Website Audit Reports
A report is written for two readers: the person who needs to know how worried to be, and the person who has to fix it. It opens with a summary, then gives the evidence for everything it says.
What is in a report
| Section | What it gives you |
|---|---|
| Executive summary | The score, what stands out and what to do first, in language a manager can read. |
| Findings | Each issue with its severity, what it means, where it was seen, the evidence and a suggested fix. |
| Test documentation | Every test case that ran, with a screenshot of each step. Intermediate and Advanced only. |
| Performance by page | The measurements for each page visited. |
| Nice to have | Suggestions that are not defects and cost you no points. |
| Second opinion | What a second AI model made of the findings, on runs where one reviewed them. |
| What this level covered | What was and was not attempted, so nobody assumes more was tested than was. |
| Compliance mapping | How findings relate to OWASP, WCAG and ISO/IEC 25010. This is a mapping, not a certificate. |
| How the score was calculated | The working behind the number, so that it can be reproduced. |
Every report also records the authorisation given for the test and how it was confirmed, which a security team may ask to see.
How to read one
- Start with the summary, then sort findings by severity.
- Confirm each finding on the actual site. Automated results can be wrong, and the evidence is there to help you check.
- Judge the risk in context. The same finding can matter a lot on one site and very little on another.
- Fix, then run again. A later run shows what was fixed, what is new and what is still open.
What a report does not mention still matters. It covers only the pages and checks it lists. The Disclaimer explains the limits.
Sharing results
| Option | Who can see what | Best for |
|---|---|---|
| PDF report | Whoever you send it to sees everything, so treat it as sensitive | Your developer, client or manager |
| Basic result link | Anyone with the link, until the result is deleted after 30 minutes | A quick look from a colleague |
| Score link or badge | Anyone: the score, the number of findings and their severity, but never the details. You can withdraw it at any time | Showing a score publicly |
Agencies can add their own logo to reports in Settings.
See a report about your own website
The free Basic assessment produces a report with a PDF download, with no account.
Start an assessmentRelated pages
Need help with your account or a report? Email provelex@devsapience.com