Website security audit
Check Key Website Security Indicators
Provelex looks for common misconfigurations and weaknesses, and explains each finding in terms of what could go wrong. Passive checks only read what your site already sends to a browser. Active probes run only on an Advanced assessment, after you have confirmed you are authorised to test.
Passive checks, at every level
These read the traffic a normal visit produces, plus a few well-known addresses. They send no attack input, and they are part of the free assessment.
| Area | Examples of what is reported |
|---|---|
| Security headers | No Content Security Policy, or one that allows inline scripts. HTTPS not enforced for return visits. Content-type sniffing not disabled. The site can be embedded inside another website. Full page addresses leaked to other sites. Camera, microphone and location access not restricted. |
| Encryption | The site is served without encryption. An outdated encryption protocol is in use. Certificate expiry. Parts of the page load without encryption. |
| Cookies | A session cookie readable by scripts. A cookie that can be sent over an unencrypted connection, or with no cross-site protection. |
| Information leaks | Server software and version advertised publicly. Sensitive information in the page address or stored in the browser. Original source code downloadable from the live site. |
| Exposed files | Files that should never be public, such as an environment file, a source control directory or a cloud credentials file. |
| Third-party code | How many outside companies load scripts on your pages. |
Active probes, on Advanced only
These send input to your site and watch how it responds. They need an Advanced assessment and your recorded authorisation.
| Probe | What it looks for |
|---|---|
| Reflected input | Text from the address bar placed into the page unescaped, which can allow script injection |
| Database errors | The database reporting its own errors to visitors, a common sign of injection problems |
| Error details | Internal error details such as stack traces shown to visitors |
| Open redirects | The site forwarding visitors to any outside address |
| Login limits | A login form that accepts unlimited password guesses |
| Session handling | A session identifier that does not change when someone logs in |
How active testing is kept in bounds
- It stays on the hosts in scope, and this is re-checked before every request.
- It uses GET and POST requests only, with detection markers rather than exploits.
- A run has a limit of 120 requests, sent with a pause between them.
- The authorisation you gave is reproduced in the report.
What a security finding means
A finding is something to review in context. It does not mean your site has been compromised. A missing header on a brochure site matters less than the same header on a banking login, and only someone who knows the application can judge the real risk. Each finding includes a severity, an explanation and a suggested fix, and findings are mapped to OWASP Top 10 categories where one applies.
What this does not replace
Provelex is not a penetration test. It does not chain weaknesses the way a skilled tester does, and a short list of findings does not mean a site is secure. For applications that handle sensitive data or money, combine automated checks with a review by a qualified security professional.
See what your site tells a browser
The free Basic assessment runs the passive security checks on up to three pages, with no account.
Check my websiteRelated pages
Need help with your account or a report? Email provelex@devsapience.com