Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security.

I am wondering from where to start? Is there a famous audit forms to analyze and evaluate the security of a website? An online free tool to make the first check?

The website in question is a very basic one developed in PHP.

share|improve this question
This is my first post in IT-Security. I can edit it as much as you ask ! –  OSryx Dec 2 '12 at 14:25

2 Answers 2

up vote 5 down vote accepted

Have a look at the OWASP Top 10 Project.

OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there.

In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon.

As far as tools go - recommendations are beyond the scope of the site. There are far too many out there. The BackTrack distribution comes with many great ones. It can be quite confusing for a beginner though.

share|improve this answer
excellent , it seems a very good start. –  OSryx Dec 2 '12 at 15:48

As Terry suggested OWASP is the first place anyone should start off especially w.r.t. Web App Security. In addition to that, I would suggest you to also look into WASCv2 and SANS CWE Top 25.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.