The checks overview explains the broad risk areas WebRiskOps reviews, the evidence families it stores, how findings become report items and what is deliberately excluded without publishing the full rulebook.
What counts as a check
A check is a scoped observation: page, condition, evidence, confidence and a plain-language reason the issue matters.
Accessibility and usability blockers
These checks look for UI and form issues that stop users from navigating, completing forms, understanding errors or reaching primary actions.
Consent, privacy and opt-out signals
Consent and privacy checks record cookie banners, CMP behavior, tracking posture, US privacy-choice links and consent or opt-out states that can block conversion or weaken trust.
Checkout and form completion
Checkout checks focus on primary CTAs, required fields, payment-adjacent pages, blocked submits and unclear field errors.
Pentest-adjacent browser and header hygiene checks capture low-impact technical evidence for authorized web journeys without attempting exploitation.
These checks support prioritization and procurement conversations. They do not prove exploitability, certify security, or replace a scoped penetration test.
Transport trust
Response status, final URL, redirect note, and captured transport/header observation.
Does not inspect private certificates, internal networks, TLS cipher policy, or exploit transport weaknesses.
Browser security headers
Header snapshot with missing or weak browser-facing protection notes.
Does not certify the policy is complete or prove that a missing header is exploitable.
Cookie trust posture
Observed cookie attributes for pages inside accepted scope, excluding secret values.
Does not capture cookie contents, bypass sessions, or validate authentication controls.
Mixed content and insecure assets
Affected URL, resource type, and browser warning or network observation.
Does not crawl private asset origins or attempt to tamper with loaded resources.
Browser warnings and failed requests
Console or network message, page URL, request status, and screenshot when available.
Does not debug vendor systems, attack third-party endpoints, or run destructive request patterns.
Scope and exposure clues
Discovered public URLs, skipped scope notes, and non-sensitive exposure observations.
Does not enumerate hidden admin panels, brute-force paths, or test access controls.
A bounded plugin ecosystem plan for customer-initiated diagnostics and evidence handoff from CMS, ecommerce and theme environments into WebRiskOps projects and reports.
First target
WordPress/WooCommerce is selected first because the current product already has WooCommerce checkout and agency demand pages, CMS/theme access request copy, and persisted platform support for both WordPress and WooCommerce project types.
Next step: WordPress and WooCommerce diagnostic handoff
Priority 1
Best first plugin target for checkout, form, theme and plugin-conflict diagnostics.
Priority 2
Next target because Shopify acquisition and agency pages already exist, but app permissions need a separate scoped model.
Priority 3
Fallback architecture for platforms without a dedicated plugin package.
/api/browser-extension/evidence-captures
A technical-only integration boundary for country-specific tax and e-invoicing work that stays disabled until a qualified local partner owns interpretation, requirements and signoff.
Partner requirements required
qualified local tax/accounting or e-invoicing partner owns interpretation and signoff. WebRiskOps role: technical adapter only.
Spain
Map partner-approved fields, build adapter tests and expose technical delivery logs only.
Partner-defined Peppol authority
Implement partner-approved schema mapping and transport diagnostics only.
Partner-defined country
Generate technical exports from provider records after partner approval of fields and wording.
A bounded evidence pack for products with digital elements: inventory, vulnerability handling, update process, secure configuration and audit artifacts without certification or legal-conformity claims.
Technical evidence only
Customer/manufacturer responsibility stays explicit. WebRiskOps role: evidence collection and gap tracking.
No certification claimTrack product name, version, deployment surface, support window and dependency inventory supplied by the customer.
Collect policy links, intake route, triage state, disclosure timing and remediation evidence.
Record update channel, patch notes, user notification path and fixed-version evidence.
Capture documented defaults, hardening notes and unsafe-default exceptions for review.
Reference generated dependency lists, scanner outputs and known-vulnerability triage.
Preserve timestamps, evidence sources, scan IDs and review status for customer-controlled records.
Evidence-based checks for AI-assisted workflows that inspect only captured configuration, prompts, outputs, logs, review records and fallback controls.
Evidence-based and bounded
Workflow purpose, user-visible task, allowed inputs, disallowed use and owner.
Request ID, prompt/template version, model/provider label, output hash and related product object.
Review state, reviewer role, approval timestamp, rejected output reason and override path.
Non-AI fallback, degraded mode copy and customer-safe blocked-state reason.
