Know exactly where your website stands.
A security audit is a full check-up for your website. We look at it the way an attacker would, find every weak spot we can, and hand you a clear list of what to fix — most important first.
- Best for
- Business sites, WordPress, online stores
- Typical time
- A few working days
- Retest after fixes
- Included, free
What we check.
Every audit is shaped around your site, but these are the areas we always cover.
Outdated software and plugins
Your CMS, themes, plugins and libraries, checked against public lists of known vulnerabilities.
Logins and admin access
Weak or default passwords, unlimited login attempts, missing two-factor login, admin pages open to the world.
Exposed files and folders
Backups, configuration files, old test pages and directory listings that should never be public.
Forms and user input
Contact forms, search boxes and checkouts tested for common injection and script attacks.
SSL and security headers
Certificate setup, HTTPS everywhere, and the browser protections most sites forget to switch on.
Server and hosting settings
Open services, software versions on display, file permissions and risky defaults.
Email spoofing protection
SPF, DKIM and DMARC records that stop criminals sending emails pretending to be you.
Third-party scripts
Chat widgets, trackers and payment scripts that load code from other companies onto your pages.
What you get.
Clear enough for a business owner. Detailed enough for your developer.
A ranked findings report
Every issue rated by real risk to your business, with proof, a plain explanation and step-by-step fix.
A walkthrough call
We go through the report with you and your developer and answer every question.
A free retest
Once you've fixed the issues, we check again and update the report so you have proof they're closed.
About the audit.
Isn't an online scanner enough?
Free scanners are a good start, but they only see the surface and often report problems that aren't real while missing ones that are. We use tools too, then verify every finding by hand and look at things tools can't judge — like whether your admin page should be public at all.
Do you need access to my hosting?
Not necessarily. We can audit purely from the outside, like an attacker would. With read-only access to your admin panel or hosting, we can check much more — your choice, agreed in writing.
How often should we do an audit?
Once a year is a sensible minimum for most small businesses, and again after any big change — a redesign, a new payment system, or a new developer.
Start with a free outside check.
Send us your website address and we'll tell you what we can already see — before you commit to anything.