Website security, and the search consequences of failing it

Both, and the split matters because they fail differently. The application layer is where an attacker gets in — an unpatched component, an exposed administrative path, an input handler that accepts more than it should. The server layer is where the consequences multiply — unnecessary services, permissive file ownership, credentials readable by the wrong process. An assessment that covers one and not the other leaves the more convenient route open, so the exposure review covers the application and the environment it runs on together.

A risk register rather than a score. Each finding carries its exploitability, the business consequence, the order it should be fixed in, who owns it, and the criteria that will show it is resolved. You also get an explicit statement of what was not assessed, because a security review that implies total coverage when it covered part of the estate is more dangerous than one that states its limits. Where the work then proceeds, the same document becomes the remediation plan.

Yes, and on shared or managed hosting it is frequently necessary — some of what an assessment finds can only be changed at a layer the provider controls, such as edge filtering, server configuration or platform versions. Where that is the case the finding names the provider as the owner rather than leaving it unassigned, and we will supply the specifics needed to raise it with them. We do not resell hosting, so there is no reason for us to prefer one arrangement over another.

Vendor clearance typically takes days to a few weeks and varies by vendor, because they assess independently and clear independently. Search recovery lags that — crawl and impressions return over weeks after clearance, not immediately, because the search engine has to observe the change. We will not give you a precise date, but we will set the sequence and measure against it.

We set up monitoring over the public surface — file integrity, unexpected redirects and altered responses — which catches the compromise patterns that affect a website. We do not offer a managed security operations service, and if what you need is continuous SOC coverage that is a different engagement with a different provider.

No, and nobody can. What can be done is closing the entry point that was used, hardening the paths most likely to be tried next, and making a recurrence detectable within hours rather than discovered by a customer. The second and third of those matter more than they sound, because most repeat compromises are the same entry point left open.

It is one layer and rarely sufficient on its own. A WAF filters requests it recognises as hostile; it does not compensate for an unpatched application, an exposed admin path, or credentials that were reused. Those are the routes most compromises actually take, and edge filtering does not address them.