Website security audit, for brochure sites and stores.
A website security audit reviews everything your site exposes on the internet, from public pages to forgotten subdomains, then tests the sensitive journeys: forms, customer area and checkout. Our in-house tools find everything that can be reached. Our hands-on expertise goes through the site first as a customer, then as an attacker.
At a glance
- ScopeA brochure site, an online store or a CMS-based site, with its customer area if it has one.
- What we look forThe gap between what you think you published and what can actually be reached from the internet.
- What we need from youThe site's address and, if there is any, read access to the code of your custom development.
- What you getA report with proof and a fix for every finding, a debrief with your team and a retest within 60 days.
Vulnerabilities found across these sectors
- Public services (.gouv.fr)
- CAC 40 groups
- Luxury leaders
- National media
- Local authorities
Nobody has it in for you. That is exactly the problem.
Bots crawl the web around the clock, trying known versions, admin paths and forgotten files, and logging everything that answers. Your site is not targeted: it is found.
A site picked up by these sweeps is not necessarily used to steal your data. It becomes a relay: phishing pages hosted on your server, redirects to counterfeit stores, fraudulent email sent from your domain. The cost is the cleanup, a blacklisted domain and weeks of lost search rankings.
The second case is more targeted: someone takes an interest in your customer area, your orders, your contacts. They often start by replaying, in bulk, credentials leaked from other sites, and a free tool already shows which breaches an address appears in. Whether that works on your site depends on your password rules, your rate limiting and your second factor.
Next, they look for what a bot cannot see: the order tracking page that opens without logging in, the form that accepts an identifier that is not yours, the staging site left online since the redesign. That is where our hands-on expertise does its work.
Before the fix
A bot asks for the files people forget most often. Your site hands over the configuration of its code repository.
After the fix
The repository no longer ships with the site: the bot moves on to the next address.
Two requests out of thousands. Flip the card to see the fix.
When to audit your website.
A public website changes more often than you think: a redesign, a new host, a store, and the exposed surface is no longer the same.
Before going live
Bots sweep a new site within hours of it being indexed: better that they find nothing.
After a redesign
The old site, a staging site or a backup often stay online, right next to the new one.
After changing hosts
New configuration, new defaults: what used to be closed may not be anymore.
Before selling online
Accounts, orders and payments: your site now holds what interests a human attacker.
After a hack or an alert
A blacklisted domain, unknown pages in Google: you need to know how they got in, and close that door.
What we test.
A public website is not just the pages you ordered. It is also everything that has piled up around them.
Real exposed surface
Forgotten subdomains, staging and development environments still online, old versions of the site nobody ever switched off.
Hosting and configuration
Security headers, cookies, The encryption of the connection between the browser and your site: the padlock in the address bar., directory listing, backups and archives left reachable.
CMS and plugins
Versions, components abandoned by their authors, default settings never hardened, an admin panel open to the whole world.
Forms
Contact, quote, sign-up, search: injection, email sent on someone else's behalf, no How many attempts a single visitor can make in a given time: without it, a bot tries thousands of passwords., exposed addresses.
Customer area and checkout
Sign-up, password reset, another customer's orders, tampered amounts, quantities and promo codes.
Uploads and custom code
Whether the file type is really checked, where files are stored, whether they can run, and the code written for you, which no scanner knows.
How a website audit runs.
Six steps, from authorization to retest, starting from what a stranger sees from the internet.
Read the full methodology- 01
Scoping and authorization
We put in writing what is in scope and what is out, the window during which we can test, and who to call if something critical comes up. An NDA is signed as soon as we get into technical details, and the penetration test authorization agreement once the quote is signed, before any access.
- 02
Mapping your exposure
Before testing anything, we establish what can actually be reached from the internet under your name. This step often turns up something nobody had in mind: a pre-production subdomain, an old store, an internal tool left public.
- 03
Public surface
Configuration, headers, CMS, plugins, forms. Our in-house tools cover everything mechanical, and every result is verified before it goes into the report: a generic tool often flags problems that are not real.
- 04
User journeys
The heart of the work. We create accounts, place orders, tamper with the parameters the interface is not supposed to let you touch, and check whether the server accepts them. This is the step that finds what a scanner cannot see.
- 05
Report and debrief
Every flaw is ranked by what it would really cost you, not by a generic score. You get the proof, the steps to reproduce it, and the fix. A one-hour session lets us go through everything with the people who will do the fixing. See what the report looks like.
- 06
Retest & close
Once the fixes are live, we replay the relevant tests and confirm in writing what is actually closed. It is part of the engagement, not billed separately.
Website or application? Not the same engagement.
Both services exist because they look for different things. Here is how to tell which one you need, in one sentence.
It is a website
Your visitors browse, fill in a form, buy, and sometimes log in to a simple customer area. Most of the risk sits in what is exposed, how it is configured and the building blocks you did not write. That is what this audit covers.
It is an application
Your users log in to get work done: several roles, overlapping permissions, business workflows. The risk moves to the logic and the permissions, and calls for a different depth of testing.
Same word, two audits. On a website, the risk comes mostly from what is exposed and what you did not write. In an application, the risk comes mostly from who is allowed to do what.
What this looks like in practice.
Real flaws found on public websites, all fixed since.
reports sent with a critical vulnerability
Out of more than 485 reports sent, in penetration tests and bug bounty.
reports sent in total
In penetration tests and bug bounty.
