Vantyris · Case study
CS-004 · Published 2026-05-23
An independent e-commerce retailer (handmade goods) in West Yorkshire.
Sole trader plus one part-time fulfilment assistant · e-commerce sector
Score after remediation
62 to 89
- Findings closed
- 3 of 3
- Time to first fix
- about 15 minutes (plugin patch)
- Time to all fixes
- about 1 week
What made them run a scan
A returning customer reported their card details "felt suspect" after checking out (no actual breach, the customer's card was eventually marked clean by their bank). The owner wanted certainty before October-to-December peak season began.
What Vantyris found
- 01
WordPress contact-form plugin with a known CVE in the curated set
highThe plugin in question had a public CVE from 2025 affecting versions earlier than the one shipped at the time of the scan. The site was on an old version.
- 02
Missing Content-Security-Policy exposing checkout iframe to clickjacking risk
mediumThe Stripe-hosted checkout iframe was loaded without an enforced CSP frame-ancestors directive. Not currently exploited, but the recommended hardening.
- 03
SSL Labs grade B due to legacy ciphers from the host's default config
mediumThe hosting account offered cipher suites that included CBC-mode TLS 1.0 fallbacks. Modern browsers do not use them but their presence drops the SSL Labs grade.
- 04
Card data handled by the payment processor; no PCI scope on the site
healthyCard details never touched the merchant's server, the payment processor hosted the checkout entirely. Confirmed via the scan's outbound-form audit.
What they fixed and how
The plugin update took 15 minutes once the owner approved the maintenance window. The CSP and X-Frame-Options headers were added at the Cloudflare layer with help from a community thread, about 45 minutes of work. The hosting cipher list was upgraded by the host on a support-ticket request the same week. A re-scan a fortnight before peak season returned a clean report.
In the customer's words
“I have one developer I use occasionally and no security person. The report gave me the three things to ask them to fix. They were done before the end of the week.”
Owner, online retailer in West Yorkshire
What's next
The retailer has scheduled a re-scan ahead of every product launch and ahead of Black Friday each year. The pattern has become part of the peak-season runbook.