Penetration testing, often abbreviated as pen testing, is an essential process to ensure you maintain a safe and secure website. But what exactly does pen testing involve, and how can you rest assured your agency partner is covering all potential vulnerabilities for you? 

This article will provide a detailed guide to penetration testing, helping you minimise your security risks and ensure your website is fully protected. 

In a recent series of articles published in our resource library, we provided an in-depth explanation of the end-to-end process of building a high-performance, enterprise-grade website. (If you’d like to read that series first before learning about pen testing, you can start here). 

After you’ve worked with your agency partner to successfully build your website, you’ll also need to ensure your site is protected from cyber security threats.  With that in mind, you should understand the important role that pen testing plays in effective website security and maintenance. 

What is Penetration Testing? 

Penetration testing is a form of website testing that’s used to identify security vulnerabilities When conducting pen testing on your site, your agency will simulate a range of cyber attacks that could be used by cyber criminals or malicious software (malware). 

The purpose of this is to identify security weaknesses within your site and take action to prevent them from being exploited in the real world. This approach goes beyond basic tests, as it doesn’t just list the vulnerabilities, it examines how they could be exploited and helps to prevent that from happening. 

Why is it Crucial for an Agency to Conduct Penetration Testing? 

Website security is critical in today’s digital business landscape. Cyber security threats have become highly intelligent and sophisticated, now capable of penetrating even the strongest security networks. 

For instance, global technology giant Acer was the victim of a cyber security attack that demanded a ransom of $50 million USD in recent years. 

The outcomes of a cyber attack on your website could be catastrophic, either through sensitive data being stolen, lengthy losses of business continuity, or even reputational damage. 

Remember, your site’s security isn’t just vital to you as a business, it’s also something your clients need assurance with when they agree to work with you. You should be taking as many proactive steps as possible to ensure your security measures are rigorous enough to match high levels of risk. 

Covering All Bases for Robust Security (in WordPress)

It’s useful to be conscious of the common security weaknesses and pitfalls cyber criminals typically aim to take advantage of. 

Security vulnerabilities can be created when your website is running on outdated versions of your platform, or if something hasn’t been configured or integrated properly. Other common pitfalls include weak authentication measures and insufficient protection from the perspective of your users. 

With platforms like WordPress, there are some areas in which less experienced agencies could allow security vulnerabilities to creep in as well. For instance: 

• Auto-updates – When your platform’s software is automatically updated, changes in the code can cause new security weaknesses to arise. 
• Plugins – Using WordPress plugins from untrustworthy sources, or neglecting to update and maintain your plugins properly, can also cause security issues. 

This is one of many reasons why it’s important to work with an experienced agency partner who has proven platform-specific knowledge and expertise. Your agency should know your CMS of choice inside out, and should therefore be well aware of all the most common security pitfalls and targets for cyber attacks. 

What Does Effective Penetration Testing Involve? 

To conduct pen testing, your agency’s security experts will run through a process that attempts to penetrate your site’s security measures. 

This is usually done in stages, as follows: 

1 – Planning and Preparation

1. Review the results and analysis of any previous tests (if there are any)
2. Define the scope of the testing, including which tests will be performed
3. Gather all necessary data and information on the system to conduct the testing
4. Determine the criteria of success or failure for the tests.

2 – Running the Tests 

1. Use automated tools to scan for vulnerabilities and identify weaknesses 
2. Attempt to exploit the identified weaknesses 
3. Repeat the tests with different types of user roles and permissions
4. Measure the outcomes against criteria for success or failure 
5. Create a report on the outcomes and results of the tests. 

3 – Post-Testing 

1. Review the reports and analyse the results 
2. Remediate and resolve the vulnerabilities that were able to be exploited
3. Re-test the vulnerabilities to ensure remediation was successful.

The Benefits of Thorough Penetration Testing

Working with an agency partner who can support you with ongoing pen testing is a necessary step towards gaining enterprise-grade security for your website.

Technology changes so quickly today. Your platform receives updates regularly, your site is always growing, and cyber criminals are constantly finding new ways to breach your defences and gain access to your data. Penetration testing allows you to keep the pace with new emerging vulnerabilities. 

