Website security review
Find the exposure in your website and hosting.
We review publicly reachable services, software, access and hosting architecture. The report records observed weaknesses and what to address first, including services or accounts that can be removed.
Establish what is reachable and who controls it
A firewall plugin covers only part of a website's environment. Old staging sites, unused accounts and unsupported services need their own checks. We trace those connections and record what we can verify within the agreed scope.
Our security review method explains the inventory, access checks and report format. Our Wordfence experiment shows why a product's role and its limits need to be understood separately.
Services, access and recovery
What is exposed
Which services answer from the public internet, and which of them need to.
Software and dependencies
What is installed, what version it is on, and what is no longer maintained upstream.
Access and accounts
Who can reach what, which credentials are shared, and what still works for people who left.
Hosting architecture
How the pieces are separated, and what one compromised component would reach.
Backups you have tested
Check the recovery path and whether backups have been restored successfully.
What to remove first
Prioritise changes by the exposure they address and the effort required.
A report your developer can act on
This is an architecture and exposure review with portable written findings. We can scope remediation separately, or you can give the plan to another supplier.
A review and a plan
Each finding records the affected system, observed condition, consequence, recommendation and priority.
Not a penetration test
The review does not claim exploit testing or certification. Where that is required, the plan says so explicitly.
Not incident response
This is planned review work, not a 24-hour emergency service for an active compromise.
Scope and handover
Do you need administrator access?
Some findings can be established externally. Configuration, account, dependency and backup checks require agreed read-only or administrative access, recorded before the review begins.
Will you attempt to break into the site?
No. This service does not include exploitation, social engineering or denial-of-service testing. Those require a separately authorised specialist scope.
Can our existing developer use the findings?
Yes. The report is written for handover and does not depend on Netcraft performing the remediation.
What happens to urgent findings?
A finding that presents immediate material exposure is reported when confirmed rather than held until the final report. Remediation still requires your approval and an agreed scope.
Arrange a website security review.
Send the URL and describe the systems or access you want reviewed. We will agree the scope and access requirements before work begins.