Technologies
The publicly observable stack: CMS, frameworks, web server, CDN and third-party libraries.
External security assessment
Review your website’s public security posture
Get a clear report on the technologies visible on your website, external security signals and areas your development team should validate.
- No infrastructure access
- Public perimeter only
- Report after request confirmation
Request a free assessment
Enter the domain and your contact details. The review starts only after the right to request it is confirmed.
What the report includes
Security configuration
HTTPS, TLS, HTTP headers, cookies and other externally available configuration signals.
Update risks
Matches between recognised technologies, public security advisories and known CVEs.
Next steps
Prioritised checks and recommendations on when an authorised audit or remediation is needed.
How the external assessment works
This is not a penetration test and not an attempt to access a system. We analyse only what the website exposes to the public internet.
1. Establish the public perimeter
We review the submitted domain and standard public web-server responses. We do not use credentials or request restricted areas.
2. Identify technologies
We match observable signals with technology databases. Detection can be incomplete, so every technology is marked as an assumption or a confirmed external signal.
3. Compare security advisories
When a publicly recognised component is associated with a CVE, we flag it as a potential area to validate — not as proof of a vulnerability.
4. Prepare recommendations
We give a clear priority: what a site owner can validate and what requires an authorised technical audit with agreed access and scope.
Assessment boundaries
If the external assessment identifies a reason to investigate, we will agree an authorised audit scope: access, scenarios, constraints and reporting format.
- We do not guess passwords, exploit vulnerabilities or bypass security controls.
- We do not scan internal networks, ports or restricted areas without separate written authorisation.
- We do not publish results or share them with third parties.
- A technology match to a CVE does not mean that a website is vulnerable: the version may be hidden, updated or vendor-patched.
Need a deeper review?
If the external assessment identifies a reason to investigate, we will agree an authorised audit scope: access, scenarios, constraints and reporting format.
Request assessment