Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security.

I am wondering from where to start? Is there a famous audit forms to analyze and evaluate the security of a website? An online free tool to make the first check?

The website in question is a very basic one developed in PHP.

share|improve this question
This is my first post in IT-Security. I can edit it as much as you ask ! – ALJI Mohamed Dec 2 '12 at 14:25
up vote 5 down vote accepted

Have a look at the OWASP Top 10 Project.

OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there.

In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon.

As far as tools go - recommendations are beyond the scope of the site. There are far too many out there. The BackTrack distribution comes with many great ones. It can be quite confusing for a beginner though.

share|improve this answer
excellent , it seems a very good start. – ALJI Mohamed Dec 2 '12 at 15:48

As Terry suggested OWASP is the first place anyone should start off especially w.r.t. Web App Security. In addition to that, I would suggest you to also look into WASCv2 and SANS CWE Top 25.

share|improve this answer

Extending the OWASP theme... OWASP highlights a top 10 of issues to be concerned with:

As well as the top 10 it is worth reflecting on the attack surface you are managing:

One of the OWASP tools, Zap (Zed), helps spider your site looking for trouble and is a useful starting point in terms of automating your audit.

In terms of efficiency, you might wish to consider mean time to patch as a metric to report on.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.