The most serious finding is not an SEO problem. It is a member-data exposure affecting 943 people, live and unremediated, alongside an end-of-life CMS, publicly reachable admin logins, and crawl waste consuming 96% of the site.
Everything below was reached by an ordinary unauthenticated browser or search crawler. No authentication was attempted, no injection, no vulnerability scanning, no state change.
| Area | Severity | One line |
|---|---|---|
| Member directory PII | CRITICAL | 943 members' names plus reversible email hashes, no login |
| End-of-life Joomla | HIGH | research.iands.org unpatched 1,075 days |
| Public admin logins | MEDIUM | 3 live cPanel logins plus CMS admin on the open internet |
| Open staging / dev hosts | MEDIUM | 12 crawlable WordPress copies, no noindex |
| Crawl traps / index bloat | SEO | 7,151 of 7,413 URLs are junk; ~262 real pages |
| URL form and canonicals | SEO | http/https/www split, 90 canonicals point at redirects |
Confidence key. Every number on this page was measured directly unless the text says otherwise. Where severity was observed but could not be confirmed without an intrusive test, it is called out as unconfirmed rather than asserted.
The 2026 conference room and ride-sharing directory is fully public — no login, no rate limit, no noindex — and walkable page by page through a simple pagination parameter. Thirty-eight listing pages were enumerated unauthenticated.
@ and . substituted — readable by eye, no computation needed.This is very likely a notifiable data breach given identifiable members, some of them international and therefore in GDPR scope. That determination belongs to IANDS's counsel, not to this audit.
Neither the slug nor the avatar hash is fatal alone. Together they are, and that is the part most likely to be missed by whoever reviews this.
A slug of the form firstnamelastnamegmail-com could correspond to several real addresses — firstnamelastname@, firstname.lastname@, firstnamelast.name@ and so on. On its own it is a strong guess, not a confirmed address.
Gravatar avatar URLs embed SHA-256(lowercase(trim(email))) — unsalted, no secret. Hash each candidate address and the one that matches the published hash is the member's real address, confirmed with certainty. The same trick works from a member's public name plus common address patterns, even when the slug is unrelated to their email.
Across the full 943-member directory, 488 of 943 addresses (52%) were recovered from public data alone — 453 hash-confirmed and 35 spelled out directly in the slug. No external breach corpus was used.
488 is a floor on impact, not a ceiling. The remaining 455 members still publish a Gravatar hash of a real address and fall to a larger wordlist or a precomputed rainbow table of common addresses. Removing the slugs alone does not close this — the hash has to go too.
Practically: treat the directory as having disclosed 943 name-to-email pairs, not 373.
research.iands.org runs Joomla 3.10.12, confirmed from two public version files.
| Milestone | Date | Elapsed |
|---|---|---|
| Joomla 3 end of life | 2023-08-17 | 1,075 days ago |
| Paid extended support (eLTS) ended | 2025-02-17 | 525 days ago |
| Current major version | Joomla 5 | two majors ahead |
The result is a public-facing CMS receiving zero security patches of any kind for nearly three years. Fix: migrate to Joomla 5, or retire the subdomain outright if the content no longer earns its keep.
Three hosting control panels answer publicly with a live login, and ten login forms in total are served unauthenticated across the CMS and panel hosts.
| Host | What it is | Why it matters |
|---|---|---|
cpanel.iands.org | cPanel login | A single cPanel credential controls files, databases, all email, and DNS for the entire hosting account — the highest-value target on the estate |
cpanel.isgo.iands.org | cPanel login | |
cpanel.symposium.iands.org | cPanel login | |
iands.org/wp-login.php | WordPress admin | Credential stuffing and password spraying targets; also fingerprints the stack for CVE matching |
ige.iands.org/wp-login.php | WordPress admin | |
research.iands.org/administrator/ | Joomla admin |
The fix is not a stronger password — it is removing the login from the public internet: IP-allowlist the cPanel logins, and enforce 2FA plus a login limiter on the CMS logins.