Active in bug bounty
Researchers on YesWeHack and Intigriti, two European bug bounty platforms where every flaw is checked before it is accepted.
- CriticalFixed
Access control
Order tracking reachable without logging in, just by changing the number in the URL.
- CriticalFixed
Forgotten environment
A full copy of the site on a staging server, indexed by Google, running on the production database.
- HighFixed
Payment logic
A negative quantity accepted in the cart, bringing the order total down to a few cents.
- CriticalFixed
File upload
A profile picture accepted without any real type check, stored in a directory that executes code.
We never disclose a client's name, nor any detail that would let anyone recognize them.
The report you receive.
Every flaw proven, explained and ranked by what it really costs: readable for your leadership, ready to forward as-is to your team or your provider.
Anyone could read another customer's order by changing one number in the URL: name, shipping address, items bought.
SeverityCritical, no login needed
Requests, screenshots and reproduction steps: redacted in this sample. Your report contains every one of them, ready to replay.
Tie every order to its account and check, every time it is displayed, that the logged-in visitor actually owns it.
PriorityImmediate, retest included
A full copy of the site, connected to the production database and indexed by Google: your customers' data, with none of the main site's protections.
SeverityCritical, found through a search engine
Requests, screenshots and reproduction steps: redacted in this sample. Your report contains every one of them, ready to replay.
Shut the staging environment down or put it behind authentication, and never connect it to real data.
PriorityImmediate, retest included
A file uploaded as a profile picture could be run by the server: a takeover of the site, and of everything it hosts.
SeverityCritical, from a customer account
Requests, screenshots and reproduction steps: redacted in this sample. Your report contains every one of them, ready to replay.
Check the file's actual content, rename it, and store it in a directory where nothing can run.
PriorityImmediate, retest included
Prioritized report
Every flaw ranked by what it would really cost your site, not by a generic score.
Reproducible proof of concept
The proof and the steps to reproduce it, which your team or your provider replays to see the flaw for themselves.
Business impact
Customer data, reputation, search rankings: what each flaw puts at stake, spelled out plainly.
Fixes ready to forward
The steps to fix each flaw, written so you can forward them as-is to whoever maintains your site.
Retest included
Once the fixes are live, we replay the tests and confirm in writing what is actually closed.
Debrief with your team
One hour to go through everything with the people who will do the fixing.
What it costs.
Every engagement is quoted, and here is why: two websites that look alike can expose very different things. To get your bearings, here is our pricing by kind of engagement.
From€2,700 incl. tax
Brochure site or store
Four to six days. A public website, its forms, its hosting and, if it has one, its customer area or store.
From€7,500 incl. tax
Business application or SaaS
Ten to fifteen days or more. When the site has grown into an application: several roles, overlapping permissions, business workflows.
From€3,200 incl. tax
Focused API
Four to eight days. The API behind your cart, your forms or your customer area, tested in its own right.
What moves the price
First, the kind of site: a brochure site with a contact form takes far less time to test than a store with customer accounts, a cart and a checkout.
Then the share of custom development, and the extent of your exposure: a single domain, or subdomains piled up over the redesigns.
A first call, with no commitment, is enough to place your site. If it needs less than you thought, we will tell you.
Every brick adds journeys to test. A brochure site takes a few days, a store adds accounts, a cart and a checkout, and code written for you has to be read.
My site is a brochure site. Do I really have anything worth stealing?
Two things, yes. Your reputation first: a compromised brochure site gets used to host phishing pages or redirect your visitors, and Google may flag it as dangerous in its results. Your infrastructure second: the server hosting the brochure site often hosts the mail, an extranet or the backups. The attacker is not after your data, they are after a machine.
How long will the site be down during the audit?
It will not be. We run no denial of service and no load testing, and we never perform a destructive action on real data. Requests are spaced out so the server never feels them. If any step carries the slightest risk for production, we tell you first and we decide together.
Do you need access to my hosting?
Not for the audit itself: we test from the outside, the way an attacker does. User accounts help if there is a customer area or a store, and read access to the code speeds up the custom development part considerably. None of it is required to start.
My agency already installed a web application firewall. Is that enough?
A WAF filters known, generic attacks, which clears out the automated background noise. It cannot see that a quote form accepts an order reference belonging to someone else, because from its point of view that request is entirely legitimate. It reduces volume, not real risk.
What do I do with the fixes afterwards?
Every vulnerability in the report comes with the steps to fix it, written so you can forward it as-is to whoever maintains your site. Once the fixes are live, we replay the relevant tests. That retest is part of the engagement, not a separate line on the invoice.
The other services.
Is your website only part of what you expose? Another engagement can round it out.
WordPress penetration testing
If your site runs on WordPress, the plugin ecosystem deserves an approach of its own.
See the serviceWeb penetration testing
For a business application, a complex customer portal or a SaaS product, with several roles and journeys to break through.
See the serviceAPI security audit
If your site relies on an API for its forms, cart or customer area, that API enforces its own rules and is tested separately.
See the serviceAuthentication and access control
If your customer area distinguishes several kinds of user, the question becomes who can actually reach what.
See the serviceGet your website audited.
Your brochure site is a target.
Tell us what kind of site you have, whether there is a customer area or a store, and whether any custom development was done. We'll get back to you with a scoping proposal and a quote. The first call commits you to nothing.