# External website security reviews

Know what your website is giving away.

A passive review of what anyone can see from outside your website. A useful starting point for fixing the things that matter, without disrupting your business.

## What I check

- Publicly visible WordPress and plugin versions, compared with published security advisories. Inferences are clearly marked as unconfirmed.
- Exposed files and information visible through ordinary public requests, such as directory listings, configuration clues and error messages.
- HTTPS, browser security headers and public settings that help protect visitors.
- Public email authentication records, including SPF, DKIM where discoverable, and DMARC, to identify gaps in spoofing protection.
- Privacy notices, enquiry forms, visible trackers and POPIA-related gaps worth discussing and fixing.

## A report you can use

You get a concise report with the review date, scope, public evidence, why each observation matters and a prioritised list of next steps. It separates confirmed observations from things your host or developer needs to verify.

- A plain-English summary for the business owner
- Evidence and source references for your developer
- Practical fixes, prioritised by likely impact
- A clear record of limitations and unconfirmed observations

## What I never do

- No exploitation, attacks, password guessing or vulnerability payloads.
- No logging into your website, hosting account or email.
- No attempts to bypass access controls or reach private information.
- No changes to your systems and no disruption to bookings or enquiries.

## A defined scope, agreed first

We agree the websites and public checks before I begin. Pricing depends on the scope. A passive review cannot prove that a website is free of vulnerabilities, and it is not a penetration test, legal opinion or POPIA compliance certificate.



---
Charl Kruger, trading as charl.dev. Hout Bay, Cape Town, South Africa.
Enquiries: https://charl.dev/contact
Privacy: https://charl.dev/privacy