Articles ·
Clinic website security: we checked 71 private clinic websites in Lviv — none blocks spoofed email
Clinics hold the most sensitive data there is — diagnoses, test results, appointments — and patients trust their websites and emails. We checked how well that trust is protected: 71 private clinic websites in Lviv, Ukraine, October 2026.
How we checked
We collected private clinic websites in Lviv from public sources: dental, multi-specialty and diagnostic centres, eye clinics, cosmetology and rehabilitation. National chains were excluded. The check was automated and passive: we looked at the home page and public DNS records exactly as any visitor or search engine sees them. No intrusion attempts, no hidden pages, no password guessing. We publish only aggregate numbers, no clinic names.
The headline: anyone can send email as the clinic
Not one of the 71 domains has DMARC set to block spoofed email. 79 % have no DMARC record at all; the rest only monitor (p=none) and stop nothing. For a patient this means a fraudster can send an email from the clinic’s address — “your test results are attached”, “pay for your appointment here” — and the inbox will not flag it.
Server security settings
- 80 % have no HSTS, so browsers are not told to always use a secure connection.
- 89 % have no Content Security Policy limiting third-party scripts.
- 82 % are not protected from being framed inside another site.
Outdated components
68 % run on WordPress, which is fine when it is kept up to date. But 41 % show their WordPress version in the page code. 15 % load jQuery older than 3.5, with known XSS vulnerabilities, some still on 1.x. At least 6 sites expose a PHP version that no longer receives security updates.
Accessibility for patients with visual impairments
83 % of sites have images with no text alternative; overall 1,522 of 4,932 images (31 %) have none. A blind patient using a screen reader cannot know what they show: directions, prices, doctors.
What is done well
All 71 sites use HTTPS, all are mobile-friendly, and none loads Russian analytics trackers. The basics are there — the next step is missing.
Four steps for a clinic manager
1. Ask whoever runs your email: “Do we have SPF, DKIM and DMARC, and is DMARC set to block, not just monitor?” If the answer is no, it is an hour or two of work and the website keeps running.
2. Ask your developer when WordPress and plugins were last updated and whether there is a recent backup. If updating is “impossible because everything will break”, it is time for a new site.
3. Ask your developer or host to switch on basic security headers: HSTS and protection from framing.
4. Have someone add short descriptions to important photos: doctors, rooms, the entrance. Not “photo 1”, but “Clinic entrance from the street, ramp on the right”.
You can run the same and several more checks on your own website for free, in about a minute, with the OLBO Website Checker.
Study by OLBO, a web studio in Lviv. Data as of 15 October 2026; automated checks are approximate and individual figures may vary. Journalists are welcome to use the numbers with a link to olbo.com.ua.