Website security review
From £245
- Configuration and exposure review
- Software and plugin condition
- Forms, admin access and backups
- Security header review
- Written prioritised findings
- Walkthrough of the report
Security
Website Security Review
A practical review that finds the common weaknesses and configuration problems affecting real business websites, and explains them in language you can act on. Based in Dundee, working with businesses across Scotland and the United Kingdom.
From £245 Starting price. Final cost depends on what the project needs.
Who it is for
- Businesses who inherited a website and do not know its condition
- Anyone whose site has not been reviewed since it was built
- Online shops handling orders and customer details
- Businesses asked about security by a client or insurer
- Anyone who has had a scare and wants a proper look
What it solves
- No idea whether the website is in good shape or not
- Software and plugins years out of date
- Administrator accounts nobody has reviewed since launch
- Forms with no protection, collecting spam or worse
- Backups that do not exist
- A scanner report full of warnings and no explanation of what to do
What can be included
Not every project needs everything here. The scope is agreed before work starts, and the quotation reflects what you actually asked for.
What gets checked
- HTTPS and certificate configuration
- Website security configuration
- Security headers
- Software and plugin condition
- Administrator exposure
- Forms and how they handle input
- Backups
- What is publicly reachable that should not be
What you receive
- Clear written findings
- Risk priority, so you know what matters first
- Plain-English explanation of each issue
- Practical recommendations you can act on
- Optional help fixing what you agree to
What you get out of it
- You find out where you stand, in writing
- Problems ranked, so the important ones get fixed first
- Explanations you can understand without a technical background
- A basis for deciding what to spend and where
- No scare tactics and no pressure to buy anything else
What you receive
- Written findings, each rated by how much it matters
- A plain-English explanation of what each issue actually means
- What is already configured correctly, said clearly
- Practical recommendations you can act on or pass to someone else
- A walkthrough of the report
- A separate quote if you want the fixes done, so the review stays independent
What is needed from you
- Written permission to review the site
- Administrator access for the fullest picture, agreed in advance
- Details of who currently hosts and maintains it
- Never a password sent by email or through a form
Security considered from the start.
This service is itself the security work, and takes recognised guidance from organisations such as OWASP and the UK National Cyber Security Centre into consideration where relevant. Where relevant, development practices take recognised guidance from organisations such as OWASP and the UK National Cyber Security Centre into consideration.
Standards and guidance this work follows
Not a certification claim. These are the published references the work is measured against, so the decisions are somebody else's tested thinking rather than only mine.
OWASP
The Open Worldwide Application Security Project. Its guidance on authentication, access control, input validation, session handling and safe error messages informs how anything with a login or a form is built.
National Cyber Security Centre
UK government guidance on small business security, account protection, device management and backups. Used as the reference point for what good practice looks like.
Information Commissioner’s Office
UK data protection guidance. Shapes what a form asks for, how long information is kept, what a privacy notice says, and how cookies are handled.
Following recognised guidance is not the same as holding an independent certification, and none is claimed here.
How it works
Agree scope
Which site, what access is needed, and what is in and out of scope. Written down first.
Review
The checks above, carried out against the live site and its configuration.
Report
Written findings, prioritised, in plain English rather than scanner output.
Talk it through
We go through it so you understand what matters and what does not.
Pricing
Prices shown are starting prices. Final pricing depends on project requirements, functionality, complexity, integrations and third-party services. A clear quotation is provided before work begins.
Honest scope: this is a website security review. It is not a full penetration test, not a formal certification, and not a guarantee that a website cannot be compromised. Anyone offering that guarantee is overselling.
Common questions
Is this a penetration test?
No. This is a practical review of configuration, exposure and software condition. A penetration test is a different and considerably larger piece of work.
Will you fix what you find?
I can, and it is quoted separately so the review stays independent. Plenty of findings are things you can sort yourself once you know about them.
Do you need admin access?
For the fullest picture, yes, agreed in writing first. A useful review is still possible from the outside only, and the limitations get stated.
How is this different from a Cyber Health Check?
This looks at one website. A Cyber Health Check looks at the business: accounts, email, devices, backups and access. Plenty of businesses want both.
Related services
Find out where your website stands
A written, prioritised answer about the state of your website, with no sales pitch attached to it.