I am asked to write a first technical audit about the security best practices to improve a PHP web-site security.

I am wondering from where to start? Is there a famous audit forms to analyze and evaluate the security of a website? An online free tool to make the first check?

The website in question is a very basic one developed in PHP.

  • 1
    This is my first post in IT-Security. I can edit it as much as you ask !
    – user16672
    Dec 2, 2012 at 14:25

3 Answers 3


Have a look at the OWASP Top 10 Project.

OWASP has the best set of resources available online when it comes to web applications. You can learn plenty of information from there.

In addition, I would look into hardening the servers which your application run on. CIS has a good set of benchmarks you could base your audit upon.

As far as tools go - recommendations are beyond the scope of the site. There are far too many out there. The BackTrack distribution comes with many great ones. It can be quite confusing for a beginner though.

  • excellent , it seems a very good start.
    – user16672
    Dec 2, 2012 at 15:48

As Terry suggested OWASP is the first place anyone should start off especially w.r.t. Web App Security. In addition to that, I would suggest you to also look into WASCv2 and SANS CWE Top 25.


Extending the OWASP theme... OWASP highlights a top 10 of issues to be concerned with: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

As well as the top 10 it is worth reflecting on the attack surface you are managing: https://www.owasp.org/index.php/Attack_Surface_Analysis_Cheat_Sheet

One of the OWASP tools, Zap (Zed), helps spider your site looking for trouble and is a useful starting point in terms of automating your audit.

In terms of efficiency, you might wish to consider mean time to patch as a metric to report on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy