Vantyris · Case study
CS-001 · Published 2026-05-23
A privately owned dental practice in Greater Manchester.
12 staff across one location · clinic sector
Score after remediation
58 to 88
- Findings closed
- 4 of 4
- Time to first fix
- about 1 hour
- Time to all fixes
- about 6 hours, same day
What made them run a scan
A patient asked the practice manager whether her appointment data was safe, after a press article about a clinic-chain breach. The manager wanted a defensible answer for the next person who asked. She found Vantyris by searching for "small business security check" and ran a verified scan on the practice's main domain.
What Vantyris found
- 01
Missing DMARC policy on the booking-system domain
highThe booking subdomain had no DMARC TXT record. Any sender on the public internet could send email claiming to be from that subdomain and a recipient's mail server had no policy to follow when it failed authentication.
- 02
WordPress admin reachable on port 8080 from any IP
highA development WordPress instance had been left exposed on port 8080 after a site refresh in 2024. The login page was indexed by search engines.
- 03
Missing Content-Security-Policy and X-Frame-Options headers
mediumThe main site set HSTS correctly but did not return CSP or X-Frame-Options, leaving the booking flow open to clickjacking framing from third-party sites.
- 04
TLS 1.3 with strong cipher suites; HSTS preloaded
healthyThe TLS configuration scored an A on SSL Labs and HSTS was set with a 1-year max-age. No work needed on the transport layer.
What they fixed and how
The practice manager forwarded the PDF to the web host (a UK shared-hosting provider). The host firewalled port 8080 within one hour of the ticket and added DMARC, CSP, and X-Frame-Options at the Cloudflare layer the same afternoon. A re-scan that evening confirmed every High and Medium finding closed. Total elapsed time from first scan to all-fixes confirmed: about 6 hours, of which the practice manager spent about 25 minutes (the scan, the ticket, and the re-scan).
In the customer's words
“I am a practice manager, not an IT person. The report told me exactly what to ask the web host to do, and they did it the same afternoon. I forwarded the PDF to a patient who asked, and that was the end of the conversation.”
Practice manager, dental practice in Greater Manchester
What's next
The practice has set the same scan to repeat monthly. Two follow-up scans have confirmed the fixes have held. The manager has the PDF on file for the next patient enquiry and for the practice's annual CQC self-assessment evidence pack.