# A website security audit with a report the owner can understand.

> Website security audit for WordPress and PrestaShop with a read-only connector, no FTP needed: plugins, integrity and users. PDF report from €129.

URL: https://webintacta.com/en/website-security-audit
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** I do WebIntacta's security audits myself, Jose Soriano, remotely and worldwide. I review your WordPress or PrestaShop site from the inside with a read-only connector, without asking for FTP or passwords: core integrity, malware, plugins or modules with known vulnerabilities, users and configuration. You get a PDF with the grade, a plain-language summary and the action plan, and we go through it together by email or chat. It costs €129 for a business website and €169 for an online store, excluding VAT, and the full price is deducted if you sign up for a cleanup or maintenance within 30 days.


You install a read-only module or plugin, without giving me FTP access or passwords. I review your site from the inside and send you a PDF with the grade, a plain-language summary and a prioritized action plan, with the evidence for every finding so your developer knows how to apply it.

## What the report includes

- A cover page with the grade (A–F) and a summary for the owner
- Action plan: what to do, when and who should do it
- Findings with their evidence: the exact path, file or version
- Core integrity: files that don't match the original
- Inventory of plugins or modules with versions and known vulnerabilities
- Two versions of the PDF: the full one with fixes, and a diagnosis-only one to share

## How I do it

1. **External scan.** Free, to start with what can be seen from the outside.
2. **You install the connector.** From the WordPress or PrestaShop dashboard, in a few minutes. It only reads.
3. **You get the PDF.** And we go through it together by email or chat. You apply it, your developer does, or you hire me at a fixed price.

## What I check on each platform

## WordPress security audit: what I check, point by point

These are the checks the report runs on a WordPress site, from the outside and from the inside with the connector. Every finding comes with its evidence (the path, the file or the version) and a concrete action:

1. **Core integrity:** every file in `wp-admin` and `wp-includes` compared with the original for your version.
2. **Integrity of the plugins** from the official directory, file by file.
3. **Plugins and theme with published vulnerabilities**, with the exact version, disabled ones included.
4. **Outdated or abandoned plugins** compared with the WordPress.org directory.
5. **PHP files where they don't belong:** in `wp-content/uploads` and other upload or cache folders.
6. **`mu-plugins` and files that load on their own**, which don't show up in the normal plugin list.
7. **Obfuscated code and backdoors:** `eval`, `base64_decode`, remote loading and known malware patterns.
8. **Administrator accounts**, to spot accounts nobody recognizes.
9. **Database:** scripts injected into options, posts and widgets, and the `siteurl` and `home` options.
10. **`wp-config.php`:** debugging (`WP_DEBUG`, `WP_DEBUG_DISPLAY`), SALT keys, file editor (`DISALLOW_FILE_EDIT`), `FORCE_SSL_ADMIN` and table prefix.
11. **Redirects in `.htaccess`** based on the visitor's browser or where they came from.
12. **PHP configuration:** `display_errors`, `allow_url_include`, `expose_php` and dangerous functions enabled.
13. **Exposed files:** `.zip` or `.sql` backups, `.git`, `.env` and debug logs that can be downloaded from the internet.
14. **The outside:** HTTPS, security headers, `xmlrpc.php`, domain email (SPF, DKIM, DMARC) and blacklists.

On WooCommerce, also the scripts that load in the cart and at checkout. Background in [WordPress security](https://webintacta.com/en/wordpress-security); if any of this already points to an infection, the next step is [hacked WordPress cleanup](https://webintacta.com/en/wordpress-malware-removal).

## PrestaShop security audit

Version of the core and of every module, enabled or not, against PrestaShop's advisories and the Friends of Presta list of vulnerable modules; overrides and where they come from; integrity of `classes/`, `controllers/` and the checkout; debug mode, the admin folder and employees. The full list of checks is on [PrestaShop security](https://webintacta.com/en/prestashop-security).

