Before paying for a security audit — is there a website security checklist we can run ourselves?

Open your browser's developer console, check the security tab, and scan your site with free header analysis tools. Adding the missing security headers from the report into your server configuration takes barely 30 minutes and wipes out half the findings right off the bat.

The penetration testing report we paid £3,200 for last year had 11 findings. 7 of them were missing server headers and open directory listings. Had we checked those ourselves beforehand, we could have pushed the testing firm to track down actual logic flaws in our payment flow.

Make sure to customize your error pages. If your server or code throws a 500 error and dumps a stack trace or database version onto the screen, you're handing attackers a roadmap. Turn off all error details in production and show only a generic error code.

Add these to your checklist as well: 1) Active CSRF tokens on booking forms. 2) No exposure of hidden admin panels or backup directories in robots.txt. 3) Scanning for forgotten sensitive config files like .zip, .sql, or .env on the server.

Your own checklist will cover basic hygiene, but don't treat it as a replacement for a professional test. Business logic vulnerabilities (like privilege escalation by tweaking someone else's booking ID to view their record) will never show up on an automated checklist. Go through your list, but don't shelve the audit entirely.

check your backups too imo... security isn't just about handling attacks, it's about whether you can restore clean data from an hour ago if everything goes south, and having that backup on an isolated server is critical.

Since you operate in the UK, user data protection carries direct statutory liability. Documenting these initial checks into a dated internal security report will demonstrate your organization's good faith and proactive approach in the event of any data compliance audit.

Don't let it intimidate you, you can run through these checks in a day. At least fix the baseline configs before reaching out; telling the firm "we've completed basic hardening, we only want in-depth business logic testing" might even bring the quote down.

I feel the same way. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Correct me if I'm wrong.

following. btw solutions that work at a small scale collapse when you grow; I learned this late.

taking notes for two weeks yields better results than a six-month estimate then anyway if you post the result here it will help others too.

There is something to watch out for. If it's your first time, start small; scaling comes later.

Trying to do this alone is the most expensive way. Good luck with that.

The answer above hits the nail on the head. Trying to do this alone is the most expensive way.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. If I were you, I'd go this route.

This thread is archived.

don't miss this: Your time to detect an issue directly determines its cost.

of course, it varies if your situation is different.

I have a question, don't want to go off-topic though. When making decisions, write down the worst-case scenario too, not just the best.

Correct me if I'm wrong.

we experienced almost the exxact same thing last year. security isnt absolute; its about making attacks not worth the effort.

i'm also curious if anyone does it differently.

I'll try it.

Three different views emerged, they all complement each other. If permission and scope aren't in writing don't start that test.

If you post the result here, it will help others too.