Cybersecurity & Digital Protection · Assessment

Website Security Audit

A read-only review of one website and its hosting, written up and ranked by risk

Buy now

$349USD one-off

One payment. Work starts once we have confirmed your requirements.

The four questions this page answers

  1. 1

    What you buy

    A one-off remote review of a single website and the hosting and content management system behind it. We read the configuration rather than change it, and you receive a written report that ranks what we found by how much it matters.

  2. 2

    What you get

    5 deliverables, listed in full below

    • A written security review report covering platform, accounts, hosting and transport
    • A risk-ranked findings list with an effort estimate against every item
    • An inventory of the accounts that can administer the site and what each can do
    + 2 more
  3. 3

    How it is delivered

    Remote Setup

    Carried out remotely by our team. Nothing is posted and no one visits.

    REMOTE SERVICE

  4. 4

    How long it takes

    5–7 business days from receipt of access, with the walkthrough call booked once the report is sent

    Measured from the point everything under “what we need from you” is with us, not from the moment you pay.

An audit report: findings grouped into severity bands with an owner for each — illustrative concept, not a screenshot of a client system
An audit report: findings grouped into severity bands with an owner for each. Illustrative interface concept — not a screenshot of a client deployment.

What is this, in plain English?

A one-off remote review of a single website and the hosting and content management system behind it. We read the configuration rather than change it, and you receive a written report that ranks what we found by how much it matters.

Narrower and deeper than the Technical Infrastructure Audit, which looks across a whole environment. This one concentrates on one website: its platform and plugin versions, its user accounts, its server configuration and the way it serves pages to a browser. It is an assessment only. If you want the findings applied, Security Hardening is the product that does that, quoted once you have the report.

The problem it solves

Your website runs software nobody has looked at in two years, several people still have administrator logins, and you have no way of telling which of that is a genuine risk and which is fine.

If that does not describe you, this is probably the wrong product. Tell us and we will point you at a better fit rather than sell you the nearest one.

What you get

The concrete things that exist at the end and that you own.

5 deliverables

  • A written security review report covering platform, accounts, hosting and transport
  • A risk-ranked findings list with an effort estimate against every item
  • An inventory of the accounts that can administer the site and what each can do
  • A one-hour recorded walkthrough call over video
  • A short list of what we could not see, and why, so nothing is quietly left out

What's included

The work covered by the figure in the buy box, at no extra cost.

  • Review of one website and the hosting account it runs on
  • Platform, theme, plugin and library version checks
  • Account and permission review
  • Header, cookie and transport configuration review
  • Risk-ranked written report
  • Walkthrough call over video

Not seeing something you expected? Check what you are not buying before you order.

What does it do?

Everything listed here is delivered as part of this product. Nothing on this list is aspirational.

  • Platform, theme and plugin versions checked against published advisory databases
  • User account and administrator permission review, including dormant logins
  • Server and hosting configuration review, including file and directory permissions
  • Security header, cookie and transport configuration checked as served
  • Backup and recovery position recorded exactly as found
  • Every finding rated high, medium or low, with the effort each fix needs
  • A one-hour walkthrough call over video once the report is sent

How it works

The delivery sequence from order to handover.

  1. 1

    Confirm authorisation

    You confirm in writing that you own or control the site and authorise us to review it. We do not start without that.

  2. 2

    Take read access

    Administrator and hosting access is provided so we can read configuration rather than guess at it.

  3. 3

    Review

    Versions, accounts, permissions, headers, transport and backups are examined against common practice.

  4. 4

    Rank the findings

    Each item is rated by risk and paired with the effort its fix would take, so you can choose.

  5. 5

    Walk it through

    A video call to go through the report, answer questions and agree what, if anything, happens next.

Delivery & fulfilment

Stream Edge Solutions ships nothing. Every package on this site is carried out and handed over remotely — this is exactly what happens after you order.

