Questions in web site security audit