Description

The problem with website security

You can’t fix what you don’t know about. Most business owners have no idea whether their site is secure, and the honest answer is usually “nobody has looked in years”. An website security audit is what you do before the emergency, on your schedule, for a price you agreed in advance.

The emergency is never just the cleanup fee. It’s the days offline, the enquiries that went to a competitor while Google showed a red warning screen instead of your homepage, the customer trust you spend the next year rebuilding – and then the fixes, which you pay for anyway, except now under time pressure and with no idea what else is broken.

An audit tells you exactly where you stand and what to fix in what order, before any of that is on the table.

Website security audit report on screen and in print, with findings ranked red, amber and green

What we check

Vulnerability scan – core software, plugins, themes and server configuration, checked against known published vulnerabilities.

OWASP Top 10 review – a manual review against the industry-standard list of the ten most critical web application risks. Manual, not just an automated report. Scanners miss things.

Malware and backdoor scan – the full file system and database, in case something is already there.

User and access audit – who has admin access, who shouldn’t, and which accounts belong to people who left years ago.

Backup and recovery assessment – not just whether backups exist, but whether they actually restore. Plenty don’t, and people find out at the worst possible moment.

What you get with the Website Security Audit

A written report in plain English, with every finding ranked by business impact rather than technical score – so you can see what to fix now, what to plan for, and what genuinely doesn’t matter.

Each finding includes what it is, what could happen, and roughly what it takes to fix. Plus a 30-minute call to walk through it and answer questions.

The report is yours. If you want to hand it to another developer, that’s completely fine – it’s written to be usable by anyone competent.

Not included in the Website Security Audit

Fixing what we find. We quote that separately once we know the scope. We won’t inflate findings to sell remediation – the report is written to stand alone.
Penetration testing of custom web applications (available separately)
Ongoing monitoring – that’s the Website Care Plan

Timeline

Day	What happens
0	Deposit paid, access provided
1–2	Automated scanning and reconnaissance
3–4	Manual review and verification
5	Report delivered
5–7	Walkthrough call, at your convenience

One thing we need from you

You must own the website, or be authorised by its owner to commission Website Security Audit of it. We’ll ask you to confirm this before we start – testing a site without authorisation is a criminal offence in the UK, so we don’t make exceptions.

Reviews

There are no reviews yet.

Be the first to review “Website Security Audit”

Website Security Audit