Cybersecurity · OWASP
Website security audit
A website security audit shows the current state: access, headers, components, backups and exposed panels. For new clients the basic audit is free and the report stays yours.
What is included
Public surface, TLS and headers, forms and roles, CMS and dependency versions, exposed admin URLs, compromise signals and whether backups actually exist.
What it is not
This is not a pentest. An audit records state and priorities. Checking whether a weakness can be used is a separate website pentest under contract.
How it runs
We agree domains and a work window, review the site without taking production down, and return findings with severity and a fix order.
Result
A short summary for the owner and a list for the developer: what we found, the impact, and what to fix first.
Where we work
Remotely, with companies in different countries. On-site work is discussed if the office perimeter should be reviewed with the site.
Next steps
After the audit the usual next step is a website pentest, a WAF or 24/7 monitoring. We can apply the fixes if the site is under maintenance.
FAQ
What is a website security audit?
It reviews the site, server and related settings: access, configuration, components and backups. A pentest goes deeper and imitates an attacker under written permission.
Really free?
The basic audit is free for new clients. A wider perimeter and a pentest are quoted separately.
How long?
Usually 3-5 days for a typical site.
Is hosting enough?
Hosting covers part of the infrastructure. The audit looks at your site: forms, roles, the admin panel, dependencies and what is visible from outside.
Notes on this service
Related services
Let's discuss your task
Send a request or message us on Telegram - we reply within an hour on business days with a clear next step.