Conducting regular pen testing can also help improve client relationships and create competitive advantages as well. In certain industries, a demonstrable commitment to security will be greatly appreciated by your target audience. This can help to differentiate you from the competition and provide the trust required to attract more prospective clients to work with you.

Website Security is a Never-Ending Battle 

While every business with a website faces tremendous security risks today, this is a proven process that can help to minimise that risk and give you the confidence you need in your site’s security.

Any agency partner you work with should have the knowledge and expertise to understand the importance of pen testing, and should insist on making this an integral, ongoing part of your site’s maintenance. 

Back in early October, SoBold made our debut visit to Brighton SEO. Since then, we’ve been busy putting the invaluable lessons from the event’s talented speakers into action, all while navigating Google’s November and December Core Updates. Now the dust has (hopefully) settled on the update-front, and the with next iteration of Brighton SEO still a few months away, we’ve taken the opportunity to reflect on our key takeaways and their impact on our approach.

A functional relationship with your development team is critical for SEO success

During Brighton SEO, a recurring theme across different talks was the challenges SEOs face when working with development teams, particularly those that operate in silos. Whether in-house or outsourced to separate agencies, a lack of communication, deprioritised SEO tickets, and limited understanding of SEO best practices often lead to delays, errors, and missed opportunities. Many speakers and attendees expressed frustration at the need for excessive hand-holding to ensure even basic tasks were actioned correctly.

At SoBold, we avoid these risks with a collaborative effort between our development and SEO teams. As a WordPress-first agency, our integrated approach ensures SEO tickets are prioritised appropriately, and implemented to the highest standard. By removing barriers between teams, we’re more efficient and deliver results that drive SEO success.

Don’t discount the basics

It sounds very simple, but one of the biggest takeaways from Brighton SEO was how critical the fundamentals remain to SEO success. Numerous case studies and real-world examples shared by speakers reinforced that many websites fail to rank well simply because they lack a strong foundation. While advanced techniques and tools may sound exciting, the potential is often wasted on websites that haven’t addressed core issues.

Speakers emphasised that getting the basics right still yields some of the highest returns. Core Web Vitals, metadata optimisation, fixing 4xx and 3xx errors, a clear site hierarchy and URL structure, proper indexation, robots.txt configurations and ensuring basic analytics are in place all play a pivotal role. These essentials are often the difference between stagnation and significant ranking improvements. Ensure your fundamentals are sound before turning to more advanced methods and strategies.

AI can be a game-changer for audits, but nothing beats human written content

AI has been the buzzword of the industry in the past two years. Incorporating AI into everyday tasks to maximise efficiency was a key theme at Brighton SEO, specifically the use of AI to streamline time consuming tasks like audits and data analysis. 

Audits are central to developing an SEO strategy and crafting roadmaps, and leveraging different AI and machine learning strategies to research, collate, and organise relevant data was a hot topic at the conference, with lots of very knowledgeable people offering extremely useful and actionable insights into how existing workflows can be enhanced through AI. 

By leveraging AI tools and machine learning, SEOs can quickly identify technical errors, gather keyword insights and generate comprehensive reports, freeing up more time for the higher-impact strategic work. Speakers showcased actionable ways to integrate AI into workflows, potentially revolutionising the process of audits, roadmaps, and reporting.

However, there are clear limits to the use of AI. While it excels behind the scenes, it falls short when it comes to creating authentic, engaging content. Google’s guidelines, a number of algorithm updates, and leading voices within the SEO community on social media continue to emphasise that nothing beats human-written content based on real expertise and experience. The message was clear: AI can enhance efficiency, but content that resonates with users, builds trust and meets the intent of the searcher must remain in the hands of skilled human writers.

Google’s AI snippets are traffic thieves

Generative AI has been a hot topic across numerous industries since the launch of ChatGPT 3.5 in November 2022, especially in SEO. Google has released numerous updates (to mixed responses) to combat the large influx of AI generated content and the ability for anyone to churn out masses of content on subjects outside their areas of expertise.

There’s no doubt the rise of AI sent internal shockwaves at Google, who had to quickly innovate to withhold a potential threat to their dominance. As a consequence, they released the Google Generative AI Snippets, which generates AI answers at the top of the search results for a range of queries, based on information it’s gleaned from the top ranking pages for said query.

