Hardening and remediation
An audit tells you where the open doors are. Hardening closes them. FastSolve fixes the flaws found and strengthens what can be strengthened, so an attacker meets a locked door where they were looking for a way in.
Like the audit, this service requires written authorisation and an agreed level of access to the site being fixed.
Knowing a flaw exists and leaving it open
The riskiest moment is not when a flaw is unknown. It is when it is known and its fix is put off until later.
- Security was considered at the end, once the site was live, when it is decided at the design stage.
- An audit report sits in a drawer because no one knows where to start with it.
- The host's default settings were left untouched, and no one checked what they let through.
- Every fix feels frightening, because there is a fear of breaking what works while trying to protect it.
Fixing takes method, not courage: doors are closed one by one, checking at each step that the site keeps working.
What hardening covers
Fixes follow the order of real risk, from the most exploitable to simple comfort reinforcement.
1. The front
Security headers, content policy, up-to-date encryption, systematic redirection to a secure connection: the first layer discourages most automated attempts.
Typical case. A site still served old encryption versions and exposed its exact technology. Two settings were enough to remove those clues and close the outdated protocols.
2. The entry points
Every form, every field, every address is an entry point. We validate what comes in, clean what goes out, and close injections before they can be used.
Typical case. A form accepted any content with no checks. Strict validation put an end to header injection and display hijacking.
3. Access and accounts
Robust sessions, data separation between users, limits against brute force, correctly scoped cookies: this is the heart of protection as soon as there are client accounts.
Typical case. A client area shared the same session token with less secure environments. Restricting its scope removed the risk of stealing another client's session.
4. Abuse and cost
Rate limits on sensitive endpoints, caps on paid services, anti-bot filters: we prevent a stranger from running up the bill or overloading the service in a loop.
Typical case. An online assistant answered with no limit at all. A per-visitor limit and a daily cap ended the risk of an uncontrolled bill.
What hardening does not do
It greatly reduces the attack surface. It does not promise invulnerability, which no one can promise honestly.
- It does not make a site impregnable. No site is. It raises the cost of an attack to the point of discouraging the vast majority.
- It is not done once and for all. Code evolves, new flaws appear: protection is maintained, not set and forgotten.
- It does not make up for bad habits. Passwords shared or written in plain sight cancel out the best hardening.
- It does not replace an official certification, when your sector or your insurer requires one.
Our role stops where your daily practices begin. We tell you plainly what depends on us and what depends on you.
Frequently asked questions
Is an audit needed before hardening?
It is the logical order, but not a requirement. We can start from an audit you already hold, or combine the audit and the hardening into a single service, often more economical.
Will the site be down during the fixes?
As a rule, no. Fixes are applied and checked one by one, and sensitive changes are prepared separately before going live, to avoid any visible interruption.
How long does the protection last?
Fixes stay in place as long as the site does not change. As soon as features are added or components updated, a new check is worthwhile. That is the purpose of regular follow-up, if you wish.
Do you work on a site you did not build?
Yes, provided we obtain sufficient access and written authorisation from the owner. We start by checking what can be changed before committing to a perimeter.
How much does it cost?
The price depends on the number of flaws to fix and their nature. Hardening headers and rebuilding access control are not the same work. The quote follows the assessment. As a guide, excluding VAT, most hardening jobs fall between 700 and 2,000 euros. A rework of the access control can reach 3,000 euros.
Tell us what you want to protect
See how a project unfolds, from scoping to delivery
See all FastSolve services