How much does a website security audit cost in the UK?
An automated scan is £0 to £300. A developer-led manual review, which is what most small businesses actually need, is £500 to £3,000. An accredited penetration test starts around £3,000 and goes well past £15,000.
Those are three different services wearing one word, which is why quotes vary by a factor of twenty. Below: what each one buys, what moves the price, and the questions that make two quotes comparable.
By Lucas Reddington, full-stack developer and AI engineer, Northbytes. Reviewed by Piers Bennett, co-founder, Northbytes, background in law. Last updated .
Four things sold as a security audit
Work out which one a quote is for before you compare it with anything else. This single distinction explains almost all of the price variation in the UK market.
Automated scan
£0 - £300
A tool run against your site, output handed over as a report.
Finds out-of-date components with published vulnerabilities, missing security headers, exposed configuration and the well-catalogued problem classes. Fast and cheap, and worth doing. What it cannot do is understand your application, so it misses the flaws that require knowing what the system is meant to do.
Developer security review
£500 - £3,000
A person working through your site the way an attacker would.
The automated sweep plus manual work on authentication, access control, data exposure and the paths your money and personal data travel down. This is where the logic flaws get found, and it is where most small organisations get the best value. Our audits sit here.
Accredited penetration test
£3,000 - £15,000+
CREST or equivalent accredited testers, against a defined standard.
What a regulator, insurer or enterprise procurement team means when they say penetration test. It produces a certificate and a formal methodology statement. Necessary when someone requires it in writing; overkill when nobody does. We do not do this and will point you to someone who does.
Ongoing programme
£500+ / month
Continuous scanning, periodic review, retests after each release.
For applications changing every week, where a point-in-time audit goes stale quickly. Usually only worth it once you have a product with real users and a release cadence to match.
What moves the price within a band
Two developer-led reviews can differ by five times, and it is almost always one of these six.
Is there a login?
The biggest single factor. A brochure site has a small surface; the moment users have accounts, every role has to be tested against every other role's data, and that multiplies the work.
How many roles
Customer, staff, admin, partner: each pair of roles is a boundary somebody has to try to cross. Two roles is not twice the work of one, it is more.
APIs
An API is a second front door, and it is frequently less protected than the interface in front of it because nobody expected it to be looked at directly.
Payments and personal data
Anything holding card data, health data or children's data raises both the depth of testing required and the consequences of missing something.
Custom code versus a platform
A stock platform has known problems and known fixes. Custom code has unknown ones, which take longer to find and are usually more interesting when found.
Is a retest included?
Fixing without verifying is half a job. Some quotes bill the retest separately, which can add a third to the real cost, so ask before comparing numbers.
Our own scope, written out
Rather than quote a market average, here is exactly what we include and exclude, so you can hold it against anyone else's proposal. This is the same document a client signs.
In scope: authentication and session handling, including password reset. Access control between every pair of roles, checked on the server and not merely in the interface. Input handling on forms, search, uploads and URL parameters. Data exposure through APIs, error messages, backups, directory listings, source maps and metadata. Transport and configuration, meaning TLS, security headers, cookie flags, CORS and reachable admin interfaces. Dependencies and platform versions with published vulnerabilities.
Out of scope unless separately agreed: anything requiring active testing that could affect availability or data, which happens only on a staging copy or in an agreed written window. Third-party services you merely use. Social engineering of your staff. Physical access. Source code review where we have not been given access.
Included: a report written for both the owner and the developer, a prioritised fix list, an ownership matrix saying who fixes what, the negative results so you know what was checked, an explicit list of what could not be tested, and a retest once you have made the fixes.
Not included, and never claimed: accreditation, certification, a compliance verdict or legal advice. The audit service page sets out those boundaries in full.
What one finding looks like
Report quality is most of what you are paying for, so here is a redacted finding in the format we use. The details are changed; the shape is real, and this class of problem is the most common serious one we find on small business applications.