Unconfirmed: whether 2FA is already enforced could not be established without attempting a login, which was deliberately not done.
Hostname enumeration across three public sources found 59 hostnames, of which 56 respond over HTTP: 45 indexable, 11 blocked.
The staging and dev family — staging, staging-1 through staging-4, dev, dev1 under isgo, plus staging-1.conference and their www. variants — serve live WordPress copies with no robots.txt, no meta-robots, and no canonical. Two serve open Apache directory listings.
Staging installs routinely carry the weakest credentials on an estate and the least-patched plugins. Fix: put them behind HTTP auth or take them offline.
ige.iands.org canonicals its own homepage to https://iands.org/, declaring itself a duplicate of the apex.shopiands.iands.org returns 404 and canonicals to an insecure http:// URL.iandsce.iands.org is a public "Account Suspended" cPanel page.conferencearchives.iands.org is 403 with no robots.txt.lamp1, matomo, projects and ruby.iands.org advertise OpenSSL 1.1.1q / 1.1.1l, a series that went end-of-life upstream 1,050 days ago. Caveat that matters: Linux distributions routinely backport security fixes while keeping the old version string, so the banner does not prove these are unpatched. Verify the actual build server-side before treating this as a live vulnerability.
No HSTS, referrer-policy or permissions-policy on the main hosts. ige.iands.org additionally lacks CSP and X-Frame-Options, so it has no clickjacking protection. Individually minor, collectively easy to fix.
"WordPress version disclosure" — isgo reports WordPress 7.0.2, which is a current, patched release. Disclosing a current version is not a meaningful flaw. Removed rather than left in to pad the count.
xmlrpc.php is disabled (405/404).isgo.iands.org serves its login at a custom path, not the default.The full crawl finished at 7,413 total crawlable URLs — the site's real size, well below the 60,000 cap. Of those, 7,151 (96%) belong to just two URL patterns that generate pages rather than hold content.
| Pattern | URLs | Status codes |
|---|---|---|
Legacy shopping cart (/shoppingcart/index.php?...) | 5,144 | 301×2,440 · 200×2,396 · 302×302 · 410×4 · 404×2 |
| Conference member directory (profiles, history, pagination) | 2,007 | 200×2,006 · 301×1 |
| Real content URLs | ~262 | — |
Google is being asked to crawl 28 junk URLs for every real one. Many of the shopping-cart URLs are insecure http://www. addresses from an old osCommerce or Zen Cart install.
Rate-limiting signal. Under an earlier, faster crawl, seven shopping-cart URLs returned HTTP 429 (Too Many Requests) — the server throttling the crawler. The slower full crawl drew zero 429s, so the behaviour is speed-dependent rather than constant. It still matters: Googlebot responds to 429s by slowing its crawl of the whole site.
Pages resolve over both http and https and both www and bare hostnames, splitting whatever ranking signal they earn across duplicate addresses.
90 canonical tags point at URLs that themselves redirect. That is the highest-value quick fix on the technical side: a canonical is supposed to name the final destination, and one that redirects makes the whole signal ambiguous.
OnPage score 91.18. Server is Sucuri/Cloudproxy; the CMS is Elementor 4.2.0.
| Issue | Count | Note |
|---|---|---|
| Duplicate content pages | 2,046 | largely the two crawl-trap patterns |
| Non-indexable pages | 2,056 | — |
| Broken link instances | 2,419 | resolving to 23 distinct broken URLs (19 hard 404s, 4 410s) |
| Duplicate titles / descriptions | 123 / 123 | — |
| Titles over display limit | 329 | plus 32 too short |
| Pages with images missing alt text | 328 | accessibility as well as SEO |
| Pages served without compression | 545 | — |
| Pages with render-blocking resources | 531 | — |
| Internal / external links | 484,087 / 36,590 | inflated by the crawl traps |
The broken URLs are largely leftover Joomla URL shapes — .html endings and /component/weblinks/ paths — from a migration that never cleaned up after itself.
