Website security audit and vulnerability testing
A website security audit finds the ways your site could be broken into: an outdated CMS and plugins, exposed admin panels and test copies, server misconfigurations, keys in the code, spoofed emails sent in your domain’s name. We start with a free passive audit — we look at your site and company from outside, the way an attacker would, with no access to your systems. We fix what we find ourselves or together with your developers.
How a website is checked for vulnerabilities
The check runs in two stages. A passive audit uses public information: the website, subdomains, email settings, services reachable from the internet, known leaks. It needs no access and doesn’t affect the site in any way, so we do it for free. An active audit runs with your permission, after a contract and an NDA: we test vulnerabilities in practice and review access rights, APIs and configuration from the inside.
Most problems aren’t sophisticated attacks but things people forgot: an old plugin, a test copy on a subdomain, an admin panel without two-factor authentication. In the industry’s list of risks, the OWASP Top 10 2025, broken access control and security misconfiguration take the top places. Many of these mistakes are visible from outside, and a passive check already shows them.
An online scanner finds known vulnerabilities in software versions and some misconfigurations, but it can’t see logic: whether one customer can open another’s order, or whether an order can be marked as paid by going around the payment system. That takes a person. It matters even more if your site or app was built with AI: such projects often have exposed databases and keys in the page code.
When you need it
- The site hasn’t been updated for a long time: an old CMS and plugins, access still held by former contractors.
- Strange pages, redirects or spam have appeared on the site, or your hosting provider has sent a warning.
- Fraudulent emails are reaching your clients and partners from your domain.
- The site takes payments or stores personal data, and you’re not sure it’s protected.
- Your site or app was built with a website builder or with AI and is about to go live for customers.
- A client, a partner or a tender requires you to confirm your level of security.
What’s included
- A passive audit: what can be seen about the site and company from outside — subdomains, exposed services, email records, leaks
- A check of the CMS, plugins and dependencies for known vulnerabilities and outdated versions
- Admin panel and access: two-factor authentication, login attempt limits, unnecessary accounts, forgotten contractor access
- Server and hosting: HTTPS, security headers, open ports, service and test pages, backups
- In the active audit, access and payment logic: whether a user can see someone else’s data and whether payment is confirmed on the server
- Protecting your domain from spoofed emails: SPF, DKIM, DMARC
- A report for management and developers: what we found, how critical it is, what we fixed and what to do next
Pricing
- Passive auditfree
A check based on public information: the website, subdomains, email, exposed services, leaks. No access to your systems.
- Quick launch$500–1,000
Fixes based on the audit: updates to compatible dependencies, access settings, fixing several confirmed issues.
- Business growth$1,500–4,000
More extensive fixes based on the audit results. We fix the scope from the audit report.
Active audits and penetration tests are quoted for an agreed scope, after the free passive audit. Larger fixes start at $5,000 and are estimated separately; rewriting authentication and recovery after a breach aren’t part of the basic package. We give an exact quote after the brief and the audit.
How we work
01. Passive audit
We look at your site and domain through an attacker’s eyes using public information and send you what we found. Free, with no access to your systems.
02. Contract and NDA
We fix the scope: which sites, subdomains and services we test, at what time, and what must not be touched.
03. Active testing
We test the CMS, admin panel, access rights, APIs and server settings in practice — without getting in the way of the site’s work.
04. Fixes and report
We close critical issues and hand over a report with the remaining risks by priority. If needed, we test again regularly.
What we’ve done
All work-
How a router misconfiguration exposed a company’s internal network to the internet
We found the misconfiguration that exposed the internal segment to the internet, reconstructed the attack and identified where defences failed. We handed over recommendations on network settings, updates and segmentation.
View case: Exposed segment -
How a forgotten internal web service gave attackers a way into every enterprise in a corporation
We reconstructed the attack chain, from the outdated web service to control of Active Directory, and identified where defences failed. We handed over recommendations for the measures that close this scenario.
View case: Infrastructure takeover -
How a single phishing email ended with the corporate database being stolen
We reconstructed the attack chain, from an employee’s email to the stolen database, and identified where defences failed. We handed over recommendations on email, workstations, admin accounts and outbound traffic.
View case: Phishing email
Frequently asked questions
How much does a website security audit cost?
The passive audit is free. Basic fixes based on it cost $500–1,000, more extensive ones $1,500–4,000. We quote active audits and penetration tests after the passive audit, for an agreed scope.
What’s the difference between a security audit and a penetration test?
An audit looks for vulnerabilities and misconfigurations and rates how critical they are. A penetration test goes further: within agreed limits we act like an attacker and show where one could really get in.
Can I check my website for vulnerabilities online?
Online scanners show known vulnerabilities in CMS versions and some misconfigurations — a useful first filter. They don’t find mistakes in the logic of access rights, payments and data access: that takes a person.
Will the testing break my website?
The passive audit doesn’t touch your systems. Active tests run at an agreed time and within agreed limits, and anything that could affect the site is agreed in advance.
What should I do if my site has already been hacked?
Change passwords and access keys, and don’t delete server logs before they’ve been analysed. We find the entry point, close it and help you get back to work. If personal data has leaked, data protection laws such as GDPR or Russia’s 152-FZ may require you to notify the regulator — in Russia, within 24 hours.
Do I need an audit if my site was built with a website builder or AI?
Yes, if the site takes money or stores personal data. Such projects often have exposed databases and keys in the page code, and the site owner — not the builder — is responsible for a leak.
Do you disclose what you find on our site?
No. We sign an NDA before any active work, and the case studies on our site are anonymised — no company names or infrastructure details.
What shall we build together?
Tell us what you want to launch or improve. We’ll discuss the task and suggest the next step.