While the concept may seem beneficial to users, the reality is stark for website owners and their SEOs: visibility is drastically reduced. Data presented at Brighton SEO revealed that URLs in Position 1 under these snippets suffered traffic drops of 70%. 

Many SEOs and site owners argue this practice borders on theft, as Google repurposes content with minimal credit or incentive for users to click through, and wouldn’t be able to surface any of this content without the websites creating it in the first place. This controversy isn’t going away anytime soon, and SEOs will need to strategise carefully to adapt to this new reality.

Test, test, and test again

Many of the talks were very insightful, offering new methods and solutions for a range of tasks. But each website is different, and what may have a profound impact on one website may not do the same on another. 

There are very little one size fits all in SEO, and our testing of the new methods and techniques detailed at Brighton SEO has shown just that. We can take the direct learnings from these talks and apply them literally with minimal change, but with benchmarking the initial metrics, examining the difference once recommendations are applied, and tweaking these with our own insights, we can maximise the impact. 

Whilst the wealth of talent and expertise of the speakers at Brighton SEO was at a very high standard, SEOs shouldn’t rest on the laurels and only go as far as these talks suggest, but leverage their own expertise and knowledge, pairing it with the expertise from these conferences to get the best results. Building upon some of the strategies outlined at Brighton SEO and putting our own SoBold-spin on these is already bearing fruit, and testing is at the heart of this.

Final Thoughts

From the importance of solid fundamentals to embracing AI’s potential while recognising its limitations, these takeaways are invaluable for SEOs and developers alike. By testing, adapting, and collaborating, we can turn these learnings into impactful strategies allowing us to navigate the uncertainty of Google Updates, as we look ahead to the next conference in April.

As we’re now into the first week of 2023, this feels like an appropriate time to reflect on what was another thoroughly successful year for SoBold in 2022.

We’re now working with enterprise clients and providing them with excellent website design and development services. We’ve also continued to grow our client base and are proud to have consistently produced outstanding work on their behalf throughout the year. 

We’re pleased to have strengthened our presence in the healthcare and financial services industries. Now, we’re looking forward to building and managing more scalable products for our clients in the year ahead. 

Our High-Performance Team

The definition of “high-performance” will vary from person to person, and you may have your own idea of what it means to you. For us, as an agency, it means every member of our team holds each other accountable to always perform at the highest possible level, so we can achieve a standard of excellence for all our clients. 

We’ve used “high-performance” as a core value of our company since day one, and have worked very hard over the years to build a “high-performance” team. In 2022, this continued to develop and has allowed us to push those standards even higher, which is something we take a lot of pride in. 

We were excited to see all three of our business teams grow in 2022: design, development, and operations. Over the past year, we also made a conscious effort to ensure the whole agency is working closer together as a more functional unit, for the benefit of our clients. 

As the team has grown, we’ve had to implement more processes, which has allowed us to scale, and will enable us to continue to scale, as we move into the next cycle of our business. 

Congratulations to Ivo Georgiev, who’s coming to the end of a successful apprenticeship scheme, which he did with us and the help of QA’s Tech, Digital, and IT Apprenticeship.

The SoBold Website! 

In 2022 we launched our new SoBold website. Finding time to do this while continuously delivering projects for our ever-growing client base was a challenge, but one I’m really proud of the team for managing so well. We used this as a beta project to roll out a new SoBold workflow, and whilst there’s still some way to go to perfect this, we’re really happy with how it’s looking on the front-end! 

Every member of the team worked on this in some way or another, and we’re already getting considerably more inbound leads and exposure from it. 

We’ve been working hard on becoming more active in the online community as well, and this is notable particularly over the last quarter where we’ve increased our marketing. We were fortunate to be interviewed by Cloudways, who are a cloud hosting service provider we work closely with, and you can see this interview here. 

Clutch has continued to be a new business driver for us and our profile has gained more exposure amongst the country’s best website design and development businesses. 

We’ve also begun producing a selection of in-depth guides and blog articles to help our community more easily navigate the current technology landscape. You can find all that useful content on our blog.

Our Clients

We’re grateful to have worked with so many wonderful people from some brilliant clients over the past 12 months, and have built an array of different sites each with their own unique brief and challenge. 

If you’d like to gain insight into the process we follow with our clients for project briefings, check out this recent article, which also includes a helpful brief template.

