State of cyber hygiene in Kitchener-Waterloo

The headline findings

Every number here comes from the public-facing side, public DNS records and a single visit to each home page, collected October 27, 2026. No business is named. This is not name and shame. It is meant to draw attention to things we do not normally pay attention to. The sections that follow break each figure down by sector, town, and platform, and the method note at the end explains exactly what was checked, and what was not.

1. A critical flaw in PHP, the software that runs most of the web, was disclosed on October 21, 2026 and is already being exploited. It hands an attacker control of the server with no password needed, and the US cyber agency ordered federal systems to patch it by October 29. At least 7 small-business sites in Kitchener-Waterloo are advertising a PHP version that is either unpatched against this bug or on a release line that will never get a fix. That is a floor, not a ceiling: most sites hide their version, so the real number is higher.
2. 217 small businesses in Kitchener-Waterloo with a website of their own were checked from the outside for this report, the way any visitor could. Local firms, shops, trades, clinics, and contractors, not chains or government.
3. 172 of them (88%) can be impersonated in email. Without an enforced DMARC record, a scammer can send an invoice or a quote that looks like it came from the business, and the customer's mail provider has nothing to stop it. Only 24 (12%) have that protection turned on.
4. 94 of these sites run WordPress. Of the 54 that publish their version number, 9 are behind on security updates, and 18 sites across the sample still load a code library that stopped getting fixes in 2016. 22 of them take card payments through WooCommerce on that same software.
5. 188 sites (90%) have HTTPS set up properly. The other 22 reachable sites do not fully, and 1 serve a broken, expired, or missing certificate, so a customer typing in a card number or a password cannot be sure who is receiving it.
6. 21 business domains have no SPF record at all, the most basic of the email checks. Anyone, anywhere, can send mail as those businesses with nothing to flag it as fake.
7. 6 domains these businesses are still listed under no longer work, and 2 more show a parking or placeholder page. An abandoned domain can be re-registered by anyone, who then receives the email meant for that business.
8. Scored across every outside check, the typical business in Kitchener-Waterloo lands at 68 out of 100. 22 earned an A. 2 failed outright.

Most domains can be impersonated by email

Nearly every site has HTTPS. Fewer than half use it fully

WordPress carries the region, and tells you its version

Where the sites live, and what stands in front of them

DNS is where most of the easy wins sit

5 domains (2%) are DNSSEC-signed, and 9 publish a CAA record limiting which authorities can issue their certificates. 6 domains in the directories no longer resolve or don't answer at all, and 2 show a parking or placeholder page; those are mostly businesses that let a domain lapse while directories still list it, which is its own risk when someone else registers it and starts receiving their mail.

Who is doing well, and who isn't

Mean score among scored domains, DMARC enforcement among mail-receiving domains, and clean HTTPS among reachable sites. Groups under 10 domains are left out so a single business can't be picked out of a row.

How Kitchener-Waterloo grades out

8 changes that cover most of the gap

Every one of these is a DNS record, a header, or a setting in a platform the business already pays for. None of them need new software.

1. Publish a DMARC record and move it to p=quarantine, then p=reject, once the SPF and DKIM sources are listed. Most providers document this in under a page.
2. Make sure SPF ends in -all (or ~all while testing) and lists only the services that send as the domain. Delete the record for any domain that doesn't send mail and add a null MX.
3. Turn on DKIM signing in the mail platform. Microsoft 365 and Google Workspace both leave it off until an admin enables it.
4. Redirect HTTP to HTTPS and add an HSTS header. On WordPress that is a 2-line change in the web server config or a setting in the host's panel.
5. Remove the version strings: the WordPress generator tag, the Server and X-Powered-By headers. None of them are needed for the site to work.
6. Add the 4 basic headers (X-Content-Type-Options, X-Frame-Options or a frame-ancestors CSP, Referrer-Policy, Permissions-Policy). Cloudflare and most hosts can inject them without touching the site.
7. Update PHP off 7.x and jQuery off 1.x, or move the site to a host that does it for you.
8. Let expired or unused domains go properly: either keep renewing them with a null MX and SPF -all, or accept that the next registrant inherits the name.

