"Security audit" gets used loosely. Some people mean a two hour automated scan, others mean a multi week penetration test with a full report and a bill to match. For most small businesses, what you actually need is somewhere in between, a focused review of the things most likely to go wrong. Here's what that should cover, and why.
Who has access, and how they log in
A real audit starts by listing every account with access to your site, admin panel, hosting, and domain registrar, then asking whether each one still needs it. It's common to find former employees, old contractors, or long forgotten test accounts still able to log in. This step alone often removes more risk than anything else on the list.
What software you're running, and how old it is
This means checking the CMS core, every plugin or package, and the underlying framework version against known vulnerabilities. Most of the time, this step alone turns up at least one component that's several versions behind and has a documented, publicly known security issue attached to it.
Whether your backups actually work
Not just whether backups exist, whether someone has restored one recently and confirmed it comes back clean and complete. An audit should include an actual test restore, not just a checkbox confirming a backup job ran last night.
How your site handles what visitors submit
Contact forms, login fields, search boxes, any place someone can type input and send it to your server. A basic audit tests these for the common issues, SQL injection and cross site scripting being the two most frequent, using automated tools built for exactly this kind of check.
Server and hosting configuration
This covers things like whether HTTPS is properly enforced everywhere, whether file permissions are set correctly, whether directory listing is disabled, and whether error messages are leaking information they shouldn't, like file paths or database details, to anyone who triggers an error.
Whether you'd even know if something went wrong
A basic audit should check what monitoring exists today, uptime checks, file integrity monitoring, login alerts, and flag if there's effectively nothing in place. Most small business sites have zero visibility into this until a customer reports something broken.
A report you can actually act on
The output of a basic audit shouldn't be a hundred page document full of jargon. It should be a short list, ranked by what's most urgent, with plain language explanations of what's wrong and what fixing it involves. If you can't tell what to do next after reading it, it hasn't done its job.
This kind of review doesn't need to be expensive or take weeks. For most small business websites, a focused audit covering these areas can be done in a few days and gives you a clear, honest picture of where you actually stand.