Repère Security Guides
Web security guides
Guides written for business owners, not for specialists. Each answers a concrete question and stays useful even if you never hire us.
Choosing the right work
Audit, scan, penetration test, quality check: four words for very different work, often used interchangeably.
- Audit, scan or penetration test: which one do you need? What each one looks for, what each one costs in time, and how to recognize the one you need. Including when it is not Repère.
Looking for yourself
Before calling anyone, there are things a site owner can establish on their own.
- What you can check yourself on your website Nine surface checks, each with what it reveals and what it does not tell you.
After the findings
Receiving a report and knowing what to do with it are two different things.
- Reading an audit report and deciding where to start The anatomy of a finding, how a severity scale actually reads, and how to choose when everything looks urgent.
WordPress
The most common platform among small businesses, and the one whose surface behaves most differently.
- WordPress security: plugins, themes and accounts, what an audit examines What third-party components change, where forgotten access hides, and what the site lets you see without meaning to.
Configuring visible protections
Two technical mechanisms can be checked without private access: the headers sent by the website and the DMARC policy published in DNS.
- Website security headers: which ones matter and why The role and limits of CSP, HSTS, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- DMARC: choosing among p=none, quarantine and reject How SPF, DKIM, alignment, aggregate reports and the current test mode inform a domain-specific decision.
Control the everyday attack surface
Four practical inventories connect access, vulnerability alerts, email authentication and the information a public website reveals.
- Website admin accounts: who should have one? Limit, protect and review the accounts that can change the site.
- How to read a vulnerability alert without panicking Separate technical severity, real exposure and the repair decision.
- SPF: inventory every email sending source Find legitimate senders before strengthening DMARC.
- What your website exposes without meaning to Separate technical clues from exposures that need remediation.
How these guides are written
They are written by Clément Marty, a web developer in Montréal, who runs the Repère audits. There is no review board: there is one person, and he signs his name to it.
When a technical claim needs a source, it is cited: first the Canadian Centre for Cyber Security, OWASP, and the WordPress documentation. The rest describes how Repère actually works, and says so.
Every guide carries a last-revision date. It changes only when the content changes. Texts that depend on software versions are reviewed more often than ones explaining a concept.
No figure is published without a source. No example uses a client's site.