Website Audit Report: Security
In the Website Audit ReportA passive website security check, from outside.
These are passive checks, not a security offering. They read what any visitor can see: whether the site stays on https, the security headers it sends, its cookie flags and the versions it gives away. Once you verify control of the domain they also read the site's public files for exposed passwords and keys. They are not a substitute for a security programme, and a clean result is not evidence that nothing is exposed.
What a Security Engineer brings.
A Security Engineer knows what a site gives away before anyone logs in, and the shapes real credentials take. These checks are that outside view, offered alongside the recognised checklists you should be working from.
Checks the transport and the headers: https, Strict-Transport-Security, a content security policy, frame protection and the other headers browsers act on.
Reads the site's public files for exposed credentials once you verify the domain, and masks every match so the report never repeats the secret.
Does not log in, test for vulnerabilities or see anything a visitor cannot, so treat a clean result as some controls passing, never as a clean bill of health. For the rest of the work, uplift against a recognised baseline: the ASD Essential Eight or the NIST Cybersecurity Framework. You should still have the other controls those frameworks ask for.
what we check
Security, from the outside only.
HTTPS
Pages served over a secure connection
Security headers
HSTS, Content-Security-Policy, framing and more
Cookie flags
Cookies set with Secure and HttpOnly
Secrets in public files
Keys and passwords, after domain proof
what it checks
The security checks, as data.
They run in the Website Audit Report on our servers. The free website audit has no security section.
- securityThe address we checked is served over httpschecked
- securityThe site tells browsers to stay on httpschecked
- securityThe site sets a content security policychecked
- securityCookies carry the Secure and HttpOnly flagschecked
- securityNo private key in public filesafter you verify
- securityNo AWS key in public filesafter you verify
In the report, some after you verify the domain
audit northside-dental.exampleEnter
why it matters
Why security matters to your client.
Headers are cheap protection
Security headers and secure cookies block whole classes of attack and take minutes to switch on.
Exposed keys get used
A password or key left in a public file is found by automated scanners. The report finds it first, after you verify the domain.
Honest about its limits
The client hears exactly what was checked and what was not, so no one mistakes it for a penetration test.
what you get back
What the security checks deliver.
Runs against
The public site: its responses, its headers, its cookies and, once the domain is verified, the files it serves.
You get
Ranked security findings in the Website Audit Report, with any matched credential masked.
Know the limit
Passive checks from outside. This is not a security programme, and it will not catch everything.
the fix workflow
From finding to fixed, in three steps.
Send one client site
Start with the free website audit. No card, nothing to install.
The security checks run
On our servers, on a Website Audit Report. The free website audit has no security section.
Fix, quote and re-check
Each finding carries the fix and a task card your team can take. The next report shows it cleared.
in the report
How security reads in the report.
Security checks
HTTPS, header, cookie and version checks on every Website Audit Report. The scan for exposed credentials unlocks once you verify control of the domain.
Not a penetration test
It reads what is public and stops there. It never logs in, never sends an attack and never changes anything on the site.
questions
Questions about security.
What does the website security check cover?
HTTPS, the security headers browsers act on, cookie flags and the software versions a site gives away. After domain proof, exposed keys in public files.
Is it in the free website audit?
No. The security section is part of the Website Audit Report on a paid plan.
Is it a penetration test?
No. It never logs in or sends an attack. It reads what any visitor can see.
the other sections
The rest of the report.
- SearchGoogle and Bing: indexing, technical SEO and how each page shows up.Search
- AIWhether AI search and its crawlers can reach, read and cite a client site.AI
- ConversionCalls to action, contact paths and forms that turn visits into enquiries.Conversion
- TrustThe trust signals visitors look for before they enquire.Trust
- PhoneWhether every page reads and works on a small phone screen.Phone
- AccessibilityWebsite accessibility on every page, drawn from WCAG 2.2.Accessibility
- The Website Audit ReportEvery section, under your brand, on every client site.Hub
- PricingPer client site, in blocks of 25, monthly or yearly.Plans
Security is in every Website Audit Report.
The free check covers search, AI, conversion, trust, phone and accessibility. Security is in the paid report only. Start with a free website audit, then add the full report under your brand.