The Pro Security Audit adds checks for your billing site’s response headers, cookies, selected sensitive-file exposure, email authentication and database privileges. Use each result to decide what needs investigation; the audit does not change the configuration for you.

Open the audit results

1. Open PD Modules → Guard → Report with Pro access active.
2. Find the Pro Security Audit section. It loads its checks when the report opens; Running deep audit… means that request is still in progress.
3. Read the check label, value, status and any recommendation. The ordinary report’s pass/warn/fail totals are separate from these additional rows.
4. After an intended change, use Re-run and wait for the deep-audit section to finish again. Record which result you reviewed and when.

A locked teaser is not a completed audit. An error or not checked result also needs attention rather than being counted as a pass. The deep audit makes live requests from your billing server; the ordinary report can use cached measurements independently.

Understand the web checks

Force HTTPS checks whether the plain-HTTP endpoint returns a recognised redirect to an HTTPS address. A failed check needs the hosting administrator to inspect the actual route. It does not establish how every URL behaves, and a blocked HTTP response is not the same observation as successfully serving a login form over HTTP.

Security headers checks for header names and a framing-policy signal. Presence alone does not validate the policy values or prove browser enforcement. A permissive or unsuitable policy can still need work even when the audit says the header is set. Have the administrator review the actual policy and test the billing site; OWASP’s header reference explains why Content Security Policy needs careful tuning.

Cookie security flags concerns cookies returned during these requests, which can include redirect responses. It is not an inventory of every authenticated administrator or customer cookie. If no cookie row appears, that does not prove all sessions have been inspected. Version disclosure similarly checks selected response headers, not every place software information could appear.

Review exposure, email and database results

The Exposed sensitive files check probes a fixed set of common locations and treats an HTTP success response as a finding. A generic success page can produce a false positive; an unreachable or unusual response can also leave the result incomplete. None is not proof that every sensitive file is inaccessible. Ask the hosting administrator to investigate privately rather than opening, copying or sharing potentially sensitive content.

The SPF and DMARC checks inspect basic DNS indicators for the configured sender-email domain, falling back to the site’s hostname when needed. They do not authenticate a delivered message or comprehensively validate every record and policy. Lookup failures can resemble missing records, and a DMARC pass does not by itself prove a valid enforced policy. Review the domain shown before changing DNS; do not replace working mail records solely to remove a warning.

The Database privileges result looks for selected powerful privileges visible to the current connection. Least-privilege means those patterns were not detected, not that every required and unnecessary permission has been audited. Not checked is inconclusive. Have the administrator responsible for the database review the privileges; do not run database commands or revoke access based only on this label.

Keep the request perspective in mind

The audit prefers the configured public address. If that cannot be reached, it can try a local-origin fallback, which may differ from the public CDN or proxy response. Its web checks inspect headers without establishing certificate trust. Use Deep SSL Audit separately for the certificate checks, and investigate routing differences with your hosting administrator.

Do not attach sensitive file contents, database grants, credentials or unredacted response headers.

See the PD Guard Blesta guide for related tasks, or explore PD Guard.