A method includes receiving web page identifiers associated with a website and determining whether the web page identifiers identify redundant web pages of the website. One or more web page identifiers are removed from the web page identifiers that identify redundant web pages to create a group of web page identifiers. A user responsible for at least one of the web pages identified in the group of web page identifiers is determined. A risk level is determined for each of the web pages identified in the group based on a plurality of risk factors, the user is associated with the risk level, and the association between the user and the risk level is stored in a database.