This is what a real security review looks like.

Example Company Ltd — example-company.com

Reviewed on 14 May 2026 · Written authorisation · Passive external analysis · Auditor: SAB Security, Karlsruhe

Overall impression: The website is fundamentally well set up. HTTPS, HSTS, and the most important security headers are correctly configured. No open admin panels, no database backups, and no sensitive configuration files were found. The most important action item is in the email area: DKIM is missing, and DMARC is set to monitoring only. Without DKIM, forged emails can be sent in the domain's name — a relevant risk for customer trust and fake invoices.

What was reviewed

• DNS: A, AAAA, MX, TXT, SPF, DKIM, DMARC
• HTTP→HTTPS redirect and www/non-www behaviour
• TLS certificate and encryption
• Security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
• Publicly accessible files (.env, .git, backups, robots.txt, sitemap.xml, security.txt)
• CMS / admin panel discovery
• Contact form: validation, consent, honeypot, basic XSS, rate limiting

What was deliberately not reviewed

• No brute-force attacks
• No denial-of-service tests
• No social engineering
• No destructive testing
• No access to protected systems or data
• No credential sharing

This review was conducted with the client's written authorisation. All tests were passive, non-destructive, and limited to publicly available information.

The review follows a standardised, reproducible process — comparable to an attacker's first look at the public website, but controlled, documented, and without harmful actions.

All tests are conducted from Karlsruhe, Germany. Each check step is logged with date, time, and result. Tools used: DNS queries (dig), HTTP header analysis (curl), TLS verification (openssl), and manual review of identified entries.

The report uses a realistic, business-oriented rating:

Medium — Real business risk (misuse, compliance, customer trust)
Low — Hardening, additional safeguards, minor improvements
Info — Observation, no immediate action required

Findings that are only theoretical or have no demonstrable business impact are not included. No "critical" without a proven exploit path.

Result: No DKIM records were found for the domain. Checked selectors: default, google, selector1, selector2, mail, k1, cloudflare, cf.

Recommendation: Configure DKIM signing with your email provider (Google Workspace, Microsoft 365, Cloudflare Email Routing, etc.). The provider supplies the public key to publish as a DNS TXT record. Effort: about 15 minutes. Afterwards, raise SPF to -all and DMARC to p=quarantine.

Result: DMARC is present but set to p=none (monitoring only).

Recommendation: After configuring DKIM, evaluate DMARC reports for 2–4 weeks. If no legitimate emails fail, raise to p=quarantine (pct=25 for 2 weeks, then pct=100).

Result: The contact form only checks the privacy consent checkbox in the browser (client-side). A direct POST request without privacy_consent is accepted by the server.

Recommendation: Add a server-side check: reject requests where privacy_consent !== true with HTTP 400. Effort: about 5 minutes.

Result: The Content Security Policy includes 'unsafe-inline' and 'unsafe-eval' in script-src.

Recommendation: Medium-term: migrate inline scripts to external .js files (with nonce or hash). As long as the site renders no dynamic user content, the current setup is acceptable.

Result: The security.txt references a PGP key at /.well-known/pgp-key.txt, which returns HTTP 403 (Forbidden).

Recommendation: Either serve the PGP key (adjust nginx rule) or remove the reference from security.txt. Effort: 2 minutes.

The Website Security Deep Review (€499) includes exactly one short retest after you have implemented the recommended measures.

Fixed — set to this status after successful retest.
Accepted Risk — deliberately not addressed, documented.
Open — not yet handled.