Iraq Government Web Estate — Security Audit

The problem

A new dev team member needed a baseline read on the security posture of the Iraqi government's public web estate before any in-depth work began. The 27 sites in scope — executive-branch, regulatory, and service-delivery ministries — were operated by different teams on different stacks, with no consolidated picture of where the common weaknesses lay. The constraint: passive reconnaissance only. No login attempts, no payload injection, no WAF bypass. Anything beyond passive inspection required explicit manager approval.

My approach

For each site, I inspected the HTTP response headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy), TLS certificate metadata, cookie attributes (Secure, HttpOnly, SameSite), and tech-stack fingerprints (Apache, Nginx, Plesk, WordPress, Nuxt). A content-hash check distinguished real exposures from WAF fallback pages. Findings were sorted into four severity tiers and four ministry categories, then cross-referenced for patterns. The final deliverable was a bilingual (Arabic/English) executive summary that a non-technical manager could read in under three minutes, plus per-site deep dives for the engineers.

The result

Eleven sites could be fully probed; twelve sat behind Cloudflare Bot Management and required a real browser session; four ministries had no resolvable public web presence at all. The most common gaps — missing Content-Security-Policy, missing Referrer-Policy, missing Permissions-Policy — were consistent across the estate regardless of stack, which pointed to a process problem rather than a tooling problem. The report gave the manager a single baseline for prioritizing remediation, plus a bilingual channel back to the relevant teams. A redacted methodology sample is available on request.