Website security assessments
Clear review with your written approval. We review your website's security within a scope you approve in writing, test only what you own or are authorized to have tested, and report the findings in plain words with the fixes in order of importance.
What you get
- Written scope
- Configuration review
- Application checks
- Access review
- Report
- Re-check
Sound familiar?
- You are not sure how exposed your site is.
- A client, partner or insurer is asking for a security review.
- You are about to launch and want to check before customers arrive.
- Your developer says the site is secure, and you would like a second opinion.
Who it helps
Stores and sites with accounts
Payments, customer data and logins reviewed.
Before a launch or a redesign
Problems found while they are cheap to fix.
Businesses answering questionnaires
Findings you can use to answer clients, partners or insurers honestly.
What is included
- Written scope What is tested, how and when, approved in writing before we start
- Configuration review WordPress, plugins, server settings, access and backups
- Application checks Common web weaknesses, such as those in the OWASP Top 10, tested safely
- Access review Who can log in, with which rights, and how
- Report Findings ranked by risk, with evidence and the fix for each
- Re-check Fixed issues checked again
Not included
- Testing systems you do not own or are not authorized to have tested
- Denial-of-service or other disruptive testing, and formal certification audits
Authorization comes first
Testing a website’s security without the owner’s permission is not a service; it is an attack. Every assessment starts with a written scope that names the systems, the methods and the times, and your signed approval. If a connected system belongs to someone else, such as a payment provider or a hosting company, it stays out of scope unless they approve too.
Findings you can act on
A useful report is not a scanner’s printout. Each finding says what the problem is, how serious it is for your business, the evidence, and exactly how to fix it, in order of importance, so your team knows where to start.
How it works
Free call
We talk about what needs assessing and why.
Scope and authorization
A written scope, your signed approval and a fixed quote.
From you: Written authorization from the owner of every system in scope.Assess
Reviews and safe tests carried out at agreed times.
From you: A contact who is reachable during testing.Report
Findings explained in plain words and ranked by risk.
Fix and re-check
We fix the issues or support your developer, then check again.
What affects the price
Every project gets a fixed quote after a free call, so you know the total before anything starts. These are the things that move it.
- Number of sites or applications in scope
- Depth: configuration review or hands-on testing
- Custom code and integrations
- Report format needed
- Whether fixes are included
Questions about website security assessments.
Is this a penetration test?
It can include hands-on testing, always within the scope you approve and without disruptive techniques. If a certification requires a formal penetration test by a certified firm, we can prepare your site for it.
Why do you need written approval?
Because testing without permission is illegal and unsafe. The written scope protects you, us and anyone whose systems are connected to yours.
Will testing affect my live site?
Tests are chosen to be safe, run at agreed times and can be done on a staging copy. Nothing disruptive is used.
What do we get at the end?
A plain-words report with findings ranked by risk, the evidence and the fix for each, and a re-check once they are fixed.
Can you fix what you find?
Yes. Because we are developers as well, we can fix the issues ourselves or work with your developer.
Tell us your goal. We'll show you the plan.
Book a free 30-minute call. You'll leave with a clear plan and a fixed quote, whether you hire us or not.
Book my free call