Vulnerability notes, site pentests and audits
Recent vulnerabilities in plain language, and how a website pentest and a security audit work for companies.
A password manager instead of a shared spreadsheet
A password spreadsheet lives in mail and in chats. A shared vault solves both storage and a person leaving.
A WAF for a store: a baseline layer, not a cure-all
A web application firewall removes part of the automated noise. It does not understand "someone else's order by someone else's number".
A leaver's access: a revocation checklist
Mail is switched off, while the domain, ads and hosting stay. A month later that is not forgetfulness. It is an open door.
A landing for ads: the offer, the speed and the form
A banner does not save a page that fails to say what this is, who it is for and what to press. After that come engineering and trust.
VPN and remote access: typical office holes
A remote desktop exposed to the internet is more dangerous than a forgotten plugin. People just do not count it as part of the site.
Infrastructure audit and a website pentest: the difference
They are two different checks. A storefront-only report creates calm right up until remote access is exposed.
Questions for a hoster before moving a site
The panel and the plan price do not answer who owns the copies, where the logs are and what happens during an hour of downtime.
Forgotten subdomains and test stands
The live site gets updates, while test.company.com lives with the password admin and a copy of the database. It is found before you find it.
Store checkout: trust, speed and security on one path
A buyer leaves for more than price. Extra fields, a foreign payment domain and a script on the order page cut both conversion and the security plane.
What to copy besides the database: files, secrets, DNS
A database dump brings up an empty site if uploads, environment variables and mail records are not beside it.