What you pay Growthbees
A fixed fee, quoted after we understand the scope. We don't publish a standard rate card.
WordPress · Shopify · Custom-coded sites
Website Security Audit Services
A Growthbees website security audit is a structured check of your website for the weaknesses attackers use most: outdated software, weak logins, insecure settings, unsafe forms, missing backups and gaps in monitoring. We review WordPress, Shopify and custom-coded websites for businesses, schools, clinics and institutions, working from our offices in Guwahati and Tezpur, Assam.
Every finding ranked
Every finding ranked: Critical, High, Medium, Low.
Testing is done only with your written permission and without disrupting your live site. You receive a plain-language report that ranks every finding by risk, explains what it means for your business and lists the fix, and our team can carry out the fixes for you.
Why small and mid-sized websites get attacked
Most website attacks are not personal. Automated tools scan the internet around the clock for websites running software with known weaknesses, such as an old WordPress plugin, a theme that hasn't been updated or a login page that accepts unlimited password guesses. A school website in Tezpur is scanned by the same tools as a bank's.
When one of those weaknesses is found, the damage is usually one of these.
Spam pages and redirects
Hidden pages selling medicines or gambling are added to your site, or visitors from Google are redirected elsewhere. Google may then show a warning or remove pages from search.
Stolen data
Enquiry forms, admission forms, patient appointment requests and customer accounts contain personal data your organisation is responsible for.
Defacement
Your homepage is replaced with someone else's message.
Lost website
Without a working backup, recovery can take days or may not be possible at all.
An audit finds these weaknesses before someone else does. If your site is already showing spam, redirecting visitors or displaying a Google warning, see what to do if you've been hacked and contact us on WhatsApp straight away.
An automated scan vs a security audit
| Automated scan on its own | Growthbees security audit | |
|---|---|---|
| Scope | Whatever the scanner can reach | The websites, subdomains and admin areas we agree, with your written authorisation |
| What's checked | Known vulnerabilities, outdated software and configuration issues | The same, plus what scanners miss: account roles, business logic in forms, backup restores and how your site is actually managed |
| Access | From the outside only | From the outside, and from the inside with read-only or temporary admin and hosting access where you agree |
| Output | A technical list of alerts | Findings ranked by risk, explained in plain language, each with its fix |
| Afterwards | Left to you | A walk-through, fixes by our team or your developer, and a re-check of what was fixed |
How the audit is carried out
Testing is designed to be non-disruptive. We don't run tests that could take your site offline or damage data, and any test with a risk of slowing the site is scheduled with you outside busy hours.
01 · Authorise
- Scope agreedWebsites, subdomains and admin areas
- Written authorisationYou confirm you own or control them
- AccessRead-only or temporary, where you agree
We never test a website without it
02 · Test
- Automated scansKnown vulnerabilities, outdated software, settings
- Manual reviewAccount roles, form logic, backup restores
Non-disruptive
03 · Report
- Findings ranked by riskCritical, high, medium or low
- Plain-language explanation
- The fix for each finding
Walk-through on a call or at our office
04 · Fix and re-check
- Fixes appliedBy our team or your developer
- Re-checkOf the findings that were fixed
Evidence kept for your developer
New vulnerabilities are discovered every week, so the report ends with a maintenance routine for staying secure.
Who this is for
Businesses
Whose website brings in enquiries and orders.
Schools, colleges and coaching centres
With admission forms, student portals and results pages.
Hospitals, clinics and diagnostic centres
With appointment forms and patient enquiries. Health information is especially sensitive, so these websites need regular checks.
Online stores
Handling customer accounts and orders.
Anyone whose previous developer is no longer available
And who isn't sure what their website is running.
What we check
Seven areas, checked from the outside and, where you give access, from the inside.
Who can log in, with what, and to where. We review admin accounts and their roles, remove old accounts left by past developers or staff, check password rules, look for two-factor authentication on admin logins, test whether login pages limit repeated attempts, and check file and hosting permissions so that each account can reach only what it needs.
Every form, search box and upload field is a way into your website. We check that forms reject harmful input, that file uploads accept only the file types you intend, that spam protection is in place, and that enquiry and admission forms don't expose submitted data to other visitors.
We check HTTPS and certificate settings, security headers, directory listing, exposed configuration or backup files, error messages that reveal technical details, file editing from the admin panel, and hosting and server settings. Many serious problems are simply settings left on their defaults.
We list the software your website runs, including the content management system, plugins, themes, libraries and server software, and compare it against publicly known vulnerabilities. You get a list of what needs updating or replacing, in order of risk, and a routine for keeping it up to date. Abandoned plugins that no longer receive updates are flagged for replacement.
We check whether backups exist, how often they run, where they are stored, whether they include both files and database, and, most importantly, whether they can actually be restored. A backup stored on the same server as the website may be lost along with it.