A page on affordable restaurants in Oak Brook, Illinois ranks for roughly 5,800 monthly searches. That is traffic which cannot convert on a near-death-studies nonprofit; it is almost certainly a leftover conference-venue guide. Fold it into the conference page or noindex it.
A separate pass crawled 531 apex URLs, excluded the member-directory subtrees entirely, and searched the remaining 232 real content pages for every name on the member lists. Excluding the directory matters: leave it in and every name matches itself, which measures nothing.
| List | People | Mentioned in content | Rate |
|---|---|---|---|
| Full member directory | 943 | 51 | 5.4% |
| Confirmed-email subset | 488 | 36 | 7.4% |
So roughly one member in twenty is ever written about on the site that publishes their name and email. The directory is not an author roster or a contributor list — it is a conference logistics form that became a public database.
Read the top of that list carefully. The single highest-count match appears on around 80 pages, but as the site's news-author byline — not as the subject of 80 write-ups. Page-count alone will mislead anyone who does not check what kind of match it is.
Sixty-eight percent of ranked keywords now return a Google AI Overview, covering roughly 80% of ranked search volume — and IANDS is the fifth most-cited domain inside those overviews, with 48 citations. For a nonprofit in this space that is a genuinely strong position and worth defending.
YouTube is both the single most-cited AI-Overview source and the top organic domain for these queries — but the videos ranking belong to other channels. IANDS has a channel (@IANDSvideos) and sells video through isgo. The gap is that its video content is not surfacing for its core terms, not that it is absent.
Corrected from an earlier draft, which wrongly stated there was no video presence at all.
Nothing here has been executed. These are instructions for whoever holds server and DNS access.
| # | Action | Why now |
|---|---|---|
| 0 | Close the public member directory. Require login; stop deriving usernames from email addresses; suppress the Gravatar hashes; request removal of any already-indexed profile pages. | Live PII exposure of 943 identifiable people. Outranks everything below it. |
| 1 | Migrate research.iands.org off Joomla 3, or retire the subdomain. | Nearly three years without a single security patch. |
| 2 | IP-allowlist the three cPanel logins; add 2FA and a login limiter to the CMS logins. | Highest-value credential target on the estate. |
| 3 | HTTP-auth or decommission the 12 staging and dev hosts. | Weakest credentials, and duplicate content besides. |
| 4 | Fix the 90 canonicals that point at redirecting URLs. | Cheapest technical win with a real ranking effect. |
| 5 | Block or retire the /shoppingcart/ URL space in robots.txt and remove internal links into it. | Recovers most of the wasted crawl budget in one move. |
| 6 | Consolidate URL forms onto one canonical host and scheme. | Stops splitting signal four ways. |
| 7 | Clear the on-page volume issues: titles, alt text, compression, render-blocking. | Mechanical, delegable, no judgment calls. |
Read-only reconnaissance: public page crawling, third-party SEO APIs, and response-header and version-file inspection. No authentication attempts, no injection, no vulnerability scanning, no state changes. Every endpoint cited is one an ordinary browser or search crawler reaches unauthenticated. Hostname enumeration drew on three independent public sources (two certificate-transparency APIs and one passive-DNS source); one of the three was returning errors on the day and contributed nothing, which the tooling recorded rather than silently absorbed.
site: queries or Search Console.Absence of a finding is not evidence of security. This audit establishes what is visible from outside without touching anything. It does not establish that nothing else is wrong.
Recovered personal data is held privately, was never committed to any repository or published, and is referenced on this page only in aggregate. No member name or email address appears anywhere in this document. Any decision to notify IANDS, or to treat the member-directory exposure as a reportable breach, belongs to the site owner and appropriate counsel.