A security audit for the site you already have
Every page gets its own security policy, written from what that page actually loads and tested against your live site before it is switched on. Leftovers from old platforms are found and taken offline. Nothing on the site breaks.
What every website needs, whatever its size
Four things keep a site safe. Every site needs the first two, from a one-page portfolio to a hundred-page catalogue. Sites with logins, payments or customer data need the other two as well. The comparison below checks each offer against these same four.
Each page allows only the scripts, fonts and media it uses, so an injected or altered script won't run.
Old pages from past platforms taken offline, and retired addresses sent to current pages.
Usually your hosting company's job. We can add server and SSL hardening to the audit, quoted after a first look. Our own site scores A+ on SSL Labs.
Tested by hand by penetration-testing specialists, and by a PCI assessor if you take cards. We work alongside them and fix what they find on the browser side.
What you have at the end
- A map of what each page loads
Scripts, fonts, images, video and third-party services, page by page. Most sites have never had this written down.
- A security policy for each page
A Content Security Policy that allows what the page needs and nothing else, so an injected or altered script won't run.
- Proof it doesn't break anything
Each policy runs in report-only mode first while the pages are used the way visitors use them. It is switched on only when your own site produces no violations.
- Old platform leftovers cleaned up
Forgotten pages from earlier builders or themes are checked for links, then taken offline. Retired addresses are redirected to current pages, so search results don't lead to dead ends.
- A before-and-after grade
Your pages scored on Mozilla's free public Observatory scan before and after, so you can check the result yourself.
- A plain-language report
What was found, what changed, what's left for later, and a short checklist to run before future updates so the policies stay correct.
How it compares
Typical published offers for a small business site. Figures are from each provider's own published pages, read 14 November 2026. Sources are listed under the table.
| Mid tierA web agency's security audit package 1 | Top tierA specialist penetration test 2 | Kunjan Collective StudioWebsite Security Audit 3 | |
|---|---|---|---|
| Price | $2,800 plus $600 a quarter, optional |
From about €5,000 €15,000–30,000 for a typical business app |
$750 fixed |
| Time | Not published | Two to three weeks of active testing, plus a few days to write the report | Five working days |
| How it's done | Automated scans | Testers try to break in by hand, the way an attacker would | By hand, page by page |
| Servers, databases, SSL | Checked, by automated scan | Checked, by hand | Not in the $750 audit. We can add it: server and SSL hardening, quoted after a first look |
| Logins, payments, customer data | Partly: automated application and PCI scans | Checked, by hand | Not in the $750 audit. We work with your tester: they test the back end, we fix what they find in the browser |
| What runs in visitors' browsers | Not in the published scope | Not in the published scope | Covered: a policy for every page, tested live before it's enforced |
| Leftover pages and old addresses | Not in the published scope | Not in the published scope | Covered: taken offline, old addresses redirected |
| Fixes | Findings are yours to fix. Hacked-site help is a separate $4,300 package | Findings are yours to fix; they retest for free | The fixes are the deliverable |
| What you get | Executive summary and detailed findings | Technical report suitable for compliance audits | Policies in place, cleanup done, before-and-after grade, plain-language report |
| After delivery | Optional quarterly audits, $600 each | Retest after your fixes | Nothing required; a checklist for future updates |
| The right choice when | You want a broad automated check of the whole site and its server, repeated every quarter | Your site has logins or stores customer data, or you need a report for SOC 2 or ISO 27001 | You need what runs in visitors' browsers locked down and old pages cleaned up. On its own for a site without logins; alongside a penetration test for one with them |
These aren't three prices for the same job, so the lowest price isn't the point. Each covers a different part of a site, and they work together. If your site has logins, stores customer data or takes card payments on its own pages, you need a penetration test, and this audit sits alongside it for the browser side.
Where these figures come from
- Mid tier: WebFX's published pricing page, "Website Security Analysis": $2,800 Security Audit with an optional $600 per quarter, and $4,300 for a hacked site. webfx.com
- Top tier: 7ASecurity's "2026 Guide to Penetration Testing Pricing and Scoping": about €5,000 for a very simple application, €15,000–30,000 for a typical business application, two to three weeks of active testing, retest after fixes. 7asecurity.com
- Kunjan Collective Studio: this offer, and the Studio's own security notes, where the same work on our own site is written up step by step with its before-and-after grade. kunjancollective.com
Why these two: WebFX is one of the largest US web agencies and publishes its security audit price; 7ASecurity is a penetration testing firm that publishes its pricing guide. Most firms ask you to call for a quote, so published figures like these are the fairest public comparison. Read 14 November 2026. "Not in the published scope" means the provider's pricing page doesn't list it, not that they never do it. Prices change; check each provider's page.
Why $750
Automated scans are affordable because a tool does the work. Freelance scan listings on marketplaces start at under $200 (Fiverr’s cost guide). They tell you what's wrong and leave the fixing to you.
This audit is the fixing. Writing a policy for each page means reading what each page loads, and testing it means running the policies in report-only mode on the live site while every page is used the way your visitors use it: forms sent, videos played, bookings opened. That testing is why it takes five working days, not five minutes. It's also why nothing breaks when the policies are switched on.
