Content security policy
A developer job
Without one, the browser has no list of scripts you allow, and it will run one that was not meant to be there.
Free website check
Your website can steal details, break the law, and shut people out.
The homepage can look perfect while that is happening. FatFish checks the public pages of a site you own and writes it down in plain English: where a stranger could take people's details through the site, where people are not told about their data, and where some visitors cannot use the site.
You get a report you can hand to the person who fixes it. You do not have to understand the technology. The check is free.
We reply before we start. We only check a site you are allowed to have tested.
Security
Response headers, and whether the browser is told which scripts to allow.
Compliance
The privacy notice and the cookie notice, against UK GDPR and PECR.
Accessibility
Whether the pages can be used, against WCAG 2.1 AA.
What you decide, and what a developer can change.
The privacy notice, the cookie notice, and the wording of consent are decisions for your organisation. FatFish will not write those for you. A missing header, text that is hard to read, or a control that is too small to tap is a change in the code, and the report lists those so a developer can pick them up.
Issue
Who
What it means
Privacy notice
Your decision
Visitors cannot see what the organisation collects, or how they can object.
Cookie notice
Your decision
The site places cookies before a visitor has had a chance to refuse them.
Colour contrast
A developer job
Parts of the text do not stand out enough from the background to read comfortably.
Tap target size
A developer job
Some controls are smaller than a fingertip, so they are easy to miss on a phone.
We usually do this for practices, clinics, agencies, and public services.
Example, first page
A sample of the report.
Northshore Studio is not a real client. The first page shows seven findings, and a score for security, compliance, and accessibility. We email the sample. It is not a report on your site.
Questions
- What do we get?
- The audit is free. A PDF covering security, the privacy and cookie notices, and accessibility against WCAG 2.1 AA. Each finding is marked as a decision for your organisation, or as a change a developer can make. You can pass the PDF to your developer, your information governance lead, or your accessibility lead.
- Can we give the PDF to our information governance or accessibility lead?
- Yes. It is written so someone else in the organisation can read it. The checks cover security headers and similar issues, UK GDPR and PECR notices, and WCAG 2.1 AA. They run automatically over the pages, the response headers, and the cookies. The report is not a legal opinion, and it is not a penetration test.
- Does the accessibility check use WCAG 2.2?
- The pass mark is WCAG 2.1 AA, which is what NHS England asks for. Anything that appears only in WCAG 2.2 may be noted, but it does not count as a failure.
- Do you keep our passwords?
- Only if you choose to give us a login, so we can see pages that are not public. Those details are encrypted where we store them, and they are never copied into the logs or the report.
- Can we send any address?
- Send a public site your organisation is allowed to have tested. We will not open localhost, a private network, or a cloud metadata address.
Send us the address.
The audit is free. You do not need to book a call first. We reply before we look at the site.
A PDF covering security, the privacy and cookie notices, and accessibility against WCAG 2.1 AA. Each finding is marked as a decision for your organisation, or as a change a developer can make.