What Is a Web Application Security Audit (And Does Your Business Need One)?

If you run a business website in Europe, there is a good chance your site is exposing data it should not be, and you may not even know it.

A web application security audit is a structured review of your site's technical setup. It checks for the things that regulators, insurers, and increasingly your customers expect to be in place. This article explains what it covers, why it matters, and what a typical audit report looks like.

What a web application security audit checks

1. Security headers

Security headers are short instructions your web server sends to the browser that control how your site behaves. They prevent common attacks like cross-site scripting (XSS), clickjacking, and data injection.

Missing or misconfigured headers are one of the most common findings in any audit. The headers we check include:

• Content-Security-Policy: controls which scripts and resources the browser is allowed to load
• X-Frame-Options: prevents your site from being embedded in an iframe on another site
• Strict-Transport-Security: forces HTTPS connections
• Referrer-Policy: controls what URL information is passed when a user clicks a link

A site with no security headers set scores an F on any standard grading tool. Most sites we audit start between D and C.

2. Cookie consent and GDPR compliance

Under GDPR and the ePrivacy Directive, cookies that track users require explicit consent before they are set, not after, not buried in a footer. We check:

• Whether consent is collected before tracking cookies fire
• Whether the cookie banner gives a genuine option to decline
• Whether the cookie policy accurately lists what is being set
• Whether consent records are stored (required under GDPR Article 7)

This is the area where most sites fail. A cookie banner that looks fine visually often sets analytics and advertising cookies before the user has clicked anything.

3. Third-party tracker mapping

Every third-party script you load, such as Google Analytics, Facebook Pixel, LinkedIn Insight Tag, Hotjar, and chat widgets, is a data processor operating on your site. GDPR requires you to have a data processing agreement with each one and to disclose them in your privacy policy.

We map every outbound request your site makes and cross-reference it against your privacy policy and cookie policy to identify gaps.

4. Open port and exposure detection

Publicly accessible admin panels, staging environments, and open ports are common entry points for attackers. We scan for:

• Exposed admin interfaces (WordPress wp-admin, database admin tools)
• Open ports that should not be publicly accessible
• Directory listing enabled on the server

5. HTTPS and certificate validity

Basic but still failed by a surprising number of sites: valid SSL certificate, correct redirect from HTTP to HTTPS, no mixed content warnings.

What you get in the report

A Fomad security audit delivers a PDF report covering:

• An overall score (0 to 100) across all categories
• A grade for each section with specific findings
• A prioritised list of fixes: critical, high, medium, low
• Plain-language explanations of each finding and why it matters
• Evidence screenshots where relevant

The report is written to be understood by a business owner, not just a developer. You can hand it directly to your web developer or IT team with clear instructions.

Who needs a web application security audit

You should get an audit if:

• Your site collects any personal data, including contact forms, newsletter signups, e-commerce, or login areas
• You operate in the EU or serve EU customers
• You have not had a technical privacy review done in the last 12 months
• You are about to sign a contract that requires GDPR compliance evidence
• Your cyber insurance renewal is coming up

You probably do not need one if your site is a completely static page with no forms, no analytics, and no third-party scripts. Though that describes almost no business website in practice.

What happens if you do not act

GDPR fines are real. The Irish Data Protection Commission fined Meta €1.2 billion in 2023. That is an extreme case, but national regulators across the EU are actively investigating small and medium businesses, not just large platforms.

More practically, if a competitor or privacy activist files a complaint about your site, the first thing a regulator will check is whether your cookie consent and data disclosures are correct. A documented audit shows you took it seriously.

How much does a web application security audit cost in Finland

This is one of the most common questions we get, and the honest answer is that it depends heavily on what is included. Many providers charge anywhere from a few hundred euros for an automated scan to several thousand for a full manual assessment with a consultant on site.

At Fomad, the Web Privacy and Security Audit is priced at €299 as a fixed scope engagement. That covers the full technical review, including security headers, cookie consent, third-party tracker mapping, open port detection, and GDPR compliance assessment, delivered as a scored PDF report within five working days. There are no ongoing fees and no upselling into a retainer. You get the report, you act on it, and if you want a follow-up assessment in six months, you order it again at the same price.

For comparison, a penetration test from a security consultancy in Europe typically starts at €2,000 to €5,000 and goes up significantly from there depending on scope. That level of engagement makes sense for larger organisations with complex infrastructure. For most small and medium businesses, the kind of web application security audit we provide is the right starting point. It surfaces the most common vulnerabilities and compliance gaps at a price that makes sense to act on.

How often should you run a security audit

The short answer is at least once a year, and after any significant change to your website or infrastructure. The longer answer is that it depends on how much your site changes and what kind of data it handles.

If your site collects payment information, handles sensitive personal data, or operates in a regulated industry, once a year is a minimum. Every time you add a new plugin, integrate a third-party tool, or launch a new feature, you are potentially introducing new risks that were not there before. A new chat widget, a new analytics script, or an updated cookie banner can all change your compliance status in ways that are not obvious from looking at the site.

For most businesses, an annual web application security audit sits comfortably as a line item in the budget alongside other compliance and insurance costs. It is a documented record that you took the question seriously, which matters if you are ever subject to a regulator complaint or a contract requirement from a large client.

What is the difference between a security audit and a penetration test

These two terms get used interchangeably but they are not the same thing and they serve different purposes.

A security audit is a structured review of your configuration, policies, and compliance posture. It checks whether your headers are set correctly, whether your cookies are handled lawfully, whether your data disclosures match what you are actually doing, and whether you are exposing things you should not be. It gives you a report with a score and a prioritised list of things to fix. It is diagnostic, not destructive.

A penetration test is an attempt to actively exploit vulnerabilities in your system. A trained tester will try to get in, move around, escalate privileges, and demonstrate what an attacker could actually achieve. It is more expensive, more invasive, and requires a formal scope agreement before anyone touches anything. It is the right tool when you need to prove to a board, an insurer, or a regulator that your defences hold up under real attack conditions.

For most businesses reading this, a web application security audit is where to start. It finds the common problems quickly and gives you a clear path to fixing them. If your audit reveals serious issues, or if your business operates at a scale where active testing is warranted, a penetration test is the logical next step.

Getting started

A Fomad Web Privacy & Security Audit costs €299 and is delivered as a scored PDF within 5 working days. No ongoing contract. No sales call required. You submit your URL and we begin.

If you have questions about what is included before ordering, get in touch.