Web security audit

A web security audit, without penetration testing

Sites are rarely lost to a sophisticated attack; they are lost to a plugin that hasn't been updated in two years, or a forgotten backup file.

This service is exactly that look: your site is examined as an ordinary visitor would see it, and the findings are ordered from most to least important.

The scope, before anything else

This audit is performed from the outside and never touches your site: the certificate, security settings, publicly reachable files, outdated plugins and the login page. It is not a penetration test.

Scope of work

What this service includes

Each item is an independent job, chosen and priced separately — not a bundle you have to buy whole.

Certificate and site encryption

The site's security certificate, its expiry date, and whether every page loads over HTTPS.

Server security settings

Security headers — the settings the server hands the browser: which exist, which don't, and which have no effect.

Publicly reachable files

Forgotten backups, configuration files and admin pages that should not open from outside.

Outdated plugins

The CMS, theme and plugin versions are compared against the latest published releases.

Known vulnerabilities

Recorded holes for those exact versions are listed; it is a version match, not proof of a breach.

The site login page

Where the login page is exposed, whether it limits attempts, and whether its error messages give anything away.

Outcomes

What changes once it is running

Instead of percentages we've written the mechanism. What is guaranteed is that the work and the cost stay clear.

Priorities, not a list

Findings are ordered from most to least important, so it is clear what to fix first.

Reproducible

Every finding comes with reproduction steps, so your own technical team can see and confirm it.

No operational risk

Because the site is never touched, the audit can run on a site that is live.

History

Running it again after the fixes shows the difference and proves the progress.

From inside the panel

How the service gets going

Each stage produces something you can review before the next one begins, and nothing runs without your approval.

  1. 01

    Verify domain ownership

    A DNS record or a file proves the domain is yours. Until that is done, nothing starts.

  2. 02

    Audit from the outside

    The site is read as an ordinary visitor would read it; no attempt is made to log in.

  3. 03

    Review the findings

    Before the report is finalised you see the findings, and anything that is intentional is marked as such.

  4. 04

    Cost estimate

    If you also want the fixes, you see the estimate. The report and the fixes are two separate jobs.

  5. 05

    Report and wallet deduction

    The prioritised report with remediation guidance is delivered and the cost comes out of the wallet.

Precondition

Domain ownership, before any run

Auditing a site that isn't yours carries legal liability; this gate has no way around it.

A DNS TXT record

One unique record in the domain's DNS — when you have access to the DNS panel.

A file at the site root

A file with a specific name on the site — when you have file access but not DNS.

Re-checked at run time

Ownership is checked again at the moment of the run, because a domain can change hands.

Cost

The report is one job, the fix is another

The same wallet: you top it up in advance and each job is deducted after your own approval.

Audit, per domain

The cost of the audit and report itself; each domain is recorded separately.

Fixes, separate and optional

Buying the report does not commit you to buying the fixes.

A second run

Re-auditing after the fixes is priced separately and shows the difference between the two runs.

Questions

The most common questions, answered directly

When it is run on your own asset and with your own permission, yes. That is exactly why domain ownership verification is a precondition.

No. The request volume is on the level of one ordinary visitor; no form is submitted and no data is written.

You can't run it. If you work for a client, the owner has to place the verification record or create an account.

The report is the base. Fixing is a separate job, chosen and priced separately.

A penetration test really does try to get in, and needs its own contract and schedule. This service only records what is visible from the outside.

Only you. It stays in your own account and is never published; its content is a map of your site's weak points.

A question about Web security audit?

Start from inside the panel, or talk to a person first — whichever is easier.