The Digital Doctor
What is checked in a website security audit?
Fifteen automated checks on what an attacker can already see about your business, without touching anything of yours. The certificate and whether it is enforced, the domain and its protections, whether your software announces a version worth attacking, addresses that leak usernames or configuration, and forgotten copies of your site still sitting online. Plus two verdicts that are not mine. It is R1,950 and takes 48 hours.
What are the 17 automated checks?
Grouped by what they protect rather than by how technical they are. Each is scored out of ten in the report, with what was checked, what was found, why it matters and what to do.
The connection between your visitor and your site
Five checks on whether the padlock means anything, and whether it is about to stop meaning anything.
- The padlock in the address bar
- Whether the site is served securely, and whether somebody typing the address without https still lands somewhere safe.
- Protective settings on your server
- The response headers that stop your page being framed inside somebody else’s site or having content injected into it.
- Whether browsers are told to always use the secure version
- Whether browsers are told to refuse the insecure version outright, closing the gap where a connection on public wifi can be intercepted.
- Insecure files on a secure page
- Anything still loading over http on a secure page. Browsers block it or warn about it, and it quietly breaks the padlock.
- When your security certificate expires
- The exact date. When a certificate lapses every visitor meets a full red warning page, and it happens when nobody is watching.
The domain itself
Four checks on the settings that decide what happens when something goes wrong at the registrar rather than on the website.
- When your domain name expires
- Read from the registry rather than guessed. When a domain lapses the website and every email address on it stop in the same moment.
- How well your domain itself is protected
- Nameserver redundancy, DNSSEC, and a CAA record limiting who may issue certificates in your name. What protects the domain rather than the site.
- Whether someone can send email pretending to be you
- SPF, DKIM and DMARC. These are what stop somebody sending an invoice in your name with their own banking details on it.
- Whether your domain can receive email
- Whether mail records are in place, so an enquiry sent to you does not silently bounce.
The software you are running
Three checks on whether your site announces something an automated attack is looking for.
- Whether your website software is current
- Whether your site publishes a version number. It is not a weakness by itself, but it tells an automated scan whether you are worth attacking.
- Whether your website software is a known target
- Which release you are on and whether the security fixes since then are public. If they are, so are the weaknesses they fixed.
- The add-ons your site runs, and what they give away
- Which add-ons the page gives away and at what versions. Most hacked WordPress sites are entered through a plugin, not through WordPress.
What is exposed to anyone who asks
Three checks on the things a scan finds in seconds and most owners have never looked at.
- Information your site hands out to anyone who asks
- Addresses that hand over more than intended: the user list, the author page, XML-RPC, a source repository, an environment file.
- Whether your login page is open to the whole internet
- Whether the login page loads for anyone from anywhere. I load the page and look for a password field. I never attempt to log in.
- Old copies of your site still reachable
- Every certificate ever issued for your domain is in a public log. This finds the dev or staging copy left behind after a redesign.
Somebody else’s verdict
Two checks that are not my opinion, which makes them harder to argue with.
- An independent security grade for your site
- Mozilla’s independent grade on your security settings. The same public scan an insurer or a corporate procurement team would run on you.
- Whether browsers are warning people away from your site
- Whether Chrome, Firefox and Safari are already showing visitors a red warning page instead of your website.
What are the five checks done by hand?
- Search for your domain in known data breaches and list which of your staff addresses appear. This is usually the finding that makes an owner act, because it is their actual people by name.
- Open every forgotten subdomain the scan finds and confirm what is actually running on it. A certificate for a dead host is a footnote; a live 2019 copy of your site is not.
- Check your platform and plugin versions against published advisories for that exact release, rather than assuming an old version is dangerous.
- Ask who holds the backups, how often they run, and when one was last restored. A backup nobody has ever restored is not a backup.
- Confirm two-factor authentication is on for every administrator account.
How do small businesses actually get hacked?
Very rarely through anything clever. In practice it is three things, and all three are on the list above.
A plugin with a published weakness. Somebody publishes the flaw, scripts scan the entire internet looking for that version, and yours answers. Nobody chose you.
A forgotten copy of the site. A staging version stood up during a redesign and never taken down. Same software, never patched, nobody watching, and often sharing the live database.
A guessed password. Automated attempts run against standard login addresses continuously. It is not personal and it does not stop.
What this is not
It is not a penetration test. This finds what an attacker can see for free, before they have tried anything. A penetration test involves actively attempting to break in, requires signed permission, and costs considerably more. Nothing here probes, injects or logs into anything.
It cannot prove your site is secure. No audit can. What it proves is that the specific things checked were or were not present on the day it ran. Anybody promising you more than that is overselling, and you should be wary of them.
It is a photograph of something that moves. A plugin that is safe today can have a published exploit next month. That is the argument for checking monthly rather than once, and it is a more honest recurring pitch than most.
Some of this runs free
The free check includes the padlock, whether your email can be spoofed, and whether your business details are readable. Instantly, with no sign up.
Run the free check