A penetration test goes much deeper and is priced for that. Most small business sites have no login or customer database to attack. What they need is the browser-side protection and the cleanup, done carefully. $750 covers that work at a fixed price, so you know the cost before anything starts.
What it isn't
Done first on our own site
The Studio's own site went through this process before it was offered to anyone. Read the notes.
Questions
How much will it cost after the audit?
Nothing is required. There's no subscription. The policies stay on your site and keep working after we're done.
Costs come up only if your site changes. If you add a new tool later, such as a booking widget, chat or analytics, that page's policy needs updating. Your report includes a checklist showing how, so your web person can do it, or we can, quoted before we start.
If the audit turns up something outside its scope, like an outdated plugin or a page that's already been tampered with, it goes in the report with what it would take to fix. Any further work is quoted first and starts only with your yes.
In short: $750 is the whole price of the audit. Anything after it is optional, quoted in writing first, and only happens if you ask.
Will it slow my site down?
No. A security policy is a short instruction your server sends with each page. It adds no scripts and nothing for visitors to download.
Will it affect my analytics, Google ranking or forms?
No. The tools your site uses, like analytics, maps, video and forms, are written into each page's policy, and report-only testing checks they still work before anything is switched on. Old addresses are redirected, so links from search results and other sites land on a real page instead of an error.
Do you need my password?
No, and please don't send one. Either you create a separate login for us that you switch off when we're done, or your web person applies the changes we send. We set access up together.
Do you see or keep my customers' data?
No. We look at what your pages load, not what your visitors send you. Nothing from your site's data is copied or kept.
What if something stops working after you switch the policies on?
Every change is backed up before it's made, so any policy can be rolled back in minutes. Tell us what you saw and on which page. If a policy we set caused it, fixing it is part of the audit.
What happens when I change my site later?
If a page adds a new tool, its policy needs one line updated. The report's checklist shows how, so your web person can do it. If you'd rather we did, it's quoted before we start.
I'd like to hire you, but I hold a lot of customer data and take payments. It sounds like you're not the best option?
Not on our own, and we'd rather say so now. A site like yours needs a penetration test of its servers, logins and the way customer data is stored. This audit doesn't do that. If you take cards, your payment provider or a PCI assessor decides what you have to show.
Where we still help: card standards now ask merchants to control the scripts that run on their payment pages (PCI DSS 4.0.1, requirements 6.4.3 and 11.6.1). A penetration test reports that kind of problem; a per-page security policy is one of the usual ways to fix it. Many testing firms find issues and leave the fixing to you. The fixing is what we do.
The usual setup: your security firm tests the back end, we lock down the browser side and clean up old pages, and you hand both reports to your assessor.
If your checkout is fully hosted by your payment provider (you're sent to their page to pay), much of the card-page duty sits with them. Tell us how you take payments and we'll say plainly what applies, even if the answer is someone else.
Will my site break while you work on it?
No. Each policy runs in report-only mode first, which records what it would block without blocking anything. It's switched on only when your own site produces no violations. Every change is backed up before it's made.
How will I know it worked?
You get your Mozilla Observatory grade before and after. The Observatory is free and public, so you can run it yourself at any time. The report lists every change made.
Why not just buy a $50 security scan?
A scan tells you what's wrong. This audit fixes it, page by page, and proves the fix doesn't break anything. If a scan is all you need, buy the scan.
Does it work on Wix, Squarespace or a site builder?
Hosted builders such as Wix, Squarespace and Shopify control most security settings themselves, so a per-page policy may not be possible there. We check what your platform allows before you pay, and if the audit can't do its job on your site, we tell you. WordPress and self-hosted sites usually allow it.
Does a bigger site cost more?
No. Every site needs the same protection, so the audit covers your whole site for $750. If a site is too large to do properly in five working days, we say so before you pay anything, not after.
What do you need from me to get started?
Your website address, who hosts or manages it, and a way to make changes. The full list is under "Ask about an audit" below.
Is this a penetration test?
No. No one tries to break into your servers or logins. See "What it isn't" above.
Want your site looked at?
Ask about an audit
Before you get in touch
- Your website address, and any older addresses or sites the business has used.
- Who hosts or manages it: the hosting company or site builder, and your web person's name if you have one.
- A way to make changes. Either a separate login to your hosting or builder that you switch off when we're done, or your web person's time to apply what we send. Never send a password by email; we set access up together.
- The tools on your site: analytics, booking, chat, forms, maps, video, payments, newsletters. A rough list is fine.
- The pages that matter most: contact forms, booking, sign-up or checkout.
- Someone who can answer questions during the five working days.
- Fill in the blanks below and send it.
- We check what your platform allows and reply with a start date. If the audit isn't right for your site, we say so.
- Price and start date are confirmed in writing before any work begins.
- Five working days later, you have the report and your before-and-after grade.
- Marketplace scan prices: Fiverr, cybersecurity expert cost guide.
- Payment-page scripts under PCI DSS 4.0.1 (requirements 6.4.3 and 11.6.1): Report URI, plain-English FAQ. Your payment provider or a PCI assessor has the final word on what applies to you.