Skip to content
38Security audits

What is wrong with your website, and what it costs to fix.

We audit the code behind your website for security vulnerabilities, speed and waste, then give you one structured report: every problem we found, how we would fix it and what each fix costs. It is a code audit, not a penetration test.

Book an audit
What each audit checks
Security audit
from £249
Speed audit
from £79
Optimisation audit
from £79
Full audit
from £348

The audits

Three audits. Every check listed.

Book one, or add speed and optimisation to any security tier as a full audit. If you go ahead with the fixes or an upgrade, the fee comes off the price.

0110 checks

Security audit

from £249

A close read of your code for the weaknesses attackers look for. We work from the code and its configuration. We never attack your live site.

Choose a tier
  1. 1.1

    Known vulnerabilities in what you depend on

    Every library, plugin, theme and package your site pulls in, checked against the public vulnerability records (CVEs) and each ecosystem's security advisories. An old plugin with a published flaw is one of the commonest ways into a small business website.

  2. 1.2

    Passwords and keys in the code

    Database passwords, API keys, payment keys and tokens written into files or left in the repository's history. Anyone with a copy of the code has them too, and deleting the file does not remove them from the history.

  3. 1.3

    Injection

    Places where what a visitor types is built straight into a database query, a file path or a server command. That is how a search box or a login form ends up handing over the database.

  4. 1.4

    Cross-site scripting

    Text a visitor sends that is shown back on a page without being made safe. It lets someone run their own script in other visitors' browsers: a fake login box, or a stolen session.

  5. 1.5

    Logins and sessions

    How passwords are stored, how sessions start and end, how password reset works, whether repeated login attempts are slowed down, and whether two-factor sign-in is available where it matters.

  6. 1.6

    Who can reach what

    Whether every admin page, API route and file actually checks who is asking, rather than relying on nobody finding the link. That includes database rules, such as Supabase or Firebase security rules, wherever the browser talks to the database directly.

  7. 1.7

    Forms and uploads

    Uploads that accept any type of file or store them where they could be run, forms that can be submitted from another site (CSRF), and forms with no protection against spam.

  8. 1.8

    HTTPS and security headers

    A valid certificate with every address redirected to HTTPS, and the headers that tell browsers how to protect your visitors: HSTS, a content security policy, and protection against framing and content sniffing.

  9. 1.9

    Out-of-date platform software

    Your CMS, PHP or Node version and frameworks, checked for releases that have reached end of life and no longer get security fixes.

  10. 1.10

    Leaks and exposed files

    Debug modes left on, error pages that print the code's internals, and server configuration that would let the web reach backups, .env files or the .git folder.

Security audit tiers

Three tiers. The same 10 checks.

The tier is set by how much there is to check, not by how carefully we check it. You are told the exact price before we start.

Tier 1

Essential

from £249

Brochure and small business sites

  • Brochure and information pages
  • Contact and enquiry forms
  • A CMS such as WordPress, with its theme and plugins
  • No customer logins or payments
Book Essential

Tier 2

Advanced

from £599

Sites with logins, payments, bookings or a shop

  • Online shops and checkouts
  • Customer or member areas
  • Booking and appointment systems
  • Payment, email and CRM integrations
Book Advanced

Tier 3

Comprehensive

from £1,499

Custom applications, APIs and larger estates

  • Custom-built web applications and their APIs
  • Several sites or apps audited together
  • Databases with their own access rules
  • Admin systems and internal tools
Book Comprehensive
028 checks

Speed audit

from £79

How quickly your pages load and respond for real visitors, and exactly what is slowing them down, measured on a phone as well as a desktop.

Book the speed audit
  1. 2.1

    Core Web Vitals

    Google's three measures of a page's experience: Largest Contentful Paint (how soon the main content appears), Interaction to Next Paint (how soon a tap gets a response) and Cumulative Layout Shift (whether things jump while it loads). Measured on a mid-range phone over mobile data and on desktop. Where Google holds real-visitor data for your site, that goes in too.

  2. 2.2

    Page weight

    The total download for each key page, split into images, scripts, styles and fonts, so you can see where the weight actually is.

  3. 2.3

    Images

    Files far larger than they are shown, old formats where WebP or AVIF would do the same job, images loaded before anyone scrolls to them, and missing sizes that make the page jump.

  4. 2.4

    Code that holds the page up

    Scripts and styles that must download before anything appears on screen, such as sliders, tag managers and chat widgets. For each one: whether to defer it, trim it or remove it.

  5. 2.5

    Third-party scripts

    Everything loaded from other companies' servers, such as analytics, adverts, embeds, reviews and chat, and the load time each one costs you.

  6. 2.6

    Caching and compression

    Whether files are compressed (gzip or Brotli) and cached by browsers and a CDN, so returning visitors do not download everything again.

  7. 2.7

    Server response time

    How long the server takes to start answering (time to first byte), and whether the hosting, slow database queries or missing page caching are the cause.

  8. 2.8

    Fonts

    How many font files load, how big they are, and whether text stays invisible while they arrive.

037 checks

Optimisation audit

from £79

Everything that makes the site heavier, harder to find or harder to change than it needs to be.

