How Much Does a Website Security Audit Cost? (2026 Small Business Guide)
“How much does a website security audit cost?” is usually the first question a business owner asks — and the answers online range from “free” to “tens of thousands of dollars”. Both can be true, because the word audit covers very different kinds of work.
This guide breaks down what you actually get at each price level, what drives the cost up or down, how to avoid paying for the wrong thing, and what our own fixed prices are, so you can budget with confidence.
Quick answer: typical price ranges
Prices vary by provider and country, but for a single small business website the market roughly looks like this:
- Automated vulnerability scan: free to a few hundred dollars per year. A tool crawls your site and lists known issues. Useful, but noisy and with no human judgement.
- External security review (manual + tooling): roughly $700 to $4,000. A specialist examines everything your site exposes to the public internet and gives you a prioritised report.
- Web application penetration test: commonly $5,000 to $30,000 or more. Testers actively try to break into the application, usually with logins, over one to several weeks.
- Compliance-driven audits (PCI DSS, SOC 2, ISO 27001): priced as projects, often well into five figures, because they cover policies and processes, not just the website.
For most small businesses with a brochure site, lead forms or a modest online shop, the middle category, an external security review, is the sweet spot between a free scan and a full penetration test.
What is included at each level
Automated scans
Scanners check for outdated software versions, missing security headers, known vulnerable plugins and basic misconfigurations. They are fast and cheap, but they produce false positives, miss anything that needs context (for example an admin panel that should not be public), and leave you to interpret a long technical list on your own.
External security review
A human reviewer looks at your site the way an attacker would, without internal access. A good review covers:
- TLS/SSL configuration and certificate setup
- HTTP security headers and cookie settings
- Public forms, login pages and file uploads
- Exposed admin panels, backup files, directory listings and forgotten subdomains
- Email authentication — SPF, DKIM and DMARC
- Information the site leaks about its software and infrastructure
The deliverable is what you are really paying for: findings ranked by severity, explained in plain language, with a clear “fix this first” list your developer can act on.
Penetration test
A penetration test goes further: testers log in as different user roles, try to escalate privileges, manipulate business logic, and chain weaknesses together. It is the right choice for custom web applications, customer portals and SaaS products, and it is often required by larger clients or regulators. It is usually overkill for a five-page marketing site. We compare the options in detail in penetration test vs. security review.
What drives the cost of a security audit
- Scope: one website or several; a single domain or many subdomains; public pages only or authenticated areas too.
- Depth: automated checks versus manual analysis, and how much the tester is allowed to actively exploit.
- Application complexity: a static site is quick to review; a shop with accounts, payments and integrations takes far longer.
- Reporting: a one-page summary versus an executive report and technical appendix.
- Retesting: whether the provider verifies your fixes afterwards, and whether that costs extra.
- Compliance requirements: mapping findings to a standard adds work and cost.
“The cheapest audit is the one that finds the issue before an attacker does. The most expensive is the one you skipped.”
NyorsoftExternal Security Review
Hidden costs to watch out for
- Hourly billing with no cap. Ask for a fixed price or at least a not-to-exceed figure.
- Raw scanner output sold as an audit. If the sample report is 80 pages of tool output, you will pay again for someone to interpret it.
- Paid retests. Confirm whether verifying fixes is included.
- Remediation not included. Most auditors find and explain issues; your developer or host fixes them. Budget a few hours of developer time for that.
Which level fits your business?
The right level depends less on the size of your company and more on what your website does:
| Your website | Sensible starting point | Nyorsoft price |
|---|---|---|
| Brochure site with a contact form | Public Website Security Check | $790 |
| Lead forms, file uploads, a client login or a small online shop | External Website Security Review | $1,900 |
| Several subdomains, customer data, or worried about leaks | Website & Data Exposure Assessment | $3,900 |
| Tax, mortgage or lending firm covered by the FTC Safeguards Rule | Twice-yearly external assessments (see our guide) | $2,900 per year |
| Custom web application, SaaS product or customer portal | Penetration test with authenticated access | Not part of our external-only services; hire a penetration testing firm |
What you can do for free first
Before paying anyone, cover the basics yourself. It makes any paid audit cheaper to act on, because the obvious issues are already gone:
- Work through our 15-point website security checklist.
