Website security · external assessment · fixed price

See your website the way an attacker sees it. Before they do.

An external security assessment of your website or web shop. We test it from the outside, the way an attacker would, verify every finding by hand and send a plain-language report with what to fix first. Five working days, fixed price.

Check my website What is in the report

No access, agent or installation needed. We test only what is publicly reachable, with your written permission, and never disrupt the site.

Assessment log · exampleweb shop · 2 domains
  1. Day 1Scope agreed · 2 domains · written permission signed
  2. Day 1recon() · 14 subdomains · 3 forgotten: staging, old-shop, mail
  3. Day 2tls.check() · TLS 1.0 still enabled · certificate expires in 9 days
  4. Day 2cms.audit() · 4 plugins with known vulnerabilities · admin panel open to the internet
  5. Day 3Checkout loads a script from an unknown domain → verified by hand, flagged critical
  6. Day 5Report · 11 findings · 3 critical · fix plan in order of risk · 60-min readout
Illustrative · findings vary by site · nothing is exploited, only verified
5 daysfrom permission to a written report
€1–2kfixed price, depending on the size of the site
Noneno access or installation needed: we test from the outside
1 pagesummary for management, details for developers

When companies call us

Usually one of these. Often it is simply that nobody has ever looked.

  • You take orders or payments onlineand the checkout has never been tested
  • The site was built by an agency or freelancer years agoplugins and frameworks never updated since
  • A customer, partner or insurer asked for a security checkand you need something to show them
  • Strange orders, chargebacks or suspicious emailsand you want to know if the site is involved
  • NIS2, ISO 27001 or a tender asks about securityand you need an independent assessment on file
  • Your developers are busy with featuressecurity is nobody's job
  • You are about to launch a new site or shopand want it checked before the traffic arrives
  • You inherited a website through an acquisitionand do not know what you bought

How the assessment works

Five working days. Nothing touched without permission.

The assessment is a fixed-price product with a fixed deliverable. Fixing what we find is a separate, optional step that you can give to us or to your own developers.

Rules we work by

  • Written authorisation from you before the first request is sent
  • No denial-of-service, no brute force, no data extraction: a finding is verified, not exploited
  • Every finding is checked by an engineer, not just an automated scanner
  • Findings are shared only with the people you name, and deleted on request after handover
  • One retest after your fixes is included in the price
  1. 1
    Scope and permission day 1

    We list the domains and systems in scope, agree what is out of scope, and sign a short written authorisation.

  2. 2
    External assessment days 1–4

    Reconnaissance, TLS and security headers, outdated components with known vulnerabilities, exposed admin panels and backups, OWASP checks on forms, login and checkout, third-party scripts, leaked credentials and data.

  3. 3
    Report and readout day 5

    Findings by severity with how we found each one, what it means for the business and how to fix it. A one-page summary for management, and a 60-minute call to walk through it.

  4. 4
    Fixing optional · fixed price or hourly

    We fix the findings together with your developers or hosting provider, retest, and confirm in writing. Or your team fixes them with the report in hand and we retest.

The report

Written for two readers: the owner and the developer

No 200-page scanner export. Every finding says what it is, how bad it is, where it is and what to do about it.

→

What the report contains

  • One-page summary. Overall risk level, the three things to fix this week, and what is fine.
  • Findings by severity. Critical, high, medium, low, each with evidence and the business impact in plain words.
  • Fix plan in order. What to do first, who can do it (developer, hosting, admin), and roughly how long it takes.
  • Attack surface map. Every domain, subdomain, service and third-party script we found exposed to the internet.
  • Retest confirmation. After the fixes, a short letter confirming what was closed, which you can show customers, partners or insurers.
⌕

Example page from a report

example-shop.com · findings 1–3 of 11

SeverityFindingFix
CriticalCheckout page loads a script from a domain not controlled by you. Card data can be read by a third party.Remove the script, rotate payment keys, add a content security policy.
HighAdmin login reachable from the internet, no rate limiting, no two-factor authentication.Restrict by IP or VPN, enable 2FA, limit login attempts.
MediumTwo plugins with publicly known vulnerabilities, last updated in 2022.Update or remove, then set a monthly update routine.

Illustrative. Each real finding also includes the evidence and the request we used to verify it.

Proof, not promises

Where this comes from

Incident response

Live checkout compromise · e-commerce

Before Bonsay, our delivery lead ran the response to a card-skimming attack on a live online store: containment the same day, forensics, remediation, hardening and a retest. The assessment above is the check we wish that store had done a year earlier. Client name on request.

Engineering, not scanning

Senior engineers behind every finding

The people who run the assessment build and operate web systems for a living: backend, DevOps and e-commerce engineers under one EU contract. They know what a fix costs, so the plan is realistic.

Honest scope

What this is not

Not a penetration test of your internal network, not a compliance certificate, and not a sales pitch for a security product. It is an external check of what the internet can see, written so you can act on it.

Check my website

Send us the address. We reply within one business day.

We look at the site, tell you if the assessment makes sense for it, and send a fixed price and a one-page authorisation to sign. Nothing is scanned before you sign.

Prefer email? gleb@bonsaytech.com · WhatsApp +372 5306 0026