How to prepare for a website or IT security review

1. Decide what you want to know

Security work ranges from a quick review of settings to an in-depth penetration test that actively tries to break in. Start by deciding what worries you most: your website or online store, customer data, email accounts, cloud services, office devices or staff awareness of phishing. A security consultant can help you choose the right type of review for your size and risks. For many small businesses, a configuration review and basic vulnerability scan are a sensible first step.

2. List what you have

You cannot protect what you do not know about. Make a list of your websites and domains, hosting and cloud accounts, important software and plugins, devices, and who has administrator access to each. Note where customer and payment data is stored. This list is valuable in itself; many businesses discover forgotten accounts, old test sites or former staff who still have access.

3. Define scope and permission in writing

Write down exactly which systems may be tested, which may not, what kinds of tests are allowed and when testing will take place. Testing systems without the owner's authorization can be illegal, so only include systems you own or have permission to test. If your website is hosted by a provider, check their rules, as some require notice before security testing. Both you and the specialist should sign or confirm the scope before work starts.

4. Plan access safely

Give the specialist their own accounts with the minimum access needed, rather than sharing administrator passwords. Use temporary accounts that you can disable afterwards. Agree on how sensitive information, such as findings and any data they encounter, will be stored, shared and deleted at the end of the project.

5. Back up and schedule

Make fresh backups of websites, databases and important files before testing begins, and confirm you can restore them. Schedule active testing outside busy periods, and give the specialist a contact person who can respond if something goes wrong. If possible, test a staging copy of the website rather than the live one for more intrusive checks.

6. Agree on the report

A useful report ranks findings by severity, explains each issue in plain language, shows evidence and describes how to fix it. Ask for a short summary for decision makers and technical details for whoever will make the fixes. Reports full of automated scanner output without explanation are much less helpful.

7. Fix and recheck

Decide in advance who will fix the issues: your own team, your website maintenance provider, an IT support freelancer or the security specialist. Tackle the most severe issues first. Many specialists offer a retest to confirm fixes worked; ask whether it is included. Common quick wins include updating software, removing unused plugins and accounts, turning on two-step verification and tightening backups.

8. Make it ongoing

Security is not a one-time project. Keep software updated, review who has access whenever staff or freelancers change, and repeat reviews after major changes such as a new website or system. Simple staff training on recognizing phishing emails is one of the most effective protections for small businesses.

Choosing a specialist

Ask candidates about similar projects, how they test safely and what their reports look like. A sample report with sensitive details removed shows a lot about their quality and clarity.

Preparation checklist

• Main concerns and type of review chosen.
• List of websites, accounts, devices and admin users.
• Written scope and authorization.
• Separate, temporary accounts for the specialist.
• Fresh, tested backups and a testing schedule.
• Report format agreed, with severity ranking.
• Plan for fixes and a retest.

Our cybersecurity guide explains how to compare specialists and what their services usually include.