Website Security Audits
Most small-business sites aren't hacked by geniuses. They're hacked by bots scanning for the same handful of mistakes.
A website security audit from Prompt & Pixel is a non-destructive review of your site’s server settings, forms, exposed files and code, delivered as a plain-language report that ranks each issue by risk and explains the fix. The scope is agreed in writing and your site stays live throughout.
Why Your Site Is a Target
Automated scanners crawl the web around the clock looking for exposed config files, outdated plugins, and forms they can abuse. They don't care how big you are. A compromised site can leak customer data, send spam in your name, get blacklisted by Google, or quietly redirect your visitors somewhere else — and you're often the last to find out.
What We Check
Server & hosting — HTTPS setup, security headers, directory listing, and files that should never be public (backups, .env, config files).
Forms & inputs — contact and login forms tested for spam abuse, header injection, and missing validation.
Code & secrets — passwords or API keys hardcoded in source files, and outdated CMS, theme, or plugin versions.
Third parties — scripts and embeds you load from other domains, and what they're allowed to do.
The Most Common Gaps We Find
Database passwords sitting in plain text inside PHP files. Contact forms that let attackers inject their own email headers. Config folders readable by anyone who guesses the URL. Missing or broken Content-Security-Policy headers. Admin panels on default URLs with no rate limiting. None of these need a sophisticated attacker — just a bot and some patience.
What You Get
A plain-language report that ranks every finding as critical, high, medium, or low — with what it means for your business and the exact fix. No jargon walls. If you want, we implement the fixes ourselves and re-test to confirm they're closed.
How We Work
We only test sites you own or are authorised to have tested, and we agree the scope in writing before we start. All checks are non-destructive — your site stays live the whole time. Findings are shared only with you, and we recommend a re-audit once a year or after any major change to your site or hosting.
Security audit questions
What is a website security audit?
A website security audit is a structured review of your site, server configuration and forms to find weaknesses an attacker could exploit, such as exposed files, missing security headers, outdated plugins or forms that can be abused. You receive a report ranking each issue by risk, with clear steps to fix it.
Will a security audit take my website offline?
No. Prompt & Pixel uses non-destructive checks only and agrees the scope with you in writing before starting. Your site stays live throughout.
How often should a website be audited?
At least once a year, and after any major change such as a redesign, a new plugin, a hosting move, or adding payments or login features.
Is Your Site Exposed?
Find the gaps
before a bot does.
Tell us about your site and hosting. We'll scope an audit that fits.
Book an Audit ↗