# Security and performance audit

> A security and performance audit is a low-cost review of a website or application covering page speed, security configuration, accessibility, SEO foundations and code health. DevRaxo delivers a prioritised report with plain-English findings, fix estimates and quick wins, which you can action yourself, with us, or with another supplier.

- Area: [Care & growth](https://devraxo.com/services/care/)
- Price: from £400. Credited against any fix work you ask us to do.
- Timeline: 1 week
- Page: https://devraxo.com/services/care/security-and-performance-audit/

## This is for you if
- Your site feels slow or has been hacked before.
- You inherited a system and do not know what condition it is in.
- You are about to buy, invest in or rely on a system and want an independent view.

## The problem
- **You cannot see the risk.** Slow pages, outdated software and open doors do not announce themselves.
- **Reports full of jargon.** A list of technical findings is no use if you cannot tell which ones matter.
- **Fixes are never ranked.** Without priorities, small cosmetic issues absorb the budget that should go to serious ones.

## How it works
1. **Scan and review.** Automated tests and manual review of speed, security headers, dependencies, accessibility and search signals.
2. **Verify what matters.** Findings checked by an engineer so the report contains real issues, not scanner noise.
3. **Rank and estimate.** Every finding rated by impact and effort, with a quick-wins list you can do this week.
4. **Walk you through it.** A call to explain the report in plain English and answer questions.

## What you get
- Written audit report
- Prioritised fix list
- Quick wins list
- Plain-English summary
- Fix cost estimates
- A walkthrough call

## Questions
### Is this a penetration test?
No. It is a configuration, code-health and performance review. A full penetration test is a different, specialist service, and we will say so if your situation needs one.

### Do you need access to our code?
Not necessarily. A basic audit works from the public site. Access to code and hosting allows deeper review, with your permission.

### Can I act on the report without you?
Yes. It is written so any competent developer can follow it.

### How often should we do this?
Annually for most businesses, and before any major launch or migration.