What does a website security audit check?
The parts of your site that small business break-ins actually come through, on WordPress, WooCommerce and Shopify:
- Software and patching. Platform, plugin, theme and PHP versions, and whether your host has applied current security fixes, including the October 2026 PHP2Shell patch.
- Logins and access. Every admin, staff and collaborator account, who still needs it, and whether two-step login is on.
- Plugins and apps. What's installed, what each one can access, which are abandoned, and code left behind by apps you already removed.
- Checkout and payment scripts. Every script that loads on your checkout, how your card form is set up with your payment processor, and the questions to put to them.
- Backups. Where they live, how far back they go, and whether a restore actually works. We test one.
- Malware and Google flags. Scans for injected code and spam pages, plus Search Console and Safe Browsing warnings.
- Encryption and browser protections. Your SSL setup and the security headers that tell browsers how to treat your pages.
- Forms and fake orders. Spam protection on your forms, and defenses against card testing at checkout.
- Email spoofing. Your SPF, DKIM and DMARC records, which make it harder for criminals to send email as your domain.
What do you get at the end?
A plain-language report: what we found, how serious each item is, and a short fix-first list in priority order. We can fix the items ourselves, or hand the list to your team or developer. Either way, you'll know what matters now and what can wait.
What isn't included?
An audit isn't a penetration test, where specialists try to break in on purpose, and it isn't a PCI certification or legal advice. If your situation calls for one of those, we'll tell you and point you to the right kind of firm.
How often should you run one?
Once a year for most small business sites, and every quarter for online stores. Also after big changes: a redesign, a new payment setup, a new developer, or a security scare like this October's PHP flaws and hijacked Shopify apps.