Learning Centre

What Does A Website Security Audit Check?

Learn what a website security audit checks, from access controls, software and hosting to DNS, forms and malware risks, so you can prioritise fixes before issues grow.

On this page

    Definition

    Website Security Audit

    A website security audit is a structured review of the technical settings, access controls, software, hosting environment, DNS, forms, files and operational processes that may affect a website’s security. It looks for weaknesses that could increase the risk of malware, unauthorised access, data exposure, downtime or loss of trust.

    A security audit does not guarantee that a website can never be compromised. It helps identify and prioritise risks so they can be reduced in a practical, documented way.

    Key Takeaways

    • A website security audit checks more than visible pages. It can include hosting, CMS access, SSL/TLS, DNS, forms, backups, logs, permissions and third-party integrations.
    • The goal is to identify practical risks, prioritise fixes and reduce the chance of avoidable downtime, malware, data exposure or trust issues.
    • Security is ongoing. An audit is most useful when it leads to clear remediation, monitoring and a maintenance plan rather than a one-off report that is never actioned.

    Quick Explanation

    What a Website Security Audit Checks First

    A website security audit usually starts by identifying what is being protected. That includes the public website, content management system, hosting environment, domain and DNS settings, forms, user accounts, integrations, backups and any third-party services connected to the site. From there, the audit checks whether common risk areas are properly managed. These may include HTTPS configuration, outdated software, weak passwords, excessive administrator access, exposed files, malware indicators, insecure form handling, missing security headers, backup gaps and poor server configuration. For a business, the practical question is not only whether the website has a technical weakness. The more important question is what that weakness could affect. A vulnerable site can lead to lost enquiries, search visibility issues, spam, brand damage, downtime, customer distrust and recovery costs. A good audit helps separate urgent risks from lower-priority improvements so the next steps are clear.
    A security audit looks at the technical foundations behind a website, not only what visitors can see.
    A security audit looks at the technical foundations behind a website, not only what visitors can see.

    Audit Process

    How a Website Security Audit Is Usually Structured

    The exact scope depends on the website, platform, hosting setup and business risk. Most useful audits follow a logical process so findings can be verified and prioritised.

    1. Confirm the scope and access

      The audit should define which domains, staging sites, CMS areas, hosting accounts, DNS zones, forms, integrations and user accounts are included. Clear scope avoids missed systems and prevents assumptions about who controls each component.

    2. Review technical and operational risks

      The auditor checks configuration, permissions, software status, SSL/TLS, hosting settings, backups, malware indicators, exposed files, form security, logging and relevant third-party connections. Findings should be based on evidence, not guesswork.

    3. Prioritise remediation

      The audit should group issues by severity and business impact. Critical items may need immediate action, while lower-risk improvements can be scheduled as part of ongoing website maintenance.

    Website Security Audit Checklist

    A practical security audit should check the areas that can affect website availability, data handling, access control and recovery. The list below is not exhaustive, but it covers the main areas most business websites should review.

    • HTTPS, SSL/TLS and browser trust

      The audit checks whether the SSL certificate is valid, HTTPS is enforced, insecure mixed content is avoided and visitors are not exposed to browser warnings. SSL/TLS supports trust and encrypted browser connections, but it does not make the entire website secure by itself.

    • CMS, software and access controls

      The audit reviews administrator accounts, password practices, unnecessary user permissions, outdated components, insecure plugins or extensions where relevant, and whether login areas are exposed without suitable controls.

    • Backups, recovery and monitoring

      The audit checks whether backups exist, whether restoration is possible, whether uptime or security monitoring is in place and whether there is a realistic path to recover from an incident.

    Technical Checks

    SSL, Security Headers and Browser-Side Protection

    One of the first visible checks is whether the website loads securely over HTTPS. The audit should confirm that the SSL certificate is current, the website redirects from HTTP to HTTPS correctly and pages do not load insecure images, scripts or fonts. Security headers may also be reviewed. These are instructions sent by the server to the browser. Depending on the website, they can help reduce risks such as clickjacking, content sniffing or unsafe script loading. Headers are not a complete defence, but they can form part of a sensible layered security approach. A website security audit may also check whether browser warnings, expired certificates or incorrect redirects could damage trust. If a potential customer sees a security warning before reaching your enquiry form, they may leave before they ever read your content.
    HTTPS, redirects and browser security settings are small details that can have a large trust impact.
    HTTPS, redirects and browser security settings are small details that can have a large trust impact.

