Skip to content
Security audit

A website security audit with a report the owner can understand.

In short

I do WebIntacta's security audits myself, Jose Soriano, remotely and worldwide. I review your WordPress or PrestaShop site from the inside with a read-only connector, without asking for FTP or passwords: core integrity, malware, plugins or modules with known vulnerabilities, users and configuration. You get a PDF with the grade, a plain-language summary and the action plan, and we go through it together by email or chat. It costs €129 for a business website and €169 for an online store, excluding VAT, and the full price is deducted if you sign up for a cleanup or maintenance within 30 days.

Reviewed by Jose Soriano ·

You install a read-only module or plugin, without giving me FTP access or passwords. I review your site from the inside and send you a PDF with the grade, a plain-language summary and a prioritized action plan, with the evidence for every finding so your developer knows how to apply it.

Hire meFree scan first
How I work

Step by step.

  1. STEP 01

    External scan

    Free, to start with what can be seen from the outside.

  2. STEP 02

    You install the connector

    From the WordPress or PrestaShop dashboard, in a few minutes. It only reads.

  3. STEP 03

    You get the PDF

    And we go through it together by email or chat. You apply it, your developer does, or you hire me at a fixed price.

What I check on each platform

WordPress security audit: what I check, point by point

These are the checks the report runs on a WordPress site, from the outside and from the inside with the connector. Every finding comes with its evidence (the path, the file or the version) and a concrete action:

  1. Core integrity: every file in wp-admin and wp-includes compared with the original for your version.
  2. Integrity of the plugins from the official directory, file by file.
  3. Plugins and theme with published vulnerabilities, with the exact version, disabled ones included.
  4. Outdated or abandoned plugins compared with the WordPress.org directory.
  5. PHP files where they don't belong: in wp-content/uploads and other upload or cache folders.
  6. mu-plugins and files that load on their own, which don't show up in the normal plugin list.
  7. Obfuscated code and backdoors: eval, base64_decode, remote loading and known malware patterns.
  8. Administrator accounts, to spot accounts nobody recognizes.
  9. Database: scripts injected into options, posts and widgets, and the siteurl and home options.
  10. wp-config.php: debugging (WP_DEBUG, WP_DEBUG_DISPLAY), SALT keys, file editor (DISALLOW_FILE_EDIT), FORCE_SSL_ADMIN and table prefix.
  11. Redirects in .htaccess based on the visitor's browser or where they came from.
  12. PHP configuration: display_errors, allow_url_include, expose_php and dangerous functions enabled.
  13. Exposed files: .zip or .sql backups, .git, .env and debug logs that can be downloaded from the internet.
  14. The outside: HTTPS, security headers, xmlrpc.php, domain email (SPF, DKIM, DMARC) and blacklists.

On WooCommerce, also the scripts that load in the cart and at checkout. Background in WordPress security; if any of this already points to an infection, the next step is hacked WordPress cleanup.

PrestaShop security audit

Version of the core and of every module, enabled or not, against PrestaShop's advisories and the Friends of Presta list of vulnerable modules; overrides and where they come from; integrity of classes/, controllers/ and the checkout; debug mode, the admin folder and employees. The full list of checks is on PrestaShop security.

Joomla, Drupal and Magento audits

They have their own read-only connector too: a plugin for Joomla (3.10 to 6), a module for Drupal (9 to 11) and a module for Magento 2.4. I check core integrity against the originals for your version, installed extensions or modules with published vulnerabilities, PHP hidden in image folders and forgotten backups in the public web root. The report costs the same as for WordPress or PrestaShop. What's specific to each platform, in Joomla security, Drupal security and Magento security.

