Website security scanning for Canadian businesses
If your business runs a website or web application in Canada, the software underneath it needs patching like any other system: the PHP runtime, the web server, TLS certificates and the containers you deploy. devsecurity checks all of that from the outside and tells you what needs fixing, with evidence.
What we check
- PHP runtime version, matched to published vulnerabilities such as PHP2Shell.
- TLS and certificate health: expiry, chain, hostname, protocol versions.
- HTTP security headers and cookie flags, labelled as hardening recommendations rather than CVEs.
- Container images: OS packages, PHP, OpenSSL, CA certificates and dependencies.
Why patching matters for privacy obligations
Canada's federal private-sector privacy law, PIPEDA, requires organizations to protect personal information with safeguards appropriate to how sensitive it is. Keeping server software patched is one of the most basic technical safeguards. This page is general information, not legal advice, and a scan does not certify compliance with any law or standard.
Need help fixing what we find?
Our security and DevOps team offers 24×7 help with vulnerability remediation, patch management, cloud and container security, Kubernetes, Azure and AWS security, DevSecOps, infrastructure hardening and incident response. Request support.
Frequently asked questions
Does a scan make my business compliant with Canadian privacy law?
No. Privacy law such as PIPEDA expects organizations to protect personal information with safeguards appropriate to its sensitivity. A scan helps you find and fix known technical weaknesses, but it is not a compliance certificate or legal advice.
Can I scan a .ca website?
Yes, as long as you own it or are authorized to assess it. You confirm this before every scan.
Is anything exploited during a scan?
No. Checks are passive and use ports 80 and 443 only. We read what any visitor can see and never attempt to exploit anything.