HTTPS is enabledPublic site address is served over HTTPS.Passing
PHP & WordPress versionsPHP 8.5.10 + WordPress OK.Passing
Encryption key sourceActive encryption-key source: filePassing
Encryption key file permissionsKey file permissions OK (mode 600).Passing
Two-factor authenticationTwo-Factor plugin not active. Install and enrol at least one admin.Recommended
Data retention periodRetention set to 730 days. Gift Aid 6-year carve-out enforced.Passing
Data Protection Officer contactDPO contact: info@nebula.designPassing
Trusted proxies / CDNTrusted-proxy configuration OK.Passing
PCI DSS SAQ-A attestationAttested by David Pottrell on June 2, 2026 at 3:09 pmPassing
Card details NEVER reach this WordPress install
No custom theme or plugin on this site captures card data
The charity has read the PCI SAQ-A worksheet