Perne
Website security audit: illustration 1
IT outsourcing and security

Website security audit

We work as a team to check your website for vulnerabilities and misconfigurations: CMS and plugin versions, security headers, SSL, access rights, forms, the admin panel and backups reachable from the internet. We use OWASP ZAP and Nmap in a gentle mode so the site is not overloaded, and we verify every finding by hand. You get a report with priorities: what to fix right away, what to fix soon and what can wait. We can apply the fixes ourselves once agreed, or hand the report to your developer.

from 25,000 ₸ (≈ $50) one-off

timeline: 3–7 working days

  • Checking CMS, plugin and library versions for known vulnerabilities
  • Review of SSL, security headers and redirects to HTTPS
  • Checking the admin panel, login forms and file access rights

Order

Message on WhatsApp
TelegramCall

The service name is added to the message for you.

This is a starting price; we give the final amount before work starts. USD is approximate.

What is included

  • Checking CMS, plugin and library versions for known vulnerabilities
  • Review of SSL, security headers and redirects to HTTPS
  • Checking the admin panel, login forms and file access rights
  • Searching for open directories, service files and backups exposed to the internet
  • Scanning with OWASP ZAP and Nmap, with every finding verified by hand
  • A report with priorities and step-by-step advice a developer can act on
  • A call to walk through the report and answer your questions

Who it is for

For online shops, CMS websites and custom projects that take orders, payments or personal data and want to understand the real risks. It does not fit if you need someone else's website checked without the owner knowing: we do not do that kind of work.

Not included

To avoid surprises, here is what the base price does not cover and what is discussed separately:

  • Fixing the found issues in the code, unless agreed separately
  • Checking websites or servers we have no access to or the owner's permission for
  • A guarantee that no attack will happen after the audit: security needs ongoing care

FAQ

After payment the report and recommendations belong to you, and you can pass them to any developer or use them inside your company. We do not share the vulnerabilities we find with third parties or publish them without your consent.

The price includes one round of clarifications on the report: if an item is unclear or you want to adjust priorities, we explain it on a call and update the text. A repeat check after your fixes, if you need one, is paid separately.

Usually 3 to 7 working days from the moment we get access and the starting data. The timing depends on the size of the site and the number of findings, and we will name an exact date after our first look at the project.

The website address, access to the admin area with a read-only role or to a test copy, the list of CMS and plugins if you have it, and a contact person to agree scan windows with. Server access must be shared only over a secure channel, so do not send passwords in chat.

For scanning we use OWASP ZAP and Nmap with rate limits, and we check forms and access by hand. We do not run aggressive scenarios that could overload or crash the site without a separate agreement. It is better to run the check outside your peak sales hours.

We report a critical finding right away, without waiting for the full report, and explain how to close it first. If the site is currently open to data leaks, we advise temporarily closing the affected section. The details will go into the report after verification.

No, no audit gives a full guarantee. We show the real weak spots at the time of the check and help close them. Security rests on regular updates and backups, and that is ongoing work.

You may also need

Cleaning a hacked or infected website

Cleaning a hacked or infected website

We find and remove malicious code, close the weakness the attacker used, and bring the site back to working order.

from 18,000 ₸ (≈ $36) one-off

Timeline: timeline: 1–4 working days

Penetration test (only with the owner's written permission)

Penetration test (only with the owner's written permission)

We test your system's security with attacker-style methods, within agreed boundaries and with the owner's written permission.

from 60,000 ₸ (≈ $120) one-off

Timeline: timeline: 5–14 working days

Website and server protection: WAF, backups, 2FA

Website and server protection: WAF, backups, 2FA

We set up protection for your website and server: request filtering, backups and two-factor login.

from 28,000 ₸ (≈ $55) one-off

Timeline: timeline: 3–7 working days

Shall we discuss your project?

The product name and a link to this page are filled into the WhatsApp message for you.

Message on WhatsApp
TelegramCall

Or send a request

We will reply in the channel you choose: WhatsApp, Telegram, phone or email. Your contact is used only to reply.

Service
How to reply

from 25,000 ₸ (≈ $50) one-off

Message on WhatsAppTelegramCall