How to Run a Website Security Audit (Step-by-Step, 2026)
A security audit answers one question: if an attacker looked at your site today, what would they find? You don't need a pentest budget to cover the basics — most real-world compromises start with an outdated version, a missing header or an exposed file.
This step-by-step audit walks the same surface an attacker sees, in priority order. Run a free MageArgus scan to automate most of these checks in under a minute.
- Most breaches start with a known, already-patched vulnerability — Verizon DBIR
- Exposed config files and outdated versions are the fastest wins for attackers — OWASP
1. Versions and patches
Identify your platform (Magento, WordPress, WooCommerce) and its exact version, then compare against the latest security release. An outdated or end-of-life version is the single biggest risk — everything else is secondary until this is current.
2. Security headers and TLS
Check for HSTS, a real Content-Security-Policy, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. Confirm HTTPS is enforced with no mixed content. Missing headers are cheap to add and close whole classes of attack.
3. Exposed files, forms and scripts
- Look for readable
.env,.git, backups and directory listings - Confirm public forms have bot protection (CAPTCHA/rate-limit)
- Inventory every third-party script and lock the checkout with a CSP allow-list
4. Malware and integrity
A remote scan sees the storefront; it can't see cloaked injections, webshells or database-level malware. Finish the audit with an on-disk file-integrity and malware scan on the server, then fix findings worst-first: critical/EOL issues before informational ones.
Frequently asked questions
How often should I audit my website?
Run an automated scan continuously (daily or weekly) and do a deeper manual pass quarterly, or after any major change, plugin install or incident.
Can I audit my site without technical skills?
The external checks — versions, headers, exposed files — are automatable. Fixing findings and on-disk scanning may need a developer, but knowing what’s wrong is step one.
What should I fix first?
Anything critical or end-of-life, then anything exposing credentials or card data, then headers and hardening. Don’t get lost in low-severity noise while a critical hole stays open.