Most small and medium businesses across East Africa run on WordPress, a lightweight custom PHP site, or an off-the-shelf e-commerce platform — built quickly, on a tight budget, with no dedicated security review. That's not a criticism; it's just how growing businesses move. But it also means the same handful of issues shows up again and again when we run a MulikaScans assessment. Here are the five we see most often, and what to do about each one.
1. SQL Injection
SQL injection happens when user input — a login field, a search box, a URL parameter — gets passed straight into a database query without being sanitized. An attacker who finds one of these can often read, modify, or delete data they were never meant to touch, and in the worst cases take over admin accounts entirely.
Fix: use parameterized queries or prepared statements everywhere — never build SQL strings by concatenating user input. Most frameworks and ORMs do this by default; the risk shows up in older or hand-rolled PHP/MySQL code. A web application firewall can catch some attempts as a stopgap, but it doesn't replace fixing the query itself.
2. Missing Security Headers
Headers like X-Frame-Options, Content-Security-Policy, and Strict-Transport-Security cost nothing to add but are skipped constantly. Without X-Frame-Options, for example, your site can be embedded in an invisible frame on another page — a technique called clickjacking, used to trick visitors into clicking things they didn't intend to.
Fix: most modern frameworks and CDNs let you set these headers in a few lines of config. Run your domain through a free header-checking tool after deploying to confirm they're actually being sent — misconfiguration is easy to miss.
3. Exposed Admin Panels with Weak Credentials
/admin, /wp-admin, and similar paths are the first thing an automated scanner checks, and they're rarely hidden. Combined with a default or weak password — or no rate limiting on login attempts — an exposed admin panel becomes a simple brute-force target rather than a real barrier.
- Restrict admin access by IP address or VPN where possible
- Enforce multi-factor authentication on every admin account
- Rate-limit or lock out repeated failed login attempts
- Remove default, sample, or unused accounts entirely
4. Outdated CMS Software and Plugins
WordPress and similar platforms make it easy to add functionality through plugins — and easy to forget to update them. Publicly disclosed vulnerabilities in old plugin versions are exactly what automated attack bots scan the internet for; the site doesn't need to be targeted specifically to get hit.
Fix: keep core software and plugins on their latest stable versions, remove anything that's no longer in use, and test updates on a staging copy before pushing to production if the site is business-critical.
5. Missing or Misconfigured HTTPS
Some sites still serve pages over plain HTTP, or load a mix of HTTPS and HTTP resources on the same page — both of which let data travel unencrypted and expose visitors to interception on shared or untrusted networks.
Fix: force HTTPS redirects site-wide, make sure every asset the page loads is served over HTTPS too, and enable Strict-Transport-Securityso browsers refuse to fall back to HTTP. Free certificates from Let's Encrypt make this close to zero-cost.
None of this is exotic — that's the point
These five issues aren't sophisticated attacks; they're the fundamentals attackers check first, precisely because they're common. It's the same pattern you can see in the sample scan output on our MulikaScans section: a flagged SQL injection vector, a missing security header, an exposed admin panel — and HTTPS correctly enforced.
If you're not sure which of these apply to your own site, that's exactly what a scan is for. Visit mulikascans.com or get in touch to have us take a look.