Website security audits and documentation
A written review of how your websites are built, hosted and kept up to date, the fixes, and the documentation your customers' security questionnaires ask for.
Short answer: Remidiy reviews how your websites are built, hosted and kept up to date, writes it up in a report you can act on, and fixes what we find. For the sites we manage, we also keep the security documentation your customers and procurement teams ask for, and help you answer the website sections of their security questionnaires.
It's for organizations that have a questionnaire on the desk, a customer asking how their data is protected, an inherited website nobody can vouch for, or several sites to bring under one standard.
Most website breaches don't start with anything clever. They start with software that stopped getting security fixes, an admin page anyone can find, a forgotten test copy of the site, or a domain and certificate nobody was watching. PHP2Shell, the critical PHP flaw fixed on October 21, 2026, is a recent example: in our check of 10,226 New York business websites, 95% of the sites that revealed their PHP version reported an affected release on the day the fix came out.
What an audit covers
- Configuration. HTTPS and certificates, security headers, cookies, and what the server reveals about itself.
- Software. The CMS, plugins, themes, PHP and server software, and whether each is still supported. See PHP end-of-life dates.
- Exposure. Admin and login pages, leftover files, backups and test copies reachable from the internet.
- Domain and email. Registration and renewal, DNS, and SPF, DKIM and DMARC so nobody can send mail as you.
- Hosting and operations. Who has access and how, backups and when a restore was last tested, monitoring, and how updates are applied.
- A written report. Each finding, its severity, the evidence and the fix, in order of priority, plus a short summary for non-technical readers.
The scope is agreed in writing with the site owner before any testing starts, and nothing outside it is touched.
Security documentation
Larger customers and public bodies often send a security questionnaire before they sign. For sites we build or manage, we keep a current security overview covering hosting, patching, backups, access control, monitoring and incident response, and we help you answer the website parts of those questionnaires accurately. It describes what's actually in place, so your answers stay true.
Who it's for
- Companies selling to larger customers who ask how the website and its data are protected.
- Organizations with several websites or locations that need one standard and one point of contact across them.
- Anyone with an inherited site whose software, hosting or access nobody can account for.
How it works
- Discovery call. The sites, what they do, any questionnaire or deadline, and what access we'll have.
- Audit. Within the agreed scope, then the written report.
- Fix. We fix what we find on sites we build or manage, or work with your team.
- Keep it current. On sites we manage, updates, monitoring and the documentation continue as part of ongoing maintenance, with a service level agreement available.
How pricing works
Audits are a fixed price, quoted after the discovery call and based on the number of sites and what's in scope. Ongoing management is a tiered monthly subscription. There's no hourly billing.
Free tools and guides
Website checker
A free first look from public information: certificate, headers, software versions, email records and domain.
PHP vulnerability checker
The PHP version your server reports and whether it's affected by PHP2Shell.
Common questions
What does a website security audit cover?
How the site is served and configured (HTTPS and certificates, security headers, what the server reveals), the software it runs and whether it's still supported, exposed files and admin pages, DNS and email authentication, the domain itself, hosting, backups and who has access. You get a written report with each finding, its severity and the fix.
Do you test our site without permission?
No. The scope is agreed in writing with the site owner before any testing, and nothing outside it is touched.
What security documentation can you provide?
For sites we build or manage: a security overview covering hosting, patching, backups, access control, monitoring and incident response, kept current, plus help answering the website sections of your customers' vendor security questionnaires.
Do you work with multiple websites?
Yes. We audit and manage multiple sites and locations for the same organization, with one report format and one point of contact, and a service level agreement is available for sites we manage.
How is this different from your free website checker?
The free checker reads what one page load of your homepage shows. An audit covers the whole site and its hosting, includes things only visible with access, and ends in a written report and fixes.
Book a free discovery call. Tell us about your sites and any questionnaire or deadline you're working to. We reply within one business day, usually sooner. Contact Remidiy, email [email protected] or call (914) 222-3310.