Allowed fields, excluded sensitive data and retention boundary.
Account/package budget context, operation type and usage ledger link.
Prompt/config version, release note, test case and rollback owner.
A planning module for native mobile app accessibility and privacy evidence that defines scanner boundaries before any Android or iOS implementation is enabled.
Planning boundaries defined
android
Inspect customer-provided Android manifest, permissions, SDK/dependency inventory and declared data-safety evidence.
ios
Inspect customer-provided privacy manifest, entitlements, SDK/dependency inventory and App Store privacy evidence.
android_ios
Run only authorized test flows on non-production builds with synthetic accounts and captured screenshots/logs.
store_listing
Compare customer-supplied store privacy declarations with observed permissions, SDK inventory and app privacy artifacts.
These links connect this resource page to focused product acquisition pages while keeping the main navigation short.
Use when the buyer already knows the storefront or commerce platform.
Use when the buyer knows the risk area: consent, checkout, accessibility, security or trust.
Use when the buyer needs repeatable client scans, white-label reports or Agency Plan boundaries.
WebRiskOps runs a broad evidence program across public previews and authenticated scans. We show the scale, coverage areas and evidence families without exposing the exact checks, thresholds or remediation playbook.
Public checks look at the first reachable page, basic metadata, public trust signals and safe-to-fetch response posture.
Shows whether the public entry point is credible enough for a deeper scan.
Security checks cover transport, browser policy boundaries, cookies, insecure resources and client-side dependency posture.
Separates immediately visible hardening gaps from findings that need authenticated browser evidence.
Form checks focus on whether buyer or signup flows are understandable, usable, reachable and safe to complete.
Turns broken or confusing completion states into prioritized report items.
Consent checks compare visible consent UI, tracking behavior and analytics state so measurement does not undermine trust.
Highlights consent and measurement mismatches without exposing the underlying rule set publicly.
Legal transparency checks observe site-level policy presence, legal-page context, refund or return policy signals on commercial sites, tracking disclosures and risky compliance claims without giving legal advice or certification.
Flags stable site-level readiness gaps for customer or counsel review without deciding legal correctness.
DNS checks observe contextual SPF, DMARC, CAA and address-resolution signals while avoiding claims that optional records are always mandatory.
Separates actionable DNS risk from informational missing-record signals that depend on how the domain is used.
Accessibility checks look for practical barriers that can block keyboard, assistive-technology or mobile users.
Connects usability defects to affected page areas and remediation guidance in private reports.
Runtime checks observe browser errors, failed requests, heavy assets and loading signals that can reduce conversion or reliability.
Shows where the live page behaves differently from the intended customer journey.
Discovery checks map crawl scope, public files, exposed implementation signals and low-impact technology observations.
Keeps report interpretation tied to what was actually reachable and observable during the scan.
A check is a scoped observation: page, condition, evidence, confidence and a plain-language reason the issue matters.
These checks look for UI and form issues that stop users from navigating, completing forms, understanding errors or reaching primary actions.
Consent and privacy checks record cookie banners, CMP behavior, tracking posture, US privacy-choice links and consent or opt-out states that can block conversion or weaken trust.
Checkout checks focus on primary CTAs, required fields, payment-adjacent pages, blocked submits and unclear field errors.
Header checks capture HTTPS posture, HSTS, content-security signals, exposed technical headers, cookie attributes and trust indicators.
Legal checks observe visible policy links, refund or return policy links on commercial surfaces, privacy-choice links, accessibility statements, data-collection context and risky compliance claims. They do not provide legal advice, legal review, regulatory opinion or compliance certification.
DNS checks monitor SPF, DMARC, CAA and address-resolution signals with context-sensitive severity. Missing optional records are treated as informational or conditional unless the domain use makes them risky.
Browser observations highlight script errors, failed requests, blocked resources and unstable third-party assets that can affect the customer journey.
Mixed content checks identify insecure images, scripts, styles, frames, or redirects that weaken user trust and browser security posture.
Coverage checks show discovered, skipped, excluded, blocked and unavailable pages so findings are interpreted inside the actual scan scope.
Findings use severity to explain likely business impact, confidence, affected surface, evidence strength and the next remediation or retest action.
WebRiskOps checks are low-impact, authorized, evidence-backed product checks. They do not include exploitation, credential attacks, denial-of-service, or legal certification.