We look at how staff and customers sign in, and whether those accounts are harder to guess or reuse than they should be.

Websites often run extra components. If those pieces are old or abandoned, they can become an easy way in.

Backups, configuration files, and old documents sometimes sit on a live site by mistake.

If your site has customer accounts or a staff dashboard, we check whether people can reach information that is not theirs.

A site can look fine while error messages, admin pages, or cloud storage are left more open than intended.

Contact forms, bookings, and checkouts need to handle input safely so visitors cannot interfere with how the site works.

We check whether visitors are sent over a current HTTPS setup so browsers do not warn that the site is not secure.

Security headers and cookie settings are small controls that help browsers treat the site more carefully.