Encryption
SSL certificate and configuration.
Cybersecurity / Website
Website Security and Privacy Check
Your website collects personal data through forms, cookies and trackers, and it is the first thing attackers probe. We check both sides together: the basic security settings and the privacy practices visitors and regulators see.
Overview
Website Security and Privacy Check
What it is
A non-intrusive external check of your website's security configuration and privacy practices, with a prioritised fix list for your developer.
Why organisations need it
Websites leak data through insecure forms, outdated plugins and misconfigured settings, and collect data through cookies and trackers that visitors never agreed to. Both expose you under the PDPA. This check covers the basics without the cost of a penetration test.
Key features
What the engagement covers
Security headers
Browser protections configured.
Software
Content management system and plugin versions.
Forms
What personal data forms collect and how it is sent.
Cookies and trackers
What is set and whether consent is obtained.
Privacy notice
Whether the notice matches the site's actual behaviour.
Business value
What the business gets out of it
Security and privacy together
One check, two risks.
Non-intrusive
No testing that could disrupt the site.
Developer-ready fixes
Clear instructions.
PDPA support
Consent and notice evidence.
Affordable
Fixed fee.
How it works
How the engagement runs
01
Scan
External checks.
02
Review
Forms, cookies and notices.
03
Findings
Prioritised report.
04
Fixes
Your developer applies them.
05
Re-check
Confirming results.
Deliverables
What you receive
Security findings
Configuration and software.
Cookie and tracker inventory
What the site sets.
Consent assessment
Is consent valid?
Notice alignment notes
Notice versus reality.
Fix list
For your developer.
Who it is for
Who this is built for
Industries
Company sizes
Departments
Why Orbix
Why organisations choose Orbix
A governance approach, not a tool sale
We do not resell products, so nothing here is shaped by a vendor margin. The recommendation is whatever your risk and your budget actually justify, including telling you that you do not need the engagement yet.
Recommendations you can actually implement
Findings come with a sequence, an owner and a realistic effort estimate, sized to the team you have rather than the team a framework assumes. A report that cannot be acted on is an expense, not a control.
Consultants who have sat on your side of the table
Our people have carried the obligation internally, not only audited it. That shows up in what we consider proportionate, and in how much documentation we think you genuinely need.
Built for the Malaysian operating context
Work is grounded in Malaysian law and regulator expectation, from the PDPA and the Cyber Security Act 2024 to Bursa, BNM and SC requirements, rather than translated from a European or American template.
HRD Corp expertise where it applies
Where an engagement includes training, the training component is structured to be HRD Corp SBL-Khas claimable, which changes what the programme costs you in practice.
Questions
Questions we get asked
Is this a penetration test?
No. It is a non-intrusive check of configuration and privacy practices.
Do you fix the website?
We provide fixes for your developer. We can coordinate with them.
Do we need cookie consent in Malaysia?
Where cookies and trackers collect personal data, PDPA notice and consent principles apply. We assess your site.
How long does it take?
Usually a few days.
Can you check several websites?
Yes, priced per site.
Get started
Check your website's security and privacy
Send us your website addresses. We will quote per site.