Everything we check for, explained in depth but without the jargon. What each problem is, why it matters to a business like yours, and exactly how to fix it.
A serious weakness in the software behind most websites that lets a stranger take control of your server. What it is, who is affected, and how to check you are safe.
Read the guide → CriticalHidden files like .env and .git can quietly hand over your passwords and source code to anyone who guesses the address.
Read the guide → CriticalAn old web address still pointing at a service you stopped using can be taken over and used to impersonate your business.
Read the guide → CriticalWhy a database or admin service left reachable from the internet is one of the most common ways businesses get breached.
Read the guide →What the padlock really means, why an expired certificate drives customers away, and how to keep yours healthy.
Read the guide → MediumHaving a certificate is not enough if people can still reach the insecure version of your site. How redirects and HSTS close that gap.
Read the guide →The single most powerful protection against malicious scripts being injected into your site — and why most small business sites do not have one.
Read the guide → MediumAn attacker can load your page invisibly inside theirs and trick people into clicking things they cannot see. One header stops it.
Read the guide → LowReferrer-Policy, Permissions-Policy and X-Content-Type-Options in plain English — what each one quietly protects you from.
Read the guide → HighA misconfigured sharing rule can let any website on the internet read your customers' private data. How it goes wrong and how to set it right.
Read the guide → MediumThree small flags on a cookie decide whether a logged-in session can be stolen. What Secure, HttpOnly and SameSite each do.
Read the guide →Without this one DNS record, anyone can send emails that appear to come from you. How SPF works and how to set it up in ten minutes.
Read the guide → MediumSPF alone is not enforced. DMARC is the rule that actually tells Gmail and Outlook to bin the fakes — and reports them to you.
Read the guide → LowA small, optional DNS record that stops anyone but your chosen provider from creating a security certificate in your name.
Read the guide →Every piece of software on your site has a version, and old versions have publicly documented weaknesses. Why updating is the cheapest security you will ever buy.
Read the guide → LowYour server may be announcing its exact software version in every response. It is a small thing that makes an attacker's job much easier.
Read the guide →