Website security for your site, online store and web applications

A check including remediation for a company website or an online store can start at €2,500 in the Starter package, depending on scope. We quote extensive web applications with roles, interfaces and several systems in the Professional package from €8,000 or individually as Enterprise. You will receive a transparent quote in advance.

A check for a typical company website is usually done in a few days; extensive web applications take longer. The duration of remediation depends on the number and type of findings. Once the scope has been defined, we will give you a concrete time frame.

Our security check is based on the OWASP Top 10 and combines automated scans with manual testing. If a formal penetration test is required, for example for a tender, we will tell you openly whether our scope is sufficient or whether a specialized tester makes sense.

We implement technical measures that matter for data protection, such as encryption, access rights and logging, and document them. Whether your company as a whole is compliant with data protection law is a legal question – our work does not replace legal advice.

First change all access credentials and get in touch with us. We secure the current state for analysis, clean up the website or restore a clean backup and close the gap the attack came through. Please clarify with your legal or data protection counsel whether reporting obligations apply.

After the free initial consultation, we define the scope of the assessment and obtain your authorization. Testing, report, remediation and retest follow. On request, we then take over ongoing monitoring as part of maintenance.

Public testing tools, for example for HTTPS, certificate and security headers, give a first impression. They only show what is visible from the outside, though. A security check additionally examines logins, forms, plugins, interfaces and server configuration and rates the findings by urgency.

A vulnerability assessment systematically looks for known gaps such as outdated components or misconfigurations, usually with a combination of tools and manual review. A pentest goes further: with your explicit permission, testers try to actively exploit vulnerabilities to show the actual risk. For many company websites, the vulnerability assessment is the sensible starting point.

Typical signs are unknown user accounts, foreign pages or links, redirects to other websites, warnings in the browser or in Google Search Console and suddenly slow load times. Some attacks remain invisible for a long time, though. If you suspect something, we examine files, database and logs and tell you whether and how the website is compromised.

Regular updates of WordPress, theme and plugins, removing unused extensions, strong passwords with two-factor authentication and a protected login area are important. On top of that come a secure server configuration, security headers and regular, tested backups. We review your WordPress installation and implement these measures – on request permanently as part of maintenance.

That is a legal question that depends on the individual case, for example on contracts and on which data is affected. Please clarify it with your legal or data protection advisor – our notes do not replace legal advice. Technically, we support you with documentation of when, how and which systems were affected; it helps with the legal assessment.