Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
An expired certificate: the site was not hacked, but the customer already left
The browser shows a warning, ads pour traffic into a wall, mail forms start behaving oddly. A frequent cause is a certificate date nobody remembered.
Keys after an employee leaves: the password changed, the cloud stayed open
Mail is blocked on the last day. The key to the host, the map and the ads stays in a password manager that left with the laptop.
Remote work and the home network: the office Wi-Fi password does not protect you
An employee signs in to mail and the admin panel from home. A router with a default password and a computer shared with children are part of your perimeter, even if the office is locked.
The printer and smart devices in the office: the network a website contract forgets
A printer with a panel on the internet, a camera with a factory password and guest Wi-Fi on the same network as accounting. The site can be in perfect shape at the same time.
WordPress security: what to close in the first week
A "site protection" plugin does not replace updates, real roles and a switched-off file editor.
A public link to a folder: contracts that are no longer found only by a colleague
A "for the client" link with no expiry lives for years. The folder holds invoices, scans and exports. Closing access means changing the link, not hiding it in a chat.
Search shows stranger's pages on your site: this is no longer "just SEO"
The storefront opens as usual, and in search the site offers someone else's goods, medicines or links. That is what a breach looks like when the owner notices last.
Corporate mail security: the mailbox, spoofing and forwarding
Mail on your own domain is both the door into other services and the storefront from which others can write as you.
Who answers in the first hour if the site starts behaving oddly
A small company loses an incident not for lack of a twenty-page manual. It loses because there is nobody to call and everyone starts fixing at once.
The CMS panel on the host: Bitrix, WordPress and an address everyone knows
The admin panel lives at a well-known path. Hiding the address helps a little. The password, a second factor and separate roles help for real.