This is a great chance to showcase below some of the work we’re most proud of in 2022, for a selection of companies who are doing some very interesting things to make positive change in their respective industries:

Built and Live

Jamie and the Jam – Jamie and the Jam conceptualise, create, deliver, and manage beautifully bespoke content for their clients and their audiences.

Amplitude Clinical – Amplitude is a leading UK Patient-Reported Outcome Measures (PROMs) and clinical outcomes platform.

Arenko – Arenko is a market-leading technology provider enabling the clean energy transition.

Dictate.IT – Dictate.IT helps healthcare organisations across the UK and Ireland harness the power of speech to deliver seamless, efficient, and effective document management.

Edgerley Simpson Howe – Edgerley Simpson Howe are specialist out-of-town retail, leisure, and commercial roadside property consultants.

Pippo – Pippo lets you book your GP appointments whenever and wherever suits you.                                                                                                                                                                                                               

Common Purpose – Common Purpose offers exceptional personal training in the heart of Mayfair. If you’re looking to start with a new gym or PT in the new year, Common Purpose are your guys to speak to! 

Still Waiting to go Live! 

Coller Capital – Coller Capital is one of the largest global investors in the private equity secondary market.

Healthlink – Healthlink connects more than 15,000 medical organisations across Australia and New Zealand.

Konnect Net – Konnect Net helps businesses in the insurance and health sectors exchange data in a quick and secure way.

Turvec – Turvec is a bike parking company specialising in designing, installing, and maintaining secure and user-friendly bicycle storage solutions and two-tier bike racks. 

There’s also a handful of special clients listed below that want to highlight, either because of the longevity of the relationships or the positive impact our work has made on their businesses:

Kapow Primary

Kapow Primary, whom we’ve been working with since 2018, is now used in almost one third of all UK primary schools, with over 30,000 primary school teachers using the Kapow Primary platform each week. 

Our amazing Kapow team has been working on some really inspiring projects over the past few months particularly, and we cannot wait to share more when we publish these live. 

You can learn more about our work with Kapow, and how we first started, in our case study here.

Rede Partners

We started working with Rede Partners in late 2019 to help bring their vision ‘RedeWire’ to life. RedeWire is a new interactive online limited partner (LP) portal, providing instant access to Rede’s current fundraising offering.

RedeWire has had a closed launch, so we’re really excited for it to launch to their wider audiences in Q1 of this year. 

Transport for London

Transport for London has renewed its cookie management contract with us for a fifth successive year. This highlights not only the great work we’re doing with them, but the importance of the relationship we’ve built with them.

We recently became only the third Platinum Certified Partner with Cookie Bot in the UK and this is a service we believe will continue to grow into 2023 and beyond. 

You can learn more about our work with Transport for London here, and you can also read about our contract renewal in our press release here. 

Clanwilliam 

We’re proud to have been working with Clanwilliam since 2017, and our relationship has flourished each year since then. We initially started working with their Global HQ, before being rolled out across their three divisions Clanwilliam Ireland (site being redesigned in Q1 2023!), Clanwilliam UK, and Clanwilliam ANZ.

We work with over 15 of their brands designing, developing, managing, and hosting their websites. We also work closely with these brands to help them with their branding and print design activations. 

2022 saw Clanwilliam take a major shift in their global brand, choosing us to help them rebrand from Clanwilliam Group, dropping the ‘Group’. We worked closely with their Global Brand and Communications Director, Lauren Turner, to help bring this to life. 

We all went into the process looking to rebrand Clanwilliam in its entirety, changing the logo and creating a completely new brand. However, we quickly realised the logo was going to stay and the brand needed to change around this. 

We uplifted Clanwilliam’s colour pallet and fonts, creating a new brand that much better reflects their company’s values and ambitions.

You can see a more detailed case study about what we did here.

It’s Not All Websites Though! 

Our talented Graphic Design Team was busy in 2022 too, across multiple rebrands and supporting various Knight Frank divisions. Some of our Knight Frank work is highlighted here. 

We’ve also successfully managed to move all our clients into our Positive Park Hosting environment, which is based in Cambridgeshire. This has meant all our sites are running on a more optimised and bespoke server, tailored to their needs. Our VIP enterprise-grade support at the hosting park has made a positive impact, ensuring all our clients have peace of mind that their sites are secure and stable. 