How the numbers were collected

• Sample: 217 businesses listed in public chamber of commerce, BIA, economic development, and municipal directories for Kitchener-Waterloo, kept only when the directory itself published a website on the business's own domain. National chains, government, hospitals, school boards, and franchise corporate sites were excluded. One row per root domain.
• DNS: A, NS, MX, TXT (SPF), _dmarc TXT, DKIM at the selectors each mail platform uses by default plus a short generic list, _mta-sts, _smtp._tls, default._bimi, and CAA, resolved over DNS-over-HTTPS with DNSSEC validation reported by the resolver.
• Web: one request to http://domain/ following redirects, one to https://domain/ (falling back to www), response headers, certificate subject, issuer, and expiry as presented, negotiated TLS version, and a single TLS 1.1-capped handshake to see whether the server accepts it. Platform fingerprints come from the home page HTML only (generator tag, asset paths, well-known builder markers).
• Browser render: each reachable site was also loaded once in a headless Chromium browser as a normal visitor, to read the rendered page (which resolves JavaScript-built sites a plain fetch cannot fingerprint), the trackers it runs, and the third-party origins it loads. One home-page view, no clicks, no form entry.
• Hosting: the serving IP of the final HTTPS hostname was resolved over DNS, then its reverse DNS name and the announcing network (ASN and country) were read from Team Cymru's public DNS service. CDN and WAF signatures come from response header names and cookie names on the home page. One extra request per site fetched /.well-known/security.txt.
• PHP2Shell exposure is read from the version string in X-Powered-By or Server headers only, compared against the fixed releases in the PHP advisory of October 21, 2026. No request was sent that touches either vulnerability. Distributions such as Debian and Ubuntu backport fixes without changing the version number, so an old-looking version is not proof of exposure, and a hidden version is not proof of safety.
• Not done: no vulnerability scanning, no port scans, no login or admin pages, no crawling beyond the home page, no mail sent, no interaction with any form. Everything here is what a browser and a DNS resolver see on a first visit.
• Limits: DKIM is checked at known selectors only, so a domain signing at a custom selector shows as not found. Fingerprints identify a platform from markers on one page and can miss heavily customized installs. Results are a point-in-time read on the date shown and sites change daily. Sector labels are approximate.
• Scoring (100 points): email 40 (SPF present 10, SPF -all 5, DMARC present 10, DMARC quarantine or reject 10, DKIM found 5; domains with no MX are scored on the remaining 60), website 40 (valid HTTPS 15, HTTP to HTTPS redirect 5, HSTS 5, TLS 1.1 refused 5, X-Content-Type-Options 2, frame protection 3, Referrer-Policy 2, enforced CSP 3), platform 20 (no server version in headers 5, no CMS version in page 5, no jQuery 1.x 5, no mixed content 5). Grades: A 85+, B 70+, C 55+, D 40+, F below 40.
• Validation and environment correction: the data was cross-checked against an independent direct-network re-scan of the same domains (1,167 records corrected, 273 confirmed). Two collection-environment artifacts were found and removed. Serving IP addresses that the collection proxy had returned as a placeholder were replaced with the real addresses resolved over DNS. Security headers that the original high-concurrency pass had missed on some responses were recovered by taking, for each site, the union of three careful measurements, since a scan can miss a header that is present but never reports one that is absent. Certificate issuers and site status were checked and found accurate as originally collected.
• No business is named in this report. Each business can get its own line from the underlying data on request.

Author: Hans Study, CISSP, independent network and security consultant, Ontario, Canada. Published as part of the close of Cyber Security Awareness Month, October 2026. Companion reports: London-Middlesex, Sarnia-Lambton, Chatham-Kent, Cambridge, Brantford-Brant, Windsor-Essex. The combined numbers and the 5 fixes are on the series hub.