A security audit of your website, reviewed by a person
We review what your website and domain expose publicly, with your written authorization, and tell you what to fix first. Read-only: nothing on your site is changed.
What the audit checks
TLS certificate and configuration
Certificate validity, chain and expiry, supported protocol versions, and whether HTTP redirects to HTTPS.
Security headers
Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy.
Cookie settings
Secure, HttpOnly and SameSite attributes on the cookies your site sets.
DNS and e-mail authentication
SPF, DKIM and DMARC records, so others find it harder to send e-mail that looks like it came from your domain.
Want to look at your headers yourself first? Read our guide to security headers.
How this differs from an online website security check
A person reviews the results
Free online checkers grade a page automatically. We review the findings, remove noise and explain what matters for your site.
Written authorization first
We confirm in writing which domains are in scope and that you may authorize the review before we look at anything.
A report you can act on
Each finding comes with evidence, a severity and a concrete recommendation, in plain language your developer or host can use.
What is not included
- Penetration testing or exploitation of any kind
- Authenticated testing behind a login
- CMS, plugin or malware scanning
- Fixing the findings (available separately by quote)
Draft pricing. Prices are not final and nothing is on sale yet; you receive a confirmed quote after scope review, before any work or payment.
Questions
Is this a penetration test?
No. The Website Security Audit is a passive review of what your site and domain already expose publicly: TLS, headers, cookies and DNS records. Nothing is attacked, exploited or changed.
Will it slow down or affect my website?
The review reads the same responses a normal visitor receives. It does not send attack traffic or high request volumes.
Does a clean report mean my website is secure?
No. The report covers the agreed scope at the time of review. It is not a guarantee that a site is free of vulnerabilities, and we never state that it is.
Can I buy it today?
Not yet. The service is in pre-release and the price shown is a draft. You can tell us you are interested through the contact form.