Hi,
First, thanks for this plugin, it solved lots of security issues. But may I ask if HMWP can fix or how many can it can fix for these security holes in a site outlined belowed (also attached screenshot)?

1 Malicious File Upload – Critical
2 Cross Site Scripting – High
3 Sensitive Information Sent Over Unencrypted Channel – High
4 Cross-Site Request Forgery High – High
5 Valid account can be brute forced – Medium
6 Weak Password Policy Medium – High
7 Autocomplete and Autofill enabled – Medium
8 ClickJacking Low – High
9 HTTP Method(TRACE) enabled on server – Low
10 Source Code Disclosure Pattern Found – Low
11 HTTPOnly attribute not set in session cookie – Low
12 Application Does Not Display Last Login Time and Date – Low
13 Application is Vulnerable to Simultaneous Login – Low
14 Session timeout is not set – Low
15 Email ID Can be Harvested for Spamming – Low
16 Valid Users can be Enumerated from the Error Messages at Login Page – Low
17 The Application does not Log off Users on Suspicious Requests – Low
18 Robots.txt Found on Site – Informational

How can these holes be fixed?

Also, how can we be sure if HMWP doesn’t have a security hole that can be exploit?

Finally, can we use HMWP on AWS?

Thanks in anticipation.

With regards

Thanks in anticipation