The Ultimate Checklist On How To Perform A Website Security Audit

Website security audits are often underestimated in importance — and misunderstood in how to perform. Security on the web is quintessential to the success of any online business, as any potential vulnerability can leave company data and customer data open for exploitation. This is why it is so important to check your website for potential loopholes.

Yes, it might not be the most glamorous job in the world, but it makes your main income-generation tool secure, and most importantly, guarantees that your operation will be smooth for years to come. When you have a good online business, why risk it all by skipping such an important part of it?

In this article, we’re going to describe what an ideal website security audit looks like, and we’re going to use a 10-step checklist to make sure that nothing is left behind in the process. You can come back to this checklist anytime you need it for easy reference.

We at Darwinapps take security very seriously, and we’re always looking for better ways to improve our security audits.¹ This means that we’re constantly researching new technologies and new vulnerabilities, especially once innovations are introduced into the market.

What Is A Website Security Audit?

First of all, let’s address the elephant in the room. What is a website security audit?² In short, this practice represents a full overview and inspection of a certain website — large or small — which could benefit from a varied number of security and technological improvements.

Basically, a website security audit is specifically conducted by agencies like Darwinapps to analyze data related to security issues or vulnerabilities in the system. Once the data has been collected, a full report is issued for the client,³ making it easy to visualize the pitfalls.

When it comes to security, there are a lot of things to consider:

• Making sure there’s no data leakage due to the way you set up your site
• Updating scripts and applications used within your hosting and CMS environment
• Ensuring that Secure Shell (SSH) and Secure Socket Layer (SSL) are active
• Checking up on database vulnerabilities that could stem from poor usage of forms⁴
• Checking whether any IP address was blacklisted due to previous security concerns
• Checking URL parameters or URL rules that are used for site navigation

… and of course, much, much more.

Surely, all of these factors need to be taken into consideration, especially if the website has been operating for a long time without paying particular attention to security. A website security audit helps you secure your assets by listing all the potential loopholes.

The Website Security Audit Checklist

A proper website security audit wouldn’t be any good without a plan to go with it. Documents like checklists allow studios like Darwinapps to keep track of everything that’s necessary for a smooth operation. Don’t confuse these with to-do lists;⁵ they’re separate things!

The perfect website security checklist doesn’t exist, but getting as close as possible by checking all the necessary boxes is generally enough to prevent nearly 100% of potential issues. There are certainly elements of these checklists that should be considered only in specific situations, as they are not the foundation of security audits.

In this section, we will discuss the core components of a website security audit,⁶ and we’ll deconstruct the checklist in 10 steps, piece by piece. If you want to conduct your own website security audit, feel free to follow the security guidelines that are listed in this article.

Here is everything that you need to know!

1. Ensuring Sitewide Secure Socket Layer (SSL) to Encrypt Traffic

SSL certificates encrypt sensitive information so that only the intended recipient can access it.⁷ Without a doubt, this is the first thing that should be implemented on your website, and it has to be done in a complete, non-exclusive manner.

This means ensuring that every page is making consistent use of HTTPS protocols and locking these in once any potential problem related to flexible SSL issues has been resolved. This will prevent the website from ever using HTTP again.

2. Obscuring the HTTP Header Info to Keep Configurations Private

HTTP headers send a lot of site information back to the user,⁸ and even if they may seem innocuous, there’s actually quite a lot of valuable data in there. Obscuring these prevents wrong-doers from attempting to do anything malicious with your website.

There are many ways to obscure headers, and all of them include technical processes that require some degree of dexterity when it comes to handling server-side tools and technologies. It’s important to keep these configurations private if you run a business.

3. Enabling HTTP Strict Transport Security (HSTS) to Disallow Unencrypted Traffic

In the first step, we saw the importance of locking in HTTPS to make sure that no user would ever have to go through HTTP again. HSTS allows you to build on top of that by protecting websites against protocol downgrade attacks and cookie hijacking.⁹

Basically, when you lock in HTTPS, there is the potential for some web browsers to keep sending you traffic via HTTP. However, with HSTS the browser is forced to send traffic via HTTPS,¹⁰ even when it’s a much older version, like Internet Explorer 9.

4. Implementing Secure Cookies to Disallow Unencrypted Cookie Transmission

A secure cookie is also known as an HTTPonly cookie and, as the name might suggest, it only works via Hypertext Transfer Protocol. This type of cookie will never be installed on a user’s computer through JavaScript scripts, which can be unstable.

It’s easier to exploit JavaScript when vulnerabilities are discovered than it is to exploit a secure protocol like HTTPS. Using secure cookies prevents hackers from stealing your data via cross-site scripting,¹¹ otherwise known as XSS. Other benefits apply.¹²

5. Securing Web Server Processes by Applying Best Practices

Keeping your web server and your databases secure are fundamental parts of making sure that your website is always safe and operational. In order to do this, servers require regular maintenance, and they must be handled in a proper way.

Some of the things to check on are unused plugins and modules, how the server can be remotely accessed, server-side scripting issues, restricting permissions and privileges, and installing all security patches and updates. There’s a whole world behind there. Web servers and site databases need security checkups and have their own separate breakdowns given the complexity behind them.