The hosting environment is an eco-friendly data centre that uses 100% renewable energy and is certified by the Green Web Foundation. 

You can learn more about our hosting solution on our WordPress Website Hosting service page.

In addition to working with our clients, we’ve also been working hard on improving our processes, becoming more compliant and becoming a more reputable company across the board. 

We became ISO 90001-compliant in 2022 and have successfully put our project management systems in place. Our Project Manager, Anna de Moraes, has been instrumental in implementing processes to optimise our workflow, and she’ll continue to drive the business forward into 2023.

We were absolutely delighted to work with Nation.Better to get a Skilled Licence VISA sponsorship as well, which opens up opportunities for us to hire more global talent. This is something as a business we’ve been looking forward to for a while now. Getting this licence and already hiring two people, and giving them the opportunity to work in London, is something we’re really proud of. 

We also renewed both our Living Wage Accreditation and Cyber Essentials certification. 

2023 and Beyond! 

2023 is only going to be bigger and better for us here at SoBold. We have big plans to execute on our hiring strategy and intend to grow the team across all areas of the business. Doing so will help us continue to improve the service we provide to our clients.

We’ll continue to work with key clients in our industry focuses: healthcare, finance, real estate, and SaaS. As we work with more medium to enterprise-sized clients, we’re confident we’ll become more recognised as the High-Performance WordPress agency. 

Thanks for reading. We hope you have a great year in 2023! 

To keep up with all the latest news and updates from our agency, and gain priority access to our weekly learning resources, please do join our community by subscribing to our newsletter below.

As a web developer team, our responsibility is in providing support to other companies. We make sure that websites look and work well for the businesses that need them. Our team serves as an expert extension of our clients so they can focus on their actual operations.

We take pride in our work and it looks like our efforts are paying off. We’re very happy to announce that we’ve been given an award. SoBold was named as a top UK web developer by Clutch for the year 2021.

Clutch is a ratings and reviews company that uses a unique verification process that ensures all of the content on their platform comes from legitimate sources. They then leverage this information to create ranked lists of the best performers in every industry around the world. The best of the best then get an award.

The best part of all this award is that it’s not decided by a panel of faceless judges. It’s based on the reactions of the people that worked directly with us. They’re the people in the best position to judge or critique our work. In fact, here’s what our Director had to say when we got the news.

“We are absolutely delighted to be chosen as one of the leading WordPress Development agencies in the UK by Clutch and look forward to continued growth and development to fulfil our potential.” Will Newland, Managing Director, SoBold.

If you want to partner with a team that will provide expert support and service to ensure your website is the best it can be, give us a call. Fill out our contact form and we’ll set up an appointment as soon as possible.

A content management system (CMS) is a type of software-based technology, used to build and manage websites and other digital products. A CMS allows you to easily create, edit, and publish digital content across a range of online channels, such as the web and mobile. This is the most common technology platform used by businesses to build assets such as websites, with almost two thirds (63%) of all sites on the Internet now delivered via a CMS. 

With that in mind, it’s clear why most businesses today are heavily reliant on this technology. Whether you’re developing something new from scratch or switching from an old platform to a new one, selecting your CMS is an extremely important decision with a lot riding on it. But with such a vast landscape of digital solutions to navigate, and so many different options available, finding the right CMS can be overwhelming. 

To help you through the process of finding the right CMS, this article compares four of the most common options for large businesses. We’ve also listed their pros and cons, and provided some additional considerations that will be useful for you to think about along the way.

First, the Criteria

A CMS can be used to build various digital products and assets, from websites and mobile apps to bespoke systems like staff portals and internal training platforms. Particularly in large businesses, it’s common to need to create some bespoke features, functionality, or digital processes as well. Whatever it is you need, you should aim to find a platform that’s capable of delivering on your specific requirements. 

Here are some points to include in your criteria when researching the options for your CMS:

• Bespoke development capabilities
• Easy integration with existing systems and legacy technology 
• Scalability and performance in peak traffic 
• Enterprise-grade security 
• Quick and easy editing capabilities 

Now we’ve covered what a CMS should be able to do when you start implementing it within your business, let’s look at the different platforms available to you.

