SSL/TLS and basic transport security
I start by checking whether your site uses HTTPS consistently and whether HTTP traffic redirects properly. SSL/TLS protects the connection between a visitor’s browser and your website, which matters for login pages, contact forms, checkout flows, and ordinary browsing. I also look for mixed content, certificate warnings, and configuration issues that can make a site appear unsafe or behave inconsistently across browsers.
A certificate alone does not make a website secure. I review related browser-facing settings, including whether important pages are forced onto HTTPS and whether security headers are present where appropriate. Findings are explained in business terms, so you can understand whether an issue affects visitor trust, account protection, search usability, or simply technical cleanliness.
- Confirm HTTPS works on the main domain and common variants
- Look for redirect and mixed-content problems
- Review relevant security headers and browser behavior
Security headers and browser protections
Security headers give browsers instructions about how a site should load content and handle certain types of requests. Depending on the technology and features your site uses, I may review headers such as Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and frame-related protections. The right configuration depends on the site, so I do not recommend blindly adding settings that could break payments, embeds, analytics, or business tools.
I also consider what the headers are trying to protect. A site with a simple brochure page has different needs from one with customer accounts, embedded scheduling, online payments, or a content management system. The audit identifies missing, weak, or potentially disruptive settings and gives you a practical path for improving them without treating every warning as an emergency.
- Match header recommendations to the site’s actual features
- Check for settings that could permit unwanted framing or content loading
- Separate safe quick wins from changes requiring testing
Outdated software, plugins, and exposed components
Old content management systems, plugins, themes, libraries, and server software can create avoidable maintenance and security problems. I look at the visible technology signals and the information you can provide about the hosting environment, update process, and installed components. Where access is available, I review versions and update practices more directly; where it is not, I identify what should be verified with your host or developer.
The point is not to update everything immediately without a plan. Updates can affect layouts, forms, integrations, and custom code. We help distinguish routine updates from changes that deserve a backup, staging test, or compatibility review. I also flag unnecessary components and exposed version information when they make the site harder to maintain or easier to target.
- Identify software and extensions that need review
- Check whether updates are manual, automatic, or neglected
- Recommend backups and testing before higher-risk updates
Admin access, hosting, domains, and forms
A website’s risk often sits outside the public pages. I review how administrator accounts, hosting panels, domain registrars, file access, and third-party tools are handled. Shared logins, unused accounts, weak passwords, missing multi-factor authentication, and unclear ownership can make recovery difficult even when the website itself looks normal. I also verify that the business—not a former vendor—controls critical accounts whenever possible.
Forms deserve their own review because they can collect names, phone numbers, messages, applications, and other business information. I check how submissions are transmitted, where they are stored, who receives them, and whether spam controls or unnecessary data collection create additional exposure. This is not a substitute for legal advice, but it can reveal practical changes worth discussing with your attorney or privacy advisor.
- List who controls hosting, domain, CMS, and email notification accounts
- Review administrator permissions and multi-factor authentication options
- Trace form submissions from visitor to inbox, database, or CRM
Backups, recovery, and a prioritized action plan
A backup is only useful if it is available, recent enough, separate from the affected system, and restorable. I review what is backed up, where copies are kept, how often backups run, and whether anyone has tested a restoration. I also ask what would happen if the site were defaced, locked, deleted, or unavailable after a hosting problem. That turns backup conversations into a recovery plan rather than a checkbox.
At the end, I organize findings by urgency, effort, and business impact. Some items may be quick configuration changes; others may require a developer, host, or replacement of an outdated component. You receive a clear sequence for addressing the risks, along with questions to ask vendors when another party manages part of your stack. If ongoing monitoring or maintenance makes sense, I can discuss that separately rather than bundling it into an unnecessary commitment.
- Confirm backup frequency, retention, location, and restoration steps
- Keep recovery instructions accessible to the business
- Prioritize findings by exposure, impact, and effort