REMOTE SERVICEHow this is delivered
  1. 1We confirm requirementsWe read what you sent with the order, come back in writing with anything missing, and agree the scope before any chargeable work starts.
  2. 2We build and configure remotelySetup, configuration and testing are done by our team over a remote connection — on your systems or on ours, whichever the package specifies.
  3. 3We hand it overYou receive the working setup, the credentials, the documentation and a walkthrough. Everything built for you is yours at handover.

Carried out remotely by our team. Nothing is posted and no one visits. Typical turnaround: 5–7 business days from receipt of access, with the walkthrough call booked once the report is sent.

Delivery method
Remote Setup
Expected delivery time
5–7 business days from receipt of access, with the walkthrough call booked once the report is sent
Measured from the point everything under “what we need from you” is with us — not from the moment you pay.

Full detail of how work is handed over, what happens if requirements are outstanding and how order records are kept is in the Delivery & Fulfilment Policy.

What we need from you

Nothing starts until these are in place, and the turnaround above is measured from that point — not from the moment you pay.

  • Written confirmation from the site owner that you authorise the review
  • Administrator access to the website and read access to the hosting account
  • A list of what is in scope, including any subdomains you want covered
  • Someone available for the walkthrough call

Who this is for

  • Businesses that inherited a website from a previous developer
  • Companies asked by a client or insurer to show they have reviewed their website
  • Owners of sites that handle logins, enquiries or customer records
  • Anyone whose site has been compromised before and wants to know why
  • Teams deciding whether to fix a site or rebuild it

Business needs this addresses: Improve IT infrastructure

What's not included

Just as plainly as the list above: the things this package is not.

  • Applying any of the findings; the site is unchanged when we finish, and fixes are quoted separately
  • Active testing of the running application, which is the Web Vulnerability Assessment
  • Certification, accreditation or compliance sign-off of any kind; we are not a certification body and cannot issue one
  • Scanning tool subscriptions, firewall services or licence renewals, which you pay to those providers directly
  • Any claim that the report finds every issue; a review of this kind finds what is visible in the time agreed

Anything outside the scope above is quoted separately, in writing, before it is carried out. Nothing is added to your bill without your agreement.

FAQs

Will this make our website secure?

No, and nobody honest will tell you otherwise. The report tells you what we found and how serious each item is, which is a starting point rather than an end state. Security is ongoing work, and a review is a snapshot of one day.

How is this different from the Web Vulnerability Assessment?

This one reads your configuration, versions and accounts without touching the running application. The Web Vulnerability Assessment actively scans the application itself, including logged-in areas, which needs signed authorisation and a maintenance window. Businesses with a custom application usually want both; a small brochure site usually only needs this one.

Does this certify us as compliant with a security standard?

It does not. We are not auditors and we hold no certification authority, so we cannot sign anything off against a standard. The report is informed by common security practice and is useful evidence to hand to whoever does assess you formally.

Can you fix what you find?

Usually yes, but it is deliberately not part of this price. We send the findings first, you decide which ones matter to you, and the work is quoted from that agreed list so the scope cannot drift. Some findings, such as a plugin whose vendor has abandoned it, need a replacement rather than a fix, and we say so plainly.

Refund & cancellation

What happens if you change your mind, and what happens to money already paid.

Cooling-off before work starts
You have 7 days after ordering to cancel while work has not yet begun. Up to 25% may be retained to cover scoping and scheduling already carried out.
Work already done
Once delivery has started, refunds are assessed against the work completed and the deliverables already handed over — the list under “what you get” above is what that assessment is made against. Approved refunds are processed within 14 days.
If we cannot deliver what is described here
You are refunded. The scope on this page is the scope we are held to, which is exactly why the exclusions above are stated before you buy rather than after.

The full terms, item type by item type, are in the Refund & Cancellation Policy. How the work reaches you is covered by the Delivery & Fulfilment Policy.

Not sure this is the right product?

We would rather point you at the right thing than sell you the nearest one. Ask us before you buy — no obligation.

Related products

Others that solve nearby problems, in case this is not quite the right fit.

Or see all 11 in Cybersecurity & Digital Protection.

Contact us