Find the weak spots before someone else does
We audit your website or web application, explain what we find in plain language, and close the gaps in the code, the server and the way people log in.
Part of Managed servicesWhat we do
Security audit
A review of the application, plugins and themes, server configuration, file permissions and exposed services, with each finding rated by risk.
Code and plugin review
Custom code checked for injection, broken access control and unsafe file uploads. Plugins for WordPress checked against known vulnerabilities and abandoned projects.
Server and header hardening
TLS settings, security headers, firewall rules and disabled services that should never have been reachable from the internet.
Access and login control
Two-factor login for admins, removal of old accounts, least-privilege roles and limits on repeated login attempts.
Web application firewall
A firewall configured in front of the site, through Cloudflare or your host, with rules adjusted so real customers are not blocked.
Payment and data handling
A check that card payments through mada, Apple Pay or your gateway stay on the provider's side, and that personal data is stored and logged appropriately.
When clients call us about this
The site collects personal data or payments
Contact forms, customer accounts and checkouts all hold data worth protecting. An audit shows how well they do it.
Former staff or agencies may still have access
Old admin accounts and shared passwords are among the most common ways in. We find and remove them.
A client or partner sent a security questionnaire
An audit and hardening report give you documented answers instead of guesses.
Questions we are often asked
Is this a penetration test?
It is a configuration and code audit with hardening. If you need a formal penetration test from an independent firm, we can prepare the site for it and fix what it finds.
Will hardening break anything?
Changes are tested on a staging copy first. Where a setting could affect customers, such as firewall rules, we watch the live site closely after release.
Do you audit sites you did not build?
Yes. Most audits are for sites built by other teams. We need admin and server access, which we remove at the end if you ask.
How often should a site be audited?
After major changes, and at least once a year for sites that take payments or hold customer data. Monitoring between audits catches most new issues.
Tell us what you want to build, fix or grow
We reply within one working day with questions or a short plan.