Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
Old scripts on the host: the site was updated, the way in stayed
The new storefront sits on the same host as a five-year-old file uploader. Updating the homepage does not touch it.
Shared hosting: the neighbor's site is sometimes closer than your contractor
On a cheap plan, sites share a server. A hole at the neighbor and a weak panel password affect you, even if your own code is tidy.
An ad-account takeover: the budget leaves while the site is still yours
The ads change overnight. The site opens as usual. Money is spent on someone else's page, and you notice it on the bill, not on storefront monitoring.
Protecting a domain at the registrar: the site can be turned off without touching the code
A DNS change takes the site and mail away in minutes. The code, the WAF and the backup stay in the old place and no longer answer anyone.
Customer leads in Telegram: a convenient chat full of personal data
A name, a phone and the point of the order in a shared group are already processing. A former employee and a stranger's phone on the bot stay in that chat for good.
Company mail without DMARC: anyone can send letters "from you"
SPF and DKIM say which servers may write as the domain. DMARC says what to do with the rest. Without the three, an invoice in your name is easy to assemble.
How to tell a site is compromised before a customer complains
A redirect, a new administrator, mail you did not send and a search warning. What to check before deleting everything.
File upload on a form: resumes and images that should not run
An "attach a file" form is convenient for the customer and dangerous if the server puts it in the site folder and is willing to open that file as a program.
Someone else's order in the account area: the page opens, the boundary does not
A customer changes a number in the address and sees someone else's order, receipt or thread. The site still "works". That is a pentest finding, not a ping.
Site security headers: what to turn on after an audit, not instead of one
HSTS, a ban on foreign framing and a careful ban on MIME sniffing close a class of ordinary problems. They do not replace roles and updates.