Website Security Vulnerability Check

Does my site have a security vulnerability, and how can I tell?

A security vulnerability is a weakness in a site's software or settings that allows someone else to carry out actions without permission. Most vulnerabilities give no sign of themselves: the site opens normally, orders come in and the forms work. That is why the thought "my site is working, so there is no problem" is misleading.

Even so, some signs can point to a problem. If you see any of the following, we recommend having your site checked without delay:

• Unexpected redirects: visitors, or people arriving from Google, are being sent to another site.
• Results you do not recognise: pages in a foreign language, or with pharmaceutical or gambling content, appear on Google under your site's name.
• Unknown accounts: there is an administrator account in the admin panel that you did not create.
• Warnings: a security issue notification in Search Console, a "not secure" warning in the browser or a warning email from your hosting company.
• Unexplained slowness: server resources are filling up and the site is slowing down even though traffic has not increased.
• Form and email problems: meaningless submissions arrive through your forms, or emails you did not send are going out from your domain.

What do we examine in a security vulnerability check?

A site's security does not come down to a single setting; it is made up of interconnected layers. During the check, we examine each layer separately and bring the findings together in a single report.

Why are PHP vulnerabilities in the news so often?

PHP is the programming language that runs a very large share of the sites on the internet; WordPress, many e-commerce platforms and corporate sites run on it. That is why, when a vulnerability is found in PHP, it is not just one site but countless sites using the same version that are put at risk at once.

An important detail: PHP runs on the server. Updating WordPress or its plugins does not update PHP; the fix is applied by the hosting provider or the team that manages the server. Older PHP versions whose security support has ended receive no fixes for new vulnerabilities. We covered the latest PHP vulnerabilities, and how to protect search visibility if the site has to be taken offline, in our UNIT Journal news piece on the patch and maintenance page rule for PHP vulnerabilities.

How do we carry out the security check?

We only begin the check with the site owner's written permission and after defining the scope together. The methods we use do not harm the site, do not delete data and do not create load that would disrupt the visitor experience.

• Inventory: we list the versions of PHP, the database, the content management system, the theme and the plugins.
• Comparison with known vulnerabilities: we compare each component against publicly available security advisories.
• External review: we check what a visitor or an automated tool can see from outside the site: exposed files, error messages, login pages and headers.
• Configuration review: where access is granted, we go through the server, panel and domain settings.
• Code and file review: where necessary, we search the site's files for unexpected changes, backdoors or malicious code.

What do we do if a vulnerability is found?

We sort each finding into three groups according to its impact and how easily it could be exploited: those that need to be closed immediately, those planned for the short term and those to be addressed in the next maintenance cycle. The report sets out in plain language what each finding is, why it matters and how it will be closed.

We take a backup first, try the updates in a test environment where possible, and then apply them to the live site. For fixes on the server side, we also take on the correspondence with your hosting provider. If the site has been compromised, we clean out the malicious code, renew passwords and access keys, search for backdoors and, where necessary, request a review through Search Console.

How is search visibility protected during an update?

An urgent patch may require taking the site offline for a short time. If pages show an error page during this time, search engines may get the impression that the site has been removed. The right approach is to return the status code that signals a temporary outage for the duration of the maintenance, keep that period as short as possible and make sure the robots file stays accessible.

On compromised sites, cleaning up the foreign pages that have made their way into search engines and getting the warnings removed is also part of the work. We carry out these steps together with our SEO team and monitor crawl errors and security notifications in Search Console.

What is the difference between a security check and a penetration test?

A security vulnerability check focuses on finding and prioritising the known weaknesses on a site: which software is outdated, which setting is missing, which file is exposed. A penetration test is a broader and longer piece of work that imitates the path an attacker would take to test whether those weaknesses can actually be exploited.

For most corporate sites and small online shops, the right starting point is a regular vulnerability check and closing the findings. For projects with payment infrastructure, a large customer database or a regulatory audit obligation, a penetration test can be planned separately; we assess this need together at the end of the check. If a penetration test is needed, we also set out its scope and permissions in writing.

Which sites need regular checks?

It is safest to assume that every site is valuable enough to be attacked; most attacks start not by targeting a particular company but with automated scans aimed at any site with a vulnerability. We particularly recommend regular checks for these sites:

• E-commerce sites that process payments and customer data
• Corporate sites that collect personal data through forms, memberships or booking systems
• Sites that have not been updated for a long time or run on an old platform
• Sites that have lost contact with the agency or developer who built them, where it is unclear who manages them
• WordPress sites that use a large number of plugins

If the old platform cannot be updated, rebuilding the site may be safer and less costly. In that case, we follow the approach set out on our website development and web and e-commerce pages.

What should be done to keep a site secure?

• Update routine: the core software, theme and plugins are updated at regular intervals, with a backup taken first.
• Backups: backups are kept somewhere separate from the site, and restoring them is tested from time to time.
• Account security: administrator accounts are personal, with strong passwords and two-step verification.
• Simplicity: unused plugins, themes and accounts are removed.
• Least privilege: everyone has only the permissions they need to do their job.
• Monitoring: Search Console notifications, server warnings and file changes are tracked.

Where should you start with your site's security? Our recommendation

If you are wondering whether your site has vulnerabilities, this is the order we recommend:

1. 1.Gather the access details: make clear who holds the domain, hosting and admin panel details.
2. 2.Find out the version: note your PHP and content management system versions from the hosting panel or the site health screen.
3. 3.Take a backup: before making any change, make sure an up-to-date backup is stored somewhere separate from the site.
4. 4.Have it checked: commission a check that compares the inventory against known vulnerabilities and prioritises the findings.
5. 5.Set up a routine: decide in writing who will handle updates, backups and monitoring.

Simply send us your site's address; we will discuss the scope and get the check under way. You can reach us through the contact page or the form at the bottom of this page.