FindingA signed-in customer can read another customer's order by changing the numeric id in the order URL. The interface never links to those pages, and the server does not check that the order belongs to the requesting account.
ImpactName, delivery address, contact details and order history of any customer, retrievable by anyone with an account and a script. Personal data at scale, which makes it a likely reportable breach if exploited.
LikelihoodHigh. Sequential ids make enumeration trivial, and this is the first thing an attacker tries once they have an account.
EvidenceRequests and responses for two accounts, with personal data redacted, showing account A retrieving account B's order.
FixCheck ownership on the server for every order lookup, in the data access layer so every route inherits it. Add a test that fails if the check is removed. Non-sequential identifiers help but are not the fix on their own.
OwnerYour development team. We can quote the fix separately, and the audit fee never depends on us finding work for ourselves.
Seven questions to ask any provider
- How much of this is a person, and how much is a tool's output?
- Does it cover areas behind a login, and every role against every other role?
- Are APIs in scope, or only what the browser shows?
- Is a retest after our fixes included, or billed again?
- Can I see a redacted sample report before I commit?
- Are you accredited to a named standard, and does my situation actually require that?
- What is out of scope, and what will you not be able to test?
If you want the wider picture first, the cyber security checklist covers the controls worth having before you spend anything on an audit. Quite often it turns out to be the better first purchase, and it is free.
Common questions
How much does a website security audit cost in the UK?
It depends which of three different things you are buying. An automated scan is £0 to £300 and finds catalogued problems only. A developer-led manual review, which is what most small businesses actually need, runs £500 to £3,000 for a typical site or small application. An accredited penetration test against a formal standard starts around £3,000 and runs well past £15,000 for anything complex. Ours are fixed-price developer reviews agreed before the work starts, with the retest included.
Why do quotes vary by a factor of twenty?
Because the word audit covers everything from a tool you could run yourself to weeks of accredited manual testing. A £200 quote and a £6,000 quote are usually not the same service at different prices; they are different services. The questions that separate them: how much of this is a person as opposed to a tool, does it include authenticated areas and APIs, is there a retest, and are the testers accredited to a named standard.
Do we need an accredited penetration test?
Only if someone requires it in writing, which is the honest test. Contracts, cyber insurance policies, enterprise procurement and some regulators specify accredited testing, and in those cases nothing else will do. If nobody is asking, a developer-led review finds the same categories of problem for a fraction of the cost, and the money saved is better spent fixing what it finds. We will tell you which situation you are in before quoting.
How often should we have one done?
Annually for a site that changes rarely, and after any significant change: a new payment flow, a new login system, a major platform upgrade, or a migration. Applications shipping weekly need continuous scanning plus a periodic manual review, because a point-in-time audit describes a version of the software that no longer exists. Between audits, dependency scanning on every build catches the most common category of new problem automatically.
What should the report actually contain?
Findings ranked by real risk to your business rather than by a generic severity score, with evidence that each was actually found and a fix specific enough for your developer to act on. It should also state what was checked and found clean, and what could not be tested and why. A report that lists 400 informational findings with no priorities is a tool's output with a cover page, and you should not pay much for one.
Sources
Figures quoted from outside Northbytes come from these sources, checked on 26 July 2026. Our own prices are our published rates.
Read next
A cyber security checklist for small businesses
Seven sections of controls with the evidence a reviewer would ask for, from accounts and backups to email, websites and the bad day.
How much does website maintenance cost?
Why hosting and maintenance are not the same product, the four price bands, six exclusions to read for, and our £45 plan itemised.
How much does a website cost in the UK?
What DIY builders, freelancers, studios and agencies really charge, what drives the price up, and what a small business should sensibly expect to pay.
Want a fixed price for your site?
Tell us the address and what worries you most. The first conversation is free and confidential, and we'll say plainly if what you need is the accredited version we don't provide.
Scope a review