Google warns visitors about your website, visitors end up on unknown sites, or the hosting provider has suspended the account? We isolate the website, close the vulnerability and clean the website within 24 hours of access, weekends included. Afterwards you receive a written report.
Securing web applications: before the pentest and after an attack
A penetration test is coming up, a report lists vulnerabilities, or your website has been hacked? We review application and server before the test, fix the findings from the report and, after an attack, help within 24 hours of access, weekends included.
- Full-stack and DevOps experience since 2012
- PHP and WordPress since 2012, plus Craft CMS
- Support and emergencies around the clock
What we do to secure your application
Typical starting points:
- A client, a bank or a tender requires a penetration test, and the date is set.
- A penetration test report lists vulnerabilities, and nobody in-house has the time or the knowledge to close them.
- Your website has been hacked, and visitors or Google noticed it first.
- A website built with Craft CMS or WordPress has been running for years without anyone keeping an eye on updates and access.
We always look at application and server together: code, configuration, access, web server and the Linux system underneath. Our engineers have worked as full-stack and DevOps engineers since 2012, with PHP, ColdFusion and Lucee. With this knowledge we find and close vulnerabilities without rewriting the application.
Pre-pentest review: before the tester arrives
If a penetration test mainly finds outdated libraries, exposed administration access and debug output, little time is left for the difficult questions. That is why we check before the test date:
- the application: input handling, login and sessions, permissions, file uploads and libraries
- the server: open services, administration access, TLS, security headers and updates
- the configuration: error messages, debug output and accounts with default passwords
You receive the findings by risk, with the effort for each finding. We make quick fixes before the test; which ones, we agree with you after the review. The review does not replace a penetration test. It makes sure the test examines the difficult questions, not the obvious ones.
Fixing the findings from a penetration test report
The report is in, and the list is long? We rank the findings by risk and fix them in the code and the configuration, for example cross-site scripting, SQL injection, insecure sessions or unchecked file uploads. We check every fix, and for the retest you receive a list of what was changed and where. This also applies to older applications in PHP, ColdFusion or Lucee whose author is no longer around.
If a vulnerability cannot be closed in the code straight away, we shield it temporarily. Network zones, administration access through a VPN and a WAF with rules for your application are described in the section on security architecture under Linux operations and infrastructure. If the cause is a version that no longer receives security updates, we plan the update as a separate step under Migration and modernisation.
First aid when your website has been hacked
Google warns visitors about your website, visitors end up on unknown sites, or the hosting provider has suspended the account? Within 24 hours of access, weekends included, we isolate the website, find the point of entry, close the vulnerability and clean the website. We renew passwords and access credentials, and if Google has flagged the website as dangerous, we request a review.
Websites built with WordPress are affected most often. We help just as much with Craft CMS and with other applications in PHP or CFML. How the 24 hours work and what you should rather not do before we start is described on the page Website hacked?
Securing Craft CMS and WordPress
A website with a content management system only stays secure if someone looks after the CMS, the plugins and the server. For websites built with Craft CMS and WordPress, this is how we proceed:
- an inventory of plugins and themes: what is maintained and what has been abandoned
- updates of CMS, plugins and PHP, tested on a staging environment first
- replacement or removal of abandoned plugins
- back-end access with two-factor authentication, appropriate file permissions and a WAF on the server
- backups with a restore test, and monitoring
The first step is the CMS check. It shows where your website stands and ends with a plan for takeover and ongoing support.
Penetration tests: we work with any testing company
The penetration test is carried out by a specialised company. We work with any penetration testing company that you or your client commission: we prepare the application and the server for the test, answer the testers' questions and fix the findings afterwards. If you do not have a tester yet, we can find a suitable partner for you to harden your application.
Technologies we secure
Two typical starting points in detail
-
-
Your legacy system works and holds rules nobody wants to rewrite. We expose its logic as a web service and close known vulnerabilities in a single pass. Comparison tests check whether behaviour stays the same, and the new system is built beside it in the new stack.
Two first steps at a fixed price: before the test and after an attack
Pre-pentest review
For companies facing a penetration test because a client, an auditor or a tender requires it, and who want to know beforehand where their application and server are open to attack.
