Growth & Support
What a Website Security Audit Actually Covers (and What a Scanner Misses)
An automated scan finds missing headers. An audit finds that any member can read any other member’s data. Here is what a proper security audit looks at, what it produces, and when you need one.
Most site owners first think about security after an incident: a defaced homepage, a Google warning, a host suspending the account. A security audit is the alternative — finding the weaknesses while they are still findings in a report rather than a story in the news. The trouble is that "security audit" covers everything from a free online scan to a week of expert testing, so it is worth being precise about what you are buying.
What Automated Scanners Find
Scanners are useful and we use them: they catch missing security headers, out-of-date software versions, weak TLS settings and known plugin vulnerabilities in seconds. What they cannot find is anything that requires understanding what the application is for. A scanner does not know that a member should not be able to see another member's invoice.
What a Real Audit Adds
Our security audit and penetration testing service works in layers:
- Application testing. The OWASP Top 10 — injection, broken authentication, broken access control, cross-site scripting, insecure uploads — tested by hand against the actual features, on a staging copy.
- Platform and plugin review. Every plugin, package and dependency checked, because an out-of-date payment plugin is the commonest way in. This is where our WordPress and Laravel experience matters: we know where each platform tends to be weak.
- Server and hosting. SSH configuration, firewall, file permissions, exposed services, backups and patching, in line with how we run hosting and servers ourselves.
- Access and data. Admin accounts, password policy, two-factor, logging, and how personal and payment data is stored and moved.
The Finding That Scanners Never See
The most serious issue we find, again and again, is broken access control: change an ID in the address bar and see someone else's record. No scanner flags it, because the page returns perfectly valid HTML. In a recent audit of a membership portal holding 40,000 members' details, exactly this was the critical finding, sitting quietly beneath eighteen lesser ones. It took an hour to fix once found.
What You Receive
A report with two audiences in mind. The front is a plain-English summary ranked by real risk, suitable for a board, an insurer or an enterprise client's supplier questionnaire. The back is technical: each finding with evidence, steps to reproduce and the fix. Because we are developers, we can carry out the fixes and then re-test to confirm each finding is closed — which is the part most audit-only firms cannot offer.
When You Need One
- A client, partner or cyber-insurer has asked for evidence of security testing.
- You are about to launch, or have just taken over, an application you did not build.
- The site holds personal data, takes payments, or has had several developers over the years.
- Something feels wrong — odd admin users, unexplained traffic — but nothing has visibly broken.
If the site has already been compromised, the order changes: clean-up and recovery first, then an audit to make sure the way in is closed. After either, a maintenance plan keeps updates and monitoring from slipping again, which is how most sites end up vulnerable in the first place.
A single site on a standard platform takes about a week from access to report. If you would like to know what one would involve for yours, tell us what it runs on and we will scope it.
Frequently Asked Questions
Is an automated vulnerability scan the same as a security audit?
No. A scanner quickly finds missing security headers, outdated software, weak TLS settings and known plugin vulnerabilities, but it cannot understand what the application is meant to allow. A real audit adds manual testing of the actual features, such as whether one user can reach another user's data, which scanners cannot detect.
What is broken access control and why do scanners miss it?
Broken access control means a user can reach data or actions they should not, for example by changing an ID in the address bar to open someone else's record. Scanners miss it because the page returns valid content; only a tester who knows what each user should be allowed to see can spot it. It is one of the most common serious findings.
How long does a website security audit take?
For a single site on a standard platform, around a week from receiving access to delivering the report. Larger applications, multiple systems or custom features take longer. The scope depends on what the site runs on, how many user roles it has and whether servers and hosting are included.
What should a security audit report include?
A good report has two parts: a plain-English summary ranked by real risk, suitable for a board, insurer or client questionnaire, and a technical section with evidence, steps to reproduce and a recommended fix for each finding. Ideally the fixes are then re-tested to confirm each issue is closed.
When does a business need a website security audit?
Typical triggers are a client, partner or cyber-insurer asking for evidence of testing, launching or taking over an application you did not build, holding personal data or taking payments, or noticing warning signs such as unknown admin users or unexplained traffic. If the site is already compromised, clean-up comes first, then the audit.
