Website security

Website security audit

We check websites for vulnerabilities by reviewing the security of the website code and server infrastructure. We identify weaknesses in the CMS and its components, configuration errors, insecure access and other weak points that attackers could exploit. We combine automated tools with manual analysis to take the specifics of each project into account. After the audit, we provide a report with a risk assessment, priorities and recommendations for fixing the issues found.

Discuss a task Projects

What the audit covers

CMS and modules
Website code
Website files
Server and hosting
Access and user accounts
Backups

2015year founded

100+completed projects

6 yearsaverage length of client relationships

≤1 hoursupport response time during business hours

150+websites restored after hacking

What is a website security audit

A website security audit is a comprehensive review aimed at finding vulnerabilities, configuration errors and security gaps that could lead to a hack, a data leak or a disruption of the website. Within the agreed scope of work, the review covers not only publicly accessible pages but also the code, the CMS, the server environment, user accounts and access control mechanisms.

Unlike a basic automated website vulnerability scan, a full audit combines technical tools with manual analysis. Our specialists verify the issues found, study how the website works and assess the possible consequences of exploiting the vulnerabilities. Instead of a list of potential errors, you get an understanding of the real risks and how to address them.

An audit is especially relevant before launching a website or making significant changes, after a change of developer or contractor, when moving to another server and when unauthorized access is suspected. A scheduled review helps detect security issues before attackers take advantage of them.

What the audit covers

Our website vulnerability assessment covers six main areas: from website components and code to server settings, access permissions and backups. We define the set of checks based on the project architecture and the access provided.

CMS and modules

We check the versions of the content management system, plugins, modules and libraries for known vulnerabilities. We identify outdated components, modules that are no longer supported and unused extensions that may create additional security risks. We review the CMS settings, including access to administrative functions, system interfaces and internal information.

Website code

During a code audit, we analyze modules, form handlers, APIs and integrations with external services. We check protection against SQL injection, XSS and unsafe file uploads, the correctness of authorization and restrictions on access to other users' data. We look for secret keys, passwords and other confidential values left directly in the source code.

Website files

We check the file structure for unauthorized PHP scripts, backdoors, suspicious changes and files that do not belong to the CMS or the project. We look for archives, backups, database dumps and configuration files that can be accessed through a browser. We check old versions of the website and test directories that may have been left after development or migration.

Server and hosting

During a server security audit, we check how well the infrastructure that runs the website is protected. We identify outdated software, insecure web server settings, network security gaps and services that attackers could use to access the system. We check the security of HTTPS connections and settings that could lead to a data leak or disrupt the website. If the server hosts several websites, we assess how well they are isolated from each other.

Access and user accounts

We check users with administrative privileges in the CMS, SSH and FTP/SFTP access, database accounts and service user permissions. We identify unused accounts, access held by former employees and contractors, shared accounts and excessive privileges. We review two-factor authentication settings, login attempt limits and activity logging.

Backups

We check whether backups of the website files and database are created, how up to date they are and where they are stored. We analyze the protection of the storage, the retention period and whether the backups are independent of the main server. If needed and agreed, we run a test restore to make sure the backup data is usable.

What you get after the audit

When the audit is complete, we deliver a structured report that you can use to assign tasks to developers, system administrators or another technical contractor. The document separates the overall security assessment of the website, the specific issues found and the order in which to fix them.

Overall security assessment

A short summary of the most significant findings: which areas need attention, which issues pose the greatest risk and how urgently action is needed. This part lets a manager understand the situation without going into technical details.

Detailed list of vulnerabilities

For each issue found, we specify the affected component or part of the website, describe the error, the conditions under which it occurs and its possible consequences. We provide technical evidence and reproduction data where this is acceptable and safe. We separately note the limitations of the review and findings that need further confirmation.

Severity rating

We rank the findings by risk level, taking into account the possible damage, the conditions for exploitation and the specifics of the project. This helps separate issues that need an immediate response from less urgent remarks. The same technical errors can have different priorities depending on which functions and data they affect.

Recommendations and fix plan

For each confirmed issue, we suggest specific measures to fix it or reduce the risk. We put together a sequence of work based on severity, dependencies and the possible impact of changes on the website. You can pass the recommendations on to your current developer or administrator, and the fixes themselves are agreed separately.