## Joomla, Drupal and Magento audits

They have their own read-only connector too: a plugin for Joomla (3.10 to 6), a module for Drupal (9 to 11) and a module for Magento 2.4. I check core integrity against the originals for your version, installed extensions or modules with published vulnerabilities, PHP hidden in image folders and forgotten backups in the public web root. The report costs the same as for WordPress or PrestaShop. What's specific to each platform, in [Joomla security](https://webintacta.com/en/joomla-security), [Drupal security](https://webintacta.com/en/drupal-security) and [Magento security](https://webintacta.com/en/magento-security).

## Shopify and custom-built sites

On **Shopify** there's no server to check: the store creates a read-only custom app and with it I review the theme, the apps' scripts and the pages; it's quoted by the hour (more in [Shopify security](https://webintacta.com/en/guides/shopify-security)). On a **custom PHP site** I use a temporary agent that is uploaded by FTP, expires after 72 hours and deletes itself. If there's no PHP (Node.js, Next.js, Python, Ruby, .NET, Java, Go…), the external scan is completed with the project's dependency files (`package-lock.json`, `composer.lock`, `poetry.lock`…) to check the libraries against published vulnerabilities and see whether the framework is still supported. That covers a security audit for a custom PHP, Laravel or Node.js site too.

## Price

The full price is deducted if you sign up for a cleanup or a maintenance plan within 30 days.

### Security report · business website — €129 (excluding VAT)
An inside analysis with the read-only connector and a PDF with an action plan.

$129 outside the EU.
- Core integrity: every file compared with the original of your version
- Malware, backdoors and PHP where it does not belong
- Inventory of plugins or modules with versions and known flaws
- Administrator accounts, configuration and permissions
- Full PDF with fixes, plus a diagnosis-only version
- Q&A by email or chat to go through it together

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Security report · online store — €169 (excluding VAT)
Everything in the website report, plus a review of checkout and the store's modules.

$169 outside the EU.
- Everything in the business website report
- Skimmers: scripts that copy cards at checkout
- Modified overrides and payment modules
- Database: scripts injected into content and settings

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Security report · 3-site pack — €329 (excluding VAT)
For agencies and developers who look after several client websites.

$329 outside the EU.
- Three full reports (website or store)
- PDF addressed to you or your agency

### Report + hardening — €299 (excluding VAT)
The security report and the fix of what is urgent (up to 3 hours).

$299 outside the EU.
- Full security report
- Fix of the urgent findings, up to 3 hours of work
- A new scan to confirm it

> Tienda online: 389 € (389 US$ en Latinoamérica).

Outside the EU, the website security audit is $129 for a website and $169 for a store.

## Frequently asked questions

### Audit or penetration test?

They're different jobs. A penetration test (pentest) actively attacks the site, by hand, to see how far someone can get: it's a much longer and more expensive engagement, with a scope agreed in writing. This audit reviews versions, files, configuration and code for known vulnerabilities and signs of intrusion. For most small businesses on WordPress or PrestaShop, this is what removes the most risk first.

### Free scan or paid report?

The [free scan](https://webintacta.com/en/free-website-security-scan) sees what anyone can see from the internet: versions, exposed files, headers, blacklists. The paid report looks inside with the connector: the integrity of every file, malware and backdoors, users and configuration, and we go through it together. If the scan comes back clean and you have no suspicions, that may be enough for you.

### Which platforms does it cover?

With a read-only connector: WordPress (and WooCommerce), PrestaShop, Joomla, Drupal and Magento. On Shopify, with a read-only app you create in the store (quoted by the hour). On custom PHP sites, with a temporary agent that expires after 72 hours; if there's no PHP, with the project's dependency files.

### What can't the connector see?

It doesn't read customer data, orders or passwords, and it can't change anything. It's explained in detail on the [connector](https://webintacta.com/en/read-only-connector) page.

### Does it help with GDPR or ISO 27001 compliance?

It helps show that you review your website's security, but it isn't a certification or a compliance audit.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en