For small business websites
Website Security Audit
Find out whether your website is a liability before an attacker does. A fixed-scope review of the problems that most often get small business sites hacked, with a plain-language report and the fixes done for you.
- Price
- from $250
- Turnaround
- Within 3 business days
- Includes
- One re-check
What is checked
Security headers
Content Security Policy, HSTS, framing protection, and the other headers that close common attack paths.
TLS and HTTPS
Certificate validity, protocol and cipher settings, and whether every page is forced onto HTTPS.
Exposed files
Backups, configuration files, version-control folders, and admin pages that should not be public.
Outdated CMS and plugins
Your CMS core, themes, and plugins checked against known vulnerabilities and end-of-life versions.
SPF, DKIM, and DMARC
Whether attackers can easily send email that looks like it came from your domain.
What you get
Owner summary
One or two pages in plain language: what is wrong, why it matters, and every finding ranked by risk.
Fixes done for you
I make the fixes from the report myself, so you do not need a developer or the time.
Technical appendix
Evidence and details for whoever makes the changes, whether that is you, your developer, or your host.
Re-check after fixes
Once the fixes are in, every finding is checked again so you know it is closed.
Not technical? The fixes are included
A report only helps if someone acts on it. You do not need the time or a developer: I make the fixes myself, such as headers, HTTPS, removing exposed files, updating your CMS and plugins, and setting up SPF, DKIM, and DMARC.
- The fixes for the findings in the report are included in the price.
- Access only for the job, removed when it is done.
- The included re-check confirms everything is closed.
How it works
Request and authorize
Tell me which site to audit. You confirm in writing that you own it or are authorized to have it tested.
Audit
A careful, non-destructive review of the site, its hosting, and its DNS. No load testing and no changes to your site.
Report
Within 3 business days you get the owner summary, ranked findings, and technical appendix.
Fix and re-check
I make the fixes for you, then re-check and confirm what is closed. Prefer your own developer? They can work from the report.
Free, no sign-up
Not ready yet? Try the free quick check
Enter your website address for a free look at the basics: your mobile speed and SEO scores, security headers, the HTTPS redirect, and your SPF and DMARC records.
Speed and SEO come from Google's own Lighthouse test on a simulated phone, which takes up to a minute. The security part makes the same requests a browser or mail server would. Nothing is stored.
FAQ
Frequently asked questions
Do I need to be technical?
No. The owner summary is written for business owners. The technical appendix is there for whoever makes the changes.
Will the audit slow down or break my site?
No. The audit is non-destructive: no load testing, no attempts to change data, and no changes to your site. If anything urgent turns up, you hear about it straight away.
What do you need from me to start?
The website address, a contact for urgent findings, and written confirmation that you own the site or are authorized to have it tested.
Is this a penetration test?
No. The audit covers the common, high-impact problems listed on this page. If your site needs deeper hands-on testing, such as a web application with logins and customer data, I will say so and quote it separately.
Are the fixes included?
Yes. Most owners do not have the time or the technical background, so the fixes for the findings in the report are part of the audit. If you would rather have your own developer make them, the report and technical appendix give them everything they need.
What do you need to make the fixes?
Temporary access to whatever the fix touches, such as your hosting, CMS, or DNS. Access is limited to the job and removed when it is done.
Why does the price say "from"?
The starting price covers a typical small business website. A larger site, or one that has already been hacked, gets a quote before any work starts.
How is this different from the free quick check?
The quick check runs Google's speed test and looks at a handful of headers and DNS records automatically. The audit is a manual review that also covers TLS, exposed files, outdated software, and DKIM, and includes the fixes and a re-check.
Want to know where your website stands?
Request an audit and you will hear back from Sam, who does the work.