Manual check by an engineer

Is your web application secure?

An outdated PHP version, an unpatched plugin or a weak server setting is how most websites get hacked. We check your site and server, tell you exactly where you stand, and quote the fix.

Audit from 29 € + VAT, one-time payment

Want the whole server and code checked? Full security audit for 199 € + VAT

Order the audit
We contact you within 2 working hours of payment
2 h
to first contact in working hours
100%
manual review, not just a scanner
OWASP
Top 10 risks in the full audit
0
obligation to have us fix it

What is a web application security audit?

It is a check of your website and the server it runs on, carried out by an engineer. We look at whether the software you run has known vulnerabilities, whether the server and site are configured safely, and whether there are signs that someone has already broken in.

An automated scanner finds only part of the problems and often raises false alarms. We verify the findings by hand in your environment and send a report in plain language: what we found, how risky it is and what to do next. Suitable for WordPress, WooCommerce, Joomla, Drupal, Magento, PrestaShop, Laravel and custom-built PHP sites.

When should you order an audit?

A security audit is not only for after a breach. Customers usually order one when:

The site has not been updated in a while: old PHP, CMS core, plugins or themes
A new critical flaw is announced, such as PHP2Shell (CVE-2026-109618, CVE-2026-109619), and you want to know whether it affects you
Something looks off: unknown files or admin users, spam being sent, strange redirects, slowdowns
The site handles customer data or payments: an online store, a customer portal, sign-ups
You are about to launch a new project or are taking over a site from another developer
A partner, insurer or GDPR obligations ask for a security check

What the basic audit covers

An engineer checks your website by hand, not just with an automated scanner, and sends you a written report in plain language.

PHP, web server and database versions checked against known vulnerabilities (CVEs)
CMS core, plugin and theme versions and their known flaws
Key settings: HTTPS and TLS, security headers, publicly reachable files (.env, .git, backups), directory listings
Protection of admin logins and services exposed to the internet
Error logs and signs of compromise: unknown files, new admin users, suspicious processes
A written report with clear next steps and a quote for the fix

How it works

1

Order and pay

Enter your website's domain and pay for the audit you chose (29 € or 199 € + VAT) by card, bank link, PayPal or crypto.

2

We contact you within 2 hours

An engineer gets in touch within 2 working hours (Mon–Fri 9:00–18:00) to agree on access.

3

Report and fix quote

You get the findings in plain language and an estimated price for the fix. You decide whether we do it.

Choose your audit

Works for any website, wherever it is hosted. You do not need to be our hosting customer.

One-time payment, no subscription. VAT is added at checkout.

Fixing the problems

Every site and server is different, so the fix is priced individually. After the audit you get an approximate price and we start only when you agree.

  • Updating PHP, the CMS, plugins and system packages to safe versions
  • Hardening server, PHP and website settings
  • Checking that the site works as before after the updates
  • Cleaning up and securing the site if signs of compromise are found

Hosted somewhere you cannot change the settings yourself? We tell you exactly what to ask your provider, or help you move.

Frequently asked questions

What does a web application security audit check?
The basic audit checks your software versions (PHP, web server, CMS, plugins) for known vulnerabilities, key security settings, publicly reachable files and signs of compromise. The full audit also covers the whole server and your website's code.
What is the difference between the basic and the full audit?
The basic audit (29 € + VAT) answers whether your site has known, easy-to-exploit flaws and whether anyone has already used them. The full security audit (199 € + VAT) includes all of that and then checks the rest of the server: outdated packages and kernel, server and firewall configuration, and your website's code, plugins and themes for common security mistakes. You get one prioritised report covering everything we found.
Do you check for the latest vulnerabilities, such as PHP2Shell?
Yes. The audit always includes the latest critical vulnerabilities, for example PHP2Shell (CVE-2026-109618 and CVE-2026-109619): flaws in the PHP engine disclosed in October 2026 that let an attacker run code on the server without logging in. We check whether your PHP is patched and look for signs of exploitation.
Do I need to host my website with you?
No. We audit any website, wherever it is hosted. If your provider has to make the change, we tell you exactly what to ask for.
What access do you need?
We agree on this when we contact you. Usually it is access to your hosting control panel (cPanel, DirectAdmin, Plesk…) or SSH. Some checks are possible with less, and we explain what each level of access allows.
Can the audit disrupt my website?
No. We review versions, settings, files and logs rather than trying to break the site with load or aggressive scans. If any check needs your consent, we tell you in advance.
How fast will you contact me?
Within 2 working hours after your payment is received. Our working hours are Monday to Friday, 9:00–18:00 Vilnius time. Orders placed outside them are picked up first thing on the next working day.
How much does the fix cost?
It depends on what the audit finds: often it is a few updates and settings, sometimes a larger upgrade or a clean-up. After the audit you get an approximate price and you decide whether to go ahead. The audit fee (29 € or 199 € + VAT) is a one-time payment.
What if my site has already been hacked?
The audit looks for signs of compromise: unknown files, backdoors, new admin users, suspicious cron jobs and processes. If we find any, we tell you and include the clean-up in the fix quote.