50 Questions to Evaluate the Quality of Your Website

50 Questions to Evaluate the Quality of Your Website

By Carsten Cumbrowski

How good is the quality of your website, really? Here is a pretty detailed list of questions every website owner should asked themselves. If the answer to every question  below is yes, give yourself a big ole pat on the back.  Most websites have flaws for a number of different reasons, mostly related to the limitation of resources.

This 50 questions long questionnaire might trigger something here and there for some of you or maybe brings some forgotten item from the long to-do list back into your mind. 

Accessibility

1.    Is content structurally separate from navigational elements?

2.    Is the website cross-browser compatible?

3.    How compliant is the website with W3C coding standards? Valid HTML/CSS?

4.    Are ‘alt’ tags in place on all significant images?

5.    Are text-based alternatives in place to convey essential information if this is featured within images or multimedia files?

Navigation

1.    Are links labeled with anchor text that provides a clear indication of where they lead without over using exact match anchor text?

2.    Depth – what is the maximum number of clicks it takes to reach a page within the depths of the site?

3.    If a splash screen or navigation feature is provided in a Java/JavaScript/Flash format, is a text-based alternative also available?

4.    Responsive on click feedback – Is a response given immediately (0.1 seconds) after a click is made on a hyperlink?

5.    Do clickable items stylistically indicate that they are clickable?

6.    How intuitive is it to navigate? Are signs obvious or obscured? Buttons/Links Like Text, that are not clickable and vice versa, links/buttons that cannot be identified as such

7.    Is it readable? Consider type face, font size, color contrast.

8.    Is there a clear statement of PURPOSE of the site? Purpose must be clear within a few seconds.

9.    Do you have clear call to action on each page?

10.Is a logical site map available?, If not, is a keyword-based search feature available? Note: Large (multi-thousands of pages) sites should have a search form.

Design

1.    Is the site’s design aesthetically appealing?

2.    Are the colors used harmonious and logically related?

3.    Are the color choices visually accessible? (For example high enough in contrast to assist the colorblind and visually impaired in reading the site appropriately)

4.    Is the design audience appropriate?- The standard text size should be readable for visitors who don’t know how to adjust their browsers.

5.    Are the fonts easy to read on various screen resolutions?

Content

1.    Is the website copy succinct but informative?

2.    Does the copywriting style suit the website’s purpose and ‘speak’ to its target audience?

3.    Are bodies of text constrained to <80 characters="" line="" o:p="" per="">

4.    Can text be resized through the browser or do CSS settings restrict size alteration?

5.    Is the contrast between text and its background color sufficient to make reading easy on the eyes?

6.    Is text broken into small, readable chunks and highlighted using headings, sub-headings, and emphasis features where appropriate to assist in skimming?

7.    Within articles, are there links to more detailed explanations of subjects, or definitions of jargon terms?

8.    Do you have an “about page” that identifies the author of the content, credits to source for content that was not written by the site owner himself?

9.    Do you have testimonials and publish them on the site?

10.Do you update the content regularly and don’t live by the phrase “set it and forget it”?

Security

1.    Any obvious security flaws?

2.    How resilient are forms to special characters?

3.    Are private directories password protected via .htaccess?

4.    Are public non-document directories (cgi-bin, images, etc) indexable or are blank index.html pages or appropriate permission settings in place to block access?

5.    Is customer data stored online? If so, is this database appropriately safeguarded against external access?

Other Technical Considerations

1.    Does the site load quickly – even for mobile users?

2.    Are all links (internal and external) valid and active?

3.    Are scripts free from errors?

4.    Is the website free from server side errors?

Other Marketing Considerations

1.    Is the website properly optimized for search engines (essential text emphasized, title tags relevant, title text presented in H1, outbound links reliable and contextually related, etc)

2.    Does the index page entice a visitor deeper into the site or shopping cart?

3.    Does the website contain elements designed to encourage future or viral visitation (i.e. a contest, newsletter, tell-a-friend feature, and forum with subscription option, downloadable toolbar, RSS feed or similar)?

4.    Robots.txt configured?

5.    Site Map available?

6.    Is every page accessible at least via a single plain HTML Link (no JavaScript or Flash Link)?

7.    Does every page have at least some text in the content? (How much Text remains on the Page if you remove all Images, Videos, Flash, Java Applets and JavaScript Code? Anything? Does the remainder still states the pages purpose?)

8.    Is every individual page only accessible via a single URL or are several URLs available (and worse, used) to access the same page? Duplicate Content Issue, Canonical URLs.

Legal Stuff/Re-Assurance/Legitimization

1.    Did you include a Contact Us page with real address, phone number (toll free for businesses) and contact form or email available, basically a clear and easy to use feedback/contact mechanism?

