Website & Web Application Security Assessment

A security assessment is a review of the security risks in a website or web application within a scope agreed in advance. Sparlio reports the findings whose evidence has been checked, together with their likely impact and recommended fixes.

Websites and web applications that the system owner has authorised in writing can be assessed. Domains, subdomains, test environments, user accounts and any APIs are defined in the scope before work begins.

Not every assessment needs an admin account. Reviewing internet-facing areas usually starts without credentials. If user roles or features behind login are in scope, test accounts limited to that scope may be requested.

Work on a live environment is carried out only with the system owner’s explicit written authorisation and an agreed test plan. Where possible, a test or staging environment is recommended first. The scope and timing of any checks on the live environment are set in advance.

System stability is protected throughout the assessment. Actions that risk downtime or heavy load are not performed unless separately agreed in writing. If an unexpected risk is noticed, the check is stopped and the client is informed.

It depends on the number of domains and applications, the size of the application, the areas behind login and the information provided. The duration and schedule are shared once the scope is clear.

The fee depends on the number of domains and applications, the areas behind login, the APIs and whether a retest is needed. It is given in writing in the proposal once the scope is clear.

The report covers the scope reviewed, the severity of each finding, the evidence, the likely impact and the recommended fixes. Findings are explained so technical teams can act on them and are listed in order of priority.

No. The assessment shows what was observed within the agreed scope and working time. No single review can guarantee that every possible risk will be found or that a system is completely secure.

No. On its own, this service does not provide an official certification or a regulatory compliance document. If work is needed for a specific standard or regulation, its requirements must be defined separately and the scope set accordingly.

No. Sparlio’s security assessment does not replace work that requires a TSE-approved penetration testing firm (for example the e-commerce trust seal) or the mandatory penetration tests required by BDDK, SPK and Central Bank (TCMB) regulations. If you have such an obligation, you need to work with a firm that holds the required certification.

No. Turkey’s Cyber Security Law No. 7545 requires public bodies and critical infrastructure to obtain cyber security services from experts and companies authorised and certified by the Cyber Security Presidency. Sparlio is not an authorised company in this sense, so this service is not offered to public bodies or critical infrastructure operators.

Yes. Once the fixes are complete, you can request a retest to check whether the related findings have been resolved. Its scope and timing are set at the proposal stage.

At first, the website address, an authorised contact at your organisation and your expectations are enough. If test accounts or other access details are needed, a secure sharing method is agreed once the scope and authorisation are clear.