A website security audit is a structured check of your site that ends in a list of confirmed problems and what to do about each. Our website security audit service covers the CMS and plugins, server and hosting settings, TLS and headers, forms, accounts, third-party scripts, DNS and mail, and backups. A person verifies every finding, and the report sorts the fixes into today, this month and later.
What the audit covers
The audit covers everything that decides whether an attacker can change your site, read its data or take it offline. We split it into six areas so nothing is skipped.
- Application: CMS version, plugins, themes, custom code that handles input, uploads and sign-in.
- Access: administrator accounts, roles, multi-factor sign-in, former staff and contractors, API keys.
- Server and hosting: control panel exposure, software versions, file permissions, open services, logging.
- Transport and browser: TLS configuration, certificate renewal, security headers, cookie flags, third-party scripts.
- Domain and mail: DNS records, SPF, DKIM and DMARC, records that point to services you no longer use.
- Recovery: what is backed up, where copies are stored, and whether a restore works.
How findings are rated and checked
Every finding gets a severity based on how easy it is to use and what it exposes, plus a recommended fix and a deadline group. Automated scanners produce many false alarms, so each item is reproduced by a person before it goes into the report.
We map findings to public reference lists so your developers and any later auditor read them the same way. OWASP publishes the Top 10:2025 list of web application risk categories and the Application Security Verification Standard (ASVS), whose current version 5.0.0 was published on 30 May 2025.
| Reference | What it gives the audit | Source |
|---|---|---|
| OWASP Top 10:2025 | Ten risk categories, from broken access control to mishandling of exceptional conditions, used to group findings | OWASP |
| OWASP ASVS 5.0.0 | Verification requirements in levels, used when a client needs a stated depth of testing | OWASP |
| GDPR Art. 32(1)(d) | Asks for a process for regularly testing, assessing and evaluating security measures | Regulation (EU) 2016/679 |
| PCI DSS v4.0.1 req. 6.4.3 and 11.6.1 | Script control and change detection on payment pages, checked for online stores | PCI Security Standards Council |
External check or full access
An external check shows what anyone on the internet sees; a check with access shows what is actually installed and who can sign in. Most business sites need both, and the scope letter states which one you ordered.
The external part needs only the list of domains and your written permission. The internal part needs CMS administrator and hosting access, and it finds outdated components, excess accounts, weak permissions and untested backups that are invisible from outside.
Who needs a website security audit
The audit fits any business whose site takes orders, bookings, enquiries or sign-ins, and any company preparing for a customer's security questionnaire. Typical triggers are a new site going live, a change of developer or agency, a security questionnaire from a large customer, a cyber insurance application, a past incident, or GDPR work that asks for regular testing.
What you receive
The deliverable is a report that a developer can work from and a manager can read in ten minutes.
- The full report: each confirmed finding with evidence, severity, the fix and the deadline group (today, this month, later).
- A short plain-language summary for the owner or management.
- A list of components and accounts we found, so you know what you run.
- A re-check after the fixes, with written confirmation of what is closed.
- On request, the fixes themselves: we close the findings or work with your developer.
What we need from you
We need the list of domains and environments, a signed scope letter with the targets, dates and contacts, and the access level you choose. If the site sits with a hosting provider, we check its rules for scanning and agree the window with you.
Boundaries
The audit confirms vulnerabilities and does not exploit them. It covers the targets listed in the scope letter, on the dates listed there. The report is a professional security assessment. Certification, legal opinions and compliance attestations stay outside it. If you need a formal PCI DSS or ISO assessment, that is done by an independent assessor or certification body, and our report helps you prepare for it.
Risks of a free online scan or an unscoped freelancer
A free online scanner reads only what your homepage sends back and often flags harmless settings while missing outdated plugins behind the login. A chatbot can explain what a finding means but cannot confirm it on your server.
A freelancer working without a scope letter may scan systems you have no right to test, such as a shared hosting server, and the report rarely includes a re-check. We work under a written scope, a person confirms each finding, and the re-check is included.
Who does the work
The contract is signed with INNOVA CONSULT LTD., Ottawa, Ontario, Corporations Canada number 1522612. Our team runs its own servers and more than 80 websites with daily vulnerability checks. The report is your property.
Cost
You get a fixed price in the scope letter after a 30-minute call. It depends on the number of sites, the amount of custom code and the access level.
Related services
- WordPress security for WordPress-specific hardening.
- Website security monitoring after the audit, to catch new changes.
- GDPR website security requirements if the audit is part of GDPR work.
- DMARC setup when the mail records need fixing.
- All cybersecurity services; to agree the scope, write to us.
Sources (checked 2026-10-23)
- OWASP, Top 10:2025.
- OWASP, Application Security Verification Standard 5.0.0.
- Regulation (EU) 2016/679, Article 32 GDPR.
- PCI Security Standards Council, Document Library: PCI DSS v4.0.1.
Maksym Stepanenko, founder of Marketing MIX. Last reviewed: 2026-10-23.