Your website could be exposing your business to more than cyberattacks. We examine security, privacy, accessibility and technical weaknesses that may create unnecessary financial, operational or legal exposure, explain what matters, and help you fix it.
Missing text alternatives, unlabelled form fields, unnamed buttons, page language, disabled zoom and other barriers automated checks can detect.
Why it may matter: Barriers can stop some customers from buying or contacting you, and accessibility complaints are a known source of demand letters. Automated checks find only part of what matters.
Analytics, advertising and session-recording tools, whether a consent tool is detectable, cookies set on first visit, and forms that send personal information.
Why it may matter: What your site shares with third parties may need notice or choices, depending on where your visitors are. Tracking on sensitive pages draws particular attention.
Keys or credentials in page code, internal addresses, linked API documentation and identity numbers visible in public pages, with values masked.
Why it may matter: Exposed information can lead directly to misuse, and may bring notification duties if personal data is involved.
Public AI assistants, contact and sign-up forms without visible bot protection, and other features that cost money each time they are used. We read the page; we do not send test traffic.
Why it may matter: Automated abuse of paid features can run up bills or exhaust email and AI quotas before anyone notices.
HTTPS, browser protections, outdated software, script integrity and email spoofing protection, from the same Penthera checks as every snapshot.
Why it may matter: The weaknesses automated attacks look for first, and the basics customers and insurers increasingly ask about.
Session cookie protections and sign-in forms served without encryption. Deeper account checks need an authorized review with test accounts.
Why it may matter: Weak sign-in protection makes account takeover easier.
Absolute security or compliance claims, card fields built into the page itself, and whether customers can find a way to contact you.
Why it may matter: Claims you can't substantiate and payment pages in wider scope create avoidable exposure; an easy contact route reduces disputes.
Error details shown to visitors, error responses, unexpected redirects, and personal pages that shared caches may store.
Why it may matter: Broken or leaky pages cost sales and give attackers a map of your systems.
| Level | How it works | What you get | Cost |
|---|---|---|---|
| Free snapshot | Public observation: the home page any browser loads. | Each area with what was observed, its severity and state. Evidence, fixes and plans are kept for the paid review. | Free |
| Verified review | Authorized external assessment, after you prove control of the site and sign a scope. | Every observation with evidence, potential exposure, the fix, how to verify it, professional-review guidance and a fix plan, in an executive report and a technical appendix. | See pricing |
| Specialist scope | Database access controls, spending limits, sessions and backups can't be judged from outside. They need test accounts, code or configuration access. | Reported as not assessed in automated reviews, never as passed. Scoped with you if you want them covered. | By arrangement |
What we observed, why it matters, the potential exposure, the evidence, how to fix it, how to verify the fix, whether a lawyer or specialist should look, and whether we can do the work. The wording comes from our rule registry, written to describe observations rather than legal conclusions, never from AI. Voluntary standards are never presented as law.
Example wording from our rule registry (NS-PRIV-002)
Tracking without a detectable consent tool
Each fix starts as a written plan linked to its finding: the cause, the change, possible side effects, testing and rollback. Nothing changes on your website until you approve the plan and grant the access it needs. A fix counts as done when a follow-up assessment no longer observes the issue.
Work is quoted per project. Changes to privacy notices or other legal wording need your counsel’s approval; we implement approved technical changes.
The free snapshot covers all eight areas from the public page, in about a minute.