Find what is open
before someone
else does.
Independent security review for small and mid-sized web teams. We read what your site publishes about itself, match it against known issues, and hand you a written path to close each one — in order, by risk.
Three ways we look at a site.
Everything we do is non-invasive. We read what is publicly visible — headers, published manifests, plugin metadata — and compare it against disclosed vulnerabilities. We do not exploit what we find.
Surface review
What your server tells the internet about itself, and what that reveals to anyone scanning for a target.
- Response headers
- TLS configuration
- Exposed paths
- Version disclosure
Component audit
Every plugin, theme and library your site loads, matched against its disclosed vulnerability history and the version that fixed it.
- Plugin inventory
- Version confirmation
- CVE matching
- Fix version
Written fix path
A short document, ordered by risk. What is open, why it matters, and the exact version or setting that closes it. No padding.
- Prioritised list
- Per-item remedy
- Verification steps
- Re-check after fixes
Four steps, no surprises.
You write to us
One line is enough. Tell us the domain and roughly what the site runs on.
We review
Read-only assessment against public data. No login attempts, no payloads, no exploitation of anything we find.
You get the list
Findings ordered by risk, each with the version or setting that closes it. Plain language, no severity theatre.
Re-check
After you patch, we confirm what closed and what is still open. One pass, included.
What this looks like in practice.
Names withheld. Each of these was found through public information only, and each owner was notified privately before anything was written down here.
Database credentials readable from the web root
A configuration file left reachable at the domain root, containing the database host, user and password in plain text. No authentication required to read it.
SQL injection in a checkout component
A storefront plugin four releases behind its security fix, with a disclosed injection affecting order data for logged-in customers.
Unrestricted file upload in a form plugin
The contact form plugin was running a build from before the upload restriction was introduced, on a site accepting public submissions.
Tell us the domain.
We will tell you what is open.
No form, no sales call, no obligation. Write from any address and we will reply from ours within a working day.
If you would rather verify us first, ask whoever maintains your site to look at the plugin list. That is where most of it lives.