- Application: input handling, login and sessions, permissions, file uploads, outdated libraries
- Server: open services, administration access, TLS, security headers, updates
- Configuration: error messages, debug output, accounts with default passwords
- List of findings by risk, with the effort for each finding
- Quick fixes before the test date, to the extent we agree with you after the review
We review one application with its servers. On the production system we change what you commission. The review does not replace a penetration test: it makes sure the test examines the difficult questions, not the obvious ones.
What the result contains
A written list of findings by risk with specific fixes, the status of the fixes already made and a plan up to the test date. The list is yours. After the test, we fix the findings from the report on request.
Website first aid after an attack
For companies whose website has been hacked: Google warns visitors about it, visitors end up on unknown sites, spam appears in the search results, or the hosting provider has suspended the website.
- Isolate the website and preserve its current state before anything is deleted
- Find the point of entry: plugin, credentials, server or code
- Close the vulnerability or shield it temporarily
- Clean the website, from a backup taken before the attack where possible
- Renew passwords, keys and access credentials
- Request a review from Google if the website is flagged as dangerous
The 24 hours run from access, weekends included. Whether data has been taken cannot always be established with certainty; what we find is in the report. When Google removes the warning is up to Google. Further work after the first 24 hours starts only with your approval.
What the result contains
Within 24 hours of access, a contained and cleaned website and a written report on what happened technically, with the next steps to secure the website. The report is yours.
from €1,500 excl. VAT
Request website first aidFrom our projects
-
A shop flooded by bots that looked like customers
A WooCommerce shop with 52 products loaded slowly or not at all. The cause was a paid network of bots sending tens of thousands of requests an hour, each from a different home address, and every single bot behaved perfectly. Our engineers stopped the traffic at the edge of the network, and when the bots changed tactics a month later, the second rule took the load off within two minutes.
Questions about securing applications and websites
Do you also carry out the penetration test?
We do not carry out the test ourselves. We work with any penetration testing company that you or your client commission, and if needed we can find a suitable partner for you. We prepare the application and the server for the test and, on request, fix the findings from the report afterwards.
This keeps the test independent of the people who develop and maintain the system.
Will our application pass the penetration test after the review?
Nobody can promise that. The review removes the obvious weaknesses, such as outdated libraries, exposed administration access or debug output. Above all, we find the embarrassing vulnerabilities that are easy to overlook in day-to-day work and look obvious when they only come up in the penetration test. On request, we also run a trial penetration test with a technology partner before the actual one. The test can then concentrate on the difficult questions.
Whatever the test still finds, we fix on request, and we document every fix for the retest.
Can you fix the findings from an existing penetration test report?
Yes. We rank the findings by risk, fix them in the code and the configuration, for example cross-site scripting or SQL injection, and check every fix. For the retest you receive a list of what was changed and where.
If a vulnerability cannot be closed in the code straight away, we shield it temporarily, for example with a rule in the WAF. This also applies to older applications in PHP, ColdFusion or Lucee.
Is a WAF enough?
Not on its own. A web application firewall (WAF) filters typical attacks in front of the application and buys time. It does not close a vulnerability in the code. That is why we combine it with fixing known vulnerabilities, network segmentation and administrator access through a VPN only.
A WAF with rules written for your application triggers fewer false alarms and protects better in practice than the default configuration. If the code cannot be changed quickly, a WAF with isolation is a stop-gap until the update. The risk then falls but does not disappear.
Can we not simply restore the latest backup?
On its own, that is rarely enough. The vulnerability the attacker used is in the backup too, and if the attack is older than you think, the backup already contains the malicious code. The website is then compromised again shortly afterwards.
So we first find the point of entry, then restore a backup from before the attack and close the vulnerability before the website goes back online. If there is no clean backup, we clean the website directly.
Do you cover weekend duty from time to time?
Yes. Support and emergencies are covered around the clock (24/7), weekends included. For other enquiries we are available Monday to Friday, 9:00 to 17:00 Central European Time, and we reply within one working day.
In 20 minutes we work out which first step fits your system
You tell us the goal and the current state, and we say openly whether and how we can help. Reply within one working day, no obligation.
Phone (German, Polish, English)
+48 501 250 220
Email
Email
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)