Shopify and custom-built sites

On Shopify there's no server to check: the store creates a read-only custom app and with it I review the theme, the apps' scripts and the pages; it's quoted by the hour (more in Shopify security). On a custom PHP site I use a temporary agent that is uploaded by FTP, expires after 72 hours and deletes itself. If there's no PHP (Node.js, Next.js, Python, Ruby, .NET, Java, Go…), the external scan is completed with the project's dependency files (package-lock.json, composer.lock, poetry.lock…) to check the libraries against published vulnerabilities and see whether the framework is still supported. That covers a security audit for a custom PHP, Laravel or Node.js site too.

Price

What it costs.

The full price is deducted if you sign up for a cleanup or a maintenance plan within 30 days.

Security report · business website

An inside analysis with the read-only connector and a PDF with an action plan.

€129

excluding VAT$129 outside the EU

  • Core integrity: every file compared with the original of your version
  • Malware, backdoors and PHP where it does not belong
  • Inventory of plugins or modules with versions and known flaws
  • Administrator accounts, configuration and permissions
  • Full PDF with fixes, plus a diagnosis-only version
  • Q&A by email or chat to go through it together
  • Fully credited if you hire a cleanup or maintenance within 30 days.
OrderPay now by card (EUR)

Security report · online store

Everything in the website report, plus a review of checkout and the store's modules.

€169

excluding VAT$169 outside the EU

  • Everything in the business website report
  • Skimmers: scripts that copy cards at checkout
  • Modified overrides and payment modules
  • Database: scripts injected into content and settings
  • Fully credited if you hire a cleanup or maintenance within 30 days.
OrderPay now by card (EUR)

Security report · 3-site pack

For agencies and developers who look after several client websites.

€329

excluding VAT$329 outside the EU

  • Three full reports (website or store)
  • PDF addressed to you or your agency
OrderPay now by card (EUR)

Report + hardening

The security report and the fix of what is urgent (up to 3 hours).

€299

excluding VAT$299 outside the EU

  • Full security report
  • Fix of the urgent findings, up to 3 hours of work
  • A new scan to confirm it
  • Tienda online: 389 € (389 US$ en Latinoamérica).
OrderPay now by card (EUR)

Outside the EU, the website security audit is $129 for a website and $169 for a store. All prices

Questions

What people usually ask me.

Audit or penetration test?

They're different jobs. A penetration test (pentest) actively attacks the site, by hand, to see how far someone can get: it's a much longer and more expensive engagement, with a scope agreed in writing. This audit reviews versions, files, configuration and code for known vulnerabilities and signs of intrusion. For most small businesses on WordPress or PrestaShop, this is what removes the most risk first.

Free scan or paid report?

The free scan sees what anyone can see from the internet: versions, exposed files, headers, blacklists. The paid report looks inside with the connector: the integrity of every file, malware and backdoors, users and configuration, and we go through it together. If the scan comes back clean and you have no suspicions, that may be enough for you.

Which platforms does it cover?

With a read-only connector: WordPress (and WooCommerce), PrestaShop, Joomla, Drupal and Magento. On Shopify, with a read-only app you create in the store (quoted by the hour). On custom PHP sites, with a temporary agent that expires after 72 hours; if there's no PHP, with the project's dependency files.

What can't the connector see?

It doesn't read customer data, orders or passwords, and it can't change anything. It's explained in detail on the connector page.

Does it help with GDPR or ISO 27001 compliance?

It helps show that you review your website's security, but it isn't a certification or a compliance audit.

Contact

Shall we talk?

Tell me which site it is and what you need. I reply with the next steps and, if needed, a fixed quote.

I answer myself, as soon as I can and in order. Anything marked urgent goes first. Support in English is by email and chat.

Support request

Open a request with its own private link

  • Your website address and what you have seen (or what you want to hire)
  • If the site is hacked right now, mark it as urgent and I will read it first
  • I reply with the next steps and, if needed, a fixed quote before touching anything
Write to me

Is your website intact? Check it now.

Free external scan. No sign-up and nothing to install.

Get the PDF result and 30-day alerts (optional)

Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.

  • No FTP access
  • Read-only
  • No customer data

Cookie preferences