// 04 · Website Security
Know what has been checked and what needs fixing.
We review your website against a written security checklist. You receive the findings in plain English, followed by the fixes included in your proposal.
For staff tools and client accounts, see Custom Business Software.
Capabilities within Website Security
Check the website’s basic protections
We review administrator access and how forms handle submitted information. We also check that the connection between the visitor and website is encrypted.
Set browser security rules
We configure rules that limit which outside content the website can load. We test those rules with the tools the site needs to use.
Limit access to the live website
Review who can publish changes and protect private test versions with a login. Keep the credentials used by the website out of publicly accessible files.
Check software updates and access keys
We check the third-party software the site relies on for reported security problems. We document who should update it and when access keys should be replaced.
Reduce automated form spam
We add checks that help distinguish genuine enquiries from automated submissions. We test that customers can still use the form.
Receive a written security review
The report lists what we checked and what we found. It separates completed fixes from items that still need action.
Set up website alerts
Where included, we configure alerts for downtime or errors. Before handover, we identify who receives them and who is responsible for responding.
Document what to do when a problem is reported
We write down who to contact and the first steps. Ongoing monitoring and incident-response cover must be stated separately in the proposal.
Outcome
You can see which checks were completed and which fixes were made. The handover identifies any remaining work and who is responsible for ongoing upkeep.
What the project includes
- · A written list of the security issues identified.
- · Changes to browser security settings.
- · A documented way to store and replace access keys.
- · Checks for reported problems in third-party software.
- · Form-spam controls.
- · A report of checks completed before launch.
- · Website alerts where included in the scope.
- · Written handover notes and named response contacts.
After the project
Your proposal states whether any ongoing checks or response cover are included. It also identifies the person responsible for updates after handover.
// Frequently asked
- What does a security review cost?
- The quote depends on the website and the checks you need. Share its address and tell us whether it has customer accounts or takes payments. We can then define the review.
- How long does the work take?
- We set a schedule after reviewing the site and the access needed. Any additional problems that change the scope are discussed with you.
- What is included?
- Your proposal lists the checks and fixes. The final report records what was completed and what remains.
- Does the website’s technology already handle security?
- Some protections come with the software and hosting. Their setup still needs checking, along with access and updates.
- What if a problem is discovered later?
- Follow the contacts and steps in your handover notes. Your agreement states whether further investigation or fixes are covered.
- Does a small website need a review?
- The review should match what the site does and the information it handles. A contact website and a customer account system need different checks.
- Can you help with a hacked website?
- Send us the website address and describe what you have noticed. We will first assess whether we can take on the work and what access is needed.