Audit
Website & E-commerce Audit
A website audit done by an engineer, not just a scanner. We review your site, store and server across eight areas. The written report ranks every finding by risk and comes with a fix plan any developer can follow.
Report within 7–10 working days of receiving access. A fixed price, quoted after a short call.
What we check: eight areas of your site
Security
Core and plugin integrity, known vulnerabilities, exposed files and backups, and malware.
Performance
Core Web Vitals, caching, assets, and server and nginx/PHP configuration.
Technical SEO
Indexing, sitemaps, metadata, structured data, redirects and broken links.
Accessibility
WCAG checks on your key templates and forms.
E-commerce and checkout
Checkout flow, payments, cart, product data, store settings and conversion blockers.
Code and plugin health
Theme and plugin quality, updates, conflicts and a review of custom code.
Hosting, backups and DNS
Server, Cloudflare and SSL, backups and recovery, and DNS.
Analytics and tracking
Analytics and tag setup, consent and conversion tracking.
How the audit works
Step 1
Short call
We learn about your site, store and setup.
Step 2
Fixed quote
One fixed price, based on the size and setup of your site.
Step 3
Read-only access
You grant us read-only access.
Step 4
We audit
An engineer reviews the site by hand.
Step 5
Report and walkthrough
You get the written report, then a call to go through it.
What you get: a written audit report
- Executive summary. A short read for decision-makers.
- Findings ranked by risk. Every finding is ranked, grouped by the eight areas above.
- A fix plan. Hand it to us or to anyone else.
Who the audit is for
We audit WordPress (including enterprise and VIP hosting), WooCommerce, Shopify, Magento and custom PHP/Laravel sites, and other web platforms on request.
What the audit does not include
- Fixing the issues. A separate, optional follow-on project.
- Penetration testing. We don’t exploit your site or run load or stress tests.
- Content and copywriting review.
- Design and UX redesign. We report findings; we don’t produce new designs.
After the report
- Walkthrough call. We go through the findings with you.
- We fix it for you. An optional follow-on project.
- Ongoing retainer. Through our Managed Services.
- Re-audit after fixes. We can check the work again.
Security work we’ve delivered
A US digital media publisher
Securing and running a WordPress publishing estate
Read the case study: Securing and running a WordPress publishing estate
A SaaS provider
Rebuilding a WordPress plugin to directory standards
Read the case study: Rebuilding a WordPress plugin to directory standards
Website audit questions
Will you change anything on our live site?
No. We work read-only. The only activity on the site is light, non-intrusive scanning, and nothing on the live site changes during the audit.
What happens to our access and data afterwards?
You can remove our access as soon as the report is delivered. We don’t keep copies of your data after the engagement.
What if the site is already compromised?
We tell you straight away. If you want, we contain it as a separate job before finishing the audit.
How is this different from a free scanner or security plugin?
An engineer reviews the site by hand, using automated tools where they help, and checks whether each issue actually matters for your setup.
Do you fix what you find?
Not as part of the audit. Fixing is a separate, optional follow-on project, and the fix plan works for any developer.
How long does it take?
We deliver the report within 7–10 working days of receiving access.
How is the price set?
A fixed price, quoted after a short discovery call based on your site’s size and setup.
Request a website audit
Tell us about your site. We quote a fixed price after a short call.