Security audit of a Linux server or a website
One server or one site at a time, before anything happens. A report with the findings in order of severity.
Who it is for
Fixed price.For before anything happens: a shop going live, a Linux server inherited from another supplier, a client asking whether their site is secure, an agency that wants a written answer to hand to its own client.
One server or one site at a time. The work runs on read only access, granted after the proforma and revoked when the work ends. Nothing gets changed during the audit: first we look, then we decide what to touch.
What it covers
- server configuration: exposed services, updates, accounts, file permissions, SSH
- site and CMS: version, modules and plugins, back office, upload folders, files left in the docroot
- search for traces of a compromise that has already happened, with the same criteria as the nightly check
- mail and domain: SPF, DKIM, DMARC, security headers, certificates
The report is technical and is not a signed expert report. If you need a document for a court, an insurer or a public call, that is a separate engagement.
What you get
A report with the findings, the severity of each and the order to fix them in. Every finding says where it is, what it gives an attacker and how to close it. Fixes are not included: they are quoted separately, on the report.
Order by emailQuestions
- How long does an audit take?
- It depends on what is on the machine: a VPS with one shop is read in a few days, a server with twenty sites is not. The timing is in the quote, together with the price.
- Does the site have to go offline?
- No. The audit reads, it does not write. The site stays online and nobody notices.
- Does it work on shared hosting too?
- Yes, but the site gets checked, not the machine: without a shell the server side is out of sight, and the report says so.
From the email to the invoice
Times count in working days. If your mail program does not open, write to the address at the bottom of the page with the same subject line.
- Right awaypick the engagement and send the pre filled email, with the answers to the questions
- 1 working dayyou get an acknowledgement with the missing questions, or the quote with price, deliverables and timing. The quote is valid for fifteen days
- On your yesthe proforma invoice arrives. Fixed price work is paid half up front and half on completion, the cleanup starts on a deposit, the monthly block is paid before the month
- On paymentwork starts. Access is exchanged only now, on a dedicated account and over an agreed channel, never in the order email
- When the work endsreport, electronic invoice for the balance, access revoked
What stays out
- the fixes, which are quoted on the report
- Windows servers: the work is on Linux
- the signed expert report, which has its own page
Order from Detector, the client portal: hours come off your prepaid balance and the proforma is issued from there, with no email in between.
Open Detector