- Test your HTTPS setup with the free Qualys SSL Server Test.
- Check your security headers with Mozilla’s free HTTP Observatory.
- Add your site to Google Search Console and watch its Security issues report.
Free tools tell you what they detected. What you pay a reviewer for is judgement: which findings matter for your business, what is a false alarm, and what to fix first.
What a good report looks like
Always ask for a sample before you buy. Ours are public, prepared for fictional clients so you can see the exact format, length and level of detail:
- Public Website Security Check sample (8 pages)
- External Website Security Review sample (12 pages)
- Website & Data Exposure Assessment sample (21 pages)
Whoever you hire, the report should rank findings by severity, explain each one in plain language, say exactly where it is fixed and by whom, and end with a short list of what to do first.
Is a security audit worth it for a small business?
Compare the price with what a single incident costs: a defaced website, a hijacked contact form sending spam from your domain, stolen customer data, or a fake invoice sent in your name. Beyond direct losses there is downtime, cleanup, notification duties in many jurisdictions, and lost trust. A few hundred to a few thousand dollars once a year is modest insurance against that.
An audit is also increasingly a sales requirement: larger clients send security questionnaires to their suppliers, and “we had an independent external review this year” is a much stronger answer than “we think we are fine”.
How often should you audit your website?
As a rule of thumb, once a year, and additionally after any major change: a redesign, a move to a new host, a new shop or customer portal, or a security incident. Between audits, an inexpensive automated scan helps catch regressions.
Nyorsoft pricing
We publish fixed prices so you know the cost before you start:
- Public Website Security Check — $790: one website, security headers, TLS, public forms and entry points, obvious external weaknesses, and a concise prioritised PDF report. Delivered in 5–7 business days.
- External Website Security Review — $1,900: a deeper manual review including logins, uploads and visible endpoints, an attack-surface snapshot, and an executive and technical report.
- Website & Data Exposure Assessment — $3,900: adds subdomains, data-leakage indicators, domain and email security, a 30/60/90-day remediation roadmap and light retesting.
- Custom Scope Review: multiple domains, public APIs or specific reporting needs, quoted to scope.
- FTC Safeguards Rule External Assessment — $2,900 per year: two external vulnerability assessments a year, six months apart, for tax preparers, mortgage brokers and other firms covered by the FTC Safeguards Rule. Also available at $1,550 every six months.
See the full comparison on our pricing page, or send us your website URL and we will recommend the right level.
Questions to ask before you buy
- Is the price fixed, and what exactly is in scope?
- Can I see a sample report?
- How much of the work is manual versus automated?
- Will findings be ranked by severity with clear remediation steps?
- Are follow-up questions and a retest included?
- Do you need any access to my systems, and could testing affect my live site?
Frequently asked questions
How much does a website security audit cost?
For a single small business website, an external security review typically costs roughly $700 to $4,000. Automated scans can be free or a few hundred dollars per year, while full penetration tests commonly start around $5,000 and can exceed $30,000 for complex applications.
What is the difference between a security audit and a penetration test?
A security audit or external review examines what your website exposes and how it is configured, then ranks the weaknesses. A penetration test goes further and actively attempts to exploit vulnerabilities, often with user accounts, to prove what an attacker could achieve.
Is a free website security scan enough?
A free scan is a useful starting point, but it cannot judge context, it produces false positives, and it misses issues such as exposed admin areas or leaked files that need human analysis. Treat it as a smoke test, not an audit.
How long does a website security audit take?
An external review of a single small business website usually takes one to two weeks from scope confirmation to report. Penetration tests of larger applications can take several weeks.
Will a security audit slow down or break my website?
A properly run external review is non-intrusive and designed not to affect visitors. Agree the testing approach and timing with your provider in advance, especially for active penetration testing.
Not sure what your website exposes?
Our Public Website Security Check looks at your site the way an attacker does — TLS, security headers, email authentication and exposed services — and gives you a short, ranked list of what to fix.
Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team