What the security review covers
This is a posture review conducted from outside your site, using the same public surface any visitor or crawler can see. It answers a specific question: does your site hand its traffic over safely, and is anything visible that should not be?
- HTTPS enforced everywhere, in one hop — Whether HTTP requests redirect to HTTPS everywhere, in a single hop, including www and non-www variants and any legacy hostnames still resolving.
- Certificate valid, complete and current — Validity, expiry window, hostname coverage including subdomains, chain completeness, and whether the negotiated protocol and cipher configuration is current.
- No mixed content — Pages served over HTTPS that still request scripts, styles, images or iframes over HTTP, which downgrade or break the secure context.
- Nothing exposed that should not be — Directory listings left enabled, source-control or backup files reachable by URL, verbose version strings and server banners, administrative endpoints answering to anonymous requests, and missing Secure, HttpOnly, SameSite or HSTS headers.
What this audit explicitly is not
W3Audit does not perform penetration testing, vulnerability exploitation, malware or backdoor scanning, source-code security review, dependency CVE analysis, or any form of authenticated or intrusive testing. We do not attempt to bypass authentication, and we do not send traffic designed to break anything. Nothing in the report should be read as a statement that your site is free of vulnerabilities — only that these specific, externally observable checks passed or failed.
If the review surfaces something that warrants real security testing, the report says so and recommends a specialist engagement. Naming the boundary is more useful to you than implying coverage we do not have.
How findings are rated
Transport failures are rated on exposure rather than effort. A site serving any page over plain HTTP, or with a certificate inside its expiry window, is a critical finding regardless of how quickly it can be fixed. Mixed content is critical where it affects scripts and high where it affects images, since the consequences differ. Version-string disclosure is low on its own and is reported as context rather than as an alarm.
Findings this review commonly surfaces
Related categories
Transport problems reliably show up as SEO and trust problems too, which is why the SEO audit reads canonical hostname and redirect findings from this category, and the HTML and technical audit covers the redirect and status-code behaviour behind them. Severity definitions are documented in the methodology.