    Access and CMS

    User Accounts, Permissions and CMS Security

    A secure website depends heavily on who can access it and what they can change. An audit should check administrator accounts, unused users, weak or shared passwords, permission levels and whether former staff, contractors or previous providers still have access. For CMS-driven websites, the audit should also review whether content editors have only the access they need. Excessive permissions increase risk because a compromised low-level account can become a larger problem if it has administrator rights. At Dobble, clients who request access to our Genesis CMS can be provided with limited user accounts containing the permissions required to manage website content. Permissions are assigned carefully to help protect website integrity, security and functionality. This is not about making content management difficult. It is about giving the right access to the right people.
    Access control is one of the most practical parts of website security because many incidents begin with compromised credentials.
    Access control is one of the most practical parts of website security because many incidents begin with compromised credentials.

    Security audits should lead to action

    A report that lists risks without priorities is hard to use. A useful audit should explain what was checked, what was found, why it matters, which items are urgent and what should happen next.

    Hosting and Infrastructure

    Hosting, Server Configuration and File Permissions

    Website security is not limited to the CMS. The hosting environment matters because it controls how files are stored, how requests are handled and how the website responds under load or attack. A security audit may check server configuration, exposed directories, file permissions, database access, backup locations, error messages, logging and whether sensitive files can be reached publicly. It may also consider whether the hosting setup is suitable for the website’s traffic, functionality and business role. Managed hosting can reduce operational risk because monitoring, backups, SSL configuration and server-level maintenance are handled within a structured environment. However, no hosting provider can guarantee uninterrupted service or protection against every cyber threat. Dobble aims to maintain 99.9% monthly uptime for websites and hosting services managed on our infrastructure, subject to relevant exclusions such as scheduled maintenance, emergency maintenance, third-party outages, client-side issues and systems outside our direct control.
    Server configuration, backups and file permissions can affect both security and recovery.
    Server configuration, backups and file permissions can affect both security and recovery.

    Automated Scan vs Manual Security Review

    Automated tools can be useful, but they are not the same as a considered audit. Most business websites benefit from both automated checks and human review, especially when hosting, DNS, forms, CMS access and business processes are connected.

    Audit Area Automated Scan Manual Review
    Known vulnerabilities Can quickly flag common signatures, exposed software versions and some configuration issues. Can verify whether a flagged issue applies to the actual website and whether it creates a practical business risk.
    Access and ownership Usually cannot determine whether user permissions, provider access or ownership arrangements are appropriate. Can review who has access, whether old accounts remain active and whether control is clearly documented.
    Prioritisation May produce a long list of findings without explaining which items matter most. Can group issues by severity, business impact and realistic remediation effort.

    Common Security Issues an Audit May Find

    Security problems often appear as business symptoms before anyone sees the technical cause. These examples show how an audit connects symptoms to likely risks and next steps.

    The website redirects visitors to strange pages or shows spam content.

    Likely cause

    This may indicate malware, unauthorised file changes, compromised CMS access or injected scripts.

    Solution

    The website should be scanned, suspicious files reviewed, access credentials changed, known entry points closed and clean backups assessed before restoration.

    Forms stop sending, or users receive suspicious emails from the website.

    Likely cause

    The form handler, SMTP configuration, DNS records or website files may be misconfigured or compromised.

    Solution

    The audit should check form security, mail settings, server logs, DNS authentication where relevant and whether spam scripts are present.

    The website shows browser warnings or loads some assets insecurely.

    Likely cause

    The SSL certificate may be expired, HTTPS redirects may be incomplete or some resources may still load over HTTP.

    Solution

    The audit should confirm certificate validity, force HTTPS where appropriate and update insecure asset references.

    Common Website Security Audit Mistakes

    Many security problems are not caused by one dramatic failure. They often build up through small oversights, unclear responsibility and delayed maintenance.