Book the optimisation audit
  1. 3.1

    Dead weight

    Plugins, scripts, styles and whole libraries that load on every page and do nothing, and code that nothing calls any more.

  2. 3.2

    The same job done twice

    Two form plugins, two copies of one library, styles repeated file after file. Each copy is one more thing to update and one more thing to break.

  3. 3.3

    Search basics

    A title and description on every page, headings in order, a sitemap and robots.txt, canonical addresses, structured data and broken internal links.

  4. 3.4

    Accessibility

    Colour contrast, text alternatives for images, labelled form fields, heading order and whether the site works with a keyboard alone. Checked against the common WCAG 2.2 AA failures.

  5. 3.5

    Phones and screens

    Every key page at phone, tablet and desktop widths: text too small to read, buttons too close together to tap, and content wider than the screen.

  6. 3.6

    How hard it is to change

    What the site is built on, how current it is, whether it is in version control, and which parts will need replacing soon, so the next change does not cost more than it should.

  7. 3.7

    Hosting and set-up

    Whether the hosting plan, the server software and the build set-up suit the site, and whether backups are being taken at all.

04All three

Full audit

from £348

Any security tier, plus speed and optimisation for £99 more: £59 less than the two on their own.

Book the full audit
  • Every check in the security, speed and optimisation audits: 25 in all.
  • One report and one prioritised list across all three, so you know what to fix first.
  • The audit every website upgrade starts with.

The report

One file. Every finding, every fix, every price.

Worst first, in plain English, with totals at the end: the cost of fixing everything, and the cost of fixing only what is urgent.

Audit report · Findings

Sample layout

  1. 01

    Database password written into the code

    Security · includes/db.php, and in the history

    Critical

    FixMove it to the server's environment, change the password and purge it from the history.

    CostPriced for your site

  2. 02

    Library with a published vulnerability

    Security · js/jquery-1.8.3.min.js

    High

    FixUpgrade to a supported version and retest every page that uses it.

    CostPriced for your site

  3. 03

    Contact form shows input back unescaped

    Security · contact/submit.php

    High

    FixEscape the output, validate on the server and add a spam check.

    CostPriced for your site

  4. 04

    Home page image several megabytes in size

    Speed · / (home page)

    Medium

    FixResize it, convert to WebP or AVIF and serve the right size for each screen.

    CostPriced for your site

  5. 05

    No content security policy

    Security · Server configuration

    Medium

    FixAdd a policy and the standard security headers, tested page by page.

    CostPriced for your site

  6. 06

    Three plugins loading on every page, used on none

    Optimisation · Site-wide

    Low

    FixRemove them and retest the pages they touched.

    CostPriced for your site

Fix everything
Priced for your site
Critical and high only
Priced for your site
A sample of the layout. These entries are common examples, not any customer's site, and prices are redacted because every fix is priced against the site it was found in.

What every finding contains

  • What we foundIn plain English, not scanner output.
  • WhereThe file and line, or the page, so any developer can find it.
  • Why it mattersWhat could happen if it is left alone.
  • SeverityCritical, high, medium or low, so you know what to do first.
  • How we would fix itThe actual change, not a vague recommendation.
  • Cost to fixA fixed price for that one fix, so you can choose which ones to do.

How severity is graded

  • CriticalFix now. Someone could get in, or customer data could leak.
  • HighFix soon. A real weakness with a known way to use it, or a problem visitors notice.
  • MediumPlan it in. Worth fixing, but not urgent on its own.
  • LowWhen convenient. Tidying that makes the site better to run.

The report is yours to keep. Have us make the fixes, make them yourself, or hand it to another developer.

Be clear what you are buying

A code audit. Not a penetration test.

A penetration test is an authorised attempt to break into your live systems. An audit is a close read of the code and its configuration. Both find real problems, but they are different jobs.

The audit is

  • A review of your source code, everything it depends on, and its configuration
  • Automated scanning, then a read of the parts scanners miss: logins, forms, payments and permissions
  • Speed measured the way a visitor's browser loads your public pages
  • A structured report: what we found, how we would fix it and what each fix costs

The audit is not

  • An attempt to break into your live site, servers or accounts
  • Phishing tests, social engineering or network testing
  • A certificate, or sign-off for PCI DSS, ISO 27001 or a cyber insurer
  • A guarantee that nothing else is wrong

If a contract, insurer or regulator asks for a penetration test, use an accredited tester. In the UK, look for CREST accreditation. An audit first is a sensible way to clear the obvious problems before you pay for one.

How it works

From booking to a closed list.

01

Book it

Tell us the site and which audit. You are told the exact price before anything starts.

02

Send access

Read-only access to the code: a repository, a zip file or a hosting login.

03

We audit

Automated scans first, then we read what they flag and the parts they cannot see.

04

The report

Every finding, how we would fix it and what each fix costs, with totals.

05

You choose

Fix everything, only the urgent items, or nothing yet. Once fixes are made, we re-run the checks to confirm each one is closed.

Questions

Before you book.

Find out what is there.Then decide what to fix.

Audits start from £79. Tell us the site and we will tell you the exact price.

Book an audit
Or talk to us first