Home / Website security audit
Website security audit
A website security audit that tells you what to fix first.
We look at your website the way an attacker would, then give you a prioritised, plain-language report and a fixed-price plan to fix what matters.
- Non-intrusive by default
- Findings ranked by risk
- Fixed-price fix plan
Security audit · example.com 11 findings, ranked by risk Critical 2 PHP 8.1 (end of life), exposed .git High 3 plugins with known vulnerabilities Medium 4 no CSP or HSTS, weak TLS settings Low 2 server version banners ✓ Fix plan attached, fixed price
What we check
Everything an attacker would look at
For WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, Django, Node.js, Go and custom-built sites.
Runtime & server
PHP, web server and operating system versions against end-of-life dates and known vulnerabilities.
CMS, plugins & dependencies
CMS components, plugins and npm, Go and Python dependencies checked against public vulnerability databases, including abandoned packages.
TLS certificates
Issuer, expiry, revocation status, protocol versions and cipher configuration.
Security headers
Content-Security-Policy, HSTS, framing protection, referrer policy and cookie flags.
Exposed files & panels
.git and .env files, forgotten backups, phpinfo pages, debug modes and public admin logins.
Access & accounts
Admin users, password and two-factor policies, and who can reach hosting and DNS.
Backups & recovery
Whether backups exist, are stored off-site, and can actually be restored.
Email & DNS
SPF, DKIM and DMARC records that stop others from sending email in your name.
Two levels
Start small, go deeper when it matters
Quick security check
A small fixed fee, no access needed. From the outside we check PHP and server versions, CMS fingerprint, TLS certificate and configuration, security headers and exposed files, then send you a short summary of what we found.
Full security audit
With read access to hosting and the CMS: plugins and themes, user accounts, file integrity, backups, logs and email DNS. You get a full report with evidence, a plain-language explanation of each finding and a fixed-price fix plan. We re-check after the fixes.
Your website is never put at risk. We don't run load or destructive tests without written permission, deeper testing happens on a copy or staging site, and findings are shared only with you.
FAQ
Security audit questions
Is a security audit safe for our live website?
Yes. Our checks are non-intrusive by default. We never run load or destructive tests without your written permission, and deeper testing happens on a copy or staging site.
Do we need to give you access?
Not for the quick check, which looks at your site from the outside. A full audit needs read access to hosting and the CMS admin, through dedicated accounts you can revoke at any time.
What happens after the audit?
You get the report and a fixed-price fix plan. You can have us fix everything, only the urgent items, or hand the report to your own team. We re-check after the fixes.
Contact
Book a website security check
Tell us your website address and what's worrying you. For a small fixed fee, we check it and reply with what we found and what we recommend.
- Send the formYour website address and a short description are enough.
- We check your siteA non-intrusive outside check of PHP and server versions, CMS, TLS and security headers.
- You get a clear answerWhat's at risk, what to fix first, and a fixed price if you want us to do it.
Existing customer? Visit support.pydevsolutions.com.