Know what your website is giving away.

What I check

• Publicly visible WordPress and plugin versions, compared with published security advisories. Inferences are clearly marked as unconfirmed.
• Exposed files and information visible through ordinary public requests, such as directory listings, configuration clues and error messages.
• HTTPS, browser security headers and public settings that help protect visitors.
• Public email authentication records, including SPF, DKIM where discoverable, and DMARC, to identify gaps in spoofing protection.
• Privacy notices, enquiry forms, visible trackers and POPIA-related gaps worth discussing and fixing.

A report you can use

You get a concise report with the review date, scope, public evidence, why each observation matters and a prioritised list of next steps. It separates confirmed observations from things your host or developer needs to verify.

• A plain-English summary for the business owner
• Evidence and source references for your developer
• Practical fixes, prioritised by likely impact
• A clear record of limitations and unconfirmed observations

What I never do

• No exploitation, attacks, password guessing or vulnerability payloads.
• No logging into your website, hosting account or email.
• No attempts to bypass access controls or reach private information.
• No changes to your systems and no disruption to bookings or enquiries.

A defined scope, agreed first

We agree the websites and public checks before I begin. Pricing depends on the scope. A passive review cannot prove that a website is free of vulnerabilities, and it is not a penetration test, legal opinion or POPIA compliance certificate.