitors and data protection authorities look for under GDPR.

    • Critical

      EU business without adequate privacy measures

      EU businesses are subject to strict GDPR requirements

      What to do: Implement comprehensive GDPR compliance including privacy policy, cookie consent, and data protection measures

  2. Network security

    Services reachable from the internet are the first thing attackers probe. Anything open that does not need to be should be closed.

    • Critical

      Critical Service Exposed: PostgreSQL

      Port 5432 (PostgreSQL) is publicly accessible - PostgreSQL - Database server

      What to do: Immediately restrict access to PostgreSQL using firewall or VPN

      • NIS2 21(2)(e)
      • IR 2024/2690 6.7.2(f): Implementing Regulation (EU) 2024/2690, Annex point 6.7.2(f): Network security
      • NIST CM-7: NIST SP 800-53 Rev. 5 CM-7: Least Functionality
      • NIST SC-7: NIST SP 800-53 Rev. 5 SC-7: Boundary Protection

  3. Security headers

    Security headers are instructions your web server sends to every visitor’s browser. Missing ones leave visitors more exposed to attacks such as clickjacking and injected scripts.

    • High

      Missing Strict-Transport-Security header

      Forces HTTPS connections

      What to do: Add "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload"

      • CWE-319
      • OWASP A04:2025
      • ASVS V3.4.1
    • High

      Missing X-Frame-Options header

      Prevents clickjacking attacks

      What to do: Add "X-Frame-Options: DENY" or "X-Frame-Options: SAMEORIGIN"

    • High

      Missing Content-Security-Policy header

      Controls resources the browser is allowed to load

      What to do: Implement a Content-Security-Policy appropriate for your application

      • ASVS V3.4.3
      • OWASP Secure Headers: OWASP Secure Headers Project recommends Content-Security-Policy: default-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none';…

Need hands-on remediation? Email guard@offseq.com

Keep watching flowers24.lv

This scan found 34 issues across 7 checks. Monitoring re-runs those checks daily, emails you when something material changes and records each fix, so you can show progress.

Daily monitoring

Recommended

€25per month

  • TLS certificates and expiry
  • DNS records
  • SPF, DKIM and DMARC
  • Security headers
  • GDPR and NIS2 posture
  • Exposed services
  • Third-party trackers
  • Risk score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly. Cancel anytime. The full timeline opens with your unlock code.

Full report

€39.90one-time

  • The complete analysis as a PDF you can cite
  • Email delivery with an unlock code
  • Lifetime access to this report

Prices incl. 21% VAT. Payments by EveryPay; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

The business operates in the retail and e-commerce sectors, focusing on flower delivery and gift items. Its market positioning is local/regional with a focus on Riga and Latvia. The business model is direct online sales with delivery, supported by a WooCommerce platform. Key competitive advantages include a diverse product catalog, active social media presence, and clear customer contact channels. Revenue streams are primarily product sales and delivery fees. The company appears to be small-sized with no visible parent or subsidiary companies. Growth indicators include recent product additions and active marketing integrations. The partnership ecosystem includes common service providers like SiteGround hosting and Google/Facebook marketing tools.

Security posture

The website enforces HTTPS and uses secure login forms, which are positive security indicators. However, it lacks important security headers such as Content-Security-Policy, X-Frame-Options, and others that help mitigate common web attacks. No exposed sensitive data or vulnerable libraries were detected in the HTML content. The site would benefit from implementing these headers and conducting regular security audits, especially for WooCommerce plugins. There is no visible incident response or vulnerability disclosure information, which could be improved to enhance trust and readiness. GDPR compliance is indicated but not deeply detailed. Overall, the security posture is moderate but with room for improvement.

Recommendations

  1. Implement comprehensive security headers including Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
  2. Enable HTTP Strict Transport Security (HSTS) to enforce HTTPS connections.
  3. Regularly update WordPress core, themes, and plugins to patch known vulnerabilities.
  4. Add a dedicated security or incident response page with contact information for reporting issues.
  5. Enhance privacy policy details to explicitly cover GDPR compliance and data retention policies.

Contact details published on the site

Addresses
Legal name
FLOWERS24 LTD
Registration number
11215737
Site observations

Automated reading of the public site. Ratings are indicative.

Business

Company
FLOWERS24 LTD
Description
Flowers24.lv is an e-commerce website specializing in the sale and delivery of flowers and teddy bears, primarily targeting customers in Riga and surrounding areas. The site offers various flower categories including roses, tulips, peonies, and gift items like teddy bears in multiple sizes.
Key services
Flower sales, Teddy bear sales, Delivery services
Content quality
good
Branding
consistent

Technology

Stack
WordPress, WooCommerce, PHP, jQuery, Google Maps API, Slider Revolution, KingComposer, YITH WooCommerce Wishlist, WooCommerce Payments, Jetpack
Frameworks
WooCommerce, WordPress
Platforms
WordPress CMS
Performance
moderate
Mobile
good
Accessibility
basic
SEO
good

Security

Observed score
65/100
Good practices seen
  • HTTPS enforced
  • Secure login forms
  • No exposed sensitive data in HTML

Analytics and tracking

Services
Google Analytics, WooCommerce Google Analytics Integration, Jetpack Stats
Tracking level
moderate
Privacy compliance
basic

Advertising

Tracking pixels
Facebook Pixel
Marketing tools
Facebook Pixel, WooCommerce Google Analytics Integration
Transparency
basic

Site quality

Design
good
User experience
good
Content relevance
good
Navigation
good
Professionalism
good
Trustworthiness
moderate

Key observations

  1. Website is a WordPress WooCommerce e-commerce site selling flowers and teddy bears.
  2. Content is well structured with clear navigation and product categorization.
  3. Contact information and social media links are prominently displayed.
  4. Privacy and cookie policies are present with consent mechanisms.
  5. No WHOIS data available due to query limit error; limits domain legitimacy verification.
  6. No security headers detected; opportunity to improve security posture.
  7. Uses common marketing and analytics tools including Facebook Pixel and Google Analytics.
  8. No adult or questionable content detected; safe for general audiences.
Technical notes

Notes

The website is built on WordPress CMS with WooCommerce for e-commerce functionality. It uses popular plugins such as YITH WooCommerce Wishlist, Jetpack, KingComposer, and Slider Revolution. Hosting is provided by SiteGround, a reputable hosting provider. The site loads various external resources including Google Fonts, Google Maps API, Facebook Pixel, and Google Analytics. Performance is moderate with good mobile optimization and basic accessibility features. SEO is supported by proper meta tags and structured navigation. Technical debt is minimal but security enhancements are needed. The site architecture supports scalability for product catalog growth and marketing integrations.
Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are taken from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures.

Retrieved 2026-10-24

Reviews of this site

Share your experience with flowers24.lv. Every review is verified by email and published after moderation.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

Loading reviews…

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.