If something goes wrong, can you tell what happened and when? We check whether logins, admin changes and file changes are recorded, whether uptime is monitored, and whether anyone would be alerted if the site were changed or went down.
We check whether Google Search Console shows security issues or manual actions, whether spam pages have been indexed under your domain, and whether your domain appears on common blocklists. For email sent from your domain, we check that basic email authentication records are set up, so others can't easily send email pretending to be you.
What the report contains
Written for the owner and the developer at the same time.
Summary for owners and managers
One page on the overall state of the website and the most urgent actions.
Findings ranked by risk
Each marked critical, high, medium or low, with what it means for your business in plain language.
The fix for each finding
Step by step, so your team or your developer can act on it, with screenshots or technical details as evidence.
Maintenance routine
What to check weekly, monthly and quarterly to stay secure.
If your website has already been hacked
Contact us straight away on WhatsApp. Cleaning without closing the way in usually means the site is hacked again within weeks, so recovery follows these steps.
Preserve
Take a copy of the current site and logs for investigation.
Clean
Remove the malicious code and accounts, and restore clean files where needed.
Close the way in
Find how the attacker got in, and close it.
Secure
Change every password and key, and update or replace vulnerable software.
Request review
Ask Google to review the site through Search Console once it is clean.
If personal data may have been exposed, your organisation may have legal reporting duties. Under directions issued by CERT-In in 2022, many organisations in India must report certain types of cyber security incidents to CERT-In within six hours of noticing them, and the Digital Personal Data Protection Act, 2023 sets duties around personal data breaches. We can help you document what happened, but you should take legal advice on reporting.
What an audit is, and what it isn't
A website security audit significantly reduces your risk, but no audit can promise that a website will never be attacked. New vulnerabilities are discovered every week, which is why the report includes a maintenance routine and why many clients choose ongoing maintenance after the audit.
Some organisations, such as government bodies and regulated financial institutions, are required to use auditors empanelled by CERT-In for formal security audits.
Growthbees is not a CERT-In empanelled auditor, so if you need a formal audit certificate for compliance, we will tell you and can help you prepare for that audit.
Security is mostly routine: updates applied promptly, backups tested, old accounts removed and warnings acted on. If we built your website, security is part of our build process; see our website development page. We also review the server and admin side of the apps we build as part of app development.
How the audit is priced
What sets the fee
Number of websites and subdomains
The platform
Forms and user roles on the site
Whether you want us to apply the fixes
Ongoing maintenance
A separate monthly fee, if you want it, covering updates, backups, uptime monitoring and periodic re-checks.
Where we work
Audits are carried out remotely for websites anywhere in India. The walk-through can be held at our office in Chenikuthi, Guwahati or Gharpara Chuburi, Tezpur, or on a video call.
Find the weak spots before someone else does
Tell us your website address and the platform it runs on. Testing starts only after you authorise it in writing.
Frequently asked questions
What is a website security audit?
A website security audit is a structured check of your website for security weaknesses, such as outdated software, weak logins, insecure settings, unsafe forms and missing backups. You receive a report that ranks each finding by risk and explains how to fix it.
Will the audit take my website offline?
No. We use non-disruptive testing and don't run tests that could crash your site or damage data. Any check that could slow the site is scheduled with you outside busy hours.
Do you need access to my website and hosting?
Not always, but it helps. An outside-only check finds what an attacker can see. With temporary admin and hosting access we can also check accounts, settings and backups from the inside, which finds more. Access is removed when the audit ends.
How often should a website be audited?
We recommend a full audit at least once a year, and after any major change, such as a redesign, a new developer or new plugins. Updates and backups should be checked every month.
My website has been hacked. Can you fix it?
Yes. We remove the malicious code, find and close the way in, change passwords, update vulnerable software and ask Google to review the site once it is clean. Message us on WhatsApp as soon as you notice the problem.
Do you audit Shopify and custom-built websites as well as WordPress?
Yes. On Shopify, the platform itself is managed by Shopify, so we focus on your store's apps, staff accounts, theme code and settings. For WordPress and custom websites we also review the server, plugins and code.
Can you give us a CERT-In audit certificate?
No. Formal audits for organisations that need CERT-In compliance must be done by a CERT-In empanelled auditor. We can check your website and fix issues beforehand so you are better prepared for that audit.
Book a website security audit
Send us your website address and tell us what platform it runs on, if you know. If you think your site has been hacked, say so and we'll prioritise it.
- ScopeWe agree which websites, subdomains and admin areas are included.
- Written authorisationYou confirm in writing that you own or control them and authorise the testing. We never test a website without this.
- You get a fixed feeA fixed fee once the scope is clear. Applying the fixes and ongoing maintenance are priced separately.