What actually happens in a website security assessment?

'Security assessment' sounds intimidating, and expensive. For a typical small business website, it's neither. Here's what our process looks like.

1. Permission first

Before we look at anything beyond your public homepage, you sign a short form confirming you own the site and agreeing what we'll check. Testing someone's website without permission can be a crime, and a reputable provider will always ask.

2. What we look at

• Your PHP version, and whether it still gets security fixes
• Your CMS (e.g. WordPress, Drupal or Joomla), theme and plugins or modules, and any known flaws in them
• Whether current named flaws in the news affect your setup
• HTTPS, security headers and other server settings
• Email spoofing protection (SPF, DKIM and DMARC)
• Full Assessment only: backups, admin accounts, 2FA and altered core files, using read-only access

3. What we need from you

For the Essential Assessment, nothing: we only look from the outside, like an attacker would. The Full Assessment adds an inside view, using temporary read-only access to your hosting control panel or WordPress admin, which gives a definite answer instead of a best guess. If you have a web developer, we can work with them instead. We never need your banking or email passwords.

4. What you get

A short report written for business owners, not IT people. It starts with a clear verdict (affected or not affected), then lists each issue with what it means, what to do, and roughly how long it takes. The assessment never changes anything on your site. Many fixes are a setting in your hosting control panel, and the report tells you which. If you'd rather we did them, we can quote a fixed price. See our sample report for an example.