What is the difference between a website security audit and a penetration test?
Short answerA website security audit and a penetration test answer different questions. A penetration test actively attacks an application to find exploitable paths and needs broad authorization and a test window. The TSmartSecurity Website Security Audit is passive: the review only reads TLS, HTTP security headers, cookies, DNS and e-mail records, and nothing is attacked, exploited or changed.
Website security audit vs penetration test, side by side
| Question | Website security audit (passive) | Penetration test |
|---|---|---|
| What it does | Reads what the site already exposes: TLS configuration, HTTP security headers, cookie flags, DNS and e-mail authentication records. | Actively attacks the application to find exploitable paths. |
| Authorization | Written authorization that lists the exact domains and the time window. | Broad authorization and an agreed test window. |
| Effect on the site | Nothing is attacked, exploited or changed; no logins and no high request volumes. | Attack traffic against the application, by design. |
| Result | A written report: evidence, a severity and a recommendation for each finding. | The exploitable paths found during the test. |
| Offered by TSmartSecurity | Yes: the Website Security Audit. | No. |
What the TSmartSecurity audit does
- TLS certificate and configuration: Certificate validity, chain and expiry, supported protocol versions, and whether HTTP redirects to HTTPS.
- Security headers: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy.
- Cookie settings: Secure, HttpOnly and SameSite attributes on the cookies your site sets.
- DNS and e-mail authentication: SPF, DKIM and DMARC records, so others find it harder to send e-mail that looks like it came from your domain.
- Starts only after you authorize the exact scope in writing; paying never authorizes testing on its own.
- A person reviews the results, removes noise and explains what matters for your site.
What the audit does not do
- Penetration testing or exploitation of any kind
- Authenticated testing behind a login
- CMS, plugin or malware scanning
- Fixing the findings (available separately by quote)
- No attack traffic, no logins and no high request volumes
- No changes to your site, its code or its settings
- No statement that a site is free of vulnerabilities
When you need a penetration test instead
If you need to know whether your application can actually be exploited, you need a penetration test from a provider that offers one. TSmartSecurity does not perform penetration tests or exploitation of any kind; its audit covers public configuration only.
Related pages
Questions
What is the difference between a website security audit and a penetration test?
They answer different questions. A penetration test actively attacks an application to find exploitable paths, and needs broad authorization and a test window. A passive security audit only reads what a site already exposes: TLS configuration, HTTP security headers, cookie flags, DNS and e-mail authentication records. Nothing is attacked, exploited or changed, and no logins or high request volumes are used. TSmartSecurity’s Website Security Audit is the passive kind: a written report on public configuration, not a penetration test.
Scope is agreed and authorized in writing first, and fixes are quoted separately.