What a website security audit covers, and what it doesn't

Most break-ins at small business websites aren’t clever. An old plugin nobody updated. A former employee whose login still works. An app installed three years ago for a promotion that ended. A server still running last month’s PHP. October 2026 delivered two reminders in one week: the PHP2Shell flaws in the software behind most WordPress sites, and hijacked Shopify storefront apps that quietly sent shoppers to fake checkout pages.

A website security audit is how you find those weak spots on your own schedule instead of an attacker’s. Here’s what a good one covers, what it leaves out, and how often to run one.

What is a website security audit?

A website security audit is a structured review of your site, the accounts that control it, and everything it loads, done to find weaknesses and rank them by risk. For a small business, most of what it finds falls into three buckets: software that’s out of date, access that’s too broad, and third-party code you didn’t know was there. You end up with a short list of fixes in priority order.

It’s a review, not an attack. Nobody tries to break in, and a careful audit doesn’t slow your site down or take it offline.

What should a security audit check?

A useful audit covers the paths small business break-ins actually come through:

• Software and patching. Your platform, plugins, theme and PHP version, and whether your host applies security fixes promptly.
• Logins and access. Every admin, staff and collaborator account, who still needs one, and whether two-step login is on.
• Plugins and apps. What’s installed, what each one can access, which are abandoned by their developers, and code left behind by apps you already removed.
• Checkout and payment scripts. Every script that loads on your checkout page, and how your card form is set up with your payment processor.
• Backups. Where they live, how far back they go, and whether a restore actually works. Testing one restore is worth more than any written policy.
• Malware and Google’s flags. Scans for injected code and spam pages, plus the warnings in Google Search Console and Safe Browsing.
• Encryption and browser protections. Your SSL certificate setup and the security headers that tell browsers how to treat your pages.
• Forms and fake orders. Spam protection on contact forms, and defenses against card testing at checkout.
• Email spoofing. Your SPF, DKIM and DMARC records, which make it harder for criminals to send email that looks like it came from you.

Where the work sits depends on your platform. On Shopify, the platform secures its servers and checkout, so the audit focuses on your accounts, apps, theme and scripts. On WordPress and WooCommerce, you own the whole stack, so the audit reaches all the way down to hosting and PHP.

What doesn’t a security audit cover?

An audit isn’t a penetration test, where specialists try to break in on purpose to prove what an attacker could reach. It isn’t a PCI certification, and it isn’t legal advice. Most small businesses don’t need a penetration test, but a company that stores sensitive customer data or answers to a large client’s security questionnaire might, and a good auditor will say so.

It also goes well past what a free online scanner can see. Remote scanners look at your site from the outside, the way a visitor does. Sucuri, which makes one of the best known, says plainly that its scanner can’t see problems on the server itself. Scanners are a fine first step, and our afternoon checklist shows how to use them. They aren’t an audit.

How often should you run one?

Once a year is the baseline for most small business sites. Online stores should audit every quarter, because checkout scripts and apps change often and the stakes include customers’ card details.

Run one off-cycle after any big change, too: a redesign, a new payment provider, a new developer with admin access, or a scare like this October’s. And if you carry cyber insurance, look at your renewal questionnaire. Insurers such as Travelers commonly require two-step login and working backups before they bind a policy, and an audit gives you honest answers to those questions.

What does a website security audit cost?

It depends on the platform, the size of the site, how many systems connect to it, and whether you take payments. A five-page WordPress site for a service business is a much smaller job than a WooCommerce store with a dozen plugins and an inventory sync.

Two warning signs: a “free audit” that turns out to be an automated scan with a sales pitch attached, and anyone who quotes a firm price before asking what your site runs on. A real quote starts with questions about your platform, hosting and payments.

Can I do it myself?

You can do a meaningful first pass yourself. Checking Google’s security flags, removing old logins, turning on two-step login, deleting unused plugins and confirming your backups exist all take an afternoon and no technical background. Our checklist walks through it.

The parts that usually need help are the ones behind the curtain: what’s running on the server, what loads on your checkout, whether a backup really restores, and what an unfamiliar plugin or app actually does. Platform-specific guides help too. Here’s ours for Shopify stores and for WooCommerce stores.

Why Florida businesses should care about “reasonable measures”

Florida’s data breach law, section 501.171 of the Florida Statutes, requires businesses to “take reasonable measures” to protect personal information they hold electronically. If that information is exposed, the law generally gives you 30 days to notify affected people, and the state’s Department of Legal Affairs must also be told when 500 or more Floridians are affected.

We’re a web team in Tampa, not a law firm, so talk to your attorney about what applies to your business. From the website side, a recent audit with a record of what you fixed is one of the clearest ways to show you took the duty seriously.

Want us to run yours?

Our website security audit covers everything on this page for WordPress, WooCommerce and Shopify sites, including sites we didn’t build. You get a plain-language report and a fix-first list, and we can make the fixes or hand them to your team. Every audit is quoted before we start. If you think the site is already compromised, skip the audit and go straight to hacked website repair.

Common questions

Is a security audit the same as a vulnerability scan? No. A scan is one tool inside an audit. The audit adds the parts a scanner can’t see: your accounts, your apps’ permissions, your backups and your checkout setup.

Do I need an audit if my site is on Shopify? Yes, though a smaller one. Shopify secures its platform, and the staff accounts, apps and scripts on your store are still yours to manage.

What should I fix first? Old logins and missing two-step login, almost every time. They’re the cheapest fixes and among the most common ways in.