Check the security gaps in your website before they become incidents.
A practical baseline for business-critical websites covering DNS, Cloudflare, security headers, WordPress exposure, admin access, backups and recovery evidence — with clear priorities instead of enterprise security theatre.
Built by Myles Agnew · 18+ years in cybersecurity & infrastructure · Cloudflare, WordPress, AWS/Azure/GCP · Sydney, AU
Who this is for
- MSP operators — repeatable checks and evidence across client websites, DNS and Cloudflare accounts.
- Web agency owners — clear WordPress, hosting and Cloudflare risk for the sites you're responsible for.
- Technical founders — know what actually matters on a revenue-critical website.
- Small internal IT/security teams — a clear baseline and priority plan without enterprise overhead.
What the baseline looks at
Domain & DNS
- DNS and registrar risk
- DNS records
- SPF, DKIM and DMARC basics
Edge & web posture
- Cloudflare / edge configuration
- HTTPS
- Security headers
Platform exposure
- WordPress exposure, if WordPress is in use
- Admin/login exposure
- Public attack surface snapshot
Recovery & evidence
- Backup and recovery readiness
- Basic OSINT exposure
- Priority risk register
What you receive
The baseline is designed to produce a clear, evidence-backed view of the website's current security posture and the next actions that matter most.
- Executive summary of the main risks
- Findings by area
- Evidence-backed notes
- Severity and priority ratings
- Priority fix list
- Practical remediation plan
- 30/60/90-day action plan
- Sample-report style structure
Want to see the output first?
The sample report shows the kind of executive summary, findings by area, priority fixes, evidence notes and next actions the baseline workflow is designed to produce.
- Executive summary
- Findings by area
- Priority fixes
- Evidence notes
- What was checked
- Next actions
Find it. Fix it. Prove it.
The baseline workflow is simple: identify the real gaps, prioritise what should be fixed first, and keep evidence of what was checked.
Find it
Check the public website, DNS, Cloudflare posture, WordPress exposure, security headers, admin surfaces, backups and recovery assumptions.
Output: a clear list of gaps, evidence and severity notes.
Fix it
Turn findings into a practical remediation sequence for the site owner, agency, MSP, internal team or existing provider.
Output: a priority fix list and 30/60/90-day action plan.
Prove it
Capture evidence, decisions, scores, screenshots and next actions in a report format that can be shared with owners, managers, agencies, MSPs or clients.
Output: a sample-report style evidence pack and next-step plan.
How the baseline path works
The public page gives you the scope and examples. The private guide explains the full path and next-step options without asking you to send secrets through a form.
Start with the public guide
Review the scope, sample report and checklist so you know what gets checked.
Get the private guide
The private guide explains the full baseline path, report structure, safe next steps and options for getting help.
Share only safe details
If you ask for help, share non-sensitive context such as website/domain, business type, platform and main concern. Do not send passwords, API keys, secrets, customer data or private credentials.
Review findings and priorities
Use the report structure to understand what matters first and what can wait.
Choose your next action
Self-assess with the checklist, work with your existing provider, or request structured help through the private follow-up path.
Choose the path that fits you
I want to self-assess first
Start with the public checklist and use it to find obvious DNS, Cloudflare, WordPress, headers and recovery gaps.
Use the free checklist →I want to see the report output
Review the sample report to see how findings, severity, evidence and priority fixes are structured.
See Sample Security Report →I manage client sites
If you run an MSP or web agency, use the agency baseline workflow to think about repeatable client-site checks.
See agency workflow →I want the private guide
Get the fuller baseline guide and next-step details by email without submitting secrets or credentials.
Get the private baseline guide →What this is not
- Not an invasive penetration test
- Not exploitation
- Not emergency incident response
- Not a compliance certification
- Not a guarantee that a site cannot be breached
- Not a request to send passwords, API keys or secrets
Safe by default
Do not submit passwords, API keys, customer data or private credentials through website forms. The baseline starts with non-invasive, public-facing checks unless a separate safe access process is agreed later.
Get the private baseline guide
Get the fuller Website Security Baseline guide and next-step details by email. The public checklist gives you the starting point; the private guide explains the complete baseline path, report structure and options for getting help.
What happens after you request the guide?
You get the private baseline guide and next-step details by email. From there, you can self-assess with the checklist, review the sample report, or decide whether a structured baseline review makes sense for your site or client environment.
- Confirm your email address — the private guide and next-step details follow straight after.
- Self-assess with the checklist or compare your site against the sample report.
- If the fit is right, the private follow-up explains how to request structured help safely.
FAQ
Is this a penetration test?
No. It is a practical baseline review focused on public-facing configuration, DNS, Cloudflare, headers, WordPress exposure, admin exposure, backups and recovery evidence. It does not include exploitation unless separately agreed.
Do I need to send credentials?
No. Do not submit passwords, API keys or secrets through the website. The baseline should start with non-invasive checks and only move to credentialed review if separately agreed through a safe process.
Is this only for WordPress sites?
No. WordPress exposure is checked when WordPress is in use, but the baseline also applies to static sites, hosted platforms, agency sites, and business-critical marketing websites.
What if I manage multiple client sites?
The baseline is designed to scale into agency/MSP reporting. Start with one site or one representative client site, then use the findings to decide whether a broader portfolio review makes sense.
Can I just use the free checklist?
Yes. The free checklist is the starting point. The baseline path is for people who want clearer evidence, prioritisation and a practical remediation sequence.