Website security audit in 2026: what it checks, free self-checks and what it costs

What does a website security audit check?

A website security audit checks who can get in, what an outsider can make the site do and how fast you could recover. Most auditors map findings to the OWASP Top 10:2025, the eighth edition of the list, where Broken Access Control stays first and Security Misconfiguration has risen from fifth to second.

A useful audit also walks the paths only your business has, such as discount codes, bookings or customer exports, which no scanner understands.

How can you check your website’s security for free?

Free public tools show a site from outside, and your own admin panels show the rest. Test only domains you own.

1. Test HTTPS in SSL LabsQualys SSL Labs’ free SSL Server Test analyses any public HTTPS server. Aim for an A; lower grades usually mean old protocols or a broken certificate chain.
2. Grade headers in HTTP ObservatoryMDN’s HTTP Observatory starts at 100 points and adjusts them for redirects, HSTS, Content-Security-Policy, framing and referrer rules; an A needs 90.
3. Check the blocklistsLook the domain up in Google’s Safe Browsing site status, then in VirusTotal, which consults more than 70 antivirus engines and blocklists.
4. Read Search ConsoleIts Security issues report lists hacked content and malware; Google says a cleaned site usually leaves its unsafe list within 24 hours of review.
5. Audit admin accountsList every admin in the CMS, hosting, registrar and code repository, delete orphaned accounts and switch on two-factor login.
6. Update, then test a restoreUpdate the CMS and plugins, delete unused ones, then restore last night’s backup to a test copy: only a restore proves a backup works.

No tool here can tell whether one customer can open another’s order; that takes a person reading the access rules and code.

Self-check: how well protected is your website?

Scan, audit or pentest: which one do you need?

A scan is software matching your site against known problems, an audit is a specialist reviewing settings and code against your risks, and a pentest is a person trying to break in within an agreed scope. The UK’s National Cyber Security Centre advises against using pentests as the primary way to find vulnerabilities.

Why do small websites get hacked?

Mostly through known holes left unpatched. Verizon’s 2026 Data Breach Investigations Report, published on 19 May 2026, says 31% of breaches began with an exploited vulnerability, the first time in 19 editions that this beat stolen credentials, and 48% involved a third party.

Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024: 4,124 posed a real threat and 1,966 were rated high severity. Plugins held 91% and themes 9%, while WordPress core had six minor issues.

Speed matters too. In 46% of cases no fix existed when the flaw went public, and heavily exploited flaws were attacked within a weighted median of five hours. The forgotten plugin or demo page is the usual door.

How much does a website security audit cost in 2026?

From nothing for the free tools to several thousand euros for a manual pentest. These are published starting points in October 2026.

Quotes rise with the number of roles and logins, with access to the code and when a retest is included. Oreol Security, for example, prices by application size, roles, API methods and business scenarios.

Is it legal to test a website, and what does the law require?

Testing someone else’s site without permission is a crime in most countries: get the owner’s signed consent, scope and dates first.

GDPR article 32 expects regular testing of security measures and timely restore of data, so a dated audit and a tested backup are evidence of care.

When do you need an accredited pentest company instead?

When someone else must rely on the report. A studio audit reduces your risk; it is not a certificate that a regulator, a bank or an enterprise client has to accept.

• A contract or tender demands a pentest by an accredited firm; for UK government systems the NCSC recommends testers from its CHECK scheme.
• Your PCI DSS assessor or ISO 27001 auditor asks for a penetration test report.
• In France, regulated operators and administrations use PASSI auditors qualified by ANSSI, the national cyber agency.
• In Russia, banks test under Bank of Russia regulations 683-P, 719-P and 757-P; LiteraFort lists that from 135,000 roubles.

Otherwise, run the free checks, then an audit with fixes, and book a formal pentest once the obvious holes are closed, so testers are not paid to report missing updates.