2.    DMCA Notice up? Terms of Use page available where you specify what you do and why and what visitors have to agree on if they want to use your site? This is to protect yourself from complains or worse regarding things that you cannot control properly, such as links to third party websites or ads from automated systems such as Google AdSense etc.

3.    Privacy Policy up (especially if you collect data, email, names, and web analytics tracking cookies)?

Cheers!

APPROACHES, TOOLS AND TECHNIQUES FOR SECURITY TESTING

INTRODUCTION TO SECURITY TESTING

Security testing is a process that is performed with the intention of revealing flaws in security mechanisms and finding the vulnerabilities or weaknesses of software applications. Recent security breaches of systems at retailers like Target and Home Depot, as well as Apple Pay competitorCurrent C, underscore the importance of ensuring that your security testing efforts are up to date.

The prime objective of security testing is to find out how vulnerable a system may be and to determine whether its data and resources are protected from potential intruders. Online transactions have increased rapidly of late making security testing as one of the most critical areas of testing for such web applications. Security testing is more effective in identifying potential vulnerabilities when performed regularly.

Normally, security testing has the following attributes:

• Authentication
• Authorization
• Confidentiality
• Availability
• Integrity
• Non-repudiation
• Resilience

WHY SECURITY TESTING

System testing, in the current scenario, is a must to identify and address web application security vulnerabilities to avoid any of the following:

• Loss of customer trust.
• Disturbance to your online means of revenue generation/collection.
• Website downtime, time loss and expenditures in recovering from damage (reinstalling services, restoring backups, etc.)
• Cost associated with securing web applications against future attacks.
• Related legal implications and fees for having lax security measures in place.

CLASSES OF THREATS

Here are the different types of threats which can be used to take advantage of security vulnerability.

Privilege Elevation

Privilege elevation is a class of attack where a hacker has an account on a system and uses it to increase his system privileges to a higher level than he/she was not meant to have. If successful, this type of attack can result in a hacker gaining privileges as high as root on a UNIX system. Once a hacker gains super-user privileges, he is able to run code with this level of privilege and the entire system is effectively compromised.

SQL Injection

SQL injection is the most common application layer attack technique used by hackers, in which malicious SQL statements are inserted into an entry field for execution. SQL injection attacks are very critical as an attacker can get critical information from the server database. It is a type of attack which takes the advantage of loopholes present in the implementation of web applications that allows a hacker to hack the system. To check the SQL injection we have to take care of input fields like text boxes, comments, etc. To prevent injections, special characters should be either properly handled or skipped from the input.

Unauthorized Data Access

One of the more popular types of attacks is gaining unauthorized access to data within an application. Data can be accessed on servers or on a network.

Unauthorized access includes:

• Unauthorized access to data via data-fetching operations
• Unauthorized access to reusable client authentication information by monitoring the access of others
• Unauthorized access to data by monitoring the access of others

URL Manipulation

URL manipulation is the process of manipulating the website URL query strings & capture of the important information by hackers. This happens when the application uses the HTTP GET method to pass information between the client and the server. The information is passed in parameters in the query string. The tester can modify a parameter value in the query string to check if the server accepts it.

Denial of Service

A denial-of-service (DoS) attack is an explicit attempt to make a machine or network resource unavailable to its legitimate users. Applications can also be attacked in ways that render the application, and sometimes the entire machine, unusable.

Data Manipulation

In data manipulation, a hacker changes data used by a website in order to gain some advantage or to embarrass the website’s owners. Hackers will often gain access to HTML pages and change them to be satirical or offensive.

Identity Spoofing

Identity spoofing is a technique where a hacker uses the credentials of a legitimate user or device to launch attacks against network hosts, steal data or bypass access controls. Preventing this attack requires IT-infrastructure and network-level mitigations.

Cross-Site Scripting (XSS)

Cross-site scripting is a computer security vulnerability found in web applications. XSS enables attackers to inject client-side script into Web pages viewed by other users and trick a user into clicking on that URL. Once executed by the other user’s browser, this code could then perform actions such as completely changing the behavior of the website, stealing personal data, or performing actions on behalf of the user.

All of the attacks listed above are most critical threat classes but these are not all.

SECURITY TESTING TECHNIQUES

To prevent all of the above security testing threats/flaws and perform security testing on a web application, it is required to have good knowledge of the HTTP protocol and an understanding of client (browser) – server communication through HTTP. Also, basic knowledge of SQL injection and XSS is required. The following techniques will help in performing quality security testing:

Cross Site Scripting (XSS):

The tester should additionally check the web application for XSS (Cross site scripting). Any HTML e.g. or any script e.g.