    Only checking the homepage

    Do this instead

    Security reviews should include login areas, forms, hidden files, staging environments, redirects, DNS, hosting and connected services. A clean homepage does not prove the whole website is safe.

    Leaving old user accounts active

    Do this instead

    Remove or reduce access for former staff, contractors and providers. Every unnecessary account increases the number of ways a website can be accessed.

    Having backups but never checking recovery

    Do this instead

    Backups are only useful if they can be restored. A security audit should consider whether backup access, retention and restoration processes are practical for the business.

    Search and Trust

    How Security Issues Can Affect SEO and Conversions

    Security and SEO are connected because search engines need to access reliable, trustworthy pages. If a site is hacked, blocked, unstable or serving spam content, search visibility can suffer. Malware warnings, unexpected redirects, broken pages and downtime can also reduce user trust and stop enquiries before they happen. A security audit may check for issues that affect crawlability and indexing, such as hacked pages, suspicious redirects, broken HTTPS, incorrect canonical tags caused by compromise, or robots.txt changes that block important pages. These checks sit alongside broader technical SEO work, not in place of it. Security also affects conversion. A potential customer may not understand the technical reason for a warning, slow load or broken form. They simply see risk. For service-based businesses, that can mean fewer calls, fewer quote requests and less confidence in the brand.
    Security supports trust, search accessibility and the reliability of enquiry pathways.
    Security supports trust, search accessibility and the reliability of enquiry pathways.

    Useful Website Security Terms

    A security audit can include technical language. These terms are useful when reading findings or discussing next steps.

    SSL/TLS
    Security protocols that encrypt information between a visitor’s browser and the website. They support HTTPS and help prevent data being read in transit.
    Malware
    Malicious software or code placed on a website or server. It may redirect visitors, send spam, steal data, inject links or damage website files.
    Access Control
    The way user accounts, roles and permissions are managed. Good access control gives people the access they need without granting unnecessary administrator rights.

    Dobble Approach

    How We Approach Website Security Audits

    We treat website security as part of the technical foundation, not a cosmetic add-on after launch. A security audit may be useful before a rebuild, after a suspected compromise, during a hosting migration, before major SEO work or when a business is unsure who controls its website, domain, DNS or hosting. Our approach is practical. We look at risk areas that affect real business operations, including website availability, CMS access, hosting, DNS, SSL/TLS, backups, forms and ongoing maintenance requirements. Where relevant, we may connect findings to related work such as managed hosting, website maintenance, domain management, technical SEO or website development. We primarily build websites using our proprietary Genesis CMS, which is designed to reduce reliance on third-party themes and large plugin stacks. We also use Laravel for larger bespoke systems, business applications and complex integrations. For any security review, the right recommendations depend on the website’s platform, configuration, scope and business priorities. No audit can remove every security risk. What it can do is provide clarity, reduce avoidable exposure and create a prioritised plan for remediation and maintenance.
    A practical audit should connect technical findings to business risk and clear next steps.
    A practical audit should connect technical findings to business risk and clear next steps.

    Website Security Audit FAQs

    These short answers clarify common questions about website security audits and what they can realistically achieve.

    Is a website security audit the same as malware removal?

    No. An audit identifies risks, configuration issues and signs of compromise. Malware removal is the remediation work needed if malicious code or infected files are found.

    Does an SSL certificate mean my website is secure?

    No. SSL/TLS encrypts traffic between the browser and website, which is important, but it does not protect against every issue. Access control, software maintenance, hosting, backups and form security still matter.

    When should a business request a website security audit?

    It is worth considering after a suspected hack, before a website migration, before major SEO work, after changing providers, when access is unclear or when the website has not been reviewed for a long time.

    Need a Practical Website Security Review?

    If you are concerned about website security, malware, access control, hosting risk or ongoing maintenance, we can help review the setup and explain the next steps in plain English.

    Request a Consultation Get a Quote

    Keep learning

    Tap to call
    Enquire now

    Ask Dobble

    Ask a question

    Send us your question and the Dobble team will get back to you.

    Prefer to talk to us directly?

    Get in touch

    Contact us

    Tell us about your project and the Dobble team will be in touch shortly.

    Prefer to talk to us directly?