Website Security Baselines & Practical Tools

Website Security Operations

Built for the people responsible for client sites

Agency technical leads

Give every client site the same review, and a handover someone else can follow.

See the agency workflow →

MSP engineers

Know what the baseline covers, what it needs from you, and where public checks stop.

Read the baseline scope →

Site operators

Work through one site yourself, and record what you checked as you go.

Use the free checklist →

The Baseline Workflow

Find it. Fix it. Prove it.

Find

Review the site and record the gaps.

Output: Findings with evidence and limits.

Explore the baseline →

Fix

Prioritise the next actions.

Output: A practical fix list for the responsible operator.

Use the checklist →

Prove

Keep the checks, decisions and retest results.

Output: A report the next person can use.

See the sample report →

Sample report

See what useful evidence looks like

Illustrative example

A sample Website Security Baseline report

A fictional example of how a report can be laid out. It does not describe a real client or a real result.

Executive summary
Findings by area
Priority fixes
Evidence notes
What was checked
Next actions

See the sample report →

MA. Website Security Baseline Report Sample

Executive summary

18Pass

4Needs fix

3Attention

25Checks

Findings by area

DNS & domainNeeds fix
CloudflarePass
Security headersNeeds fix
WordPressAttention
RecoveryNeeds fix

Priority fixes

Back up DNS off-platform P1
Enable HSTS P1
Remove stale admin account P1

Start here

Start with one task

Review a website

Check DNS, edge settings, headers, WordPress and recovery, and record what you find.

Explore the baseline →

Check DNS recovery

Find out whether you could restore your DNS after a bad change or a lost account.

Review recovery →

Investigate an alert

Look at a suspicious email, a traffic export or a Windows log without uploading it.

Open the triage tools →

For agencies and MSPs

Repeat the baseline across client sites

Use the same scope, record what was checked, assign the next actions and leave a handover the client can follow.

See the agency workflow →

Tools

More tools for the next job

Browse all tools →

About

Built by an operator

I'm Myles — a cyber security practitioner and tool builder based in Sydney, Australia.

I build practical security utilities, automation workflows, and repeatable templates for cloud, web, and operational security. My bias is toward tools that reduce real risk, make recovery easier, and turn manual security work into systems that can be reused.

I've spoken at WordCamp Brisbane, run cloud security tooling across AWS, Azure, and GCP, and been in the trenches with Cloudflare, Splunk, and Velociraptor.

Reduce real risk Make recovery boring Keep systems observable Automate repeatable work Prefer practical controls Avoid security theatre

GitHub ↗ LinkedIn ↗

Guides