Option 1 – Drupal 

The Pros: 

• Drupal is a highly secure platform, which is a crucial quality for a CMS to have. 
• It’s very intuitive for users who have coding experience or advanced content management skills. 
• It has a great community of users surrounding it, which contributes a lot of value and is able to provide support.
• It also has hundreds of unique thematic options to choose from when designing your site. 

The Cons: 

• Drupal can be hard to work with for non-technical users, as it lacks simplicity and provides limited customisation.
• It can take a long time to get up and running, which means your costs will be quite high if you work with an agency partner.
• It’s also worth noting that the version of Drupal most businesses use now (Drupal 7) will be reaching end-of-life soon.

Option 2 – Sitecore 

The Pros: 

• Sitecore is purpose-built for large businesses, guaranteeing an enterprise-grade experience. 
• Sitecore is a robust CMS with a high level of in-built security.
• It actually provides a fully-managed ‘digital experience platform’ that comes with more capabilities than the average CMS. 
• It also offers great personalisation and excellent pre-built features. 

The Cons: 

• Sitecore is an expensive option, even if you have a large budget to work with.
• It requires you to procure licenses to begin using it, and also restricts certain capabilities unless you progress to higher tiers of licenses. 
• It typically runs with hierarchical, complex workflows that might be frustrating for small or agile teams. 

Option 3 – Umbraco

The Pros: 

• Umbraco’s scalability makes it very suitable for large businesses.
• It’s free to use and open-source, with an active community of users supporting it.
• It allows you to manage a high volume of pages easily and efficiently.
• It’s another platform that comes with a high level of in-built security.

The Cons: 

• It can be difficult to work with for the average user. As with Drupal, Umbraco is mostly suitable for more technical users who have coding skills or some development experience.
• This complexity again increases the likelihood of higher costs with your agency partner (if you go that route). 
• It’s common for sites built with Umbraco to be reported as slow, for both back-end editing and the front-end user experience. 

Option 4 – WordPress 

The Pros: 

• WordPress is extremely scalable and dynamic. It can easily grow and evolve as your business grows, continuing to meet your changing needs.
• It’s renowned for its ease-of-use. Because of this, it enables you to deliver your projects quickly and efficiently.
• It’s highly customisable, making it ideal for bespoke development. With the right knowledge and skills, you can build almost anything with WordPress. 
• It also typically comes with a very low total cost of ownership (TCO). You won’t need to add on new features or capabilities, nor pay for costly extra work to handle platform upgrades or updates.

The Cons: 

• If you apply too many plug-ins, WordPress sites can slow down and experience dips in performance, but a good agency partner should encourage you to minimise the use of these.
• Some still see WordPress as an unprofessional platform used mostly for small blogs, but that old myth couldn’t be further from the truth today.
• WordPress is a secure platform, but plug-ins can create vulnerabilities if they’re not tested well or taken from untrusted sources. Again, a good agency partner should guide you with this to reduce the risk and prevent any issues.

Interested in learning more? Check out our related article here, where we explore the benefits of WordPress for large businesses in greater detail. 

A Brief Word on Agency Partners 

As touched on earlier, you’ll also need to consider whether you want to take the approach of working with an agency partner or not. For large businesses, most development projects tend to involve complex requirements that are almost impossible to manage without the support of an experienced agency. 

An agency partner can provide you with strategic guidance, platform-specific skills and tools, and expertise to help you gain as much value from the technology as possible. While it’s perfectly valid to decide to implement a new CMS without an agency working alongside you, doing so will probably make things a lot more challenging, a lot more expensive, or possibly both.

All the platforms mentioned here have their benefits. But they’ll each be significantly easier to use, and will deliver far greater return on investment (ROI), if you have an experienced partner involved. 

How to Choose the Best Option for Your Business  

Keep in mind that every business is unique and every web development project is different. These platforms are all good options in their own way, but a solution that works well for the majority of organisations might not be the right choice for you. 

Whether you’re building a bespoke website or migrating an existing site to a new platform, you have to be thorough in your assessment and make the right choice for your specific business.

To really understand the pros and cons of these options, you first have to be clear about exactly what you need and what you’re aiming to achieve. You’ll then need to determine which solution best aligns with your requirements, budget, and strategic objectives.

If you’re in the process of assessing solutions to help you deliver a bespoke development project, read our comprehensive guide to evaluating and selecting the right platform here.