Web security audit
A web security audit, without penetration testing
Sites are rarely lost to a sophisticated attack; they are lost to a plugin that hasn't been updated in two years, or a forgotten backup file.
This service is exactly that look: your site is examined as an ordinary visitor would see it, and the findings are ordered from most to least important.
The scope, before anything else
This audit is performed from the outside and never touches your site: the certificate, security settings, publicly reachable files, outdated plugins and the login page. It is not a penetration test.
Scope of work
What this service includes
Each item is an independent job, chosen and priced separately — not a bundle you have to buy whole.
Certificate and site encryption
The site's security certificate, its expiry date, and whether every page loads over HTTPS.
Server security settings
Security headers — the settings the server hands the browser: which exist, which don't, and which have no effect.
Publicly reachable files
Forgotten backups, configuration files and admin pages that should not open from outside.
Outdated plugins
The CMS, theme and plugin versions are compared against the latest published releases.
Known vulnerabilities
Recorded holes for those exact versions are listed; it is a version match, not proof of a breach.
The site login page
Where the login page is exposed, whether it limits attempts, and whether its error messages give anything away.
Outcomes
What changes once it is running
Instead of percentages we've written the mechanism. What is guaranteed is that the work and the cost stay clear.
Priorities, not a list
Findings are ordered from most to least important, so it is clear what to fix first.
Reproducible
Every finding comes with reproduction steps, so your own technical team can see and confirm it.
No operational risk
Because the site is never touched, the audit can run on a site that is live.
History
Running it again after the fixes shows the difference and proves the progress.
From inside the panel
How the service gets going
Each stage produces something you can review before the next one begins, and nothing runs without your approval.
- 01
Verify domain ownership
A DNS record or a file proves the domain is yours. Until that is done, nothing starts.
- 02
Audit from the outside
The site is read as an ordinary visitor would read it; no attempt is made to log in.
- 03
Review the findings
Before the report is finalised you see the findings, and anything that is intentional is marked as such.
- 04
Cost estimate
If you also want the fixes, you see the estimate. The report and the fixes are two separate jobs.
- 05
Report and wallet deduction
The prioritised report with remediation guidance is delivered and the cost comes out of the wallet.
Precondition
Domain ownership, before any run
Auditing a site that isn't yours carries legal liability; this gate has no way around it.
A DNS TXT record
One unique record in the domain's DNS — when you have access to the DNS panel.
A file at the site root
A file with a specific name on the site — when you have file access but not DNS.
Re-checked at run time
Ownership is checked again at the moment of the run, because a domain can change hands.
Cost
The report is one job, the fix is another
The same wallet: you top it up in advance and each job is deducted after your own approval.
Audit, per domain
The cost of the audit and report itself; each domain is recorded separately.
Fixes, separate and optional
Buying the report does not commit you to buying the fixes.
A second run
Re-auditing after the fixes is priced separately and shows the difference between the two runs.
Technology
Standards and technologies
What stays constant is open standards — something any other developer could pick up and continue.
- TLS 1.2 / 1.3
- HSTS
- Content-Security-Policy
- Referrer-Policy
- CVE / NVD
- DNS TXT
- WordPress
- robots.txt
Used in
Which sectors it suits
E-commerce
Automated SEO, speed, a sales chatbot and abandoned-cart SMS — visits turn into orders.
Companies and mid-sized organisations
Automatic responses, paperless workflows and automatic reports — your team's time goes back to the real work.
Large and industrial organisations
Production-line monitoring, failure prediction and AI on organisational data — delivered in stages.
Questions
The most common questions, answered directly
When it is run on your own asset and with your own permission, yes. That is exactly why domain ownership verification is a precondition.
No. The request volume is on the level of one ordinary visitor; no form is submitted and no data is written.
You can't run it. If you work for a client, the owner has to place the verification record or create an account.
The report is the base. Fixing is a separate job, chosen and priced separately.
A penetration test really does try to get in, and needs its own contract and schedule. This service only records what is visible from the outside.
Only you. It stays in your own account and is never published; its content is a map of your site's weak points.
Other digital services
More from LIDTAK
LIDTAK AI
An assistant for everyday work: type or talk and get the answer right away — from page copy and emails to customer replies.
Automated SEO
Over forty SEO, speed and security checks — and you clear each fault with a single approval.
AI for business
AI agents and chatbots, content generation and data analysis — with a dedicated API and dedicated servers.
Business automation
Chatbot, online booking, automatic SMS and a loyalty programme — for cafés, clinics, salons and shops.
Café and restaurant automation
Guests order by QR, the ready alert arrives on their own phone, and staff get a live view of every order.
Web design and custom plugins
Custom websites and WordPress plugins: fast on mobile, SEO-ready and wired to your chatbot and store.
A question about Web security audit?
Start from inside the panel, or talk to a person first — whichever is easier.