After delivering the report, we can go over the results with the person in charge and clarify the work priorities. Retesting after the fixes is agreed separately and shows whether the previously found issues have been resolved.

How the audit works

We organize the work according to an agreed plan: from defining the scope of the review to delivering the results. Fixing the issues found and retesting after the fixes are separate stages that are carried out if needed and by agreement.

Initial discussion

We clarify the purpose of the website, the CMS or tech stack in use, the specifics of the infrastructure and the reasons you contacted us. We find out whether there are any restrictions on when the work can be done, on website availability or on the handling of user data.

Agreeing on scope and cost

We define the boundaries of the audit: which websites, domains, servers, applications and components are included in the review. We separately agree on access to the source code, the permitted active tests and any exclusions. We put the scope of work, the timeline and the cost in writing before the review begins.

Granting access

We agree on the access permissions needed for the CMS, server, file system, database or source code repository. We request only the permissions needed for the selected checks. If needed, we sign a non-disclosure agreement and agree on a secure way to share the credentials.

Running the audit

We perform the checks within the agreed boundaries and record the results. If confirming an issue requires actions that could affect website availability or data integrity, we agree on them with you in advance. If we find a critical issue that needs an urgent response, we report it before the entire audit is complete.

Report delivery and review

We deliver the results of the review and discuss the most significant findings with you or your technical team. We clarify the limitations of the audit, answer questions about the recommendations and agree on the next steps.

Fixing the issues found

The fixes are made by your technical team or by RIVERIT specialists under a separate agreement. When planning the changes, we take into account the dependencies between components, the need for backups and the possible impact of the fixes on the website.

Retesting

After the fixes are made, we check the previously found issues by agreement and record the result: whether the vulnerability has been resolved, remains or needs further work. Retesting does not replace a new comprehensive audit and does not mean that all website components are checked automatically.

Cost of a website security audit

The cost of a website security audit depends on the scope of work and the complexity of the checks. When estimating it, we take into account the project architecture, the specifics of its functionality, the infrastructure and the required depth of analysis.

When calculating the cost, we consider:

Website complexity. The number of functional sections, user roles, non-standard scenarios and external integrations

Infrastructure in scope. How many websites, servers, databases and related services need to be included in the audit

Depth of analysis. Whether the review needs to cover the source code, complex access mechanisms, APIs and additional components beyond the basic review

Cost and terms. We set the cost after a preliminary review of the project. Before the work begins, you receive a proposal with the list of items to be checked, the agreed depth of the audit, the timeline and the final price.

Additional work. Fixing the vulnerabilities found and retesting after the fixes are priced separately unless they are included in the agreed scope of work.

Discuss a task

Security audit FAQ

01Can an audit affect how the website works?

Most checks can be carried out without taking the website offline, but the impact of active testing cannot be ruled out completely. That is why we agree on the permitted methods and limits in advance. We run potentially risky checks only after approval and, if needed, on a staging copy of the website or at a specially scheduled time.

02How long does a website security audit take?

The timeline depends on the scope and depth of the review. It is affected by the complexity of the functionality, the availability of the source code, the number of systems checked and the need for manual analysis. We set a specific timeline after a preliminary assessment of the project.

03How is an audit different from an automated scan?

Automated tools help detect known vulnerabilities and signs of misconfiguration, but they cannot fully assess all the specifics of a particular website. An audit adds manual analysis and verification of the issues found to automated checks, so confirmed vulnerabilities can be separated from false positives.

04Can an audit be done without access to the server and source code?

Yes, some checks can be performed from outside the website. However, without access to the server, its settings and the source code, the related components cannot be examined fully. In that case, we define the available scope of the audit in advance and note the limitations in the final report.

05Does an audit guarantee that the website cannot be hacked?

No. Even a thorough review cannot guarantee that there are no vulnerabilities left or that the website is safe from future attacks. An audit makes it possible to find issues within the agreed scope of work and to define measures that reduce the risks.

Order a website security audit

Planning to check your website security or want an independent assessment of how well it is protected? Contact RIVERIT. We will study the specifics of your project, clarify the tasks and suggest a suitable scope for the audit.

Services in this area