Security review
A security review, with clear priorities
A review of what is exposed or misconfigured on the website: headers, dependencies, reachable admin panels, the SSL certificate and backups. The result is a report on what to fix first.
What is included
What is checked
Security headers
HSTS, Content-Security-Policy, framing protection, Referrer-Policy and other HTTP headers the browser uses to protect visitors.
HTTPS and certificate
Certificate validity, redirects to HTTPS and the TLS versions the server accepts.
Dependencies and versions
CMS, plugins and libraries with known, published vulnerabilities, and what is out of date.
Exposed panels and files
Admin pages, configuration files, forgotten backups or directory listings open to anyone.
Backups
Whether they exist, where they are stored, how often they run and when the last restore was tested.
Domain email
SPF, DKIM and DMARC records, which make it harder to send fake emails in your domain's name.
The report
Every finding with a priority and a fix
Each problem found is explained in plain language, with the risk it poses, its priority and what to do to fix it. It serves both whoever decides and whoever makes the fixes.
What this review is not
It is not a penetration test or a certification. The review checks configuration and versions without trying to exploit vulnerabilities or overload the site, and is only carried out with the authorisation of whoever is responsible for it.
- Critical
Database backup publicly accessible
A .sql file left in the site's root. Remove it and check for other copies.
- High
Three plugins with known vulnerabilities
Versions with published flaws. Update or replace them, in that order.
- Medium
No Content-Security-Policy
Add a policy in report-only mode and tighten it afterwards.
- Low
DMARC in monitoring mode
Review the reports and move to quarantine.
Typical cases
When it makes sense
A website left unmaintained for years
Nobody knows for sure what is installed or when it was last updated.
Before launching a new website
A final check so nothing goes live with default settings or test files.
A website inherited from another provider
Understand its real state before taking responsibility for it.
After strange behaviour
Redirects to other sites, spam or unknown pages. In that case, the review is the first step to recover the site.
How it works
Four steps, without disrupting the website
- 01
Authorisation and scope
Which domains are covered and, optionally, read access to the dashboard or server.
- 02
Review
Light, passive checks from the outside and, with access, from the inside.
- 03
Report
Each problem with a priority, an explanation and a recommended fix.
- 04
Fixes
Carried out by Tejobit, under a maintenance plan, or by whoever already maintains the site. The report works for both.
Frequently asked questions
Before you start
Is it a penetration test?
No. A penetration test actively tries to exploit vulnerabilities. This review checks configuration, versions and exposure, without attacking the site.
Is access to the site required?
Not necessarily. Part of the review is done from the outside, like any visitor. With read access to the dashboard or server, the review of versions and backups is more complete.
Will the website go down during the review?
No. The checks are light, with no load testing or attack attempts.
Does the review guarantee the website is secure?
There are no absolute guarantees in security. The report reduces the most likely risks and sets out the right order to fix them.
Is it only for WordPress?
No. The review applies to any website. On WordPress, the review of plugins and themes is more detailed.
Want to know what state your website is in?
Give the address and who maintains it today. The reply sets out the scope of the review and what it costs.