6. Validating Forms to Prevent SQL Injection Attacks

One of the easiest ways to exploit websites is by using front-end elements that connect to backend databases — forms. These useful elements allow you to gather data from the user and store it in your database.

Experienced hackers can use forms to run an SQL injection attack,¹³ where the front-end user can exploit vulnerabilities such as poor database programming and misconfigured servers in order to retrieve information and steal or delete it.¹⁴

7. Protecting Against DDoS Attacks and Brute Force

Protecting against these attacks is hard to do on your own. This is because there is no real way to prevent these things from happening; you just have to hope that you’re not the next person in the queue of a massive amount of traffic being sent your way.

That said, it is extremely important to mitigate the effects of DDoS¹⁵ and brute force attacks by using filters around your website(s) that allow you to redirect all the traffic away from your poor, unaware server and onto bigger infrastructure. Using a CDN helps here!

8. Updating Website, Server OS, Scripts, Plugins, etc.

Everyone keep their apps and personal software updated, and yet servers are often used in a very liberal way. Most people are unconcerned about the potential security vulnerabilities of the apps they give their personal information to. And — this absolutely translates to those who are stakeholders in the success and/or reliability of their company’s website.

There’s no reason to live in blissful ignorance here. Updating server-side technologies is crucial to ensuring that the most recent security patches are installed. These patches are built by experts, and they’re easy to manage once you get used to the server’s interface.

There’s a lot to get into here, and if you’re too busy to dive deep, this is explained in a simple way. Think about a “container” that stores everything related to your public-facing site, your private area for site editing, and any external/local customer or general data the site needs to operate. You serve items to clients, take their info while they’re visiting the site and/or integrate any other platforms, like HR for example.

Limiting Privileges and Access to Website and Server

Some webmasters like to collaborate with a lot of people, and that’s great! Having a dedicated team to help you achieve your vision is always a good idea. However, it can become an issue if you start inviting friends and family into your account.

Though uncommon, people and organizations sometimes forget developers, designers, editors, collaborators, and people that had been invited when the website was initially launched. Unless they are helping you on an ongoing basis, these people should not have access.

9. Using Tools to Regularly Check Various Parameters

An audit cannot be complete without an Excel spreadsheet taking in all the different parameters that your website needs to monitor over time. There are various tools that help you skip all the unnecessary noise and get to the important things first.¹⁶

Software like ScanMyServer, Qualys SSL Labs, Acunetix, UpGuard Web Scan, and many more can go through all the details that we previously discussed, as well as doing so in a non-intrusive way. Get the data you need to start working as soon as possible.

As you might have noticed, all the steps in our checklist have a lot to do with HTTP (Hypertext Transfer Protocol). That’s because the protocol itself is the foundational core that allows websites to securely interact in the way that they do, and it requires your utmost attention.

Be sure to always keep an eye out for activity on your server.¹⁷ If something’s going on and you don’t recognize the activity, you might have a security issue (or a hacker) at hand. Also, keep your certificates up to date! Never let any of them expire while the website is still up.

Why You Should Care About Website Security

A lot of casual internet users seem to think that building a website is fairly easy — and that it doesn’t require as many resources as it actually does. There are many misconceptions about website security, but the biggest one is that it’s a set-and-forget procedure.

You get all the security parameters set up correctly and boom, you’re done. You don’t really have to think about it anymore. This is an incorrect assumption in a world that changes by the day, and it’s an incorrect statement if we think about all the failures that could occur.

Even if you have the most stable hosting provider in the world, you would still need to check on your backups manually from time to time. Yes, automation is growing stronger, but it’s not as easy as counting to three. There are quite a few aspects that need to be addressed.

Here at Darwinapps, we take website security very seriously. We see high-tech security as one of the best investments for your business, and we strive to always provide support that’s clear and concise. Learn more here about our best practices for security and technology!¹⁸

As always, we hope you found this article useful. If you’d like to add something to the conversation, feel free to drop a comment down below. We’re always ready to answer your questions, and we’re happy to assist you further with your backend-related issues.

¹ Services — Darwinapps

² A Complete Guide to Securing a Website — Acunetix

³ How To Generate A Website Security Report — WebARX

⁴ 4 Ways To Keep Your Forms Secure and Stay #CyberAware — CognitoForms

⁵ Checklists and To-Do Lists are Different — Manifestly

⁶ Implementing a Website Security Checklist — Nojitter

⁷ Why SSL? The Purpose of Using SSL Certificates

⁸ The Security of HTTP Headers — Context

⁹ Understanding HSTS and Preloading It — Troy Hunt

¹⁰ HSTS — Wikipedia

¹¹ What Is a Secure Cookie? — Techopedia

¹² Securing Cookies with HTTPonly and Secure Flags — INFOSEC

¹³ Running an SQL Injection Attack — Computerphile

¹⁴ What is SQL Injection and How To Prevent It — Acunetix

¹⁵ What is a DDoS Attack? — Cloudflare

¹⁶ 12 Online Free Tools to Scan Website Security Vulnerabilities — Geekflare

¹⁷ How Often Your Website Needs a Security Audit — Xeim

¹⁸ Homepage — Darwinapps