OWASP for a small company: which site risks to close first

The OWASP Top 10 sounds like an exam. For a small site it is a short list of places where web apps fail in the same way: access control, injections, old components, weak configuration. You do not need to be a bank. A lead form is an entry point too.

Three filters before any large report

• Update the CMS, the theme and the plugins. Turn off what nobody uses. An old form module is a common door.
• Check whether changing an id in the address opens someone else's order, profile or file.
• Review forms and file upload: types, size, where the file lands and who opens it later.

Only then is it worth talking about headers, sessions and dependencies in your own code. A custom landing benefits from the same three filters: a hacked page that redirects to someone else's store loses both trust and index quickly. Security here supports SEO rather than arguing with it.

Lexora's basic audit is about that priority. We do not write a hundred-page report if the first holes close with an update and with permissions.